CN112398861B - Encryption system and method for sensitive data in web configuration system - Google Patents

Abstract

The invention discloses a quick encryption system for sensitive data in a web configuration system, wherein a safety login module completes user access authentication and blacklist filtering of the encryption system, an SQL injection attack identification and sensitive data screening module performs SQL injection attack identification on an SQL sentence to be executed and adds a user account number corresponding to the SQL injection attack identification and sensitive data screening module into a user blacklist, the SQL injection attack identification and sensitive data screening module also performs sensitive data screening on the SQL sentence to be executed by utilizing a typical field in the SQL sentence, and an ECC data encryption module encrypts the screened sensitive SQL data by utilizing an elliptic curve password code. The invention can realize the rapid data encryption of the Web system and improve the system performance.

Description

Encryption system and method for sensitive data in web configuration system

technical field

The invention relates to the technical field of smart grids, in particular to a system and method for encrypting sensitive data in a web configuration system.

Background technique

The customer-side energy consumption control system in the smart grid serves as the link between the customer and the smart energy service platform. It is an important means to support the ubiquitous power Internet of Things on the customer side, and is also the execution unit of various comprehensive energy services such as demand response and energy efficiency improvement. The client-side energy control system has a wide variety of application scenarios, lack of understanding of common requirements such as data collection and monitoring, demand response, high development costs, and poor portability and reusability. The WEB-based configurable development platform system and application environment are used to provide users with a standardized process and application model for the construction of an energy control system based on a configurable development engine framework, so as to solve the problem that the development efficiency of the energy control system in the current mode is low, The problem of high construction cost supports the rapid deployment and efficient implementation of the energy consumption control system on the client side of the power system.

This WEB-based configuration system has completely modularized business functions, using a reliable service cloud platform, according to specific application scenarios and requirements, through the mutual combination of components, a client-side energy consumption that meets user needs can be assembled arbitrarily. The control system is presented to the user in the form of WEB. The energy control system in the smart grid carries a large amount of sensitive data. However, WEB-based applications usually do not strictly filter the validity of user input data on the client side, so that attackers can add additional SQL ( Structured query language (Structured QueryLanguage) statement to achieve illegal operations, deceive the database server to perform unauthorized queries and other operations. In order to prevent the sensitive data in the database from being stolen, tampered and deleted, a sensitive data encryption method for Web system needs to be designed.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a system and method for encrypting sensitive data in a web configuration system, and the present invention can realize fast data encryption of the web system and improve system performance.

In order to realize this purpose, the encryption system of sensitive data in the web configuration system designed by the present invention is characterized in that: it comprises a security login module, a SQL injection attack identification and a sensitive data screening module, and an ECC data encryption module;

The secure login module is used to complete the user access authentication and blacklist filtering of the encryption system, and transmits the SQL statement to be executed transmitted by the user through the access authentication and blacklist filtering to the SQL injection attack identification and sensitive data screening module ;

The SQL injection attack identification and sensitive data screening module is used to identify the SQL statement to be executed for SQL injection attack, and add the user account corresponding to the identified SQL injection attack to the user blacklist, and the SQL injection attack identification and sensitive data screening module also Use typical fields in the SQL statement to filter sensitive data of the SQL statement to be executed, and the ECC data encryption module is used to encrypt the filtered sensitive SQL data using elliptic curve cipher coding.

The beneficial effects of the present invention are:

The invention identifies the transmission data, only performs intrusion detection on the non-sensitive data to identify malicious attackers, and reduces the number of server encryption and decryption operations; at the same time, the sensitive data is encrypted by using a lightweight and improved ECC encryption algorithm to ensure the sensitive data. Security, reducing the time-consuming of encryption and decryption operations; thus realizing fast encryption of data in the Web system and improving system performance.

Description of drawings

Fig. 1 is the structural representation of the present invention;

Fig. 2 is the flow chart of the sensitive data encryption method of Web configuration software;

3 is a flowchart of user access authentication;

Figure 4 is the SQL injection attack identification strategy framework;

Figure 5 is a flowchart of SQL injection attack identification strategy;

Figure 6 is a flowchart of a sensitive data screening strategy;

Figure 7 is a flowchart of the improved ECC encryption algorithm.

Among them, 1-secure login module, 2-SQL injection attack identification and sensitive data screening module, 3-ECC data encryption module.

Detailed ways

The present invention will be described in further detail below in conjunction with the accompanying drawings and specific embodiments:

The encryption system for sensitive data in the web configuration system designed by the present invention, as shown in Figure 1, includes a secure login module 1, a SQL injection attack identification and sensitive data screening module 2, and an ECC data encryption module 3. The security The login module 1 is used to complete the user access authentication and blacklist filtering of the encryption system, and transmit the to-be-executed SQL statements transmitted by the users who have passed the access authentication and blacklist filtering to the SQL injection attack identification and sensitive data filtering module 2, The described SQL injection attack identification and sensitive data screening module 2 is used for SQL injection attack identification to be performed on the SQL statement to be executed, and the user account corresponding to the identified SQL injection attack is added to the user blacklist, and the SQL injection attack identification and sensitive data screening module 2. It also uses typical fields in the SQL statement to filter sensitive data of the SQL statement to be executed, and the ECC data encryption module 3 is used to encrypt the filtered sensitive SQL data using Elliptic Curves Cryptography (ECC, Elliptic Curves Cryptography).

In the above technical solution, the specific method for the secure login module 1 to complete the user access authentication and blacklist filtering of the encryption system is:

The verification code is obtained from the secure login module 1 by using the reserved mobile phone number, and the user access authentication of the encryption system is performed through the verification code. The secure login module 1 uses the user blacklist to filter the user account and IP.

In the above-mentioned technical scheme, the concrete method that described SQL injection attack identification and sensitive data screening module 2 is used to carry out SQL injection attack identification to the SQL statement to be executed is:

The SQL injection attack identification and sensitive data screening module 2 standardizes the SQL statements to be executed: first, the to-be-executed SQL statements with encoding or interference characters are converted into normal statements or corresponding strings; Classify the SQL statement to be executed corresponding to the string, clarify the operation type of the SQL statement to be executed and the database table name used; trim the SQL statement to be executed, delete the string entered by the user in the SQL statement to be executed; delete the user input The similarity between the SQL statement to be executed and the statement in the SQL statement template library is calculated. The SQL statement template library is in the classic SQL statement format. If the similarity is greater than the preset similarity threshold, the SQL statement to be executed will be transmitted. Execute to the server, otherwise, send an alarm message to the user's reserved mobile phone, and add his account and IP address to the blacklist (the source address of the illegal sentence is included in the blacklist).

In the above-mentioned technical scheme, the SQL injection attack identification and sensitive data screening module 2 utilizes typical fields in the SQL statement to perform sensitive data screening of the SQL statement to be executed. The specific method is:

Create a sensitive data dataset based on the fields containing sensitive data in the database table of the server, for example, the field names that store account password, certificate number, transaction, phone number and other information, scan the SQL statement to be executed, if the field name in the sensitive dataset is included The SQL statement needs to be encrypted, otherwise it is directly sent to the server for execution.

In the above technical solution, the specific method for encrypting the screened sensitive SQL data by the ECC data encryption module 3 using elliptic curve cipher coding is:

Randomly generate an elliptic curve E and select a point on the ellipse as the base point G, select a private key k, generate a public key K=kG, generate a random number r, and use the elliptic curve plaintext embedding algorithm to encode the plaintext m into the ellipse Point M on the curve E, that is to calculate the coordinates of the point M on the elliptic curve;

Expand the random number r through the double-base chain representation, and control the number of base chains, that is, the number of non-zero elements in the expansion, so that the number of operations of point addition and point multiplication in the subsequent scalar multiplication calculation is greatly reduced. The random number division method of , estimates the optimal number of base chains, calculates the scalar multiplication of the random integer r and the public key K, and the scalar multiplication of the random integer r and the base point G, and uses the scalar multiplication of the random integer r and the public key K , and the scalar multiplication of the random integer r and the base point G to obtain the corresponding ciphertext C ₁ and ciphertext C ₂ .

In the above technical solution, NAF (non-adjacent form) encoding is performed on the random number r, where r ⁿ represents the integer of the random number r after NAF encoding, and s _t is the leading coefficient of the t-th item (the coefficient item of the expanded radix chain);

Among them, n represents the n-bit integer of the random number r after NAF encoding;

The pre-calculation scale limit weight is set to limit the calculation amount of the subsequent calculation, that is, the number of point addition and point multiplication operations ψ, and the calculation formula is as follows:

表示对基底求平均数并向下求整；Among them, r is a random integer, EB is the base {2,3,5,7},

Indicates that the base is averaged and rounded down;

Divide the NAF-encoded integer r ⁿ of length n according to the pre-computed scale limit weight, that is, the expansion of the random number r, in order to reduce the computation amount of subsequent scalar multiplication;

表示经过划分后rⁿ的展开式第t项，

表示经过划分后rⁿ的展开式第

项；in,

represents the t- ^th term of the expansion of rn after division,

represents the expansion of ^rn after division

item;

The maximum length of the base chain (the base chain notation is expanded, and the number of control base chains is the number of non-zero elements in the expansion) is

的最优多基数链为for

The optimal multi-cardinality chain of is

Wherein, Π is the cumulative multiplication symbol, γ is the exponential coefficient corresponding to the base EB, si is the leading coefficient of the _i -th item, and eb belongs to the set of the base EB;

Calculate the scalar multiplication of the random integer r and the public key K, and the scalar multiplication of the random integer r and the base point G;

表示经过划分后的rⁿ的展开式第t项；Among them, d represents the number of cardinality chains,

represents the t- ^th term of the expansion of rn after division;

Calculate the ciphertexts C ₁ and C ₂ ;

C ₁ =M+rK

C ₂ =rG.

An encryption method for sensitive data in a web configuration system, as shown in Figure 2, includes the following steps:

Step 1: The secure login module 1 completes the user access authentication and blacklist filtering of the encryption system, and transmits the SQL statements to be executed sent by the users who have passed the access authentication and blacklist filtering to the SQL injection attack identification and sensitive data filtering module 2;

Step 2: The SQL injection attack identification and sensitive data screening module 2 performs SQL injection attack identification on the SQL statement to be executed, and adds the user account corresponding to the identified SQL injection attack to the user blacklist, SQL injection attack identification and sensitive data screening Module 2 also utilizes typical fields in the SQL statement to filter sensitive data of the SQL statement to be executed;

The ECC data encryption module 3 encrypts the filtered sensitive SQL data by using elliptic curve cipher coding.

In step 1 of the above technical solution, the specific method for the secure login module 1 to complete the user access authentication and blacklist filtering of the encryption system is as follows:

The verification code is obtained from the secure login module 1 by using the reserved mobile phone number, and the user access authentication of the encryption system is performed through the verification code. The secure login module 1 uses the user blacklist to filter the user account and IP.

Considering the relatively fixed application scenario of the customer-side energy control system in the smart grid, the reserved mobile phone number is used to complete the login operation. The complete user access authentication process is shown in Figure 3. The user enters the reserved mobile phone number and sends a login request to the server. The server queries whether the number has access rights according to the mobile phone number and the user rights mapping table, and then sends a message to the user through the mobile operator. Login verification code, the user needs three pieces of information to log in, including account number, password and verification code. Verify whether the user's IP address is in the blacklist, and deny users who use the IP address in the blacklist to log in. After the user logs in, the server queries the historical login information, and if the user's IP address changes, it sends an alarm message to the user.

In step 2 of the above technical solution, the specific method for identifying the SQL injection attack on the SQL statement to be executed by the SQL injection attack identification and sensitive data screening module 2 is:

The SQL injection attack identification and sensitive data screening module 2 standardizes the SQL statements to be executed, and first converts the SQL statements to be executed with encoding or interference characters into normal statements or corresponding strings (that is, SQL statements with escape characters). The statement is converted into a standard SQL statement); then, classify the SQL statement to be executed that is converted into a normal statement or a corresponding string, clarify the operation type of the SQL statement to be executed and the database table name used by it; cut the SQL statement to be executed, delete Remove the string entered by the user in the SQL statement to be executed; the similarity calculation is performed between the SQL statement to be executed after the string input by the user is deleted and the statement in the SQL statement template library. If the similarity is greater than the preset similarity threshold, it will be executed. The SQL statement is transmitted to the server for execution, otherwise, an alarm message is sent to the user's reserved mobile phone and the account and IP address are added to the blacklist.

The SQL injection attack identification and sensitive data screening module 2 utilizes typical fields in the SQL statement to perform sensitive data screening of the SQL statement to be executed The specific method is:

Create a sensitive data dataset based on the fields containing sensitive data in the database table of the server, scan the SQL statement to be executed, and encrypt the SQL statement if it contains the field name in the sensitive data set, otherwise it is directly sent to the server for execution.

As shown in Figure 4, the SQL injection attack identification is divided into two parts, namely the SQL statement standardization module and the injection attack identification module based on the similarity of SQL statements. The process of SQL injection attack identification strategy is shown in Figure 5. First, convert SQL statements with encoding or interference characters into normal statements or corresponding strings; then, classify SQL statements to clarify their operation types and the database they use Table name; trim the SQL statement and delete the strings entered by the user in the SQL statement; calculate the similarity between the standardized SQL statement and the statement in the SQL statement template library, where the SQL template library stores the classic SQL statement format. The formula for calculating similarity is as follows:

η=∑op·tn, op, tn=(0, 1)

Among them, the SQL statement to be executed is matched with the current statement in the template library. If the table to be operated is a non-sensitive data table, tn is 1, and the execution action is the same, then op is 1, otherwise, it is 0.

If the similarity is greater than the threshold, the SQL statement is transmitted to the server for execution; otherwise, an alarm message is sent to the user's reserved mobile phone and the account and IP address are added to the blacklist.

As shown in Figure 6, the steps of the sensitive data screening strategy flow chart are as follows: First, create a sensitive data dataset according to the fields containing sensitive data in the database table in the server, for example, store account password, certificate number, transaction, phone number and other information. Field Name. Scan the SQL statement to be executed. If it contains the field name in the sensitive data set, the SQL statement needs to be encrypted. Otherwise, it is directly sent to the server for execution.

In step 3 of the above technical solution, the specific method that the ECC data encryption module 3 uses elliptic curve cipher coding to encrypt the screened sensitive SQL data is, as shown in Figure 7:

Randomly generate an elliptic curve E and select a point on the ellipse as the base point G, select a private key k, generate a public key K=kG, generate a random number r, and use the elliptic curve plaintext embedding algorithm to encode the plaintext m into the ellipse Point M on the curve E, that is to calculate the coordinates of the point M on the elliptic curve;

Expand the random number r through the double base chain representation, control the base chain number, that is, the number of non-zero elements in the expansion formula, use the random number division method in the ECC data encryption module 3, estimate the optimal base chain number, and calculate the random integer The scalar multiplication of r and the public key K, and the scalar multiplication of the random integer r and the base point G, and the scalar multiplication of the random integer r and the public key K, and the scalar multiplication of the random integer r and the base point G are used to obtain the corresponding encryption. Text C ₁ and cipher text C ₂ .

The content not described in detail in this specification belongs to the prior art known to those skilled in the art.

As will be appreciated by those skilled in the art, the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that: the present invention can still be Modifications or equivalent replacements are made to the specific embodiments of the present invention, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention shall be included within the protection scope of the claims of the present invention.

Claims (8)

1. An encryption system for sensitive data in a web-configured system, comprising: the system comprises a security login module (1), an SQL injection attack recognition and sensitive data screening module (2) and an ECC data encryption module (3);

the security login module (1) is used for completing user access authentication and blacklist filtering of an encryption system, and transmitting SQL sentences to be executed, which are transmitted by users through the access authentication and the blacklist filtering, to the SQL injection attack identification and sensitive data screening module (2);

the SQL injection attack identification and sensitive data screening module (2) is used for carrying out SQL injection attack identification on an SQL sentence to be executed and adding a user account number corresponding to the identified SQL injection attack into a user blacklist, the SQL injection attack identification and sensitive data screening module (2) also carries out sensitive data screening on the SQL sentence to be executed by utilizing a typical field in the SQL sentence, and the ECC data encryption module (3) is used for encrypting the screened sensitive SQL data by utilizing elliptic curve password coding;

the specific method for the SQL injection attack recognition and sensitive data screening module (2) to perform the SQL injection attack recognition on the SQL statement to be executed is as follows:

the SQL injection attack recognition and sensitive data screening module (2) standardizes SQL sentences to be executed: converting the SQL sentence to be executed with the coding or interference characters into a normal sentence or a corresponding character string; classifying the SQL sentences to be executed which are converted into normal sentences or corresponding character strings, and clarifying the operation types of the SQL sentences to be executed and the database table names used by the SQL sentences; cutting the SQL sentence to be executed, and deleting the character string input by the user in the SQL sentence to be executed; similarity calculation is carried out on the SQL sentences to be executed with the character strings input by the user and the sentences in the SQL sentence template library, if the similarity is larger than a preset similarity threshold, the SQL sentences to be executed are transmitted to a server to be executed, and if not, the source addresses of the illegal SQL sentences are counted into a blacklist;

the specific method for the ECC data encryption module (3) to encrypt the screened sensitive SQL data by utilizing elliptic curve cryptography coding comprises the following steps:

randomly generating an elliptic curve E, selecting a point on an ellipse as a base point G, selecting a private key K, generating a public key K = kG, generating a random number r, and encoding a plaintext M to a point M on the elliptic curve E by using an elliptic curve plaintext embedding algorithm, namely calculating the coordinate of the point M on the elliptic curve;

the random number r is expanded by a representation of a double-base chain,controlling the base chain number, namely the number of nonzero elements in the expansion, estimating the optimal base chain number by using a random number division method in an ECC data encryption module (3), calculating the scalar multiplication of a random integer r and a public key K and the scalar multiplication of the random integer r and a base point G, and obtaining a corresponding ciphertext C by using the scalar multiplication of the random integer r and the public key K and the scalar multiplication of the random integer r and the base point G ₁ And ciphertext C ₂ 。

2. The system for encrypting sensitive data in a web-configured system as claimed in claim 1, wherein: the specific method for the secure login module (1) to complete user access authentication and blacklist filtering of the encryption system is as follows:

and obtaining a verification code from the security login module (1) by using the reserved mobile phone number, performing user access authentication of the encryption system through the verification code, and filtering a user account and an IP (Internet protocol) by using a user blacklist through the security login module (1).

3. The system for encrypting sensitive data in a web-configured system as claimed in claim 1, wherein: the specific method for screening the sensitive data of the SQL sentence to be executed by the SQL injection attack identification and sensitive data screening module (2) by using the typical field in the SQL sentence is as follows:

and establishing a sensitive data set according to fields containing sensitive data in a database table of the server, scanning the SQL sentence to be executed, if the field name in the sensitive data set is contained, encrypting the SQL sentence, otherwise, directly sending the SQL sentence to the server for execution.

4. The system of claim 3, wherein the encryption system for sensitive data in a web configuration system comprises:

NAF encoding the random number r, r ⁿ Denotes the integer of the random number r after NAF coding, s _t Leading coefficient of t-th item;

wherein n represents an n-bit integer of the random number r after NAF coding; the predicted calculation scale restriction weight ψ is set, which is calculated as follows:

wherein r is a random integer, EB is a substrate {2,3,5,7},

means to average and round down the basis;

encoding NAF according to pre-calculated scale limiting weight to obtain integer r with length n ⁿ Dividing;

wherein,

represents r after division ⁿ The term "t" of the expansion of (1),

represents r after division ⁿ Is of an expanded type

An item;

maximum length of radix chain

For the

Is the optimal multi-radix chain of

Wherein pi is a multiplication sign, gamma is an exponential coefficient corresponding to the substrate EB, and s _i EB belongs to the set of the base EB for the leading coefficient of the ith item;

calculating a scalar multiplication of the random integer r and the public key K and a scalar multiplication of the random integer r and the base point G;

wherein d represents the number of radix chains,

represents the divided r ⁿ Item t of the expansion;

computing a ciphertext C ₁ And C ₂ ；

C ₁ ＝M+rK

C ₂ ＝rG。

5. A method for encrypting sensitive data in a web configuration system according to claim 1, comprising the steps of:

step 1: the security login module (1) completes user access authentication and blacklist filtering of an encryption system, and transmits SQL sentences to be executed, which are transmitted by a user through the access authentication and the blacklist filtering, to the SQL injection attack identification and sensitive data screening module (2);

and 2, step: the SQL injection attack recognition and sensitive data screening module (2) performs SQL injection attack recognition on an SQL sentence to be executed, adds a user account number corresponding to the identified SQL injection attack into a user blacklist, and the SQL injection attack recognition and sensitive data screening module (2) also performs sensitive data screening on the SQL sentence to be executed by utilizing a typical field in the SQL sentence;

and 3, step 3: and the ECC data encryption module (3) encrypts the screened sensitive SQL data by using elliptic curve cryptography.

6. The method of claim 5, wherein the sensitive data is encrypted according to the following steps: in the step 1, the specific method for the secure login module (1) to complete the user access authentication and the blacklist filtering of the encryption system is as follows:

and obtaining a verification code from the security login module (1) by using the reserved mobile phone number, performing user access authentication of the encryption system through the verification code, and filtering a user account and an IP (Internet protocol) by using a user blacklist through the security login module (1).

7. The method of claim 5, wherein the sensitive data is encrypted according to a key value selected from the group consisting of: in the step 2, the specific method for the SQL injection attack recognition and sensitive data screening module (2) to perform the SQL injection attack recognition on the SQL statement to be executed is as follows:

the SQL injection attack recognition and sensitive data screening module (2) standardizes the SQL sentences to be executed, and firstly converts the SQL sentences to be executed with coding or interference characters into normal sentences or corresponding character strings; then, classifying the SQL sentences to be executed which are converted into normal sentences or corresponding character strings, and clarifying the operation types of the SQL sentences to be executed and the database table names used by the SQL sentences; cutting the SQL sentence to be executed, and deleting the character string input by the user in the SQL sentence to be executed; similarity calculation is carried out on the SQL sentences to be executed with the user input character strings deleted and the sentences in the SQL sentence template library, if the similarity is larger than a preset similarity threshold value, the SQL sentences to be executed are transmitted to a server to be executed, and otherwise, the source addresses of the illegal SQL sentences are included in a blacklist;

the SQL injection attack recognition and sensitive data screening module (2) utilizes typical fields in SQL sentences to screen the sensitive data of the SQL sentences to be executed, and the specific method comprises the following steps:

and establishing a sensitive data set according to fields containing sensitive data in a database table of the server, scanning the SQL sentence to be executed, if the field name in the sensitive data set is contained, encrypting the SQL sentence, otherwise, directly sending the SQL sentence to the server for execution.

8. The method of claim 5, wherein the sensitive data is encrypted according to the following steps: in the step 3, the specific method for the ECC data encryption module (3) to encrypt the screened sensitive SQL data by using elliptic curve cryptography is as follows:

randomly generating an elliptic curve E, selecting a point on an ellipse as a base point G, selecting a private key K, generating a public key K = kG, generating a random number r, and encoding a plaintext M to a point M on the elliptic curve E by using an elliptic curve plaintext embedding algorithm, namely calculating the coordinate of the point M on the elliptic curve;

expanding a random number r by a double-base-chain representation method, controlling the base chain number, namely the number of nonzero elements in the expansion, estimating the optimal base chain number by using a random number division method in an ECC data encryption module (3), calculating scalar multiplication of a random integer r and a public key K, scalar multiplication of the random integer r and a base point G, and calculating to obtain a corresponding ciphertext C by using the scalar multiplication of the random integer r and the public key K and the scalar multiplication of the random integer r and the base point G ₁ And ciphertext C ₂ 。

Images