Optimizing the Defense System of University English Teaching Platform from the Perspective of Network Security: Preventing Data Leakage and Network Attacks

Extensible Markup Language XML is a source markup language recommended by the W3C, which has three features: authors can define new tags and attributes; the document structure can achieve arbitrarily complex nesting; XML documents can contain their own format of the syntax description (DID). DTD (Document Type Definition) is used to define a specific format for a certain type of XML document, to standardize the content of such XML documents. DTD (Document Type Definition) is used to define a specific format for a certain type of XML document, to standardize the content of such XML documents, the framework structure, the use of DTD, XMIL document format structure can be varied.

Organization of teaching data in XML format is the core of the whole system. Course as the basic unit to save data, each course within the teaching data is divided into four categories: BBS class data (Q&A, discussion); auxiliary courseware class data; homework class data; recommended materials (handouts) class data. Each type of data is further divided into two parts: unstructured data is stored in a specified path; structured data is stored in an XML document. In the DTD document library, each type of instructional data XML document has a matching DID document to illustrate the structure of its content framework. the XML document also stores index information pointing to the same type of unstructured data, such as paths, file types, etc., so as to tightly integrate the structured and unstructured data.

Considering the real demand for the construction of the data sharing platform of the university English teaching system, and drawing on the sharing programs such as certificate sharing, elliptic curve algorithm sharing, and data hierarchical sharing, in the process of designing and constructing the sharing platform of the university English teaching system, according to the scale of data sharing, management and application difficulties of the university English teaching system, we propose to establish a “one-level ownership, two-level management” model in which the sharing platform will set up a scope of shared data sharing. The “one-level ownership, two-level management” model. The so-called “one level of ownership and two levels of management” model means that the ownership of shared data belongs to the data sharing platform manager, who defines the data sharing rights, but adopts a two-level management structure in the management mode, where the sharing platform manager authorizes professional managers who understand the semantics, security scope, and confidentiality scope of the shared data to actually manage the data. However, in the management method, a two-tier management structure is adopted, in which the sharing platform manager authorizes the professional manager who understands the semantics, security scope and confidentiality of the shared data to carry out actual management.

The “one-level ownership” in the “one-level ownership, two-level management model” means that after the shared data is uploaded to the sharing platform, the storage, management and ownership of the shared data belong to the administrator of the sharing platform, and the owner of the shared data no longer has the right to manage the data. The owner of the shared data no longer has management authority over the data. In view of the heterogeneity of shared data, in order to effectively manage heterogeneous shared data and extract the metadata information of shared data, the administrator achieves the control of shared data storage, sharing and authorization through the management of homogeneous metadata.

The specific implementation of “one level of all” is shown in Figure 2.

Figure 2.

The one-level of the model

Each subsystem uploads the shared data to the data sharing platform, and subsystems A, B, and C share the data (A1,A2)$$\left( {{A_1},{A_2}} \right)$$, B₁, and C₁, respectively. shared data A₁, A₂, B₁, and C₁ are centrally stored in the sharing platform, and the ownership is also attributed to the sharing platform, which extracts the metadata information a₁, a₂, b₁, and c₁ of A₁, A₂, B₁, and C₁, respectively, and the administrator M has the management privileges of the metadata information, and the administrator M The management of shared data is realized through the management of metadata.

The “second-level management” in the security management model means that the administrator of the sharing platform delegates the data management privileges to the second-level administrator who has a better understanding of the semantics and security scope of the data, and the second-level administrator actually authorizes the access to the data. The specific model is shown in Figure 3.

Figure 3.

The two-level management

In order to realize the specialized management of shared data, the administrator of the sharing platform M can establish a second-level administrator, who will formulate the sharing scheme and carry out the real management of the data. As shown in Fig. 3, the manager of the sharing platform entrusts the management authority of data a₁ and b₁ to the second-level manager M₁, and entrusts the management authority of data a₂ and c₁ to the second-level manager M₂. M₁ and M₂ respectively carry out the actual sharing authorization of data resources (a1,b1)$$\left( {{a_1},{b_1}} \right)$$ and (a2,c1) $$\left( {{a_2},{c_1}} \right)$$, and formulate a reasonable data sharing scheme.

Under the above shared platform secondary management mode, the secondary managers of the shared information platform manage the shared data, but their operations are audited for later checking and analysis; the administrators of the information sharing platform are similar to the “security administrators”, who mainly manage the permissions and operations of the secondary managers in a secure manner, and audit their behaviors to ensure that their data management and operations are in compliance with the security regulations. The administrator of the information sharing platform is similar to a “security administrator”, who mainly manages the authority and operation of the secondary management personnel in a secure manner, and audits their behavior to ensure that their data management and operation behaviors are legal and reasonable.

RSA public key cryptosystem is a special kind of encryption system with reversible modulo exponential operation. Its appearance not only solves the problem of key distribution, but also meets the needs of a variety of functions such as digital signature authentication, identification, and so on, and thus has a wide range of applications in modern confidential communications.

RSA algorithm is also recognised as a very secure public key cryptography algorithm, and in all public key cryptography algorithms is also the easiest to understand and implement, RSA algorithm’s security is based on the ‘large integer decomposition of the difficulty’, because for the processing power of modern computers, it is easy to solve for the product of two large prime numbers, and the product is decomposed into two prime factors is very easy. The RSA public key cryptography algorithm system usually consists of a key generation process, an encryption and decryption process, and a signature authentication process. The key is divided into two types, public and private, and is used in pairs. In the encryption and decryption process, the data is encrypted with the public key and decrypted with the private key, while in the signature authentication process, the private key is used for signing and the public key is used for authentication.

RSA key generation method is as follows: 1)

Choose any two large prime numbers p and q (confidential), and p ≠ q, and compute modulus n = p*q (which can be made public).

Through the above process, public key e, private key d and modulus n can be generated, usually (e, n) and (d, n) are called public key pair PK and private key pair SK respectively, where public key pair PK(e, n) is public and private key pair SK(d)$$SK\left( d \right)$$ and n are kept secret.

From the in-depth analysis of RSA encryption algorithm and AES encryption algorithm in this paper, we can know that RSA encryption algorithm as an asymmetric encryption algorithm has the advantage of high security, but due to its own algorithm needs to be modulo n resulting in all the data greater than n will produce a wrap-around, and its encryption efficiency is not high, so it is not suitable for encryption of large files. AES encryption algorithm as a symmetric encryption algorithm has a faster encryption speed and can encrypt large files, but due to its characteristics as a symmetric encryption algorithm security is not high, especially in the cloud environment, the system is distributed and deployed, which further increases the likelihood of the leakage of the secret key, and symmetric encryption algorithms encryption and decryption using the same key, so that the cost of the secret key management has increased greatly. In order to ensure the security of these files and the feasibility and efficiency of file encryption, this paper integrates the advantages of RSA encryption algorithm and AES encryption algorithm, and mixes the advantages of the two algorithms to complement each other to form a safe and effective encryption algorithm suitable for the needs of the encryption module of the system.

The basic idea of this algorithm is as follows, in order to be able to effectively encrypt large files, the uploaded files are encrypted using AES, in this paper the AES-128 algorithm with a secret key length of 128bit is used to encrypt the files, the files are encrypted and then uploaded to the cloud storage system, and in order to ensure that the encryption is secure. The AES algorithm secret key encrypts the public key generated by the RSA algorithm, and the encrypted AES secret key is saved by the user. When decrypting the downloaded file, use the RSA private key to decrypt the encrypted AES secret key to obtain the AES secret key, and then use the AES secret key to decrypt the ciphertext to obtain the final plaintext. The encryption and decryption process is shown in Figure 5.

Figure 5.

Encryption and decryption flow chart

In this section, this paper will analyze the operational efficiency of the hybrid RSA-AES encryption algorithm through simulation experiments. All the experiments are run on a desktop computer with 3.40GHz CPU and 8GB RAM running Ubuntu 12.04, and all the experimental codes are written in Python. In this paper, we use the Teaching Evaluation dataset from “English Learning Center of a School” as the training set of the hybrid RSA-AES encryption algorithm. This dataset contains 1728 records, each for 6 attributes (d=6) as well as 4 categories (λ=4). At the same time we fix the parameters in the experiment (l = 20). We adjust the number of training sets required for the hybrid RSA-AES encryption algorithm, i.e., the size of m, and measure the running time required for stage 1 as well as stage 2 in the platform defense system and the communication between the two cloud servers CS₁ and CS₂ for different key lengths K. The running time of stage 1 as well as stage 2 in the platform defense system is measured in Fig. 6 as well as Fig. 7. The distribution of the running time of stage 1 as well as stage 2 is shown in Fig. 6 as well as Fig. 7.

Figure 6.

The calculation time required for phase 1

Figure 7.

The calculation time required for phase 2

Figure 6 shows the running time of stage 1 for K=512 bits as well as for 1024 bits. When K = 512 bits, the number of samples m in the training set gradually increases from 400 to 1600, and the computation time spent in stage 1 changes from 1.76 seconds to 6.85 seconds accordingly. When K = 1024 bits, the number of samples m in the training set gradually increases from 400 to 1600, and the computation time spent in stage 1 changes from 11.81 seconds to 46.56 seconds accordingly. From Fig. 6, we can see that the running time of stage 1 grows linearly with the sample data m, indicating that the hybrid RSA-AES encryption algorithm is more efficient in processing data.

The running time of stage 2 in the platform defense system is shown in Fig. 7. When K=512 bits, the number of samples m in the training set is gradually increased from 400 to 1600, and the computation time spent in stage 2 is correspondingly changed from 5.33 minutes to 30.81 minutes. When K=1024 bits, the number of samples m in the training set gradually increases from 400 to 1600, and the computation time spent in stage 2 also changes from 16.31 minutes to 89.25 minutes accordingly. It can be seen that the computation time of stage 2 is much higher than that of stage 1, however, the whole algorithm including stage 1 and stage 2 is outsourced to the cloud server for computation, and the system does not bear any computational burden. In this way, the RSA-AES hybrid encryption algorithm scheme can greatly reduce the computational burden of the system.

Stage 1 in the algorithm, the amount of communication between CS₁ and CS₂ is shown in Fig. 8. When K = 512 bits, the number of samples m in the training set is gradually increased from 400 to 1600, and the amount of communication between CS₁ and CS₂ is correspondingly increased from 0.5 MB to 2.11 MB. When K = 512 bits, the number of samples m in the training set is gradually increased from 400 to 1600, and the amount of communication between CS₁ and CS₂ is correspondingly increased from 0.92 MB to 3.63 MB. From Fig. 8 we can see that the communication between CS₁ and CS₂ in stage 1 grows linearly with the sample data m, indicating that the hybrid RSA-AES encryption algorithm is able to handle a wide range of data better.

Figure 8.

Phase 1Traffic between CS₁ and CS₂

The amount of communication between CS₁ and CS₂ in phase 2 in the algorithm is shown in Fig. 9. When K = 512 bits, the number of samples m in the training set is gradually increased from 400 to 1600, and the amount of communication between CS₁ and CS₂ is correspondingly increased from 4.45 MB to 17.75 MB. When K = 1024 bits, the number of samples m in the training set is gradually increased from 400 to 1600, and the amount of communication between CS₁ and CS₂ is correspondingly increased from 8.06 MB to 32.09 MB.

Figure 9.

Phase 2 Traffic between CS₁ and CS₂

Figure 10 illustrates the statistics of RSA-AES key requests under a new form of persistent DoS attack. In order to verify the impact of this attack on the instructional platform defense system, simulation experiments are designed and conducted in this paper. In the experiment, a network environment with 100 users and 10 servers of the teaching platform defense system is simulated, in which 10-15 users are browsing the platform data within the coverage area of each teaching platform defense system server. Each user periodically sends RSA-AES key requests to the instructional platform defense system, while the instructional platform defense system provides necessary data information and service messages to the users. In the attack scenario, the attacker is unable to process legitimate RSA-AES key requests by continuously sending a large number of invalid RSA-AES keys to the target teaching platform defense system, which causes the teaching platform defense system to run out of resources. In our experiments, we counted the number of broadcast keys received by the teaching platform defense system in different time periods to evaluate the impact of DoS attacks. Comparison results show that the teaching platform defense system is able to successfully receive the vast majority of RSA-AES key requests from users when it is not under attack. However, with the initiation of the new DoS attack, the number of legitimate RSA-AES keys received by the Teaching Platform Defense System decreases significantly, and there is even a situation that the Teaching Platform Defense System fails to receive valid RSA-AES keys during the peak of the attack. This indicates that the attacker successfully blocked the normal communication of the teaching platform defense system by saturating its resources to achieve the effect of a DoS attack.

Figure 10.

Comparison of packet quantity before and after the attack

The Teaching Platform Defense System sends a request to verify the RSA-AES key to all users who have established communication after a DoS attack is detected. After receiving the request, the user decrypts the RSA-AES secret key by the RSA private key and transmits it back to the Teaching Platform Defense System. The Teaching Platform Defense System evaluates the decrypted value received against its own calculated value, and if it is accurate and consistent, it continues to communicate. If there is no agreement, the user will be identified as a fake user and communication will be shut down.

Figure 11 shows the change in the number of RSA-AES secret keys received by the teaching platform defense system after verifying the RSA-AES key method. In the experiment, we simulated a server containing 75 normal users who send 1 AES key per second for data exchange. At the same time, the attacker deploys 10 witch users (i.e., attacker users disguised as normal users), which also send 1 forged AES secret key per second in an attempt to interfere with the communication between the teaching platform defense system and the normal users. When the Teaching Platform Defense System activates the traffic restriction, the strategy of verifying the RSA-AES key method is used in order to defend against potential DoS attacks. At this time, the RSA-AES key verification messages of normal users interact frequently, resulting in an increase in the number of RSA-AES key requests received by the teaching platform defense system. However, at the end of the RSA-AES key verification process, the teaching platform defense system successfully identifies and blocks the forged RSA-AES key from the witch user, which ultimately keeps the number of received valid RSA-AES keys stable. This change suggests that the verified RSA-AES key approach plays a positive role in defending against DoS attacks, even though the implementation process leads to a short-term rise in the number of RSA-AES key requests.

Figure 11.

Comparison of the number of keys after re-verification

In this paper, we compare the RBS-IP-CHOCK model based on key management in the literature, the hybrid solution based on distributed and centralized in the literature with the hybrid RSA-AES encryption algorithm proposed in this paper, and analyze the performance of different defense strategies in terms of CPU and memory consumption. Figure 12 shows the performance data of the three defense strategies in terms of CPU usage and Figure 13 shows the performance data of the three defense strategies in terms of memory consumption. These data will provide an important basis for understanding the impact of DoS attacks on the performance of the encryption module of the teaching platform and the effectiveness of its mitigation strategies.

Figure 12.

Comparison of CPU usage

Figure 13.

Memory usage comparison chart

The results in Figs. 12 and 13 show that the proposed hybrid RSA-AES encryption algorithm has the least impact on the CPU and memory usage of the teaching platform defense system. The average CPU occupancy is less than 15%, and the average memory usage is 20 MB, which does not affect the normal functional operation of the teaching platform defense system. The paper also verifies the resource consumption of the teaching platform defense system in the case of different numbers of attacking users, and the experimental results are shown in Figure 13. The experimental results show that when the number of attacking users exceeds 25, the CPU and memory occupancy are less than 30%. Additionally, the average detection delay of the method is 20 ms and the average revalidation delay is 15 ms, which is suitable for DoS attack defense in the teaching platform defense system.