Data transmission method based on service characteristics

Abstract

The data transmission method based on the service characteristics comprises the following steps that: a partial node acquires data from a central node: the partial node sends a data acquisition request to the central node; the central node queries target data according to the data acquisition request, generates a first key according to a service extraction feature to which the target data belongs, and encrypts the target data with the first key to obtain a first data packet; the central node transmits the first data packet to the partial nodes in a fragmented manner; the sub-node receives all the fragments of the first data packet, then assembles the fragments into the first data packet, generates a second secret key according to the service extraction feature to which the target data belongs, and decrypts the first data packet by using the second secret key; and if the central node and the partial nodes have the same logic according to the business extraction features to which the target data belong, decryption is successful, and the partial nodes obtain the target data. According to the method, the problem that a traditional static key is easy to crack is avoided, the diversity and security of the key are greatly improved, and data encryption is more flexible and safer.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and in particular to a data transmission method based on service characteristics. Background Art

[0002] In today's era of rapid development of informatization, secure data transmission has become a key requirement for various business systems. Especially in some business data systems with multi-point distribution and strong confidentiality, data security issues are particularly prominent. In the existing technology, a single-point isolation and independent deployment operation method is usually adopted to ensure data security. However, with the continuous advancement of data security technology and the comprehensive promotion of informatization work, the single-point isolation and independent deployment method has gradually failed to meet actual needs, and the multi-point interconnection deployment method has gradually become the mainstream. However, in the process of connecting the network between multiple points and building a large local area network, the risk of data leakage is also increased.

[0003] At present, the protection of business data transmission mainly focuses on the protection during the data flow process, but there is no encryption protection method specifically for business modules. Existing technical solutions are often vulnerable to various attacks during the data transmission process, such as man-in-the-middle attacks, data interception, etc., which greatly increases the risk of data leakage and tampering. In addition, most of the data encryption methods in the prior art are static and cannot dynamically adjust the key according to changes in business characteristics, which greatly reduces the flexibility and security of data encryption. Summary of the invention

[0004] In order to address the deficiencies in the prior art, the present invention aims to provide an end-to-end data transmission protection method based on business characteristics, which greatly improves the security of data transmission through dynamic key generation and shard encryption, prevents data leakage and tampering, and ensures the safe and reliable transmission of business data in a complex network environment.

[0005] In order to achieve the above-mentioned invention object, the technical solution provided by the present invention includes:

[0006] The data transmission method based on business characteristics includes the steps of obtaining data from a central node by a sub-node:

[0007] The sub-node sends a data acquisition request to the central node; the central node queries the target data according to the data acquisition request, extracts features according to the business to which the target data belongs, generates a first key, and encrypts the target data with the first key to obtain a first data packet;

[0008] The central node transmits the first data packet fragments to the sub-nodes; the sub-nodes receive all the fragments of the first data packet and assemble them into a first data packet, extract features according to the business to which the target data belongs to generate a second key, and use the second key to decrypt the first data packet;

[0009] If the central node and the sub-node have the same logic for extracting features based on the business to which the target data belongs, decryption is successful and the sub-node obtains the target data.

[0010] The data transmission method based on service characteristics provided by the present invention further includes the step of uploading data from the sub-node to the central node:

[0011] The sub-node sends a data upload request to the central node; the central node queries and returns the feature extraction logic of the business module to which the uploaded data belongs according to the data upload request;

[0012] The sub-node compares the feature extraction logic stored in the sub-node with the feature extraction logic transmitted by the central node to see whether they are the same. If so, a third key is generated according to the feature extraction logic, and the uploaded data is encrypted with the third key to obtain a second data packet;

[0013] The sub-node transmits the second data packet fragments to the central node; the central node receives all the fragments of the second data packet and assembles them into a second data packet, and generates a fourth key based on the business extraction features to which the uploaded data belongs, and uses the fourth key to decrypt the second data packet to obtain the uploaded data.

[0014] Preferably, if the central node and the sub-node have different logics for extracting features according to the business to which the target data belongs, decryption fails, and the sub-node applies to the central node for query and obtains the feature extraction logic of the corresponding business module, and regenerates the second key according to the feature extraction logic.

[0015] Preferably, if the feature extraction logic stored in the sub-node itself is different from the feature extraction logic returned by the central node, the sub-node replaces the feature extraction logic stored in the sub-node itself with the feature extraction logic returned by the central node.

[0016] Preferably, an encrypted channel is configured between the sub-node and the central node, and data transmission between the two is sent and received in the encrypted channel after conventional encryption.

[0017] Preferably, the method by which the central node transmits the first data packet fragments to the sub-nodes includes:

[0018] The central node randomly divides the first data packet into a number of first fragments, and selects a corresponding fifth key for encryption according to the size of each of the first fragments; the fifth key corresponds to the size of the first fragment one by one.

[0019] Preferably, the method by which the sub-node transmits the second data packet fragments to the central node comprises:

[0020] The subnode randomly divides the second data packet into a plurality of second fragments, and selects a corresponding sixth key for encryption according to the size of each second fragment; the sixth key corresponds to the size of the second fragment in a one-to-one manner.

[0021] Preferably, the method in which the subnode receives all the fragments of the first data packet and assembles them into the first data packet comprises:

[0022] The subnode receives the first fragments of all the first data packets, selects the corresponding fifth key for decryption according to the size of each of the first fragments, and assembles all the decrypted first fragments into a first data packet.

[0023] Preferably, the method in which the central node receives all the fragments of the second data packet and assembles them into a second data packet comprises:

[0024] The central node receives the second fragments of all the second data packets, selects the corresponding sixth key for decryption according to the size of each of the second fragments, and assembles all the decrypted second fragments into a second data packet.

[0025] Preferably, the method for generating a key based on the business characteristics extracted from the data includes:

[0026] r=(base64(aX+bY+cZ)).substr(0,64);

[0027] Among them, r is the target key; X is the abbreviation of the business module, Y is the name of the communication initiator, Z is the business main table display column, a, b, c are weights; base64(aX+bY+cZ) is the base64 encoding of the string aX+bY+cZ, and substr(0,64) is the operation of intercepting the first 64 bits of data after base64 encoding.

[0028] Beneficial Effects

[0029] Dynamic key generation: This invention dynamically generates keys according to the characteristics of the business module, avoiding the problem that traditional static keys are easily cracked. By using the feature extraction logic of different business modules to generate keys, the diversity and security of the keys are greatly increased, making data encryption more flexible and secure.

[0030] Fragmented encryption transmission: This invention introduces a fragmented encryption mechanism, which randomly splits the data packet into multiple fragments and selects the corresponding key for encryption according to the size of the fragment. This fragmented encryption method can effectively prevent large data packets from being intercepted or tampered with during transmission. Even if a single fragment is cracked, it is difficult to restore the entire data packet, further improving the security of data transmission.

[0031] Encrypted channel transmission: By configuring an encrypted channel between the sub-node and the central node, the data in the transmission process is ensured to be sent and received in the encrypted channel after conventional encryption, providing double encryption protection. Even if the transmission channel is monitored, the data content is difficult to be directly read.

[0032] Flexibility of business feature extraction logic: The business feature extraction logic of the present invention is highly flexible and can customize feature extraction parameters according to different business requirements to generate keys suitable for each business module. This flexibility not only improves the adaptability of the system, but also allows the encryption strategy to be adjusted according to specific business requirements to ensure the data transmission security of each business module.

[0033] Enhanced security and reliability: By combining dynamic key generation, shard encryption and encrypted channel transmission, the present invention greatly improves the security and reliability of data transmission. Data is encrypted at every stage of transmission, effectively preventing data leakage and tampering, and ensuring the safe and reliable transmission of business data in a complex network environment.

[0034] Wide application: The end-to-end data transmission protection method and system provided by the present invention are applicable to various business systems with high data security requirements, including but not limited to finance, medical care, military and other fields, and can meet the data security transmission needs in a variety of scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A schematic diagram of a process of obtaining data from a central node by a sub-node in the data transmission method based on service characteristics provided by the present invention;

[0036] Figure 2 A schematic diagram of the process of uploading data from a sub-node to a central node in the data transmission method based on business characteristics provided by the present invention; DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention is further described below in conjunction with the accompanying drawings. In the description of the present invention, it should be understood that the terms "upper", "lower", "front", "back", "left", "right", "top", "bottom", "inside", "outside" and the like indicate directions or positional relationships based on the directions or positional relationships shown in the accompanying drawings, which are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention.

[0038] Example 1

[0039] The present invention is applied to a communication system deployed at multiple points, the system includes at least one central node and several sub-nodes, the sub-nodes are connected to each other through local area network signals, and each sub-node is respectively connected to the central node signal. Each node is configured with complete front-end and back-end and server hardware. When the communication system is constructed, several business modules are configured according to user needs and business architecture, and each business module is configured with an independent business feature extraction method to dynamically extract its feature data according to different contents of the business module.

[0040] As the first line of defense for data protection in the communication system, in some preferred embodiments, an encrypted channel is provided between the sub-node and the central node, and the data transmission between the two is sent and received in the encrypted channel after conventional encryption. Specifically, channel encryption equipment can be installed at the network entrance and exit of each point, and the encryption method can be the encryption method commonly used in the field, or other encryption methods that match the present invention. The export encryption and decryption steps in the data transmission process will not be described in detail later.

[0041] The data transmission of the present invention mainly involves two situations: one is that the sub-node obtains data from the central node, and the other is that the sub-node uploads data to the central node. This embodiment mainly explains the first situation in detail.

[0042] like Figure 1 As shown, this embodiment provides a data transmission method based on business characteristics, including: a step of a sub-node acquiring data from a central node:

[0043] S11, the sub-node sends a data acquisition request to the central node; the central node queries the target data according to the data acquisition request, and generates a first key according to the business extraction features to which the target data belongs, and encrypts the target data with the first key to obtain a first data packet.

[0044] The data acquisition request is used by the sub-node to obtain specific business data, which includes the specific content of the request, that is, the relevant information of the target data, specifically including but not limited to the following parameters: start time, end time, unit name, data version number, the business module, etc.

[0045] The business extraction feature to which the target data belongs refers to extracting specific business features based on the business module to which the target data belongs, such as inventory management, user information, order processing, etc. These features may include but are not limited to the name, function point, data structure, display column, etc. of the business module. For example, for the inventory management module, the abbreviation of the business module (such as "inventory"), the name of the communication initiating unit (such as "warehouse A"), the display column of the business main table (such as "product ID"), etc. can be extracted. Generate a first key based on the extracted business features. The business feature extraction method can extract its content data and convert it into a string based on the business type, business function point, technical implementation method, data presentation method, etc. as extraction parameters, and then perform a displacement transformation on the string, and then convert it into a data encryption key through a commonly used encryption algorithm (AES, 3DES, RSA, etc.). It should be understood that there are many methods for generating the first key, which are not further limited in this embodiment. Its main purpose is to enhance the security and flexibility of data encryption through dynamic feature extraction and key generation methods. The following are several common methods:

[0046] 1. Generate a key based on the business identifier, and use the business identifier (such as business ID, order ID, user ID, etc.) to perform hash processing to generate a key of fixed length.

[0047] 2. Generate a key based on business context features. By extracting multiple features in the business context, such as timestamp, business type, user role, etc., each feature is concatenated into a string and hashed to generate a key.

[0048] 3. Generate keys based on dynamic business data. Generate keys based on dynamically changing business data, such as transaction amounts, inventory quantities, etc., and generate keys by encrypting the business data obtained in real time using AES or other encryption methods.

[0049] S12, the central node transmits the first data packet fragments to the sub-nodes; the sub-nodes receive all the fragments of the first data packet and assemble them into a first data packet, and extract features according to the business to which the target data belongs to generate a second key, and use the second key to decrypt the first data packet.

[0050] When a subnode receives a fragment of the first data packet, it is necessary to determine whether the currently received fragment is the final fragment. If not, the received fragment can be stored in a temporary area, and after the final fragment is received, all the fragments of the first data packet are assembled into the first data packet.

[0051] The fragment transmission is a technology that divides a large data packet into multiple small fragments for transmission. There are many ways to implement it. Its main purpose is to improve transmission efficiency and data security. In particular, when the network is unstable or the security requirements are high, the fragment transmission can reduce the risk of data packet loss and interception. In some preferred embodiments, a preferred first data packet fragmentation method is given, that is, the method in which the central node transmits the first data packet fragments to the sub-node, specifically including: the central node randomly divides the first data packet into several first fragments, and selects the corresponding fifth key for encryption according to the size of each first fragment; the fifth key corresponds to the size of the first fragment. Correspondingly, the method in which the sub-node receives all the fragments of the first data packet and assembles them into the first data packet specifically includes: the sub-node receives all the first fragments of the first data packet, selects the corresponding fifth key for decryption according to the size of each first fragment, and assembles all the decrypted first fragments into the first data packet. It should be understood that the fifth key is built into the data storage device of the central node and the sub-node, and is configured with a mapping relationship table between the fifth key and the fragment size, as shown in Table 1 below.

[0052]

[0053] Table 1 is a mapping relationship table between keys and fragment sizes in a preferred embodiment.

[0054] S13. If the central node and the sub-node have the same logic for extracting features based on the business to which the target data belongs, decryption is successful, and the sub-node obtains the target data. At this time, if the central node and the sub-node have different logics for extracting features based on the business to which the target data belongs, decryption cannot be successfully performed. Since the key of the present invention is generated based on the business extraction feature logic, and the business extraction feature logic changes dynamically based on data requests, the business feature extraction logic determines the way the key is generated. Different business feature logics will generate different keys. Only when the logic is the same, the generated keys are consistent and decryption is successful.

[0055] When the decryption of the sub-node fails, it indicates that the business feature extraction logics at both ends are inconsistent. In order to correct this situation, a mechanism is needed to resynchronize the business feature extraction logic. In some preferred embodiments, the following synchronization method is proposed: the sub-node applies to the central node to query and obtain the feature extraction logic of the corresponding business module, and regenerates the second key according to the feature extraction logic. The sub-node applies to the central node to query the correct business feature extraction logic and update the local logic to ensure that subsequent decryption operations can be successful.

[0056] Example 2

[0057] This embodiment mainly describes in detail the situation where the sub-nodes upload data to the central node. Figure 2 As shown, this embodiment provides a data transmission method based on service characteristics, including:

[0058] S21, the sub-node sends a data upload request to the central node; the central node queries and returns the feature extraction logic of the business module to which the uploaded data belongs according to the data upload request. The data upload request refers to a request sent by the sub-node to the central node to upload specific business data, and the request involves a series of steps, including but not limited to the encryption, transmission, reception, decryption, verification and storage of the request.

[0059] S22, the sub-node compares the feature extraction logic stored in itself with the feature extraction logic returned by the central node to see if they are the same. If so, a third key is generated according to the feature extraction logic, and the uploaded data is encrypted using the third key to obtain a second data packet. In other preferred embodiments, if the feature extraction logic stored in the sub-node itself is different from the feature extraction logic returned by the central node, the sub-node replaces the feature extraction logic stored in itself with the feature extraction logic returned by the central node.

[0060] S23, the sub-node transmits the second data packet fragments to the central node; the central node receives all the fragments of the second data packet and assembles them into a second data packet, and generates a fourth key based on the business extraction features to which the uploaded data belongs, and uses the fourth key to decrypt the second data packet to obtain the uploaded data.

[0061] When the central node receives fragments of the second data packet, it is necessary to determine whether the currently received fragment is the final fragment. If not, the received fragment can be stored in a temporary area, and after the final fragment is received, all the fragments of the second data packet are assembled into a second data packet.

[0062] In some preferred embodiments, a method is provided for the sub-node to transmit the second data packet fragments to the central node, specifically comprising: the sub-node randomly splits the second data packet into a plurality of second fragments, and selects the corresponding sixth key for encryption according to the size of each second fragment; the sixth key corresponds to the size of the second fragment one by one. Correspondingly, the method for the central node to assemble the fragments of all the second data packets into a second data packet specifically comprises: the central node receives the second fragments of all the second data packets, selects the corresponding sixth key for decryption according to the size of each second fragment, and assembles all the decrypted second fragments into a second data packet. Similar to the situation in Example 1, the sixth key is built into the data storage device of the central node and the sub-node, and is configured with a mapping relationship table between the sixth key and the fragment size.

[0063] Example 3

[0064] This embodiment is developed on the basis of the above-mentioned embodiment 1 or 2. This embodiment provides a method for generating a key based on the business extraction feature of the data, which specifically includes:

[0065] r=(base64(aX+bY+cZ)).substr(0,64);

[0066] Among them, r is the target key; X is the abbreviation of the business module, Y is the name of the communication initiator, Z is the business main table display column, a, b, c are weights; base64(aX+bY+cZ) is the base64 encoding of the string aX+bY+cZ, and substr(0,64) is the operation of intercepting the first 64 bits of data after base64 encoding.

[0067] It should be understood that the weights a, b, and c represent the number of repetitions of the corresponding string, and are dynamically configured by those skilled in the art to generate a dynamic secret key; it should be understood that the central node and the sub-nodes should use a unified weight when generating the corresponding key to ensure that the same secret key is generated, thereby performing data encryption and decryption operations.

[0068] The key generation method of this embodiment is described below with reference to specific examples.

[0069] Take the warehouse management scenario as an example. At this time, the business module that the communication system needs to transmit data is the warehouse management module, whose abbreviation is X=INVENTORY. The communication initiator is warehouse A, whose name is Y=WAREHOUSE_A. The requested business main table display column is the item name, then Z=ITEM_ID. At this time, the assigned weights a=1, b=2, c=3. The feature string generated at this time is

[0070] "INVENTORYWAREHOUSE_AWAREHOUSE_AITEM_IDITEM_IDITEM_ID";

[0071] The characteristic string is encoded by Base64, and the result is as follows:

[0072] "SU5WRU5UT1JZV0FSRUhPVVNFX0FXQVJFSE9VU0VfQUlURU1fSURJVEVNX0lESVRFTV9JRA==";

[0073] Intercept the first 64 bits to get the target key:

[0074] "SU5WRU5UT1JZV0FSRUhPVVNFX0FXQVJFSE9VU0VfQUlURU1fSURJVEVNX0lESVRF".

[0075] The above shows and describes the basic principles, main features and advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A data transmission method based on business characteristics, characterized in that: Including the steps of sub-nodes obtaining data from the central node: The sub-node sends a data acquisition request to the central node; the central node queries the target data according to the data acquisition request, extracts features according to the business to which the target data belongs, generates a first key, and encrypts the target data with the first key to obtain a first data packet; The central node transmits the first data packet fragments to the sub-nodes; the sub-nodes receive all the fragments of the first data packet and assemble them into a first data packet, extract features according to the business to which the target data belongs to generate a second key, and use the second key to decrypt the first data packet; If the central node and the sub-node have the same logic for extracting features based on the business to which the target data belongs, decryption is successful and the sub-node obtains the target data.

2. A data transmission method based on business characteristics, characterized in that: Including the steps of uploading data from sub-nodes to the central node: The sub-node sends a data upload request to the central node; the central node queries and returns the feature extraction logic of the business module to which the uploaded data belongs according to the data upload request; The sub-node compares the feature extraction logic stored in the sub-node with the feature extraction logic transmitted by the central node to see whether they are the same. If so, a third key is generated according to the feature extraction logic, and the uploaded data is encrypted with the third key to obtain a second data packet; The sub-node transmits the second data packet fragments to the central node; the central node receives all the fragments of the second data packet and assembles them into a second data packet, and generates a fourth key based on the business extraction features to which the uploaded data belongs, and uses the fourth key to decrypt the second data packet to obtain the uploaded data.

3. The data transmission method based on service characteristics according to claim 1, characterized in that: If the central node and the sub-node have different logics for extracting features based on the business to which the target data belongs, decryption fails. The sub-node applies to the central node for query and obtains the feature extraction logic of the corresponding business module, and regenerates the second key based on the feature extraction logic.

4. The data transmission method based on service characteristics according to claim 2, characterized in that: If the feature extraction logic stored in the sub-node itself is different from the feature extraction logic returned by the central node, the sub-node replaces the feature extraction logic stored in the sub-node itself with the feature extraction logic returned by the central node.

5. The data transmission method based on service characteristics according to claim 1 or 2, characterized in that: An encrypted channel is assigned between the sub-node and the central node, and data transmission between the two is sent and received in the encrypted channel after conventional encryption.

6. The data transmission method based on service characteristics according to claim 1, characterized in that: The method by which the central node transmits the first data packet fragments to the sub-nodes includes: The central node randomly divides the first data packet into a number of first fragments, and selects a corresponding fifth key for encryption according to the size of each of the first fragments; the fifth key corresponds to the size of the first fragment one by one.

7. The data transmission method based on service characteristics according to claim 2, characterized in that: The method for the sub-node to transmit the second data packet fragments to the central node includes: The subnode randomly divides the second data packet into a plurality of second fragments, and selects a corresponding sixth key for encryption according to the size of each second fragment; the sixth key corresponds to the size of the second fragment in a one-to-one manner.

8. The data transmission method based on service characteristics according to claim 6, characterized in that: The method for assembling the fragments of all the first data packets received by the divided nodes into a first data packet includes: The subnode receives the first fragments of all the first data packets, selects the corresponding fifth key for decryption according to the size of each of the first fragments, and assembles all the decrypted first fragments into a first data packet.

9. The data transmission method based on service characteristics according to claim 7, characterized in that: The method in which the central node receives all the fragments of the second data packet and assembles them into a second data packet comprises: The central node receives the second fragments of all the second data packets, selects the corresponding sixth key for decryption according to the size of each of the second fragments, and assembles all the decrypted second fragments into a second data packet.

10. The data transmission method based on service characteristics according to claim 1 or 2, characterized in that: Methods for generating keys based on characteristics of the business to which the data belongs include: r=(base64(aX+bY+cZ)).substr(0,64); Among them, r is the target key; X is the abbreviation of the business module, Y is the name of the communication initiator, Z is the business main table display column, a, b, c are weights; base64(aX+bY+cZ) is the base64 encoding of the string aX+bY+cZ, and substr(0,64) is the operation of intercepting the first 64 bits of data after base64 encoding.

Images