Cross-domain file secure transmission method, system and device and storage medium

Abstract

The invention provides a cross-domain file secure transmission method, system and device and a storage medium wherein a server establishes an encryption tunnel between a sending end gateway and a receiving end gateway based on an IPSec protocol and deploys a firewall; the sending end gateway packages the original file to obtain an original compressed package, and encrypts the original compressed package by using a target encryption algorithm to obtain a target compressed package; transmitting the target compressed packet to a receiving end gateway by using an SFTP protocol in an encryption tunnel internal server; in the transmission process of the target compressed packet, the server performs real-time security policy control on the SFTP protocol data flow bearing the target compressed packet by using the firewall; after the control is passed, the receiving end gateway receives the target compressed packet; and the receiving end gateway decrypts the target compressed packet to obtain a decrypted compressed packet, and unpacks the decrypted compressed packet to obtain a decrypted file. By adopting the method, the security, integrity and availability of cross-domain file transmission are comprehensively guaranteed.

Description

Technical Field

[0001] This application relates to the field of data transmission, and more specifically, to a method, system, device, and storage medium for secure cross-domain file transmission. Background Technology

[0002] With the continuous development of society, cross-domain data interaction is becoming more and more frequent. This type of data often contains sensitive information such as personal privacy and trade secrets, which puts forward rigid requirements for the security and reliability of the transmission process. Cross-domain file transfer has become a key basic link supporting regional collaborative development.

[0003] In the current field of cross-domain file transfer, a single IPSec VPN solution is a common technical choice. This solution builds an encrypted tunnel on the public Internet through the IPSec protocol to achieve secure transmission of IP packets between two private networks, and uses the tunnel encryption feature to resist the risk of data eavesdropping and tampering at the network layer.

[0004] However, this existing technology has significant drawbacks: it can only achieve network layer encryption protection and lacks the ability to manage application layer "file" objects in a refined manner. When faced with scenarios such as large file transmission interruption, file integrity verification, and multi-format file adaptation, it cannot provide practical functions such as breakpoint resumption and file-level verification, resulting in low transmission efficiency and difficulty in ensuring data reliability, and it cannot meet the diverse file transmission needs in cross-domain scenarios. Summary of the Invention

[0005] In view of this, the purpose of this application is to provide a method, system, device and storage medium for secure cross-domain file transfer, which comprehensively ensures the security, integrity and availability of cross-domain file transfer.

[0006] In a first aspect, embodiments of this application provide a method for secure cross-domain file transfer, applied to a cross-domain file transfer system, the cross-domain file transfer system including a sending gateway, a receiving gateway, and a server, the method comprising: The server establishes an encrypted tunnel between the sending gateway and the receiving gateway based on the IPSec protocol, and deploys firewalls at both ends of the encrypted tunnel. The original file is packaged into an original compressed package through the sending gateway, and the original compressed package is encrypted using the target encryption algorithm to obtain the target compressed package; Inside the encrypted tunnel, the target compressed package is transmitted to the receiving gateway via the SFTP protocol through the server. During the transmission of the target compressed package, the server uses the firewall to perform real-time security policy control on the SFTP protocol data stream carrying the target compressed package; After the security policy control is approved, the target compressed package is received through the receiving gateway; The receiving gateway uses a target decryption algorithm to decrypt the target compressed package to obtain a decrypted compressed package, and then unpacks the decrypted compressed package to obtain a decrypted file.

[0007] Optionally, establishing an encrypted tunnel between the sending gateway and the receiving gateway based on the IPSec protocol includes: Based on the IKE protocol, the sending gateway and the receiving gateway are used to perform two-way identity authentication using national cryptographic algorithms; After the two-way authentication, the first phase of IKE negotiation is carried out using the national cryptographic algorithm key exchange protocol to generate shared key materials for establishing the IKE security alliance. An IKE security association is established based on the shared key material, and the IPSec security association parameters are determined through negotiation within the IKE security association. An IPSec encrypted tunnel is established between the sending gateway and the receiving gateway according to the IPSec security association parameters.

[0008] Optionally, before encrypting the original compressed package using the target encryption algorithm to obtain the target compressed package, the method further includes: The sending gateway selects one or more encryption algorithms from a pre-configured set of encryption algorithms as the target encryption algorithm based on the file attributes of the original compressed package; the file attributes include file size, file type, or security level identifier; or, The sending gateway randomly selects one or more encryption algorithms from the set of encryption algorithms as the target encryption algorithm; or... The sending gateway selects multiple encryption algorithms from the set of encryption algorithms based on the file attributes and random selection to obtain the target encryption algorithm.

[0009] Optionally, the step of using the firewall to perform real-time security policy control on the SFTP protocol data stream carrying the target compressed package includes: The firewall performs network layer access control on the SFTP protocol data stream, and filters the source address, destination address and port of the data packets based on a preset access control list to obtain the SFTP protocol sessions that are allowed to pass. The allowed SFTP protocol sessions are subjected to session state tracking and protocol command compliance analysis to verify that they conform to the predefined SFTP protocol specifications, thereby obtaining compliant SFTP protocol sessions and their data streams. Application-layer deep packet inspection is performed on the data stream carried by the compliant SFTP protocol session, and the transmission behavior is finally judged and controlled according to predefined content security rules.

[0010] Optionally, the step of decrypting the target compressed package using a target decryption algorithm to obtain a decrypted compressed package includes: The corresponding target decryption algorithm is determined based on the decryption algorithm identifier carried in the target compressed package or based on the encryption strategy pre-synchronized with the sending gateway. The target compressed package is decrypted using the target decryption algorithm and the corresponding key. Perform an integrity check on the decrypted data packet. If the check passes, the decrypted compressed packet is obtained.

[0011] Optionally, before encrypting the original compressed package using the target encryption algorithm to obtain the target compressed package, the method further includes: In response to a user instruction, the original compressed package is initially encrypted via the sending gateway using a password specified by the user.

[0012] Optionally, after decrypting the target compressed package using the target decryption algorithm through the receiving gateway to obtain a decrypted compressed package, the method further includes: The receiving gateway performs a second decryption of the decrypted compressed package based on the password provided by the user.

[0013] Secondly, embodiments of this application provide a cross-domain file secure transfer system, which includes a sending gateway, a receiving gateway, and a server: The server is used to establish an encrypted tunnel between the sending gateway and the receiving gateway based on the IPSec protocol, and to deploy firewalls at both ends of the encrypted tunnel. The sending gateway is used to package the original file into an original compressed package, and encrypt the original compressed package using a target encryption algorithm to obtain a target compressed package; The server is used to transmit the target compressed package to the receiving gateway using the SFTP protocol within the encrypted tunnel. The server is used to perform real-time security policy control on the SFTP protocol data stream carrying the target compressed package during the transmission of the target compressed package using the firewall. The receiving gateway is used to receive the target compressed package after the security policy control is passed; The receiving gateway is used to decrypt the target compressed package using the target decryption algorithm to obtain a decrypted compressed package, and to unpack the decrypted compressed package to obtain a decrypted file.

[0014] Optionally, establishing an encrypted tunnel between the sending gateway and the receiving gateway based on the IPSec protocol includes: Based on the IKE protocol, the sending gateway and the receiving gateway are used to perform two-way identity authentication using national cryptographic algorithms; After the two-way authentication, the first phase of IKE negotiation is carried out using the national cryptographic algorithm key exchange protocol to generate shared key materials for establishing the IKE security alliance. An IKE security association is established based on the shared key material, and the IPSec security association parameters are determined through negotiation within the IKE security association. An IPSec encrypted tunnel is established between the sending gateway and the receiving gateway according to the IPSec security association parameters.

[0015] Optionally, the sending gateway is configured to select one or more encryption algorithms from a pre-configured set of encryption algorithms as the target encryption algorithm before encrypting the original compressed package using the target encryption algorithm to obtain the target compressed package. The file attributes include file size, file type, or security level identifier. The sending gateway is configured to randomly select one or more encryption algorithms from the set of encryption algorithms as the target encryption algorithm; or... The sending gateway is used to select multiple encryption algorithms from the set of encryption algorithms based on the file attributes and random selection to obtain the target encryption algorithm.

[0016] Optionally, the step of using the firewall to perform real-time security policy control on the SFTP protocol data stream carrying the target compressed package includes: The firewall performs network layer access control on the SFTP protocol data stream, and filters the source address, destination address and port of the data packets based on a preset access control list to obtain the SFTP protocol sessions that are allowed to pass. The allowed SFTP protocol sessions are subjected to session state tracking and protocol command compliance analysis to verify that they conform to the predefined SFTP protocol specifications, thereby obtaining compliant SFTP protocol sessions and their data streams. Application-layer deep packet inspection is performed on the data stream carried by the compliant SFTP protocol session, and the transmission behavior is finally judged and controlled according to predefined content security rules.

[0017] Optionally, the step of decrypting the target compressed package using a target decryption algorithm to obtain a decrypted compressed package includes: The corresponding target decryption algorithm is determined based on the decryption algorithm identifier carried in the target compressed package or based on the encryption strategy pre-synchronized with the sending gateway. The target compressed package is decrypted using the target decryption algorithm and the corresponding key. Perform an integrity check on the decrypted data packet. If the check passes, the decrypted compressed packet is obtained.

[0018] Optionally, the sending gateway is configured to, in response to a user instruction, encrypt the original compressed package for the first time using a password specified by the user before encrypting the original compressed package using the target encryption algorithm to obtain the target compressed package.

[0019] Optionally, the receiving gateway is configured to, after decrypting the target compressed package using the target decryption algorithm through the receiving gateway to obtain a decrypted compressed package, perform a second decryption of the decrypted compressed package based on the password provided by the user.

[0020] Thirdly, embodiments of this application provide a computer device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the computer device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps of the cross-domain file secure transfer method described in any of the optional embodiments of the first aspect are performed.

[0021] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the cross-domain file secure transfer method described in any of the optional embodiments of the first aspect.

[0022] The technical solution provided in this application includes, but is not limited to, the following beneficial effects: By establishing an encrypted tunnel between the sending and receiving gateways based on the IPSec protocol and deploying a firewall on the server, a dedicated secure channel can be built at the network layer for cross-domain transmission. The encryption features of the IPSec protocol can be used to isolate the risk of data eavesdropping in the public network environment. At the same time, the firewall forms the first line of security, effectively blocking unauthorized external access and laying a secure foundation for subsequent file transmission.

[0023] By packaging the original files into an original compressed package through the sending gateway and encrypting it using the target encryption algorithm, it can uniformly encapsulate original files of any format, simplify the operation process of multi-file transmission, and at the same time ensure the confidentiality of the files themselves through encryption processing, preventing the file content from being illegally stolen or tampered with before and after transmission.

[0024] By using the SFTP protocol to transfer target compressed packages through a server within an encrypted tunnel, the network layer security of the encrypted tunnel can be combined with the application layer encryption capabilities of the SFTP protocol to achieve dual protection for data transmission, ensuring that files are not intercepted or tampered with during transmission and guaranteeing the security of the transmission link.

[0025] During the transmission of the target compressed package, the server uses a firewall to implement real-time security policy control over the SFTP protocol data stream. This dynamically filters data streams that do not comply with security rules, promptly blocks abnormal transmission behavior, avoids illegal data injection or malicious attacks, and further strengthens the security of the transmission process.

[0026] After the security policy control is approved, the target compressed package is received through the receiving end gateway. This ensures that the receiving end only obtains legitimate data that has been verified by security, avoiding the receipt of tampered, illegally injected, or non-compliant files, and guaranteeing the purity and legitimacy of the received data.

[0027] The receiving gateway uses the target decryption algorithm to decrypt and unpack the original file, which can accurately restore the original file from the sending end. This ensures the integrity and availability of data after the entire transmission process, allowing the receiving end to use the transmitted file normally and guaranteeing the final effect of cross-domain file transmission.

[0028] In summary, the above steps are progressive and complementary, forming a complete cross-domain file security transmission link from network layer channel security, file encryption, transmission link protection, real-time data flow control, received data verification to final data restoration. This comprehensively ensures the security, integrity, and availability of cross-domain file transmission and effectively meets the file transmission needs in cross-domain scenarios.

[0029] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0030] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 A flowchart of a cross-domain file secure transfer method provided in Embodiment 1 of this application is shown; Figure 2 A schematic diagram of a cross-domain network architecture provided in Embodiment 1 of this application is shown; Figure 3The flowchart of a complete cross-domain file secure transfer method provided in Embodiment 1 of this application is shown; Figure 4 A flowchart of an encrypted tunnel establishment method provided in Embodiment 1 of this application is shown; Figure 5 A flowchart of a security policy control execution method provided in Embodiment 1 of this application is shown; Figure 6 A flowchart of a compressed file decryption method provided in Embodiment 1 of this application is shown; Figure 7 This paper shows a schematic diagram of the structure of a cross-domain file secure transfer system provided in Embodiment 2 of this application; Figure 8 A schematic diagram of the structure of a computer device provided in Embodiment 3 of this application is shown. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0033] Example 1 To facilitate understanding of this application, the following is combined with... Figure 1 The flowchart illustrating a cross-domain file secure transfer method provided in Embodiment 1 of this application will be described in detail for Embodiment 1 of this application.

[0034] See Figure 1 As shown, Figure 1 The flowchart illustrates a cross-domain file secure transfer method provided in Embodiment 1 of this application, which is applied to a cross-domain file transfer system. The cross-domain file transfer system includes a sending gateway, a receiving gateway, and a server. The method includes steps S101 to S106: S101: The server establishes an encrypted tunnel between the sending gateway and the receiving gateway based on the IPSec (Internet Protocol Security) protocol, and deploys firewalls at both ends of the encrypted tunnel.

[0035] Specifically, the sending gateway and the receiving gateway are deployed in two different security domains located in different geographical locations. The corresponding cross-domain network architecture can be found in [reference needed]. Figure 2 As shown, Figure 2 This diagram illustrates a cross-domain network architecture provided in Embodiment 1 of this application. The diagram fully presents the core architecture of the cross-domain deployment, clearly defining two independent security domains: a "first regional network" and a "second regional network." A "sending gateway (firewall + IPsec)" is deployed on the sending side, and a "receiving gateway (firewall + IPsec)" is deployed on the receiving side. The two gateways establish a dedicated connection via an "IPSec VPN tunnel." Data transmission uses the "transmission protocol: SFTP over IPSec," clearly demonstrating the three-layer architecture design of "firewall + IPSec + SFTP." The encrypted tunnel is a persistent dedicated IPSec VPN (Virtual Private Network) tunnel, conforming to the security standard framework defined by the IETF (Internet Engineering Task Force), providing a secure communication channel between two private networks over the public internet. The tunnel uses the IKE protocol for key negotiation and security association establishment, supporting an automatic reconnection mechanism. When network jitter causes tunnel interruption, the connection can be quickly rebuilt within 500ms, ensuring transmission continuity.

[0036] Independent hardware and software firewalls are deployed at both ends of the tunnel, adopting a hybrid architecture of "hardware acceleration + software rules". At the hardware level, it supports hardware acceleration modules for national cryptographic algorithms. At the software level, it limits access IPs (supports IP whitelist configuration accurate to 32-bit subnet mask) and opens specific ports (such as only opening port 43, and must comply with the HTTPS (Hypertext Transfer Protocol Secure) protocol).

[0037] The firewall also supports real-time traffic monitoring, which can set threshold limits on bandwidth usage, packet size, and transmission frequency for a single connection. For example, the maximum number of connection requests per second for a single IP can not exceed 10, and the maximum bandwidth for a single session can be limited to 100Mbps. If the threshold is exceeded, rate limiting or blocking will be automatically triggered, solving the problem of insufficient protection by a single solution in existing technologies.

[0038] S102: The original file is packaged into an original compressed package through the sending gateway, and the original compressed package is encrypted using the target encryption algorithm to obtain the target compressed package.

[0039] Specifically, the original files can cover single or multiple sensitive files in any format from fields such as medical care, finance, logistics, and government affairs. The generated original compressed package is in .tar format, which supports batch file merging and packaging. During the packaging process, the file checksum (using the CRC32 algorithm) is automatically calculated for integrity verification during subsequent unpacking.

[0040] It also supports on-demand encryption. Users can first set a password to encrypt the original compressed file for the first time. The password must meet the complexity requirement of "more than 8 characters + uppercase and lowercase letters + numbers + special symbols". Users can also choose not to encrypt it.

[0041] The target encryption algorithm specifically refers to the national cryptographic algorithm, which can be a digital envelope algorithm combining SM2 and SM4: the SM4 symmetric key is encrypted using the SM2 asymmetric algorithm, and then the original compressed package is encrypted using the SM4 symmetric algorithm (128-bit key length, GCM encryption mode). During the encryption process, a 16-byte random salt value and timestamp are automatically added to prevent the same ciphertext from being generated after encrypting the same file, effectively resisting dictionary attacks and replay attacks.

[0042] S103: Inside the encrypted tunnel, the target compressed package is transmitted to the receiving gateway via the server using the SFTP (Secure File Transfer Protocol).

[0043] Specifically, the encrypted tunnel is a pre-established IPSec VPN tunnel, and the SFTP protocol is based on the security mechanism of SSH (Secure Shell) version 2.0, using the SSH-256 encryption algorithm for session encryption. The combination of these two provides dual security protection through "IPSec tunnel encryption + SFTP protocol encryption," offering comprehensive protection from the network layer to the application layer. The SFTP protocol supports file attribute preservation (including creation time, modification time, and permission settings), and uses binary mode for transmission to avoid file corruption caused by text format conversion.

[0044] This transmission method supports breakpoint resumption and multi-threaded transmission. Breakpoint resumption is achieved through "file offset recording combined with checksum comparison": when transmission is interrupted, the sending end records the file offset of the transmitted data and the SM3 hash value of the transmitted data. After the connection is restored, the receiving end first sends the offset and hash value of the received data to the sending end. The sending end verifies that they match and then continues transmission from that offset, avoiding duplicate transmissions. Multi-threaded transmission supports dynamic allocation of the number of threads based on the file size: single-threaded transmission is used for files ≤100MB, 4-threaded transmission is used for files 100MB~1GB, and 8-threaded transmission is used for files >1GB. Each thread independently performs data encryption and transmission, and mutual exclusion locks are used between threads to avoid data conflicts. This mechanism solves the problems of needing to restart after transmission interruption and low efficiency in large-scale file processing in existing technologies.

[0045] S104: During the transmission of the target compressed package, the server uses the firewall to perform real-time security policy control on the SFTP protocol data stream carrying the target compressed package; Specifically, the firewall's real-time security policy control is designed around building a defense-in-depth system, employing a "three-layer detection combined with dynamic protection" mechanism: The first layer is network layer access control, which filters the source address, destination address and port of data packets based on a pre-defined access control list. It only allows communication between the sender and receiver gateways via designated IP addresses, and only opens compliant ports, directly blocking unauthorized IP access and access to non-compliant ports.

[0046] The second layer is the protocol layer inspection, which verifies the command format and data packet structure of the SFTP protocol and rejects non-compliant commands that do not conform to the RFC 4253 standard (such as illegal file deletion and directory traversal commands).

[0047] The third layer is application-layer deep inspection, which performs keyword matching and malicious code scanning on the data stream content. In addition to the above protection, it can also effectively block DDoS (Distributed Denial of Service) attacks (supports abnormal traffic identification based on source IP reputation database and packet characteristics, and can resist common DDoS attacks such as SYN Flood and UDP Flood; the protection threshold can be dynamically adjusted), port scanning (when the same IP is detected scanning multiple ports within a short period of time, the IP is automatically added to the blacklist, and the blacklist validity period can be configured from 1 to 24 hours), connection hijacking, and other security threats that are prone to occur in existing technologies.

[0048] By strictly controlling the data flow, this solution mitigates the risks associated with public cloud transmission (data is transmitted directly between the two gateways without passing through any third-party servers), the risks of eavesdropping and tampering with plaintext protocols such as FTP (File Transfer Protocol) and HTTP (Hypertext Transfer Protocol) (FTP uses plaintext transmission, and HTTP is unencrypted, both of which pose a risk of data interception and tampering, while the dual encryption mechanism of this solution can completely avoid this problem), and the shortcomings of a single security technology solution.

[0049] S105: After the security policy control is passed, the target compressed package is received through the receiving terminal gateway.

[0050] Specifically, the receiving gateway, as the core node for cross-domain reception, adopts a "verify before receiving" mechanism. First, it verifies the integrity of the IPSec tunnel encapsulation of the data packet (verifies the authentication field of the AH header or ESP header), then verifies the session legitimacy of the SFTP protocol, and finally verifies the integrity of the data packet (message authentication code based on the HMAC-SHA256 algorithm). It only receives target compressed packets that have been encrypted through the IPSec tunnel, transmitted via the SFTP protocol, and passed the firewall security verification, ensuring the legitimacy and security of the received data.

[0051] The receiving gateway supports load balancing. When there are multiple receiving nodes, it can dynamically allocate receiving tasks based on indicators such as CPU utilization, memory usage, and network bandwidth to avoid overloading a single node.

[0052] This receiving mechanism meets the stringent data requirements of government, finance, and other industries. During the data receiving process, detailed audit logs are generated, including information such as receiving time, sender IP, file name, file size, checksum, and receiving status. The logs are retained for no less than 180 days and support traceability, thus preventing data leakage or tampering at the transmission terminal.

[0053] S106: The target compressed package is decrypted by the receiving gateway using the target decryption algorithm to obtain a decrypted compressed package, and the decrypted compressed package is unpacked to obtain a decrypted file.

[0054] Specifically, the target decryption algorithm corresponds one-to-one with the national cryptographic algorithm used by the sending end, employing a process of "SM2 decryption key combined with SM4 decryption data": The receiving end first uses its locally stored SM2 private key to decrypt the received SM2 encrypted data, obtaining the SM4 symmetric key. Then, it uses this SM4 key to decrypt the target compressed packet. During decryption, the validity of the timestamp and salt value is automatically verified. If the difference between the timestamp and the current time exceeds 24 hours (configurable), decryption is rejected to prevent expired ciphertext attacks. To ensure the decryption process is compliant and effective, an integrity check must be performed on the data packet after decryption, using the same SM3 hash algorithm as during encryption. Only after verifying that the data has not been tampered with or corrupted can the decrypted compressed packet be obtained.

[0055] The complete processing and transmission flow of a file from the sender to the receiver can be found in [reference]. Figure 3 As shown, Figure 3 The diagram illustrates a flowchart of a complete cross-domain file secure transmission method provided in Embodiment 1 of this application. The flowchart presents the entire chain logic of cross-domain file transmission in a streamlined manner: starting with the "original file" at the "sender," a branch determines whether the user needs file encryption. If yes, it is "packaged into a password-protected zip file"; otherwise, it is directly "packaged into a zip file." Subsequently, a unified encryption step of "packaging into an AR file according to the national cryptographic algorithm" is performed, followed by transmission via "SFTP protocol" to the "IPSECVPN channel." At the receiving end, after "receiving via SFTP protocol," the "AR file is decompressed according to the national cryptographic algorithm" to generate a corresponding "zip file." A branch determines whether a user password is required; if yes, it is "decompressed according to the password provided by the user," ultimately restoring the "original file" and delivering it to the "receiver." The "AR file" is a proprietary encapsulation format encrypted using the national cryptographic algorithm, containing a file header (storing encryption algorithm identifier, timestamp, salt value, etc.) and an encrypted data body, fully reflecting the core design of "packaging + national cryptographic encryption."

[0056] After unpacking the decrypted compressed file, if the original compressed file was initially encrypted with a user-specified password, the corresponding password must be entered to restore the original file. Password acquisition methods include user input and saving, receiving via SMS (the SMS verification code is valid for 15 minutes and supports repeated sending), or being randomly generated by the system and notified to the user via SMS. The unpacking process automatically verifies the CRC32 checksum; if the verification fails, a "file corrupted" message is displayed and logged, allowing the user to initiate a retransmission request.

[0057] The restored original files contain sensitive information in fields such as healthcare, finance, logistics, and government affairs. Data privacy and security are guaranteed throughout the process. The files are stored using encrypted storage methods. When the receiving gateway stores the files locally, it uses the SM4 algorithm to encrypt the files to prevent local storage leaks.

[0058] In an optional implementation, see Figure 4 As shown, Figure 4 The flowchart of an encrypted tunnel establishment method provided in Embodiment 1 of this application is shown, wherein the establishment of an encrypted tunnel between the sending gateway and the receiving gateway based on the IPSec protocol includes steps S201-S204: S401: Based on the IKE (Internet Key Exchange) protocol, the sending gateway and the receiving gateway are authenticated in two directions using national cryptographic algorithms.

[0059] Specifically, the two-way authentication employs a dual authentication mechanism combining digital certificates and pre-shared keys: both the sending and receiving gateways are pre-installed with nationally recognized CA certificates (using the SM2 algorithm for signature). During authentication, both parties exchange digital certificates to verify their validity (including certificate validity period, signature integrity, and the legitimacy of the issuing authority), and simultaneously verify the pre-shared key (which is dynamically updated through key negotiation, with an update cycle configurable from 1 to 7 days). Subsequent communication is only permitted after both verifications are successful. This two-way authentication mechanism rigorously verifies the true identities of the sending and receiving gateways, preventing unauthorized nodes from accessing the encrypted tunnel.

[0060] This authentication method solves the problems of insufficient identity verification and vulnerability to illegal intrusion in existing single security schemes. It builds a solid first line of defense for cross-domain transmission. Compared with traditional single certificate authentication, its security is significantly improved and can effectively resist risks such as certificate forgery and man-in-the-middle attacks.

[0061] S402: After the two-way authentication, the first phase of IKE negotiation is carried out using the national cryptographic algorithm key exchange protocol to generate shared key materials for establishing the IKE security alliance.

[0062] Specifically, the national cryptographic algorithm key exchange protocol adopts the SM2-based key exchange algorithm. The negotiation process is as follows: The sending gateway generates a temporary SM2 key pair and sends the public key to the receiving gateway; the receiving gateway generates a temporary SM2 key pair, uses the sending gateway's temporary public key and its own temporary private key to calculate the shared key material, and simultaneously sends its own temporary public key to the sending gateway; the sending gateway uses the receiving gateway's temporary public key and its own temporary private key to calculate the shared key material, and both parties obtain consistent shared key material.

[0063] This process ensures the confidentiality and integrity of the key transmission process, preventing the key from being leaked or tampered with during the negotiation process. After the generated shared key material is processed by KDF (Key Derivation Function), a session key (including encryption key, authentication key, and integrity verification key) for the IKE Security Alliance is generated, providing a reliable key foundation for the subsequent establishment of the IKE Security Alliance.

[0064] This process avoids compliance risks associated with internationally accepted algorithms, while also addressing the weakness in key management in existing technologies. Shared key materials are only valid during the current negotiation process, and temporary key pairs are automatically destroyed after the negotiation is completed, further enhancing key security.

[0065] S403: Establish an IKE security association based on the shared key material, and determine the IPSec security association parameters through negotiation of the IKE security association.

[0066] Specifically, the IKE Security Association provides an encrypted environment for negotiating IPSec Security Association parameters. All negotiation messages are encrypted using the IKE session key, ensuring that parameters are not stolen or tampered with during the negotiation process. The negotiated IPSec Security Association parameters include core elements such as encryption algorithm (SM4-GCM mode by default), authentication algorithm (HMAC-SM3 by default), key lifespan (8 hours by default, configurable from 1 to 24 hours, with automatic renegotiation triggered before key expiration), encapsulation mode (tunnel mode), and anti-replay window size (64 packets by default), fully adapting to the security standard framework of the IPSec protocol.

[0067] This step provides a clear technical basis for the establishment of encrypted tunnels, ensuring that the security performance of the tunnels meets the requirements of cross-domain transmission. The IPSec Security Association supports parallel negotiation, and when there are multiple transmission links, multiple security associations can be established at the same time to achieve load sharing and redundancy backup.

[0068] S404: Establish an IPSec encrypted tunnel between the sending gateway and the receiving gateway according to the IPSec security association parameters.

[0069] Specifically, the encrypted tunnel built based on IPSec security association parameters uses tunnel mode to encapsulate IP packets. The original IP packets are used as the payload, with new IP headers and IPSec headers (ESP headers) added. At the network layer, the IP (Internet Protocol) packets are encrypted and encapsulated. During encapsulation, the packets are segmented (maximum segment size MTU set to 1400 bytes for public network transmission), enabling secure data transmission between two private networks. The tunnel supports path probing, periodically sending probe packets to check link quality. When a link packet loss rate exceeds 5%, it automatically switches to a backup link (if multiple links are configured), effectively solving network layer security issues in cross-domain data transmission.

[0070] This tunnel is a continuously maintained dedicated channel that supports hot standby redundancy. It deploys two gateway devices, one primary and one backup. When the primary device fails, the backup device can seamlessly take over the service, avoiding the defects of unstable transmission channels and vulnerability to attacks in existing technologies. It also supports the efficient transmission of large-scale, multi-format files.

[0071] In an optional implementation, before encrypting the original compressed package using the target encryption algorithm to obtain the target compressed package, the method further includes: The sending gateway selects one or more encryption algorithms from a pre-configured set of encryption algorithms as the target encryption algorithm based on the file attributes of the original compressed package. The file attributes include file size, file type, or security level identifier.

[0072] Specifically, the pre-configured encryption algorithm set is based on Chinese national cryptographic algorithms and includes three combination modes: SM4 (symmetric encryption), SM2+SM4 (digital envelope), and SM4+SM3 (encryption + integrity verification). It does not contain internationally common algorithms such as RSA and AES and fully meets compliance requirements.

[0073] File attributes can be adapted to different transmission needs. For example, large files (>10GB) can be encrypted using the SM4 algorithm alone. This algorithm has high encryption efficiency and low CPU usage, which can improve transmission efficiency. High-security government and financial documents (security level marked "Top Secret" or "Confidential") can choose the SM2+SM4+SM3 combination mode. First, the file is encrypted with SM4, then the file hash value is calculated with SM3, and finally the hash value is signed with SM2, achieving triple protection of "encryption + integrity verification + non-repudiation". Ordinary office documents (security level marked "Secret" or "Internal") can choose the SM4+SM3 combination mode, which balances security and efficiency. Any format of file can be securely encrypted using the corresponding algorithm.

[0074] This selection method addresses the lack of efficient processing mechanisms for large-scale, multi-format files in existing technologies, balancing security and convenience. The algorithm selection process is completed automatically by the system, eliminating the need for manual configuration by the user. It also supports users manually specifying algorithm combinations to meet the needs of special scenarios.

[0075] Alternatively, the sending gateway may randomly select one or more encryption algorithms from the set of encryption algorithms as the target encryption algorithm.

[0076] Specifically, the core of the encryption algorithm set is the national cryptographic algorithm that complies with regulations. The random selection method uses a pseudo-random number generator (a random number generator based on the SM3 algorithm, conforming to the GB / T 35276-2023 standard). The algorithm combination is randomly selected each time it is transmitted, which increases the concealment and randomness of the encryption and reduces the risk of being cracked.

[0077] For example, the first transmission uses the SM4 algorithm, the second transmission uses the SM2+SM4 combination, and the third transmission uses the SM4+SM3 combination. This makes it impossible for attackers to crack the key by analyzing the encryption mode, while avoiding the compliance risks of internationally used algorithms.

[0078] This method is suitable for scenarios that require encryption flexibility, and the selected algorithms can ensure high security for file transmission, meeting the transmission requirements of sensitive data such as medical and financial data. It supports users to configure the range of randomly selected algorithms, such as only allowing random selection from the two combinations of SM2+SM4 and SM4+SM3, to further refine the configuration.

[0079] Alternatively, the sending gateway may select multiple encryption algorithms from the set of encryption algorithms based on the file attributes and random selection to obtain the target encryption algorithm.

[0080] Specifically, the encryption algorithm set uses the national cryptographic algorithm as the sole core. This selection method considers both file characteristics (such as file size and security level indicators) and incorporates random combination logic, employing a strategy of "attribute filtering + random sampling". First, suitable algorithm combinations are selected based on file attributes (e.g., for small government documents with high security levels, the combination of SM2+SM4 and SM2+SM4+SM3 is selected after attribute filtering). Then, one of the selected combinations is randomly chosen as the target encryption algorithm to further enhance encryption strength.

[0081] For example, a 1GB government document with a high security level, after attribute filtering, yields two matching combinations. The system randomly selects the SM2+SM4+SM3 combination for encryption, which satisfies the high security requirements and increases the difficulty of cracking by random selection.

[0082] This method effectively compensates for the shortcomings of existing single encryption schemes in providing sufficient protection, achieving a dual improvement in security and flexibility. It supports secure cross-domain transmission of files of any format and can adjust attribute filtering rules and randomly select weights according to actual application scenarios to adapt to the security needs of different industries.

[0083] In an optional implementation, see Figure 5 As shown, Figure 5 The flowchart illustrates a security policy control execution method provided in Embodiment 1 of this application, wherein the step of using the firewall to perform real-time security policy control on the SFTP protocol data stream carrying the target compressed package includes steps S501-S503: S501: The firewall performs network layer access control on the SFTP protocol data stream, and filters the source address, destination address and port of the data packets based on the preset access control list to obtain the SFTP protocol sessions that are allowed to pass.

[0084] Specifically, the pre-configured access control list employs a dual mechanism of "whitelist + blacklist." The whitelist strictly restricts communication to only specified IPs of the sending and receiving gateways, supporting configuration of multiple IP ranges (e.g., 192.168.1.0 / 24, 10.0.0.0 / 8). Only compliant ports are opened (e.g., port 43, which must comply with the HTTPS protocol), while all unnecessary ports (e.g., ports 21 and 23) are disabled, directly blocking unauthorized IP access and access to non-compliant ports. The access control list supports dynamic updates; IP addresses can be added and deleted remotely via API. Updates take effect without requiring a firewall restart, adapting to flexible network topology changes.

[0085] This control method effectively avoids the risks of IP address exposure and port scanning caused by SFTP running directly on the public Internet, and solves the problem of weak transmission channel control capabilities in existing technologies. The firewall also supports access log auditing, recording information such as the source IP, access time, request port, and processing result of all access requests. The logs can be exported to CSV format for easy security analysis and compliance checks.

[0086] S502: Perform session state tracking and protocol instruction compliance analysis on the allowed SFTP protocol sessions to verify that they conform to the predefined SFTP protocol specifications and obtain compliant SFTP protocol sessions and their data streams.

[0087] Specifically, session state tracking employs "stateful inspection firewall" technology, maintaining a session state table to record the establishment, data transfer, and connection termination of SFTP sessions. It monitors session legitimacy in real time and automatically closes connections and releases resources for sessions with prolonged periods of no data transfer (timeout configurable from 30 to 300 seconds). Protocol command compliance analysis strictly adheres to standards such as RFC 4252 (User Authentication Protocol), RFC 4253 (SSH Transport Layer Protocol), and RFC 9132 (SFTP Protocol Extensions), validating the SFTP protocol's command codes, parameter formats, and data lengths. It rejects illegal commands (such as commands for file tampering, unauthorized downloads, directory traversal, etc.) and discards and logs data packets with incorrect formats.

[0088] This step addresses the security vulnerabilities of the traditional FTP protocol, which transmits data in plaintext and makes commands easily intercepted. The FTP protocol operates at the application layer of the OSI (Open Systems Interconnection) model and typically uses TCP (Transmission Control Protocol) as its transport protocol, with the default port 21. It transmits user credentials and data in plaintext, resulting in extremely low security. In contrast, SFTP optimizes security and reliability based on the SSH protocol. All commands and data are transmitted in encrypted form, and protocol command compliance analysis further ensures the security of the transmission process, effectively resisting protocol-level attacks (such as command injection and format spoofing).

[0089] S503: Perform application-layer deep packet inspection on the data stream carried by the compliant SFTP protocol session, and make a final judgment and control on the transmission behavior according to the predefined content security rules.

[0090] Specifically, the application layer deep packet inspection adopts a combination of "pattern matching + behavior analysis" to support keyword matching (configurable sensitive word library, such as "confidential", "top secret", "privacy data", etc.), file type identification (identifying malicious files, such as virus files and Trojan programs, through file header features), and data format verification (such as verifying the legality of XML and JSON formats).

[0091] The predefined content security rules combine cross-domain transmission compliance requirements with security standards in industries such as government and finance. For example, they prohibit the transmission of files containing sensitive personal information such as ID card numbers, mobile phone numbers, and bank card numbers (by matching sensitive information formats using regular expressions), prohibit the transmission of executable files with extensions such as .exe, .bat, and .dll, and prohibit the transmission of files larger than 100GB (configurable file size thresholds can be configured).

[0092] The detection mechanism supports custom rules, allowing users to add rules based on their business needs (such as adding keywords for specific business systems or whitelisting allowed file types). Rules support priority configuration (levels 1-10, with higher priority rules executed first). When multiple rules conflict, the higher-priority rule is executed. This detection mechanism prevents sensitive data leakage, mitigates the risk of data leakage via third-party servers in public cloud transmissions, ensures compliance and security of data transmission, and has a detection time of ≤1ms per data packet, without affecting transmission efficiency.

[0093] In an optional implementation, see Figure 6 As shown, Figure 6 The flowchart of a compressed file decryption method provided in Embodiment 1 of this application is shown, wherein the step of decrypting the target compressed file using a target decryption algorithm to obtain a decrypted compressed file includes steps S601 to S603: S601: Determine the corresponding target decryption algorithm based on the decryption algorithm identifier carried in the target compressed package or based on the encryption strategy pre-synchronized with the sending gateway.

[0094] Specifically, the header of the target compressed file contains a 1-byte decryption algorithm identifier field. Different identifiers correspond to different decryption algorithm combinations (e.g., 0x01 corresponds to the SM4 algorithm, 0x02 corresponds to the SM2+SM4 combination, 0x03 corresponds to the SM4+SM3 combination, and 0x04 corresponds to the SM2+SM4+SM3 combination). After parsing this identifier, the receiving gateway automatically loads the corresponding decryption algorithm module. If the file header does not carry an algorithm identifier (applicable to earlier version compatibility scenarios), the decryption algorithm is determined based on the encryption strategy pre-synchronized with the sending gateway (synchronized via configuration file or API interface, with synchronization data encrypted using SM2), ensuring that the receiving end can accurately match the decryption algorithm and avoid decryption failure.

[0095] The encryption policy synchronization supports both automatic and manual synchronization. The automatic synchronization period can be configured from 1 to 24 hours, and the identity of the sending end is verified during the synchronization process to prevent the encryption policy from being tampered with. Manual synchronization can be triggered by administrator operation and is suitable for scenarios requiring urgent updates to the encryption policy. This mechanism is adaptable to cross-domain communication scenarios across different security domains, ensuring the accuracy and compliance of the decryption process and meeting the requirements of commercial cryptography applications.

[0096] S602: Decrypt the received target compressed package using the target decryption algorithm and the corresponding key.

[0097] Specifically, the target decryption algorithm is the national cryptographic algorithm corresponding to the sending end. Key acquisition and management include two methods: First, the user enters and saves the password (password storage uses SM3 hashing and salting, not plaintext passwords), or receives it via SMS (SMS sending uses an encrypted channel to prevent interception); second, the system randomly generates a password (8 random characters, including uppercase and lowercase letters, numbers, and special symbols), which is then sent to the user via SMS for verification. Key transmission and storage employ strict security mechanisms. Transmission is encrypted via an IPSec tunnel, and storage uses a hardware security module (HSM) for encryption. The hardware security module conforms to the national cryptographic level 2 standard to prevent key leakage.

[0098] For SM2 private keys, a "sharded storage + multi-access control" management approach is adopted. The private key is divided into three shards, each stored on a different hardware device. Accessing the private key requires authorization from at least two shards, and dual authorization from both the administrator and the security auditor is required, further ensuring private key security. This approach avoids decryption risks caused by key leakage and addresses the weakness in key management in existing technologies. Keys support periodic rotation, with a configurable rotation period of 1 to 90 days. The rotation process is automatic and requires no manual intervention.

[0099] S603: Perform an integrity check on the decrypted data packet. If the check passes, the decrypted compressed packet is obtained.

[0100] Specifically, the integrity verification uses the national cryptographic SM3 hash algorithm. Before encryption, the sending end calculates the SM3 hash value of the original compressed packet and stores it in the header of the target compressed packet. After decryption, the receiving end recalculates the SM3 hash value of the data packet and compares it with the hash value stored in the header. If they match, it means that the data has not been tampered with or damaged, and the verification passes. If they do not match, it means that the data is abnormal, and the decrypted compressed packet is refused to be generated. A verification failure notification is sent to the sending end, supporting the user to initiate a retransmission.

[0101] The verification process supports segmented verification. For very large files (>10GB), the file is divided into multiple 100MB segments, and the SM3 hash value of each segment is calculated. Simultaneously, the total hash value of the entire file is calculated. During verification, the hash values ​​of each segment are checked first, followed by the total hash value. This ensures both accuracy and efficiency. This step overcomes the lack of file-level verification in existing technologies, ensuring the reliability of large-scale, multi-format file transmissions, preventing data loss due to transmission anomalies, and recording the verification results in the audit log for easy traceability.

[0102] In an optional implementation, before encrypting the original compressed package using the target encryption algorithm to obtain the target compressed package, the method further includes: In response to a user instruction, the original compressed package is initially encrypted via the sending gateway using a password specified by the user.

[0103] Specifically, the initial encryption is a user-defined password protection layer, using the PBKDF2 key derivation function to generate an encryption key (256 bits long) based on the user-input password. The encryption algorithm uses AES-256-GCM mode (this encryption is only an additional protection for user-defined purposes and does not affect the compliance of the national cryptographic algorithm). Users can choose whether to enable it according to their actual needs. It is suitable for file transmission scenarios containing highly sensitive information, such as medical, financial, and government affairs (e.g., transmitting patient medical records, financial transaction data, and confidential government documents).

[0104] User passwords support a strength check function, which checks password complexity in real time when the password is entered. If the password does not meet the requirement of "at least 8 characters + uppercase and lowercase letters + numbers + special symbols", the system prompts the user to change it. It also supports password history management, prohibiting the use of passwords used in the last 5 times. This encryption method adds extra security to files, forming a "double encryption" protection with subsequent national cryptographic algorithm encryption. Even if the national cryptographic encryption is cracked (in extreme cases), the original file can only be obtained by cracking the user's password, further enhancing file privacy and meeting users' personalized needs for file security.

[0105] In an optional implementation, after the target compressed package is decrypted using the target decryption algorithm by the receiving gateway to obtain a decrypted compressed package, the method further includes: The receiving gateway performs a second decryption of the decrypted compressed package based on the password provided by the user.

[0106] Specifically, the password required for secondary decryption must be exactly the same as the password specified by the sending user. Password verification uses a "three-failure lock" mechanism; if the wrong password is entered three times consecutively, decryption access to the file is locked. The lock time can be configured from 1 to 24 hours. After locking, an administrator must unlock the file before decryption can continue, preventing brute-force attacks. The original file can only be restored after successful password verification. The password acquisition method is the same as on the sending end (user saves it, receives it via SMS, or the system randomly generates a notification). Passwords received via SMS support one-click copying for user convenience.

[0107] The secondary decryption process generates detailed decryption logs, including decryption time, decryption user, password verification result, and decryption status. These logs are linked to transmission and reception logs, forming a complete audit chain. This step prevents the decrypted compressed package from being illegally obtained and leaking the original data, creating a complete security loop of "decryption-verification-secondary decryption." This strengthens the final protection of sensitive data, aligns with the stringent data security requirements of government, finance, and other industries, and supports integration with third-party auditing systems, synchronizing decryption logs to the auditing platform in real time to meet compliance auditing needs.

[0108] Example 2 See Figure 7 As shown, Figure 7 This illustration shows a schematic diagram of a cross-domain file secure transfer system provided in Embodiment 2 of this application, wherein the cross-domain file transfer system includes a sending gateway 701, a receiving gateway 702, and a server 703: The server is used to establish an encrypted tunnel between the sending gateway and the receiving gateway based on the IPSec protocol, and to deploy firewalls at both ends of the encrypted tunnel. The sending gateway is used to package the original file into an original compressed package, and encrypt the original compressed package using a target encryption algorithm to obtain a target compressed package; The server is used to transmit the target compressed package to the receiving gateway using the SFTP protocol within the encrypted tunnel. The server is used to perform real-time security policy control on the SFTP protocol data stream carrying the target compressed package during the transmission of the target compressed package using the firewall. The receiving gateway is used to receive the target compressed package after the security policy control is passed; The receiving gateway is used to decrypt the target compressed package using the target decryption algorithm to obtain a decrypted compressed package, and to unpack the decrypted compressed package to obtain a decrypted file.

[0109] In an optional implementation, establishing an encrypted tunnel between the sending gateway and the receiving gateway based on the IPSec protocol includes: Based on the IKE protocol, the sending gateway and the receiving gateway are used to perform two-way identity authentication using national cryptographic algorithms; After the two-way authentication, the first phase of IKE negotiation is carried out using the national cryptographic algorithm key exchange protocol to generate shared key materials for establishing the IKE security alliance. An IKE security association is established based on the shared key material, and the IPSec security association parameters are determined through negotiation within the IKE security association. An IPSec encrypted tunnel is established between the sending gateway and the receiving gateway according to the IPSec security association parameters.

[0110] In an optional implementation, the sending gateway is configured to select one or more encryption algorithms from a pre-configured set of encryption algorithms as the target encryption algorithm before encrypting the original compressed package using the target encryption algorithm to obtain the target compressed package. The file attributes include file size, file type, or security level identifier; or... The sending gateway is configured to randomly select one or more encryption algorithms from the set of encryption algorithms as the target encryption algorithm; or... The sending gateway is used to select multiple encryption algorithms from the set of encryption algorithms based on the file attributes and random selection to obtain the target encryption algorithm.

[0111] In an optional implementation, the step of using the firewall to perform real-time security policy control on the SFTP protocol data stream carrying the target compressed package includes: The firewall performs network layer access control on the SFTP protocol data stream, and filters the source address, destination address and port of the data packets based on a preset access control list to obtain the SFTP protocol sessions that are allowed to pass. The allowed SFTP protocol sessions are subjected to session state tracking and protocol command compliance analysis to verify that they conform to the predefined SFTP protocol specifications, thereby obtaining compliant SFTP protocol sessions and their data streams. Application-layer deep packet inspection is performed on the data stream carried by the compliant SFTP protocol session, and the transmission behavior is finally judged and controlled according to predefined content security rules.

[0112] In an optional implementation, the step of decrypting the target compressed package using a target decryption algorithm to obtain a decrypted compressed package includes: The corresponding target decryption algorithm is determined based on the decryption algorithm identifier carried in the target compressed package or based on the encryption strategy pre-synchronized with the sending gateway. The target compressed package is decrypted using the target decryption algorithm and the corresponding key. Perform an integrity check on the decrypted data packet. If the check passes, the decrypted compressed packet is obtained.

[0113] In an optional implementation, the sending gateway is configured to, in response to a user instruction, encrypt the original compressed package for the first time using a password specified by the user before encrypting the original compressed package using the target encryption algorithm to obtain the target compressed package.

[0114] In an optional implementation, the receiving gateway is configured to, after decrypting the target compressed package using the target decryption algorithm through the receiving gateway to obtain a decrypted compressed package, perform a second decryption of the decrypted compressed package based on the password provided by the user.

[0115] Example 3 Based on the same application concept, see [link / reference] Figure 8 As shown, Figure 8 This illustration shows a structural schematic diagram of a computer device provided in Embodiment 3 of this application, wherein, as shown... Figure 8 As shown, the computer device 800 provided in Embodiment 3 of this application includes: The computer device 800 includes a processor 801, a memory 802, and a bus 803. The memory 802 stores machine-readable instructions that can be executed by the processor 801. When the computer device 800 is running, the processor 801 communicates with the memory 802 through the bus 803. When the machine-readable instructions are executed by the processor 801, the steps of the cross-domain file secure transfer method shown in Embodiment 1 above are performed.

[0116] Example 4 Based on the same concept, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the cross-domain file secure transfer method described in any of the above embodiments.

[0117] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system and apparatus described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0118] The computer program product for secure cross-domain file transfer provided in this application includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the preceding method embodiments. For specific implementation details, please refer to the method embodiments, which will not be repeated here.

[0119] The cross-domain file secure transfer system provided in this application embodiment can be specific hardware on a device or software or firmware installed on the device. The system provided in this application embodiment has the same implementation principle and technical effects as the foregoing method embodiments. For the sake of brevity, any parts not mentioned in the system embodiment can be referred to the corresponding content in the foregoing method embodiments. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can all be referred to the corresponding processes in the above method embodiments, and will not be repeated here.

[0120] In the embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. The system embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some communication interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0121] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0122] In addition, the functional units in the embodiments provided in this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0123] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0124] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0125] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application. All should be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A method for secure transmission of files across domains, the method comprising: The application is applied to a cross-domain file transmission system, and the cross-domain file transmission system comprises a sending end gateway, a receiving end gateway and a server. An encryption tunnel is established between the sending end gateway and the receiving end gateway based on an IPSec protocol through the server, and a firewall is deployed at both ends of the encryption tunnel; An original file is packaged by the sending end gateway to obtain an original compressed package, and a target compressed package is obtained by encrypting the original compressed package using a target encryption algorithm; Inside the encryption tunnel, the target compressed package is transmitted to the receiving end gateway by the server using an SFTP protocol; During the transmission of the target compressed package, the server uses the firewall to perform real-time security policy control on an SFTP protocol data stream carrying the target compressed package; After the security policy control passes, the target compressed package is received by the receiving end gateway; The target compressed package is decrypted by the receiving end gateway using a target decryption algorithm to obtain a decrypted compressed package, and a decrypted file is obtained by unpacking the decrypted compressed package.

2. The method of claim 1, wherein, The encryption tunnel is established between the sending end gateway and the receiving end gateway based on an IPSec protocol, comprising: Based on an IKE protocol, a national secret algorithm is used to perform bidirectional identity authentication on the sending end gateway and the receiving end gateway; After the bidirectional identity authentication, an IKE first-stage negotiation is performed using a national secret algorithm key exchange protocol to generate shared key materials for establishing an IKE security alliance; Based on the shared key materials, an IKE security alliance is established, and IPSec security alliance parameters are determined through the IKE security alliance negotiation; According to the IPSec security alliance parameters, an IPSec encryption tunnel is established between the sending end gateway and the receiving end gateway.

3. The method of claim 1, wherein, Before the target compressed package is obtained by encrypting the original compressed package using a target encryption algorithm, the method further comprises: One or more encryption algorithms are selected as the target encryption algorithm from a pre-configured encryption algorithm set by the sending end gateway according to file attributes of the original compressed package, and the file attributes include file size, file type or security level identifier; or One or more encryption algorithms are randomly selected as the target encryption algorithm from the encryption algorithm set by the sending end gateway; or A plurality of encryption algorithm combinations are selected from the encryption algorithm set to obtain the target encryption algorithm by the sending end gateway according to the file attributes combined with random selection.

4. The method of claim 1, wherein, The firewall is used to perform real-time security policy control on the SFTP protocol data stream carrying the target compressed package, comprising: Network layer access control is performed on the SFTP protocol data stream by the firewall, and the source address, destination address and port of the data packet are filtered based on a pre-configured access control list to obtain an SFTP protocol session allowed to pass; Session state tracking and protocol instruction compliance analysis are performed on the SFTP protocol session allowed to pass, and it is verified that it conforms to a pre-defined SFTP protocol specification to obtain a compliant SFTP protocol session and a data stream carried thereby; The data stream carried by the compliant SFTP protocol session is subjected to application layer deep packet inspection, and a final decision and control on the transmission behavior is made according to predefined content security rules.

5. The method of claim 1, wherein, The target compressed package is decrypted by using a target decryption algorithm to obtain a decrypted compressed package, including: According to the decryption algorithm identifier carried in the target compressed package, or according to the encryption strategy pre-synchronized with the sending end gateway, the corresponding target decryption algorithm is determined; The target decryption algorithm and the corresponding key are used to decrypt the received target compressed package; The decrypted data packet is subjected to integrity check, and the decrypted compressed package is obtained after the check is passed.

6. The method of claim 1, wherein, Before the target compressed package is obtained by encrypting the original compressed package by using a target encryption algorithm, the method further includes: In response to a user instruction, the original compressed package is first encrypted by the sending end gateway using a user-specified password.

7. The method of claim 6, wherein, After the decrypted compressed package is obtained by decrypting the target compressed package by using a target decryption algorithm through the receiving end gateway, the method further includes: The decrypted compressed package is secondarily decrypted by the receiving end gateway according to the password provided by the user.

8. A cross-domain file secure transmission system, characterized by, The cross-domain file transmission system includes a sending end gateway, a receiving end gateway and a server; The server is configured to establish an encrypted tunnel between the sending end gateway and the receiving end gateway based on the IPSec protocol, and deploy a firewall at both ends of the encrypted tunnel; The sending end gateway is configured to package an original file to obtain an original compressed package, and encrypt the original compressed package by using a target encryption algorithm to obtain a target compressed package; The server is configured to transmit the target compressed package to the receiving end gateway using the SFTP protocol inside the encrypted tunnel; The server is configured to use the firewall to perform real-time security policy control on the SFTP protocol data stream carrying the target compressed package during the transmission of the target compressed package; The receiving end gateway is configured to receive the target compressed package after the security policy control passes; The receiving end gateway is configured to decrypt the target compressed package by using a target decryption algorithm to obtain a decrypted compressed package, and to unpack the decrypted compressed package to obtain a decrypted file.

9. A computer device, comprising: including: A processor, a memory and a bus, the memory stores machine readable instructions executable by the processor, when the computer device is running, the processor and the memory communicate through the bus, the machine readable instructions are executed by the processor to execute the steps of the cross-domain file security transmission method in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer program is stored on the computer readable storage medium, and the computer program is executed by the processor to execute the steps of the cross-domain file security transmission method in any one of claims 1 to 7.

Images