Computer network-based computer data security encryption protection system

Abstract

The application discloses a computer data security encryption protection system based on a computer network, relates to the technical field of computer security, and calculates and generates an AES encryption key K in an AES encryption key algorithm unit by comprehensively considering influence factors such as plaintext data size Pds and key generation time Tgen AES , which can greatly improve the complexity and randomness of the data encryption key, the dynamic generation mechanism of the encryption key enables the computer data security encryption protection system to effectively resist brute force cracking and replay attacks, and the dynamic adjustment of the key by a session key adjustment value algorithm unit can guarantee the reliability of data encryption; in addition, the dynamic adjustment of the key can reasonably allocate system resources according to the change of the multi-data encryption performance, so that the computer data security encryption protection system can evaluate the subsequent encryption strategy according to the current encryption performance of different data under the condition of limited encryption resources, thereby saving computing resources.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer security, in particular to a computer data security encryption protection system based on a computer network. BACKGROUND

[0002] A computer network is also called a computer communication network. The simplest definition of a computer network is: a collection of some interconnected, autonomous computers for the purpose of sharing resources. The data encryption security in existing computer networks is low, and computer data encryption protection is needed.

[0003] Chinese patent CN202210599195.0 discloses a computer security protection system. When data anomalies are monitored, the system automatically determines abnormal conditions and intelligently processes them. It can automatically close data transmission functions and computer locking functions. When data anomalies occur, the system intelligently determines data anomaly conditions and intelligently processes them according to actual conditions. Chinese patent CN202311533630.0 discloses a computer network big data security protection method and system. The node encryption key is obtained through the complex and unique contact parameters of the device node, and the node encryption key is updated over time. The complexity and dynamic characteristics further improve the cracking difficulty and distributed storage security.

[0004] Existing computer data encryption protection is relatively simple, and it is difficult to adjust the encryption strength of data according to factors such as encrypted data size and encryption time. When there is a large amount of data to be encrypted, it is difficult to evaluate the subsequent encryption strategy and optimize the allocation of encryption resources based on the current encryption state of the data under limited encryption resources.

[0005] Therefore, there is an urgent need for a computer data security encryption protection system based on a computer network to solve the above problems. SUMMARY

[0006] The purpose of the present application is to provide a computer data security encryption protection system based on a computer network to solve the problems raised in the background art.

[0007] To achieve the above purpose, the present application provides the following technical solution: a computer data security encryption protection system based on a computer network, comprising:

[0008] A data collection module for monitoring and obtaining encrypted data information through a computer's built-in operating system;

[0009] A computing and processing module, which specifically computes and processes as follows:

[0010] S1, calculate and generate an AES encryption key K through an AES encryption key algorithm unitAES ;

[0011] S2, inputting the AES encryption key K AES Inputting the plaintext into the AES-GCM encryption algorithm combined with the initialization vector IV for encryption, and outputting the ciphertext;

[0012] S3, obtaining the plaintext data size Pds and the ciphertext data size Cds through the file management interface of the operating system, inputting them into the encryption performance compensation value algorithm unit combined with the encryption time Tenc to calculate the encryption performance compensation value Se and uploading it to the database of the computer data security encryption protection system;

[0013] S4, setting the adjustment threshold Y of the encryption performance compensation value Se in the database of the computer data security encryption protection system, comparing the encryption performance compensation value Se with the adjustment threshold Y, and dynamically adjusting the parameter value in the AES encryption key algorithm unit.

[0014] Optionally, the obtaining of the encryption data information specifically comprises:

[0015] Recording the timestamp and obtaining the key generation time Tgen in the key generation process through the operating system built in the computer;

[0016] Recording the timestamp and obtaining the encryption time Tenc in the encryption process of the AES-GCM encryption algorithm through the operating system built in the computer.

[0017] Optionally, the dynamic adjustment of the parameter value in the AES encryption key algorithm unit specifically comprises:

[0018] When the encryption performance compensation value Se is greater than or equal to the adjustment threshold Y, triggering the key adjustment mechanism, inputting the AES encryption key KAES and the encryption performance compensation value Se into the session key adjustment value algorithm unit to calculate a new session key Knew;

[0019] Re-inputting the new session key Knew into the AES encryption key algorithm unit for secondary calculation and re-encrypting the data.

[0020] Optionally, the calculation processing module comprises an AES encryption key algorithm unit, an encryption performance compensation value algorithm unit, a session key adjustment value algorithm unit, and an AES-GCM encryption algorithm.

[0021] Optionally, the calculation logic of the AES encryption key algorithm unit is as follows:

[0022] S11, mapping the plaintext data size Pds to a logarithmic space to compress the numerical value influence of the plaintext data size Pds, so that the influence of the data size change on the key generation is more smooth;

[0023] S12, divide the key generation time Tgen by 1000 and take the natural exponential, through the characteristics of the exponential function can amplify the tiny time difference, the tiny time change cause larger fluctuations in amplitude, ensure that the AES encryption key K generated in a short time AES Different, prevent replay attacks, and make it difficult for attackers to predict the key by measuring time difference;

[0024] S13, through the logarithmic impact of the plaintext data size Pds and the exponential impact of the key generation time Tgen combined with the random number R1, generate a dynamically changing intermediate value, ensure that the key is strongly related to the plaintext size and time of each encryption, and enhance the uniqueness;

[0025] S14, through the XOR operation, mix the TLS session key K TLS with the intermediate value, ensure that the key is based on session security and related to the current encryption operation, enhance the randomness of the key;

[0026] S15, through the hash operation, map the mixed value to a fixed length AES key, get the AES encryption key K AES .

[0027] Optionally, the calculation logic of the encryption performance compensation value algorithm unit is as follows:

[0028] S31, through the ratio of the encryption time Tenc and the plaintext data size Pds, reflect the efficiency of the encryption algorithm processing data;

[0029] S32, through the ratio of the ciphertext data size Cds and the plaintext data size Pds, reflect the expansion degree of the encryption algorithm to the data, and after adding 1 to the ratio, perform logarithmic transformation processing, so that the influence of this part of the ratio on the encryption performance compensation value Se is more smooth;

[0030] S33, through the variant of the Sigmoid function, map the influence of the encryption time Tenc on the encryption performance compensation value Se to the value interval of 0-1.

[0031] Optionally, the calculation logic of the session key adjustment value algorithm unit is as follows:

[0032] S41, according to the maximum value and the minimum value in the calculation of the encryption performance compensation value recorded in the database, normalize the influence of the encryption performance compensation value Se on the new session key Knew;

[0033] S42, according to the AES encryption key K AES Combine the normalized influence value to calculate the new session key Knew.

[0034] Optionally, the adjustment threshold Y of the encryption performance compensation value Se in the database of the computer data security encryption protection system is set to 0.1.

[0035] Compared with the prior art, the present application has the following advantages:

[0036] Firstly, the present application forms the core architecture of the computer data security encryption protection system based on computer network through the cooperation of multiple algorithm units, and calculates and generates the AES encryption key K in the AES encryption key algorithm unit by comprehensively considering the influence factors such as the plaintext data size Pds and the key generation time Tgen AES , so that the complexity and randomness of the data encryption key are greatly improved. By incorporating the time factor in key generation and calculation, the key for each encryption operation is different, which can effectively resist replay attacks. Even if the attacker intercepts the ciphertext, it cannot reuse the same key for decryption, so as to avoid brute force cracking or dictionary attack of the static key. This dynamic generation mechanism of the encryption key enables the computer data security encryption protection system to effectively resist brute force cracking and replay attacks, and adapt to various application scenarios.

[0037] Secondly, when the encryption performance compensation value Se is greater than the adjustment threshold Y, the key is dynamically adjusted by the session key adjustment value algorithm unit, which can ensure the reliability of data encryption. Moreover, this dynamic key adjustment method can reasonably allocate system resources according to the changes in multi-data encryption performance. When the encryption performance of the data is good, a smaller key adjustment range can reduce the waste of system resources, and when the encryption performance decreases, a larger key adjustment range can prompt the system to re-evaluate the encryption strategy, so as to enable the computer data security encryption protection system to evaluate the subsequent encryption strategy according to the current encryption performance of different data in the case of limited encryption resources, thereby saving computing resources. BRIEF DESCRIPTION OF DRAWINGS

[0038] Figure 1 It is the overall structure diagram of the computer data security encryption protection system based on computer network. DETAILED DESCRIPTION

[0039] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0040] Embodiment one, please refer to Figure 1 , the present application provides a computer data security encryption protection system based on computer network, which comprises:

[0041] The data collection module is used to monitor and acquire encrypted data information through the computer's built-in operating system, specifically including:

[0042] The key generation time Tgen is obtained by recording timestamps during the key generation process through the computer's built-in operating system.

[0043] The computer's built-in operating system records timestamps and obtains the encryption time (Tenc) during the AES-GCM encryption process.

[0044] The calculation and processing module, and the specific calculation and processing steps are as follows:

[0045] S1, calculates and generates the AES encryption key K through the AES encryption key algorithm unit. AES ;

[0046] S2, use the AES encryption key K AES The plaintext is encrypted using the AES-GCM encryption algorithm in conjunction with the initialization vector IV, and the ciphertext is output.

[0047] S3 obtains the plaintext data size Pds and the ciphertext data size Cds through the operating system's file management interface, inputs them together into the encryption performance compensation value algorithm unit, calculates the encryption performance compensation value Se in combination with the encryption time Tenc, and uploads it to the database of the computer data security encryption protection system.

[0048] S4, set an adjustment threshold Y for the encryption performance compensation value Se in the database of the computer data security encryption protection system, compare the encryption performance compensation value Se with the adjustment threshold Y, and dynamically adjust the parameter values ​​within the AES encryption key algorithm unit, specifically including:

[0049] When the encryption performance compensation value Se ≥ the adjustment threshold Y, the key adjustment mechanism is triggered. The AES encryption key KAES and the encryption performance compensation value Se are input into the session key adjustment value algorithm unit to calculate the new session key Knew.

[0050] The new session key Knew is re-entered into the AES encryption key algorithm unit for secondary calculation and re-encryption of the data.

[0051] In this embodiment:

[0052] This invention utilizes the cooperation of multiple algorithm units within the computational processing module to form the core architecture of a computer network-based computer data security encryption and protection system. By comprehensively considering factors such as the plaintext data size Pds and the key generation time Tgen, the AES encryption key K is calculated and generated within the AES encryption key algorithm unit. AES This makes the encryption key KAES The complexity and randomness are greatly improved. By incorporating the time factor into key generation and calculation, the key for each encryption operation is different, which can effectively resist replay attacks. Even if the attacker intercepts the ciphertext, they cannot reuse the same key to decrypt it. This can avoid static keys from being cracked by brute force or dictionary attacks. This mechanism of dynamically generating encryption keys can effectively resist brute force and replay attacks, optimize key generation efficiency, and adapt to diverse application scenarios.

[0053] When the encryption performance compensation value Se ≥ adjustment threshold Y, the key can be dynamically adjusted by the session key adjustment value algorithm unit to ensure the reliability of data encryption. For example, after the system has been running for a long time, there may be slight fluctuations in encryption performance. If the key is not adjusted in time, some potential security risks may gradually accumulate. The dynamic adjustment method of the session key adjustment value algorithm unit can avoid this situation and make the system more reliable in the face of various complex security environments.

[0054] Furthermore, this dynamic key adjustment method can rationally allocate system resources based on changes in encryption performance. When encryption performance is good, a small key adjustment can reduce the waste of system resources; when encryption performance deteriorates, a larger key adjustment will prompt the system to re-evaluate the encryption strategy, optimize subsequent encryption resource allocation, and improve overall security and efficiency. This allows the system to evaluate subsequent encryption strategies based on the current encryption performance of different data under limited resources, thus saving computing resources.

[0055] Please see Figure 1 The AES encryption key algorithm unit is as follows:

[0056]

[0057] in:

[0058] K AES Represents the AES encryption key;

[0059] K TLS The TLS session key is a 16-byte random string, generated randomly by the computer's built-in operating system-level random number generator.

[0060] R1 represents a random number, which is generated randomly by the computer's built-in random number generator;

[0061] Pds represents the size of the plaintext data, which is obtained through the operating system's file management interface and is measured in bytes.

[0062] Tgen represents the key generation time. The computer's built-in operating system records and retrieves the timestamp during the key generation process.

[0063] The log2(Pds+1) part maps the plaintext data size Pds to the logarithmic space, compresses the numerical influence of the plaintext data size Pds, and makes the influence of the data size change on the key generation more smooth. Specifically:

[0064] When the data size increases from 100 bytes to 1000 bytes, directly using the data size as a parameter will cause a large change in the key. After the logarithmic transformation, the change will be relatively small, avoiding the key from fluctuating sharply due to the slight change in the data size.

[0065] This part divides the key generation time Tgen by 1000 and takes the natural exponential. The exponential function has a growth characteristic. With the increase of the key generation time Tgen, This part value increases, and through the characteristics of the exponential function, it can amplify the small time difference, so that the small time change causes a large fluctuation, to ensure that the AES encryption key K AES is generated in a short time. Different, prevent replay attacks, and make it difficult for attackers to predict the key by measuring the time difference;

[0066] This part combines the logarithmic influence term of the plaintext data size Pds and the exponential influence term of the key generation time Tgen with the random number R1 to generate a dynamically changing intermediate value, to ensure that the key is strongly related to the context (plaintext size, time) of each encryption, and to enhance uniqueness;

[0067] This part mixes the TLS session key K TLS with the intermediate value through XOR operation, to ensure that the key is based on session security and related to the current encryption operation, and to enhance the randomness of the key through simple and efficient XOR operation;

[0068] Finally, through the hash operation, the mixed value is mapped to the fixed length AES key, and the AES encryption key K AES is obtained.

[0069] In this embodiment, the AES encryption key algorithm unit calculates and generates the AES encryption key K AES by comprehensively considering the plaintext data size Pds, the key generation time Tgen, and other factors, so that the complexity and randomness of the encryption key K AES are significantly improved. Specifically, the time factor is integrated into the key generation, and the key of each encryption operation is different, which can effectively resist replay attacks. Even if the attacker intercepts the ciphertext, it cannot reuse the same key to decrypt, so as to avoid the static key from being brute-forced or dictionary attacked.

[0070] And, by considering the plaintext size and generation time for encryption key generation, the calculation complexity of the key generation algorithm can be optimized, for example, lightweight KDF is used for small data, and parallel key expansion is used for large data, to balance the security and system performance of the computer data security encryption protection system. In general, this kind of encryption key dynamic generation mechanism can effectively resist brute force cracking, replay attacks and other threats, while optimizing the key generation efficiency and adapting to diversified application scenarios.

[0071] Please refer to Figure 1 The encryption performance compensation value algorithm unit is as follows:

[0072]

[0073] Among them:

[0074] Se represents the encryption performance compensation value;

[0075] Cds represents the ciphertext data size, which is obtained through the file management interface of the operating system, and the unit is byte;

[0076] Pds represents the plaintext data size, and the unit is byte;

[0077] Tenc represents the encryption time, and the computer built-in operating system records the timestamp and obtains it in the process of AES-GCM encryption algorithm;

[0078] Tavg represents the average encryption time;

[0079] Tstd represents the standard deviation, which is the standard deviation of the historical encryption time of the computer data;

[0080] The calculation formula of the average encryption time Tavg and the standard deviation Tstd is:

[0081]

[0082] n represents the number of encryptions;

[0083] Tenci represents the i-th encryption time;

[0084] This part is divided by the plaintext data size Pds, which represents the encryption time corresponding to the processing unit plaintext data size, reflects the efficiency of the encryption algorithm processing data, and is the basic calculation item of the encryption performance compensation value Se. When the plaintext data size Pds is constant, as This part of the ratio decreases, indicating that the encryption algorithm takes less time to process the same size of plaintext data, and the encryption efficiency is higher, and the encryption performance compensation value Se calculated is reduced;

[0085] This part is divided by the ciphertext data size divided by the plaintext data size, representing the ratio of the ciphertext data size to the plaintext data size, reflecting the expansion degree of the encryption algorithm to the data, and this part This part is processed by logarithmic transformation after the ratio is added by 1, making the influence of this part ratio on the encryption performance compensation value Se more smooth, specifically:

[0086] When the ciphertext data size Cds increases relative to the plaintext data size Pds, this part The value will increase, representing that the encryption algorithm has efficiency problems in data storage, and the calculated encryption performance compensation value Se increases;

[0087] The denominator in this part is a transformation of the Sigmoid function, which is an adjustment term based on the difference between the encryption time Tenc and the average encryption time Tavg, is the standardized difference between the encryption time and the average encryption time, is an exponential transformation of this standardized difference, which is then mapped to (0, 1) by Finally, adding a constant 1 makes the result between (1, 2), specifically:

[0088] When the encryption time Tenc is close to the average encryption time Tavg, the value is close to 1, and the influence on the encryption performance compensation value Se is small, when the encryption time Tenc is much larger than the average encryption time Tavg, the value is close to 2, and the calculated encryption performance compensation value Se increases, indicating that the current encryption operation time is longer and the encryption efficiency is low;

[0089] In this embodiment:

[0090] The encryption performance compensation value algorithm unit can intuitively evaluate the expansion degree of the encryption algorithm to the data through the ratio of the ciphertext data size Cds to the plaintext data size Pds. Different encryption algorithms will result in different ciphertext data sizes. By calculating the encryption performance compensation value Se, the computer data security encryption protection system can select more efficient encryption algorithms in terms of storage and transmission. For example, for systems with limited storage resources, selecting an algorithm with smaller ciphertext expansion can save storage space. The ratio of the ciphertext data size Cds to the plaintext data size Pds also reflects the encryption time required for unit plaintext data, which can directly measure the processing speed of the encryption algorithm, which is crucial for real-time application scenarios such as online transactions and real-time communication, ensuring that data encryption is completed within a reasonable time without affecting the overall performance of the system.

[0091] The stability of encryption time is an important guarantee for the reliability of computer data security encryption protection system. If the encryption time fluctuates greatly, it will lead to performance bottleneck or failure of the system. The encryption performance compensation value algorithm unit can make the system discover and handle the unstable encryption performance in time and take corresponding measures in the computer data security encryption protection system, so as to improve the reliability of the system and ensure the normal operation of the system.

[0092] Please refer to Figure 1 , the session key adjustment value algorithm unit is as follows:

[0093]

[0094] Among them:

[0095] Knew represents the new session key;

[0096] K AES represents the AES encryption key;

[0097] α represents the adjustment coefficient, and the default value is 0.2;

[0098] Se represents the encryption performance compensation value;

[0099] Se max represents the maximum value of the encryption performance compensation value, which is the maximum value of the encryption performance compensation value calculated in the past encryption in the database;

[0100] Se min represents the minimum value of the encryption performance compensation value, which is the minimum value of the encryption performance compensation value calculated in the past encryption in the database;

[0101] represents the relative position of the current encryption performance compensation value Se in the encryption performance compensation value range, i.e. from the minimum value to the maximum value. When the encryption performance compensation value Se is close to the minimum value of the encryption performance compensation value Se min , this part of the ratio is small, this part of the value is close to 1, which means that the new session key Knew and the original AES encryption key K AES have small difference, indicating that the current encryption performance is good, and the key does not need to be adjusted greatly;

[0102] When the encryption performance compensation value Se is close to the maximum value of the encryption performance compensation value Se max , this part of the ratio increases, and the new session key Knew calculated at this time is relative to the original AES encryption key K AESThere is a big change, which means that when the encryption performance is poor, a new session key Knew is dynamically adjusted for secondary calculation and data encryption is performed again to deal with the existing security risks;

[0103] In the present embodiment,

[0104] In practical applications, the encryption environment of the computer data security encryption protection system is complex and changeable, and various unexpected situations may occur to cause the encryption performance to decrease. The dynamic adjustment of the parameters in the session key adjustment value algorithm unit enables the system to adapt to these changes. For example, in the case of network attacks causing encryption resources to be occupied and encryption algorithms to be disturbed, timely adjustment of the key can maintain the security of the system. Specifically, by setting the adjustment threshold Y of the encryption performance compensation value Se in the database of the computer data security encryption protection system to 0.1, when the encryption performance compensation value Se is greater than or equal to the adjustment threshold Y, the key adjustment mechanism is automatically triggered. This dynamic adjustment of parameters can monitor the encryption performance in real time. Once the encryption efficiency is low and there may be security risks, the key can be adjusted in time to avoid the existence of potential security threats.

[0105] By dynamically adjusting the key, the reliability of data encryption can be ensured. Because different encryption performance conditions mean different security risks, timely adjustment of the key can reduce the impact of these risks on data security. For example, after the system has been running for a long time, there may be slight fluctuations in encryption performance. If the key is not adjusted in time, some potential security risks may gradually accumulate. The dynamic adjustment of the session key adjustment value algorithm unit can avoid this situation, making the system more reliable in the face of various complex security environments. By dynamically adjusting the key, system resources can be reasonably allocated according to changes in encryption performance. When the encryption performance is good (the encryption performance compensation value Se is low), a smaller key adjustment range can reduce the waste of system resources. When the encryption performance decreases (the encryption performance compensation value Se is high), a larger key adjustment range can prompt the system to re-evaluate the encryption strategy, optimize resource allocation, and improve overall security and efficiency. In the case of limited resources, dynamically adjusting the key according to the encryption performance can avoid unnecessary key update operations and save computing resources.

[0106] Although embodiments of the present application have been shown and described, it will be understood by those of ordinary skill in the art that various changes, modifications, replacements and variations can be made to these embodiments without departing from the principles and spirit of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A computer data security encryption protection system based on computer network, characterized in that, The application relates to a computer data security encryption protection system and a method thereof. The data collection module is used for monitoring and acquiring encrypted data information through a computer built-in operating system; the calculation processing module specifically comprises the following steps: S3, acquiring plaintext data size Pds and ciphertext data size Cds through a file management interface of the operating system, inputting the plaintext data size Pds and the ciphertext data size Cds into an encryption performance compensation value algorithm unit together, combining encryption time Tenc to calculate an encryption performance compensation value Se, and uploading the encryption performance compensation value Se to a database of a computer data security encryption protection system; S1, calculate and generate the AES encryption key K by the AES encryption key algorithm unit AES ; S2, encrypting the AES key K AES Input the plaintext and the initialization vector IV into the AES-GCM encryption algorithm to encrypt the plaintext and output the ciphertext. S4, setting an adjustment threshold value Y of the encryption performance compensation value Se in the database of the computer data security encryption protection system, comparing the encryption performance compensation value Se with the adjustment threshold value Y, and dynamically adjusting parameter values in an AES encryption key algorithm unit. The acquisition of the encrypted data information specifically comprises the following steps:

2. The computer network-based computer data security encryption protection system according to claim 1, wherein: Recording a timestamp and acquiring key generation time Tgen in a key generation process through the computer built-in operating system; Recording a timestamp and acquiring encryption time Tenc in an encryption process of the AES-GCM encryption algorithm through the computer built-in operating system. The dynamic adjustment of the parameter values in the AES encryption key algorithm unit specifically comprises the following steps:

3. The computer network-based computer data security encryption protection system of claim 2, wherein: Re-inputting a new session key Knew into the AES encryption key algorithm unit, performing secondary calculation, and re-performing data encryption. When the encryption performance compensation value Se is greater than or equal to the adjustment threshold Y, a key adjustment mechanism is triggered, and the AES encryption key K AES The encryption performance compensation value Se is input into a session key adjustment value algorithm unit, and a new session key Knew is calculated. The calculation processing module comprises an AES encryption key algorithm unit, an encryption performance compensation value algorithm unit, a session key adjustment value algorithm unit and an AES-GCM encryption algorithm.

4. The computer network-based computer data security encryption protection system of claim 3, wherein: The calculation logic of the AES encryption key algorithm unit is as follows:

5. The computer network-based computer data security encryption protection system, according to claim 4, wherein: S11, mapping the plaintext data size Pds to a logarithm space, compressing the numerical value influence of the plaintext data size Pds, and making the influence of data size change on key generation more smooth; S13, generating a dynamically changed intermediate value by combining a logarithm influence term of the plaintext data size Pds, an exponential influence term of the key generation time Tgen and a random number R1, ensuring that the key is strongly related to the plaintext size and time of each encryption, and enhancing uniqueness; S12, the key generation time Tgen is divided by 1000 and the natural index is taken, through the characteristics of the exponential function, the tiny time difference can be amplified, the tiny time change leads to a larger fluctuation, and the AES encryption key K generated in a short time is ensured AES Different, prevent replay attacks, and make it difficult for attackers to predict the key by measuring the time difference; The calculation logic of the encryption performance compensation value algorithm unit is as follows: S14, the TLS session key K is mixed with the intermediate value by exclusive OR operation TLS Mixing with the intermediate value ensures that the key is based on both session security and the current encryption operation, enhancing the randomness of the key. S15, mapping the mixed value into a fixed length AES key through hash operation to obtain the AES encryption key K AES .

6. The computer network-based computer data security encryption protection system, according to claim 5, wherein: S31, reflecting the data processing efficiency of the encryption algorithm by the ratio of the encryption time Tenc to the plaintext data size Pds; S32, reflecting the expansion degree of the data of the encryption algorithm by the ratio of the ciphertext data size Cds to the plaintext data size Pds, logarithm transforming the ratio after adding 1 to the ratio, and making the influence of the ratio on the encryption performance compensation value Se more smooth; S33, mapping the influence term of the encryption time Tenc on the encryption performance compensation value Se to a numerical interval of 0-1 by a variant of a Sigmoid function. The calculation logic of the session key adjustment value algorithm unit is as follows:

7. The computer network-based computer data security encryption protection system according to any one of claims 3-6, wherein: S41, normalizing the influence of the encryption performance compensation value Se on the new session key Knew according to the maximum value and the minimum value of the encryption performance compensation value Se in the database; The adjustment threshold value Y of the encryption performance compensation value Se is set to 0.1 in the database of the computer data security encryption protection system. S42, the AES encryption key K is calculated according to the normalized influence value AES The new session key Knew is calculated in combination with the normalized influence value.

8. The computer network-based computer data security encryption protection system, as recited in claim 1, characterized by, ​

Images