Data encryption security processing method

Abstract

The invention relates to the technical field of data transmission, in particular to a data encryption security processing method, which comprises the following steps of: 1, performing legality and validity verification on an identity of an access host; 2, setting internal and external network hosts, establishing a bidirectional authentication account by the internal and external network hosts, and enabling the internal and external network hosts to establish an authentication and encryption mechanism; 3, after the identity authentication is passed, the trusted host carries out authority distribution according to a preset access control strategy; 4, encrypting the transmitted data by the internal and external network bidirectional authentication trust host by adopting a data encryption technology; 5, generating a corresponding secret key; step 6, performing encryption processing on data needing to be transmitted by using the generated secret key and the selected encryption algorithm; and 7, the sender signs the data by using the private key of the sender, and the receiver verifies the signature by using the public key of the sender and encrypts the data, so that the data cannot be illegally stolen or monitored, and the confidentiality of the data is protected.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and in particular to a data encryption security processing method. Background Art

[0002] At present, the transmission efficiency of the optical gate system may be affected by many factors, such as transmission distance, data format, hardware facilities, etc. During long-distance transmission, the optical gate system may face signal attenuation and distortion problems, resulting in reduced transmission efficiency. In addition, if the data format does not meet the transmission requirements, it may also lead to low transmission efficiency. The optical gate system may have compatibility issues and be incompatible with other systems or devices, resulting in the inability to transmit data normally. This may be due to different technical standards, interface specifications or transmission protocols.

[0003] For example, in the data stream fusion transmission method, system and electronic device based on a one-way optical gate disclosed in publication number CN116743350A, although the optical gate system has the characteristics of physical isolation, it may still face data security risks. For example, during the transmission process, the data may be intercepted, stolen or tampered with. In addition, if there are security vulnerabilities in the system, it may also cause data security problems. If the isolation measures of the optical gate system are not strict enough, or there are security vulnerabilities, data may be illegally obtained or stolen. In addition, the optical gate system may face malicious attacks from external networks, such as denial of service attacks, virus propagation, etc. These attacks may attempt to disrupt the normal operation of the optical gate system or steal sensitive information.

[0004] The software and hardware facilities of the optical gate system may fail or be damaged, causing the system to fail to operate normally. This may require appropriate fault recovery measures to ensure the availability and stability of the system. The management of the optical gate system may also have loopholes, such as lax authority management and improper configuration. These problems may lead to unauthorized access or operation, thereby threatening the security of the system. Summary of the invention

[0005] The technical problem to be solved by the present invention is to overcome the deficiencies of the prior art and provide a data encryption security processing method.

[0006] The technical solution adopted by the present invention to solve the technical problem is: the data encryption security processing method comprises the following steps:

[0007] Step 1: Use identity authentication technology to verify the legitimacy and validity of the identity of the access host;

[0008] Step 2: Set up the internal and external network hosts, establish two-way authentication accounts for the internal and external network hosts, and establish authentication and encryption mechanisms for the internal and external network hosts;

[0009] Step 3: After identity authentication, the trusted host also needs to be assigned permissions according to the preset access control policy;

[0010] Step 4: The trusted host for two-way authentication between the internal and external networks usually uses an encryption algorithm to encrypt the transmitted data;

[0011] Step 5: Generate the corresponding key according to the selected encryption algorithm;

[0012] Step 6: Use the generated key and the selected encryption algorithm to encrypt the data to be transmitted;

[0013] Step 7: The sender signs the data using his private key, and the receiver verifies the signature using the sender's public key.

[0014] In step 1, different access rights and operation rights can be assigned to the host according to its identity and role, so as to limit its access scope and operation behavior to intranet resources.

[0015] In the step 2, two-way authentication is performed on the internal and external hosts through IP address or Mac address, thereby realizing physical isolation double authentication and a secure trust host of a one-way channel, realizing secure isolation, establishing users on the internal and external network hosts respectively, and the users establish a unified trust policy for the internal and external networks. After the trusted host passes, the IP address is mapped to the MAC through the secondary trust policy to establish two-way trust.

[0016] In step three, different access rights and operation rights can be assigned to the host according to its identity and role to limit its access scope and operation behavior to intranet resources.

[0017] The encryption algorithm in step 4 is SSL / TLS encryption: SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are encryption protocols used to protect the security of data transmission on the Internet. They use public and private keys for encryption and decryption.

[0018] In the step 5, the key of the present application is used to determine whether the numerical quantity of the encrypted data is an odd number or an even number. If it is an even number, every two numbers in the data are converted into binary in sequence, and the formed binary numbers are increased by one and multiplied by the day of the week corresponding to the day of the week sent to obtain the encrypted data; if it is an odd number, every two numbers in the data need to be converted into binary, and the last single number is converted into 2-bit binary, and the formed binary numbers are increased by one and multiplied by the day of the week corresponding to the day of the week sent to obtain the encrypted data.

[0019] Internal and external hosts are connected through the optical gate, and a list of trusted hosts for the internal and external networks is established in the optical gate system, including hosts and services that are allowed to be accessed. It is ensured that only hosts in the list can communicate with each other.

[0020] Identity authentication includes one or more combinations of username / password authentication, digital certificate authentication, and multi-factor authentication to ensure that only authorized hosts can access intranet resources.

[0021] It also includes regularly reviewing and updating trusted host lists, monitoring access logs, and security events.

[0022] Compared with the prior art, the present invention has the following beneficial effects:

[0023] 1. Data can be encrypted so that it will not be illegally stolen or monitored, thereby protecting the confidentiality of the data. The integrity of the data can be verified to ensure that the data has not been tampered with or damaged. This can prevent data tampering attacks and ensure the authenticity and integrity of the data. It can prevent data from being illegally intercepted or tampered with, thereby improving the security of data transmission. This is especially important for scenarios where sensitive information needs to be transmitted, such as financial transactions, government agencies, etc. It can provide data confidentiality and protect the privacy and confidential information of both parties. This can prevent the communication content from being eavesdropped or stolen, and ensure communication security.

[0024] 2. It combines the physical isolation characteristics of the optical gate system and the security mechanism of the trusted host. This solution can achieve more efficient, reliable and secure data transmission and management by establishing a trust relationship between the internal and external networks; the optical gate system can achieve physical isolation to ensure that the data transmission between the internal and external networks is one-way, and only allows data to be transmitted from the external network to the internal network, while preventing reverse transmission. This physical isolation mechanism can effectively prevent the risk of malicious attacks and data leakage; by establishing a trusted host relationship, the dual trusted host solution of the optical gate system for the internal and external networks can simplify the access control and security management between the internal and external networks, and the administrator can easily configure and manage the access rights and security policies of the trusted hosts, improving management efficiency and security; the dual trusted hosts of the optical gate system for the internal and external networks can achieve fast data transmission and management. Since the data transmission between the internal and external networks is one-way, network congestion and delay problems can be avoided, and the performance and response speed of data transmission can be improved. The dual trusted host solution of the optical gate system for the internal and external networks has good scalability and flexibility. The number of trusted hosts can be increased or decreased according to actual needs, and the access control and security policies of the internal and external networks can be flexibly configured and managed.

[0025] 3. Through multi-link selection technology, the impact of a single link failure on the entire data transmission can be avoided, thereby improving the reliability of data transmission; by real-time monitoring of link status and selecting the best link for data transmission, load balancing can be achieved and the efficiency of data transmission can be improved; BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a process framework diagram of the present invention. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] Example 1

[0029] Reference Figure 1 , the data encryption security processing method includes the following steps:

[0030] Step 1: Use identity authentication technology to verify the legitimacy and validity of the identity of the access host;

[0031] Step 2: Set up the internal and external network hosts, establish two-way authentication accounts for the internal and external network hosts, and establish authentication and encryption mechanisms for the internal and external network hosts;

[0032] Step 3: After identity authentication, the trusted host also needs to be assigned permissions according to the preset access control policy;

[0033] Step 4: The trusted host for two-way authentication between the internal and external networks usually uses an encryption algorithm to encrypt the transmitted data;

[0034] Step 5: Generate the corresponding key according to the selected encryption algorithm;

[0035] Step 6: Use the generated key and the selected encryption algorithm to encrypt the data to be transmitted;

[0036] Step 7: The sender signs the data using his private key, and the receiver verifies the signature using the sender's public key.

[0037] In step 1, different access rights and operation rights can be assigned to the host according to its identity and role, so as to limit its access scope and operation behavior to intranet resources.

[0038] In the step 2, two-way authentication is performed on the internal and external hosts through IP address or Mac address, thereby realizing physical isolation double authentication and a secure trust host of a one-way channel, realizing secure isolation, establishing users on the internal and external network hosts respectively, and the users establish a unified trust policy for the internal and external networks. After the trusted host passes, the IP address is mapped to the MAC through the secondary trust policy to establish two-way trust.

[0039] In step three, different access rights and operation rights can be assigned to the host according to its identity and role to limit its access scope and operation behavior to intranet resources.

[0040] The encryption algorithm in step 4 is SSL / TLS encryption: SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are encryption protocols used to protect the security of data transmission on the Internet. They use public and private keys for encryption and decryption.

[0041] In the step 5, the key of the present application is used to determine whether the numerical quantity of the encrypted data is an odd number or an even number. If it is an even number, every two numbers in the data are converted into binary in sequence, and the formed binary numbers are increased by one and multiplied by the day of the week corresponding to the day of the week sent to obtain the encrypted data; if it is an odd number, every two numbers in the data need to be converted into binary, and the last single number is converted into 2-bit binary, and the formed binary numbers are increased by one and multiplied by the day of the week corresponding to the day of the week sent to obtain the encrypted data.

[0042] Internal and external hosts are connected through the optical gate, and a list of trusted hosts for the internal and external networks is established in the optical gate system, including hosts and services that are allowed to be accessed. It is ensured that only hosts in the list can communicate with each other.

[0043] Identity authentication includes one or more combinations of username / password authentication, digital certificate authentication, and multi-factor authentication to ensure that only authorized hosts can access intranet resources.

[0044] It also includes regularly reviewing and updating trusted host lists, monitoring access logs, and security events.

[0045] Example 2

[0046] On the basis of Example 1, the present application establishes an intranet connection and selects the best link for data transmission; further, first, an intranet connection is established: an optical gate is set between the intranet and the intranet, and an optical gate system is used to achieve physical data isolation and unidirectional data transmission between the intranet and the extranet;

[0047] Secondly, detect link status: In multiple communication links, it is necessary to detect the status of each link in real time, including link availability, bandwidth, delay and other parameters. Optical gate intranet and extranet multi-link selection transmission is an efficient, reliable and secure data transmission technology solution, suitable for network communication scenarios that require high reliability and high performance.

[0048] Furthermore, the best link is selected: based on the detected link status information, the best communication link is selected for data transmission. The selection criteria can be determined according to actual needs. For example, the link with the largest bandwidth and the smallest delay can be selected. In this example, the link with the largest bandwidth is selected first, and the link with the best delay is selected from the link with the largest bandwidth as the best communication link for data transmission.

[0049] Finally, data transmission based on the best link: Data transmission through the selected communication link can use the unidirectional transmission characteristics of the optical gate system to ensure data security and reliability.

[0050] In addition, link switching can also be performed. In steps 1-3, the top five communication links are marked when selecting links, and the best communication link is used for data transmission. In some cases, a communication link may fail or its performance may degrade. In this case, link switching is required, and the communication links are switched in the ranking order for data transmission.

[0051] This application uses the SSL / TLS protocol to encrypt the communication between the FTP server and the client. In this case, an SSL / TLS connection needs to be established between the FTP server and the client, and all data transmission will be encrypted on this connection. For example, common FTP protocols based on SSL / TLS include FTPS (FTP Secure) and FTPES (FTP Encryption Secure).

[0052] Integrate the SSL / TLS protocol into the FTP protocol to encrypt the data transmission part of the FTP protocol. In this case, the SSL / TLS protocol will work together with the FTP protocol to encrypt the data transmission part of FTP. For example, the common FTP protocol based on integrated SSL / TLS is FTP over SSL / TLS.

[0053] In this application, the trusted host is added to the security policy to enable two-way authentication of internal and external network hosts. This can better protect the security and integrity of the network and reduce potential security risks and threats.

[0054] In step 3, a trusted host relationship is established through identity authentication and authorization management;

[0055] The identity verification is used to verify whether the identity of the host is legal and valid;

[0056] The authorization management is used to assign corresponding permissions and access control policies according to the identity and role of the host.

[0057] In order to establish a trusted host relationship, identity authentication and authorization management are usually required. Identity authentication refers to verifying whether the host's identity is legal and valid, while authorization management refers to assigning corresponding permissions and access control policies based on the host's identity and role. Through effective identity authentication and authorization management, the security of communication and data transmission between trusted hosts can be ensured. This can improve the security and reliability of the network and protect the confidentiality and integrity of data.

[0058] Example 3

[0059] The data encryption security processing method applied to Example 2 includes an external network host and an internal network host, both of which are provided with multi-channel network cards, and the external network host and the internal network host are connected through the multi-channel network card.

[0060] The multi-channel network card carries an FTP link, a physical single-channel link, and data has only an inlet channel but no outlet channel link.

[0061] The intranet host is connected to the extranet host through the optical gate device, which is used for optical transmission control and data exchange. Each link of the optical gate device corresponds to an optical port unit, and these devices achieve fast switching of the optical path through high-speed optical switches. The optical gate device is equipped with an intranet interface and an extranet interface corresponding to the intranet and extranet hosts respectively.

[0062] The optical gate device is connected to the control unit, which is used to control the opening and closing of the optical gate device and the switching of the optical path according to relevant instructions. Ensure that data is transmitted from the external network to the internal network at the right time, and cannot be transmitted from the internal network to the external network (through physical isolation, there is only a one-way channel). At the same time, the entire multi-link optical gate system is centrally managed and monitored. Formulate security strategies, establish secure trusted hosts, map trusted IPs or MACs, monitor link status, record logs, etc. to ensure the safe and stable operation of the system.

[0063] The intelligent selection multi-link optical gate system device is an advanced network security device that combines the physical isolation characteristics of the optical gate system with the intelligent multi-link selection technology to achieve intelligent selection and management of multiple communication links to improve the security and reliability of data transmission.

[0064] This application sets up intelligent multi-link: real-time monitoring of the status of multiple communication links, including link availability, bandwidth, delay and other parameters, and automatically selects the best link for data transmission according to the preset strategy. This can avoid the impact of a single link failure on the entire data transmission and improve the reliability and stability of data transmission.

[0065] Physical isolation protection: The physical isolation technology of the optical gate system is used to ensure that data can only be transmitted from the external network to the internal network in one direction, while preventing reverse transmission. This can effectively prevent the risk of malicious attacks and data leakage and improve the security of data transmission. The network physical link between the internal network host and the external network host is only connected to the entrance, and the exit is physically isolated.

[0066] Load balancing function: The device can dynamically adjust the load distribution of data transmission on different links based on the monitored link status information, avoid link congestion and delay problems, and improve the performance and response speed of data transmission.

[0067] Identity authentication: Use identity authentication technology to verify the legitimacy and validity of the identity of the access host. This usually includes username / password authentication, digital certificate authentication, multi-factor authentication, etc. to ensure that only authorized hosts can access intranet resources.

[0068] Two-way authentication accounts are established for internal and external network hosts, so that authentication and encryption mechanisms can be established for internal and external network hosts; two-way authentication is performed on internal and external hosts through IP addresses or Mac addresses, thereby achieving physical isolation, dual authentication, and secure trust hosts for one-way channels to achieve secure isolation.

[0069] Establish users on the internal and external network hosts respectively, and the users establish a unified trust policy for the internal and external networks. After the host is trusted, the IP address is mapped to the MAC through the secondary trust policy to establish two-way trust.

[0070] Access control: After identity authentication, the trusted host also needs to be assigned permissions according to the preset access control policy. According to the identity and role of the host, different access rights and operation permissions can be assigned to it to limit its access scope and operation behavior to intranet resources.

[0071] Data encryption: In order to ensure the security of data transmission, the internal and external network two-way authentication trusted host usually uses data encryption technology to encrypt the transmitted data. This can prevent the data from being stolen or tampered with, and protect the confidentiality and integrity of the data.

[0072] Specifically, the encryption algorithm selected by this application is SL / TLS encryption: SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are encryption protocols used to protect the security of data transmission on the Internet. They use public and private keys for encryption and decryption to ensure data integrity and confidentiality in FTP communications. When FTP uses SSL / TLS encryption, it is usually called FTPS (FTP over SSL / TLS).

[0073] SFTP protocol: SFTP (Secure File Transfer Protocol) is a secure file transfer protocol based on SSH (Secure Shell) protocol. It uses SSH's encryption and security mechanisms to provide file transfer services, thereby ensuring data integrity and confidentiality.

[0074] Generate key: Generate the corresponding key according to the selected encryption algorithm. Symmetric encryption algorithms need to use the same key for encryption and decryption, while asymmetric encryption algorithms require a pair of public and private keys. The key of this application is to determine whether the number of values ​​of the encrypted data is odd or even. If it is an even number, each 2 numbers in the data are converted into four-bit binary in sequence, and the formed binary numbers are added by one and then multiplied by the day of the week corresponding to the day of the week sent to obtain the encrypted data; if it is an odd number, each 2 numbers in the data are converted into binary in sequence, and the last single number is converted into 2-bit binary, and the formed binary numbers are added by one and then multiplied by the day of the week corresponding to the day of the week sent to obtain the encrypted data. Taking the first data to be encrypted as 11186 as an example, 11 corresponds to 1011, 18 corresponds to 10010, and 6 corresponds to 110, so the string of 101110010110 is obtained. Add 1 to all the strings and get 212221121221. Taking Sunday as an example, the encrypted string is 1,485,547,848,547.

[0075] Data encryption: Use the generated key and the selected encryption algorithm to encrypt the data to be transmitted. The encrypted data will become a string of garbled characters, and only the recipient with the correct key can decrypt and restore the original data.

[0076] Data transmission: The encrypted data is transmitted to the recipient (trusted party) to ensure the security of data transmission.

[0077] Data decryption: The receiver uses the same key and encryption algorithm to decrypt the received encrypted data and restore it to the original data (trust decryption). Encrypted transmission can effectively protect the confidentiality and integrity of data during transmission and improve data security. Appropriate encryption algorithms and key management combined with trusted hosts and IP or MAC mapping mechanisms are the key to security.

[0078] This prevents data from being illegally stolen or monitored during transmission, thereby protecting the confidentiality of the data.

[0079] Encrypted transmission verifies the integrity of the data to ensure that the data has not been tampered with or damaged during transmission, including the following:

[0080] Digital signature: The sender signs the data with his or her own private key, and the receiver verifies the signature with the sender's public key. This ensures the integrity of the data and verifies the sender's identity.

[0081] Encrypted transmission: When performing encrypted transmission, in addition to protecting the confidentiality of data, the encryption algorithm itself can also generate a check value through a key to ensure the integrity of the data after decryption.

[0082] Transport Layer Security (TLS): Use TLS to implement secure transport layer communications. TLS protects data integrity through encryption and authentication mechanisms.

[0083] Security audit: In order to monitor and record the host's behavior and operations, trusted hosts usually also have security audit functions. By recording and analyzing the host's access logs and operation records, potential security threats and abnormal behaviors can be discovered in a timely manner, and corresponding countermeasures can be taken.

[0084] Intelligent fault recovery: The device is equipped with intelligent fault recovery function. When a communication link fails or its performance degrades, the device can automatically switch to other available links for data transmission to ensure the continuity and stability of data transmission.

[0085] Scalability: The intelligent selection multi-link optical gate system device has good scalability. It can increase or decrease the number of communication links according to actual needs, and flexibly configure and manage the access control and security policies of the internal and external networks.

[0086] Simplify access control and security management between internal and external networks based on the following steps:

[0087] 1. Network segmentation: First, the internal network and the external network need to be strictly segmented to ensure that communication between the two can only be established after trusted hosts and IP or Mac mapping.

[0088] 2. Optical gate system deployment: Deploy the optical gate system to ensure that the system can achieve one-way communication control between the internal and external networks, and only authorized hosts can access each other.

[0089] 3. Establish trust relationship: Establish a list of trusted hosts in the internal and external networks in the optical gate system, including hosts and services that are allowed to be accessed. Ensure that only hosts in the list can communicate with each other.

[0090] 4. Access control rules: Configure access control rules for each host in the internal and external networks, allowing access only from trusted hosts and strictly limiting access rights to ensure security.

[0091] 5. Security management: Regularly review and update the trusted host list, monitor access logs and security events, and respond to security threats and risks in a timely manner.

[0092] The intelligent selection multi-link optical gate system device is an efficient, reliable and secure data transmission and management device, suitable for network security scenarios that require strict protection of sensitive information and important resources. It improves the security and reliability of the network, reduces potential security risks and threats, and provides strong protection for the information security of enterprises.

[0093] The above descriptions are only optional embodiments of the present invention, and are not intended to limit the patent scope of the present invention. All equivalent structural changes made using the contents of the present invention's specification and drawings, or directly / indirectly applied in other related technical fields, are included in the patent protection scope of the present invention.

Claims

1. A data encryption security processing method, characterized in that: The following steps are involved: Step 1: Use identity authentication technology to verify the legitimacy and validity of the identity of the access host; Step 2: Set up the internal and external network hosts, establish two-way authentication accounts for the internal and external network hosts, and establish authentication and encryption mechanisms for the internal and external network hosts; Step 3: After identity authentication, the trusted host allocates permissions according to the preset access control policy; Step 4: The trusted host of the intranet and extranet two-way authentication uses an encryption algorithm to encrypt the transmitted data; Step 5: Generate the corresponding key according to the selected encryption algorithm; Step 6: Use the generated key and the selected encryption algorithm to encrypt the data to be transmitted; Step 7: The sender signs the data using his private key, and the receiver verifies the signature using the sender's public key.

2. The data encryption security processing method according to claim 1, characterized in that: The first step is to allocate different access rights and operation rights according to the identity and role of the host to limit the access scope and operation behavior of the intranet resources.

3. The data encryption security processing method according to claim 1, characterized in that: In the step 2, two-way authentication is performed on the internal and external hosts through IP address or Mac address, thereby realizing physical isolation double authentication and a secure trust host of a one-way channel, realizing secure isolation, establishing users on the internal and external network hosts respectively, and the users establish a unified trust policy for the internal and external networks. After the trusted host passes, the IP address is mapped to the MAC through the secondary trust policy to establish two-way trust.

4. The data encryption security processing method according to claim 1, characterized in that: In step three, different access rights and operation rights can be allocated according to the identity and role of the host to limit the access scope and operation behavior of the intranet resources.

5. The data encryption security processing method according to claim 1, characterized in that: The encryption algorithm in step 4 is SL / TLS encryption, which uses public and private keys for encryption and decryption.

6. The data encryption security processing method according to claim 1, characterized in that: In the step 5, the key is used to determine whether the number of values ​​of the encrypted data is an odd number or an even number. If it is an even number, every two numbers in the data are converted into binary in sequence, and the formed binary numbers are increased by one and multiplied by the day of the week corresponding to the day of the week to obtain the encrypted data; if it is an odd number, every two numbers in the data are converted into binary, and the last single number is converted into 2-bit binary, and the formed binary numbers are increased by one and multiplied by the day of the week corresponding to the day of the week to obtain the encrypted data.

7. The data encryption security processing method according to claim 3 is characterized in that: Internal and external hosts are connected through a light gate, and a list of trusted hosts for the internal and external networks is established in the light gate system, including hosts and services that are allowed to be accessed.

8. The data encryption security processing method according to claim 2, characterized in that: Identity authentication includes one or more combinations of username / password authentication, digital certificate authentication, and multi-factor authentication.

9. The data encryption security processing method according to claim 1, characterized in that: It also includes regular review and update of trusted host lists, monitoring of access logs and security events.

Images