A data transmission method, device, equipment, system and storage medium

Abstract

The present application provides a data transmission method, in which a source end obtains data to be transmitted, and divides the data to be transmitted into a plurality of segmented data, and determines the sending order of each segmented data, so that verification information of each segmented data can be generated according to the segmented data and the sending order of each segmented data, and then the plurality of segmented data and the corresponding verification information are sent to a destination end. In this way, the destination end can verify the received segmented data based on the receiving order and verification information of each segmented data, so as to determine whether there is a transmission anomaly in the transmission process of the segmented data. In this way, when it is verified that there is a transmission anomaly in the segmented data, the destination end can determine that there is a transmission anomaly in the data to be transmitted, without having to wait until the entire data to be transmitted is transmitted before determining it, thereby effectively improving the verification efficiency of the data to be transmitted. In addition, the present application also provides an apparatus, a device, a system and a storage medium for data transmission.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a data transmission method, device, equipment, system and storage medium. Background Art

[0002] In data communication scenarios, the data transmitted between the source and the destination during communication may be tampered with due to attacks during the transmission process. For this reason, the source and the destination usually use digital signatures or hash-based message authentication code (Hash-based Message Authentication Code, HMAC) technology to perform signature verification on the transmitted data to improve the reliability of the data communicated between the source and the destination.

[0003] However, the destination end needs to receive the complete data to be transmitted before it can verify whether the data to be transmitted it receives is consistent with the data to be transmitted sent by the source end based on the digital signature generated by the source end for the data to be transmitted. This makes the destination end's verification efficiency of the data to be transmitted low when the data to be transmitted is large. Summary of the invention

[0004] The present application provides a data transmission method for improving the verification efficiency of data to be transmitted. In addition, the present application also provides a data transmission device, equipment, system, computer-readable storage medium and computer program product.

[0005] In the first aspect, the present application provides a data transmission method, which is applied to a source end, and the source end can obtain data to be transmitted, such as data generated by one or more applications on the source end, and divide the data to be transmitted into multiple segmented data, and determine the sending order of each segmented data, so that verification information of each segmented data can be generated according to the segmented data and the sending order of each segmented data, and then the signature device can send the multiple segmented data and the verification information corresponding to the multiple segmented data to the destination end. In this way, the destination end can verify the received segmented data and the verification information based on the receiving order of each segmented data, so as to determine whether there is a transmission anomaly in the transmission process of each segmented data.

[0006] In this way, in the process of transmitting multiple segmented data of the data to be transmitted, when it is verified through the verification information that there is a transmission anomaly in the segmented data, the destination end can determine that the data to be transmitted has a transmission anomaly, without having to wait until the entire data to be transmitted is transmitted to determine it, thereby effectively improving the verification efficiency of the data to be transmitted. Moreover, since the verification information is generated according to the sending order of the segmented data, and the sending order does not need to be transmitted to the destination end (the destination end can generate verification information based on the receiving order corresponding to the sending order and verify the segmented data), therefore, the destination end can verify whether the multiple segmented data in the data to be transmitted have been tampered with, replaced, and reorganized during the transmission process according to the receiving order of the segmented data. In this way, while improving the efficiency of data verification, the security of data transmission is also further improved.

[0007] The source end is the sender of data during a session, and the destination end is the receiver of data during a session. The source end and the destination end may be implemented by hardware or software, and the source end and the destination end may be implemented by the same type of hardware or software, or by different types of hardware or software, which is not limited in this embodiment.

[0008] In a possible implementation, when the verification information is specifically HMAC, the process of the source end generating verification information for each segmented data may specifically be combining each segmented data and the sending order of each segmented data with a key, thereby performing an HMAC operation to obtain the verification information corresponding to each segmented data.

[0009] In one example, for each segmented data, the source end can concatenate the segmented data with the order in which the segmented data is sent, and perform a hash operation on the concatenated data to generate a corresponding summary. Then, the source end can use a pre-saved key to encrypt the generated summary, and use the encrypted ciphertext as the verification information corresponding to the segmented data. Correspondingly, when the destination end verifies the segmented data, it can concatenate the received segmented data with the order in which the segmented data is received, and perform the same hash operation on the concatenated data to generate a corresponding summary; at the same time, the destination end can decrypt the received verification information using a pre-saved key. Then, the destination end can determine whether there is a transmission anomaly in the transmission of the segmented data by comparing whether the generated summary is consistent with the decrypted summary.

[0010] In another example, for each segmented data, the source end can use the corresponding hash algorithm to perform a hash operation on the segmented data to generate a summary corresponding to the segmented data. Then, the source end can concatenate the characters of the pre-saved encryption key with the sending order of the segmented data, and encrypt the generated summary based on the new key obtained by concatenation, so that the obtained encrypted ciphertext can be used as the verification information corresponding to the segmented data. Correspondingly, when verifying the segmented data, the destination end can concatenate the characters of the receiving order of the segmented data with the pre-saved decryption key, and decrypt the received verification information based on the new key obtained by concatenation to obtain a summary; at the same time, the destination end can generate a summary based on the received segmented data, and determine whether there is a transmission anomaly in the transmission of the segmented data by comparing whether the generated summary is consistent with the decrypted summary.

[0011] In another example, for each segmented data, the source end can use a corresponding hash algorithm to hash the segmented data to generate a summary corresponding to the segmented data. Then, the source end can concatenate the generated summary with the sending order corresponding to the segmented data to obtain a new summary, and use a pre-saved key to encrypt the concatenated new summary, so that the obtained encrypted ciphertext can be used as the verification information corresponding to the segmented data. Correspondingly, when the destination end verifies the segmented data, it can use a pre-saved decryption key to decrypt the received verification information, and remove the sending order from the decrypted summary to obtain a new summary; at the same time, the destination end can perform a hash operation on the received segmented data to generate a corresponding summary. In this way, the destination end can compare whether the two summaries are consistent, so as to determine whether there is a transmission anomaly in the transmission process of the segmented data.

[0012] In a possible implementation, the source and the destination can transmit the data to be transmitted through a session. Then, before transmitting data to the destination, the source can first send the current session identifier to the destination. Then, when the source generates the verification information corresponding to each segmented data, it can generate the verification information for each segmented data based on each segmented data, the sending order of each segmented data, and the session identifier. In this way, when the destination verifies each segmented data, it can verify it in combination with the session identifier corresponding to the segmented data. Therefore, during the transmission of the segmented data, if there are segmented data with the same sending order in two different sessions that are interchanged, the destination can also verify that the currently received segmented data is not the segmented data sent by the source, thereby further improving the reliability of data communication.

[0013] In a possible implementation, the source end may send a session identifier to the destination end before sending the first segmented data and verification information of the first segmented data to the destination end, and may specifically send a request header carrying the session identifier to the destination end.

[0014] Furthermore, the request carrying the session identifier sent by the source end to the destination end may also include verification information corresponding to the request header, so that the destination end can use the verification information to verify the received request header to determine whether the content carried in the received request header has been tampered with during the transmission process.

[0015] In a possible implementation, when the source sends multiple segmented data and verification information corresponding to the multiple segmented data to the destination, the source may specifically send the last segmented data, the verification information of the last segmented data, and an end mark to the destination, wherein the end mark indicates that the transmission of the multiple segmented data is complete. In this way, the destination can determine through the end mark whether the multiple segmented data currently received are all the segmented data that the source wants to transmit to the destination, so that the destination can promptly identify whether the segmented data is truncated by the attacker during the transmission process.

[0016] In a possible implementation, before the source end obtains the data to be transmitted, it can start multiple transmission threads and divide the obtained resources to be transmitted to obtain multiple data to be transmitted. Then, the source end can send at least one segmented data of the data to be transmitted and the verification information corresponding to the segmented data to the destination end through each transmission thread. In this way, the source end can transmit the data to be transmitted to the destination end in parallel, thereby improving the transmission efficiency of the resources to be transmitted between the source end and the destination end.

[0017] In a possible implementation, before the source sends at least one segmented data of the data to be transmitted and the corresponding verification information to the destination through each transmission thread, the source may first send a request header carrying description data to the destination, so that the destination can determine that the received multiple data to be transmitted belong to the same resource to be transmitted based on the description data of the data to be transmitted, so that the destination can integrate the received multiple data to be transmitted. The description data may include at least one of the following: an identifier of the resource to be transmitted and a slice range of the data to be transmitted. The identifier of the resource to be transmitted may be, for example, the file name of the resource to be transmitted, and the slice range of the data to be transmitted may be, for example, a slice identifier and a slice size of the data.

[0018] In a possible implementation, the source end may also generate verification information corresponding to each segmented data based on time information and / or location information, thereby increasing the verification dimension for the segmented data and further improving the reliability of data verification.

[0019] In the second aspect, the embodiment of the present application also provides a data transmission method, which is applied to a destination end. The destination end can receive multiple segmented data from a source end and verification information corresponding to each segmented data, wherein the received multiple segmented data are obtained by the source end segmenting the data to be transmitted; then, the destination end can determine the receiving order of each segmented data, and verify whether each segmented data in the data to be transmitted is abnormally transmitted according to each segmented data, the receiving order of each segmented data, and the verification information of each segmented data.

[0020] In this way, in the process of transmitting multiple segmented data of the data to be transmitted, when it is verified through the verification information that there is a transmission anomaly in the segmented data, the destination end can determine that the data to be transmitted has a transmission anomaly, without having to wait until the entire data to be transmitted is transmitted to determine it, thereby effectively improving the verification efficiency of the data to be transmitted. Moreover, since the verification information is generated according to the sending order of the segmented data, and the sending order does not need to be transmitted to the destination end (the destination end can generate verification information based on the receiving order corresponding to the sending order and verify the segmented data), therefore, the destination end can verify whether the multiple segmented data in the data to be transmitted have been tampered with, replaced, and reorganized during the transmission process according to the receiving order of the segmented data. In this way, while improving the efficiency of data verification, the security of data transmission is also further improved.

[0021] In one possible implementation, the verification information is specifically HMAC. When the destination end verifies whether each segmented data in the data to be transmitted has a transmission abnormality, it can specifically determine whether each segmented data in the data to be transmitted has a transmission abnormality based on each segmented data, the order in which each segmented data is received, the key, and the received verification information.

[0022] For each segmented data, the order in which each segmented data is received, and the combination of the key, in one example, for each segmented data, the source end can concatenate the segmented data with the order in which the segmented data is sent, and perform a hash operation on the concatenated data to generate a corresponding summary. Then, the source end can use a pre-saved key to encrypt the generated summary, and use the encrypted ciphertext as the verification information corresponding to the segmented data. Correspondingly, when verifying the segmented data, the destination end can concatenate the received segmented data with the order in which the segmented data is received, and perform the same hash operation on the concatenated data to generate a corresponding summary; at the same time, the destination end can decrypt the received verification information using a pre-saved key. Then, the destination end can determine whether there is a transmission anomaly in the transmission of the segmented data by comparing whether the generated summary is consistent with the decrypted summary.

[0023] In another example, for each segmented data, the source end can use the corresponding hash algorithm to perform a hash operation on the segmented data to generate a summary corresponding to the segmented data. Then, the source end can concatenate the characters of the pre-saved encryption key with the sending order of the segmented data, and encrypt the generated summary based on the new key obtained by concatenation, so that the obtained encrypted ciphertext can be used as the verification information corresponding to the segmented data. Correspondingly, when verifying the segmented data, the destination end can concatenate the characters of the receiving order of the segmented data with the pre-saved decryption key, and decrypt the received verification information based on the new key obtained by concatenation to obtain a summary; at the same time, the destination end can generate a summary based on the received segmented data, and determine whether there is a transmission anomaly in the transmission of the segmented data by comparing whether the generated summary is consistent with the decrypted summary.

[0024] In another example, for each segmented data, the source end can use a corresponding hash algorithm to hash the segmented data to generate a summary corresponding to the segmented data. Then, the source end can concatenate the generated summary with the sending order corresponding to the segmented data to obtain a new summary, and use a pre-saved key to encrypt the concatenated new summary, so that the obtained encrypted ciphertext can be used as the verification information corresponding to the segmented data. Correspondingly, when the destination end verifies the segmented data, it can use a pre-saved decryption key to decrypt the received verification information, and remove the sending order from the decrypted summary to obtain a new summary; at the same time, the destination end can perform a hash operation on the received segmented data to generate a corresponding summary. In this way, the destination end can compare whether the two summaries are consistent, so as to determine whether there is a transmission anomaly in the transmission process of the segmented data.

[0025] In a possible implementation, the destination end can receive the data to be transmitted sent by the source end through a session, and the destination end can also receive the session identifier from the source end; when the destination end verifies whether there is a transmission anomaly in the segmented data, it can specifically verify whether each segmented data in the data to be transmitted has a transmission anomaly based on each segmented data, the receiving order of each segmented data, the verification information of each segmented data, and the identifier of the current session. In this way, even if segmented data with the same sending order in two different sessions are exchanged during the transmission of segmented data, the destination end can verify that the currently received segmented data is not the segmented data sent by the source end, thereby further improving the reliability of data communication.

[0026] In a possible implementation, the destination end may receive a request header from the source end, the request header carrying an identifier of the current session between the source end and the destination end, so that the destination end may parse the session identifier from the request header.

[0027] In a possible implementation, the destination end may receive verification information corresponding to the request header sent by the source end, and thereby determine whether the content carried in the request header has been tampered with during transmission based on the verification information corresponding to the request header.

[0028] In a possible implementation, the destination end may receive the last segmented data, the verification information of the last segmented data, and an end mark from the source end during the process of receiving the multiple segmented data and the verification information corresponding to each segmented data from the source end, wherein the end mark indicates that the transmission of the multiple segmented data is complete. In this way, the destination end can determine through the end mark whether the multiple segmented data currently received are all the segmented data that the source end wants to transmit to the destination end, so that the destination end can timely identify whether the segmented data is truncated by the attacker during the transmission process.

[0029] In a possible implementation, when the destination end receives multiple segmented data and verification information corresponding to each segmented data from the source end, it may specifically receive segmented data of at least one data to be transmitted sent by the source end through each transmission thread and corresponding verification information, wherein different transmission threads are used to transmit different data to be transmitted obtained by segmenting the resources to be transmitted, so that the source end transmits the data to be transmitted to the destination end in parallel, thereby improving the transmission efficiency of the resources to be transmitted between the source end and the destination end.

[0030] In a possible implementation, before receiving at least one segmented data of the data to be transmitted and the corresponding verification information sent by the source end through each transmission thread, the destination end can receive a request header carrying description information from the source end, wherein the identifier of the resource to be transmitted can be, for example, the file name of the resource to be transmitted, and the slice range of the data to be transmitted can be, for example, the slice identifier and slice size of the data.

[0031] In a possible implementation, the source end may also generate verification information corresponding to each segmented data based on time information and / or location information, thereby increasing the verification dimension for the segmented data and further improving the reliability of data verification.

[0032] In a third aspect, the present application provides a source end, which is used to implement various modules of the data transmission method executed by the source end in the first aspect or any possible implementation of the first aspect.

[0033] In a fourth aspect, the present application provides a destination end, which is a source end used to implement various modules of the data transmission method executed by the destination end in the second aspect or any possible implementation method of the second aspect.

[0034] In a fifth aspect, the present application provides a data transmission system, comprising a source end and a destination end, wherein the source end is used to execute the data transmission method in the above-mentioned first aspect or any possible implementation manner of the first aspect, and the destination end is used to execute the above-mentioned second aspect and the data transmission method in any possible implementation manner of the second aspect.

[0035] In a sixth aspect, the present application provides a computing device, comprising a processor and a memory; the processor is used to execute instructions stored in the memory to execute the data transmission method executed by the source end in the above-mentioned first aspect or any possible implementation scheme of the first aspect.

[0036] In the seventh aspect, the present application provides a computing device, which includes a processor and a memory; the processor is used to execute instructions stored in the memory to execute the data transmission method executed by the destination in the above-mentioned second aspect or any possible implementation scheme of the second aspect.

[0037] In an eighth aspect, the present application provides a computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is executed on a computer device, the computer device executes the method described in the first aspect or any one of the implementations of the first aspect.

[0038] In a ninth aspect, the present application provides a computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is executed on a computer device, the computer device executes the method described in the second aspect or any one of the implementations of the second aspect.

[0039] In a tenth aspect, the present application provides a computer program product comprising instructions, which, when executed on a computer device, enables the computer device to execute the method described in the first aspect or any one of the implementations of the first aspect.

[0040] In an eleventh aspect, the present application provides a computer program product comprising instructions, which, when executed on multiple computer devices, enables the computer devices to execute the method described in the second aspect or any one of the implementations of the second aspect.

[0041] Based on the implementations provided in the above aspects, the present application can also be further combined to provide more implementations. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0043] Figure 1 The following is a schematic diagram of an application scenario;

[0044] Figure 2 This is a schematic diagram of the architecture of a data transmission system in an embodiment of the present application;

[0045] Figure 3 A schematic diagram of dividing the data to be transmitted and generating verification information in an embodiment of the present application;

[0046] Figure 4 A schematic diagram of transmitting multiple data to be transmitted in parallel in an embodiment of the present application;

[0047] Figure 5 This is a schematic diagram of a request header transmitted from a source end 100 to a destination end 200 in an embodiment of the present application;

[0048] Figure 6 This is a schematic diagram of an exemplary request header in an embodiment of the present application;

[0049] Figure 7 Schematic diagram of the process of transmitting data between the source end 100 and the destination end 200 in the embodiment of the present application;

[0050] Figure 8 A schematic diagram of the hardware structure of a computer device in an embodiment of the present application;

[0051] Fig. 9 This is a schematic diagram of the hardware structure of another computer device in an embodiment of the present application. DETAILED DESCRIPTION

[0052] In actual applications, when data is transmitted between the source and the destination, it may be subject to a man-in-the-middle attack, resulting in the data (such as files, data streams, etc.) received by the destination being different from the data sent by the source. Figure 1 As shown, in the process of the source end sending a file to the destination end through the network (internet), the middleman (through the proxy server) mainly attacks the file by "tampering", that is, modifying the legitimate file segment content (that is, the file sent by the source end), such as modifying part of the content into other content, etc., so that the complete file finally received by the destination end is different from the original complete file sent by the source end, thereby affecting the reliability of communication between the source end and the destination end.

[0053] Based on this, before sending a file, the source end can sign the entire file based on a digital signature or HMAC, and send the signature and the entire file to the destination end. Then, the destination end verifies the signature to detect whether the received file has been tampered with during the transmission process, so as to improve the reliability of communication between the source end and the destination end.

[0054] Among them, a digital signature, also known as a public key digital signature, is a digital string that can only be generated by the sender of the information and cannot be forged by others. The digital string is also a valid proof of the authenticity of the information sent by the sender. A set of digital signatures usually defines two complementary operations, one for signing and the other for verification.

[0055] HMAC is a method of message authentication based on hash functions and keys. It requires both parties to share a key, agree on an algorithm, and perform a hash operation on the transmitted data to form an authentication code of a fixed size. Both parties verify the authentication code to determine the legitimacy of the transmitted data.

[0056] However, in the above-mentioned file verification method, the destination needs to receive the complete file before verifying whether the file has any transmission anomalies, and after determining that the file has transmission anomalies, notify the source to resend the entire file. Therefore, the part of the file that does not have transmission anomalies still needs to be retransmitted from the source to the destination, which makes the file verification and transmission efficiency low. In particular, when the file transmitted between the source and the server is large, the destination may not be able to receive a normal complete file for a long time. Attackers may also continue to send large error files based on this to consume the computing power of the destination.

[0057] Based on this, an embodiment of the present application provides a data transmission method for improving the verification efficiency of data such as files to be transmitted. In specific implementation, the source end can segment the data to be transmitted, the source end determines the sending order of multiple segmented data included in the data to be transmitted, and generates verification information corresponding to each segmented data based on the sending order. Then, the source end can send the verification information and the segmented data to the destination end. In this way, the destination end can verify each received segmented data according to the receiving order of the segmented data received by the destination end and the verification information corresponding to the segmented data, so as to determine whether the segmented data has a transmission anomaly during the transmission process, that is, to determine whether the data to be transmitted has a transmission anomaly during the transmission process.

[0058] In this way, during the data transmission process, the destination can promptly determine the segmented data with transmission anomalies, without having to wait for the entire data to be transmitted to be transmitted before verification, thereby improving the efficiency of data verification. In addition, since the verification information is generated according to the sending order of the segmented data, and the sending order does not need to be transmitted to the destination (the destination can generate verification information based on the receiving order corresponding to the sending order and verify the segmented data), the destination can verify whether multiple segmented data in the data to be transmitted have been tampered with, replaced, and reorganized during the transmission process based on the receiving order of the segmented data. In this way, while improving the efficiency of data verification, the security of data transmission is also further improved.

[0059] Furthermore, for the segmented data determined by the destination end to have transmission anomalies, the source end can only retransmit the segmented data to the destination end without retransmitting the entire data to be transmitted. Therefore, the segmented data in the data to be transmitted that does not have transmission anomalies does not need to be transmitted to the destination end, thereby improving data transmission efficiency.

[0060] The embodiments of the present application are described below in conjunction with the accompanying drawings.

[0061] The terms "first", "second", etc. in the specification and drawings of this application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances. This is just a way of distinguishing objects with the same attributes when describing the embodiments of this application.

[0062] See also Figure 2 The structural diagram of the data transmission system shown in the figure includes a source end 100 and a destination end 200, and the source end 100 and the destination end 200 communicate with each other through an intermediate network 300. The source end 100 refers to the sender of data during a session, and the destination end 200 refers to the receiver of data during the session. The source end 100 and the destination end 200 can be any device with communication capabilities, or software modules on the devices. Specifically, when the source end 100 and the destination end 200 are implemented based on hardware, the source end 100 can be a terminal that provides data, and the destination end 200 can be a server that receives data; or, the source end 100 can also be a server that provides data, and the destination end 200 can be a terminal that receives data. The source end 100 and the destination end 200 can be devices of the same type or different types. For example, both the source end 100 and the destination end 200 may be terminals, that is, the two terminals may send and receive data to each other through the intermediate network 300, or both the source end 100 and the destination end 200 may be servers, that is, data communication is performed between the two servers.

[0063] When the source end 100 and the destination end 200 are specifically software modules on a device, the source end 100 may be a client running on the device, and the destination end 200 may be a cloud service module provided by a cloud platform. Of course, the cloud service module may also send data to the client, that is, the source end 100 is a cloud service module, and the destination end 200 is a client, or the source end 100 and the destination end 200 are both clients or both are cloud service modules. As an example, the source end 100 may include a data production device 110 and a signature device 120. Among them, the data production device 110 is used to generate data to be transmitted that needs to be transmitted to the destination end 200. The signature device 120 is used to segment, sign, and other processes to be processed on the data to be transmitted.

[0064] The data production device 110 may include one or more applications, and the signature device 120 may be embedded in the application as a software development kit (SDK). Alternatively, the data production device 110 may include multiple applications, and the signature device 120 may be an independent application software in the source end 100, capable of processing the data to be transmitted generated by multiple applications at the same time.

[0065] The signature device 120 includes a segmentation module 121, a sorting module 122, a verification information generation module 123, and a transmission module 124. Before transmitting data, the source end 100 can segment the data to be transmitted by the segmentation module 121 to obtain a plurality of segmented data corresponding to the data to be transmitted. Figure 3 As shown, the segmentation module 121 can divide the data to be transmitted into (N+1) segmented data, which are segmented data 0 (segment 0) to segmented data N (segment N). Exemplarily, the segmentation module 121 can divide the data to be transmitted according to a preset size (size), and the sizes of the multiple segmented data obtained by the division are the same. Of course, the size of the last segmented data can be less than or equal to the preset size. The preset size can be preset by a technician in advance, or it can be set by the source end, such as 1M Byte (MB), 64K Byte (KB), etc. For example, for a piece of data to be transmitted with a size of 1024KB, assuming that the segmentation module 121 divides the data to be transmitted according to the preset size of 64KB, 16 segmented data can be obtained. The segmentation module 121 can also use other methods to segment the data to be transmitted, such as not using a fixed preset size for data segmentation, and the size of each segmented data can be different.

[0066] After the segmentation module 121 divides the data to be transmitted into multiple segmented data, the sorting module 122 can determine the order in which the multiple segmented data are sent to the destination end 200. Exemplarily, the sorting module 122 can use the arrangement order of each segmented data in the data to be transmitted as the order in which the segmented data is sent to the destination end 200. For example, the sorting module 122 sorts the first segmented data (the first 64KB) of the data to be transmitted as 1, and the first segmented data is sent to the destination end 200 first based on the sorting, and the second segmented data (the data from 64KB to 128KB) of the data to be transmitted is sorted as 2, and the second segmented data is sent to the destination end 200 second based on the sorting, and so on.

[0067] In other possible examples, the sorting module 122 may be to randomly sort the multiple segmented data, such as the source end 100 may determine the sending order of each segmented data based on a preset random algorithm. Then, usually, the order in which the source end 100 sends each segmented data is different from the arrangement order of each segmented data in the data to be transmitted. In this way, even if the source end 100 is attacked when transmitting each segmented data, it is difficult to determine the arrangement order of each segmented data in the data to be transmitted based on the sending order / transmission order of each segmented data, so it is difficult to reconstruct the data to be transmitted based on each segmented data, which further improves the transmission security of the data to be transmitted.

[0068] After the sorting module 122 determines the sending order for each segmented data, the signature device 120 can generate corresponding verification information for each segmented data through the verification information generation module 123, such as Figure 3 As shown, for the segmented data 0 to the segmented data N obtained by the segmentation module 121, the verification information generation module 123 can generate corresponding verification information 0 to verification information N based on each segmented data. In specific implementation, for any segmented data among the multiple segmented data (hereinafter referred to as the target segmented data), the verification information generation module 123 can combine the sending order of the target segmented data, the segmented data and the key to generate corresponding verification information for the target segmented data, and the verification information is used for the consistency verification of the subsequent target segmented data when it is transmitted to the destination end 200.

[0069] In practical applications, the verification information may be a digital signature corresponding to the target segmented data. Exemplarily, this embodiment provides the following methods for generating verification information.

[0070] Method 1: The verification information generation module 123 can concatenate the target segmented data with the sending order (or a combination of other methods), and generate a summary for the concatenated data content, and then encrypt the summary using the public key stored in the source end 100 to obtain the digital signature corresponding to the target segmented data.

[0071] Method 2: After the verification information generation module 123 generates a summary for the target segmented data, it concatenates the summary with the target segmented data in the sending order (or a combination of other methods), and encrypts the concatenated summary using the public key stored in the source end 100, thereby obtaining a digital signature corresponding to the target segmented data.

[0072] In other possible implementations, the verification information may also be the HMAC corresponding to the target segmented data generated in combination with the sending order, or may be other data generated in combination with the sending order and capable of being used to perform consistency verification on the target segmented data.

[0073] For example, method three: when the verification information is specifically HMAC, for each segmented data (i.e., target segmented data), the verification information generation module 123 can concatenate the encryption key stored in the source end 100 with the sending order corresponding to the target segmented data (or combine them in other ways) to obtain the concatenated key, and then use the concatenated key to encrypt the summary generated based on the target segmented data to obtain the HMAC corresponding to the target segmented data, and use it as the verification information corresponding to the target segmented data.

[0074] Method 4: The verification information generation module 123 may concatenate the target segmented data with the encryption key to obtain the concatenated data, and then use the encryption key stored in the source end 100 to encrypt the digest generated based on the concatenated data to obtain the HMAC corresponding to the target segmented data.

[0075] Mode 5: After the verification information generation module 123 generates a digest based on the target segmented data, the digest is concatenated with the sending order corresponding to the target segmented data (or combined in other ways), and the concatenated digest is encrypted using the encryption key stored in the source end 100 to obtain the HMAC corresponding to the target segmented data. Of course, the above specific implementation methods for generating verification information are only used as some exemplary explanations and are not used to limit their specific implementation in actual applications.

[0076] After obtaining the target segmented data and the verification information corresponding to the target segmented data, the signature device 120 sends the target segmented data and the verification information to the destination 200 through the transmission module 124 .

[0077] As an example, the source end 100 can establish a communication connection with the destination end 200 through the HyperText Transfer Protocol (HTTP) or the HyperText Transfer Protocol Secure (HTTPS), and transmit the data to be transmitted to the destination end 200 through the intermediate network 300 under the connection. In the intermediate network 300, for each segmented data sent by the transmission module 124 and the verification information corresponding to the segmented data, it can be split into multiple segmented sub-data, and for each segmented sub-data, the Internet Protocol (IP) protocol is used to encapsulate it into an IP protocol message, such as based on the Transmission Control Protocol (TCP) or the User Datagram Protocol (UDP) to encapsulate each segmented sub-data. Then, the intermediate network 300 can send each IP protocol message corresponding to the segmented data to the destination end 200. In the intermediate network 300, each IP protocol message can carry part of the segmented data and / or (part or all) verification information corresponding to the segmented data.

[0078] In an optional solution, in order to improve the verification reliability of the received target segmented data by the destination end 200, the signature device 120 does not send the sending order of the target segmented data to the destination end 200, thereby avoiding the sending order from being stolen during the transmission from the source end 100 to the destination end 200, thereby avoiding affecting the verification of the received target segmented data by the destination end 200. For example, when tampering with the transmitted target segmented data, an attacker may also tamper with the digital signature of the target segmented data based on the stolen sending order.

[0079] The destination end 200 may include a transmission module 211 and a verification module 212. The transmission module 211 may be used to receive the target segmented data and the verification information corresponding to the target segmented data sent by the source end 100, and may further determine the receiving order of the target segmented data and the verification information corresponding to the target segmented data. The receiving order may be, for example, the nth segmented data received by the destination end 200, and then the target segmented data, the verification information and the receiving order are handed over to the verification module 212 for data verification. The verification module 212 may verify the target segmented data according to the verification information, the target segmented data and the receiving order to determine whether there is a transmission anomaly in the target segmented data, that is, to verify whether the target segmented data received by the destination end 200 is consistent with the target segmented data sent by the source end 100.

[0080] As an example, when the verification information is specifically a digital signature. If the signature device 120 generates a data signature based on the implementation method in the above-mentioned method 1, the verification module 212 can use the private key stored in the destination 200 to decrypt the received digital signature when performing verification, obtain summary A, and splice the target segmented data with the receiving order according to the same rule, and generate summary B according to the spliced ​​data content. Then, the verification module 212 compares summary A with summary B to determine whether the two summaries are consistent. If so, the verification module 212 can determine that there is no transmission anomaly in the target segmented data, that is, the target segmented data received by the destination 200 is consistent with the target segmented data sent by the source 100; and if the two summaries are inconsistent, the verification module 212 can determine that there is a transmission anomaly in the target segmented data, that is, the target segmented data received by the destination 200 is inconsistent with the target segmented data sent by the source 100, for example, the target segmented data may have content tampering, or be replaced during transmission.

[0081] In other examples, if the signature device 120 generates a digital signature based on the above-mentioned method 2, the verification module 212 can use the private key stored in the destination end 200 to decrypt the received digital signature when performing verification, and obtain summary A, and derive the summary B corresponding to the target segmented data from the summary A according to the rule of generating digital signatures by the source end 100, such as removing the part of the sending order from the summary A to obtain summary B. In addition, the verification module 212 can generate summary C based on the received target segmented data. Then, the verification module 212 can compare whether the summary B is consistent with the summary C. If so, the verification module 212 can determine that there is no transmission anomaly in the target segmented data, and if not, the verification module 212 can determine that there is a transmission anomaly in the target segmented data. The above two examples are only exemplary descriptions of the verification process of the verification module 212 on the target segmented data when the verification information is specifically a digital signature. In actual applications, other implementation methods can also be used.

[0082] In addition, the verification information may also be an HMAC corresponding to the target segmented data generated in combination with the sending order, or may be other data generated in combination with the sending order and capable of being used to perform consistency verification on the target segmented data.

[0083] Exemplarily, when the verification information is specifically HMAC, if the signature device 120 generates HMAC based on the above-mentioned method three, for each segmented data (i.e., target segmented data), the verification module 212 concatenates the decryption key stored by the destination end 200 with the receiving order corresponding to the target segmented data (or combines them in other ways) to obtain the concatenated key, and then uses the concatenated key to decrypt the received verification information (i.e., HMAC) to obtain digest A; then the verification module 212 generates digest B based on the received target segmented data, and compares digest A with digest B to see if they are consistent. If the two digests are consistent, the verification module 212 can determine that there is no transmission anomaly in the target segmented data, and if not, the verification module 212 can determine that there is a transmission anomaly in the target segmented data.

[0084] When the verification information is specifically HMAC, if the signature device 120 generates HMAC based on the above-mentioned method 4, the verification module 212 can perform data splicing (or combine in other ways) on the received target segmented data and the corresponding receiving order of the target segmented data, and generate a corresponding summary A based on the spliced ​​data content. Then, the verification module 212 can use the decryption key stored in the destination 200 to decrypt the received verification information to obtain summary B, and compare the summary A with the summary B to determine whether the two summaries are consistent. If they are consistent, the verification module 212 can determine that there is no transmission anomaly in the target segmented data, otherwise, it is determined that there is a transmission anomaly in the target segmented data.

[0085] When the verification information is specifically HMAC, if the signature device 120 generates HMAC based on the above-mentioned method 5, the verification module 212 can use the decryption key to decrypt the received verification information to obtain summary A, and remove the receiving order corresponding to the target segmented data from summary A to obtain summary B; then, the verification module 212 can generate summary C based on the received target segmented data, and compare whether summary B is consistent with summary C. If they are consistent, the verification module 212 can determine that there is no transmission anomaly in the target segmented data, otherwise, it is determined that there is a transmission anomaly in the target segmented data.

[0086] In this embodiment, the verification module 212 can verify the received target segmented data according to the receiving order of the target segmented data and the received verification information. The specific implementation process can adopt any applicable implementation method, and this embodiment does not limit or elaborate on this.

[0087] Based on the above process, when the source end 100 and the destination end 200 transmit each segmented data in the data to be transmitted, they can verify the transmitted segmented data according to the above process, and when the currently transmitted segmented data passes the verification, the source end 100 continues to transmit the next segmented data to the destination end 200. If the currently transmitted segmented data fails to pass the verification, the destination end 200 can notify the source end 100 to retransmit the segmented data, and continue to verify the retransmitted segmented data until the segmented data received by the destination end 200 is consistent with the segmented data sent by the source end 100 before transmitting the next segmented data. Since the data volume of each segmented data is smaller than the data volume of the data to be transmitted, the verification efficiency can be effectively improved by verifying each transmitted segmented data. Moreover, even if any segmented data undergoes transmission anomalies during the transmission process, such as replacement (i.e., using other segmented data to replace the segmented data currently being transmitted), replay (i.e., repeatedly sending the same segmented data), and sequence reorganization (i.e., the sequence of multiple segmented data during the transmission process is recombined), the destination end 200 can promptly determine the occurrence of the transmission anomaly through the above-mentioned verification process.

[0088] Furthermore, the source end 100 may also notify the destination end 200 that the data to be transmitted has been transmitted, so that the destination end 200 can determine that the multiple segmented data currently received include all the segmented data of the data to be transmitted. At the same time, the destination end 200 can also determine whether some of the segmented data in the data to be transmitted has been intercepted by the attacker during the transmission process based on whether the notification of the completion of the transmission of the data to be transmitted sent by the source end 100 is received.

[0089] In an exemplary implementation, after the source end 210 successfully transmits all the segmented data of the data to be transmitted to the destination end 200, it can continue to transmit a special segmented data to the destination end 200, which is referred to as the end segmented data. Among them, the end segmented data can carry an end mark, which can be used to indicate that multiple segmented data of the data to be transmitted have been successfully transmitted to the destination end 200. The segmentation module 121 in the source end 100 can also construct an end segmented data with a size of 0 while dividing the data to be transmitted and obtaining multiple segmented data, and the sorting module 122 determines that the sending order of the end segmented data is the last to be sent. At the same time, the verification information generation module 123 can generate a digital signature for the end segmented data according to the sending order corresponding to the end segmented data, and then the transmission module 124 sends the end segmented data and the corresponding digital signature to the destination end 200. In this way, when the destination end 200 receives the end segmented data and completes the verification of the end segmented data, it can be determined that the transmission of multiple segmented data of the data to be transmitted is completed. In this way, the entire data to be transmitted is successfully transmitted from the source end 100 to the destination end 200.

[0090] In other possible implementations, the source end 100 sends an end identifier to indicate whether the data to be transmitted has ended while sending the segmented data to the destination end 200. For example, the end identifier may be sent when sending the last segmented data and the verification information corresponding to the last segmented data. In this way, when the intermediate network 300 transmits each segmented data, it can generate multiple messages (each message carries part of the data in the segmented data) based on the segmented data, and newly define an end indication field in the message header (or other position in the message). The end indication field is used to indicate that the segmented data currently being transmitted is the last segmented data, and the value of the end indication field is defined in the message header according to the value of the end identifier. For example, when the value of the end indication field is 0, it indicates that the data to be transmitted has not been transmitted completely, and when the value of the end indication field is 1, it indicates that the data to be transmitted has been transmitted completely. In actual applications, if the segmentation module 121 divides the data to be transmitted into (N+1) segmented data, then in the message corresponding to the 1st to Nth segmented data sent by the source end 100 to the destination end 200, the value of the end indication field can be 0; and in the message corresponding to the (N+1)th segmented data sent by the source end 100 to the destination end 200, the value of the end indication field can be 1, which is used to inform the destination end 200 that the last segmented data of the data to be transmitted has been transmitted.

[0091] Of course, the above example is only used to illustrate the implementation process of the source end 100 notifying the destination end 200 that the transmission of the data to be transmitted is completed. In other embodiments, the source end 100 may also notify the destination end 200 of the completion of the transmission process of the data to be transmitted based on other methods. For example, the source end 100 sends an indication message of the end of the transmission to the destination end 200 alone, and the indication message carries an end mark, etc. This embodiment does not limit this.

[0092] In the above embodiment, the signature device 120 can implement the above process of segmenting the data to be transmitted, determining the sending order, generating verification information and sending the segmented data through a single thread. In actual applications, the signature device 120 can also transmit data to the destination end 200 concurrently through multiple threads to improve the data transmission efficiency from the source end 100 to the destination end 200.

[0093] As an exemplary implementation, the data production device 110 may divide the resource to be transmitted into multiple data to be transmitted, such as first data to be transmitted and second data to be transmitted, and transmit the two data to be transmitted to the signature device 120. The signature device 120 may have multiple threads, such as thread 1 and thread 2. When signing the data to be transmitted, the signature device 120 may process one data to be transmitted with each thread based on the above embodiment. Specifically, Figure 4As shown, the signature device 120 uses thread 1 to segment the first data to be transmitted to obtain multiple segmented data of the first data to be transmitted, and further determines the sending order and corresponding first verification information for each segmented data of the first data to be transmitted, and then uses the thread 1 to send the multiple segmented data of the first data to be transmitted and the first verification information corresponding to each segmented data to the destination 200. Among them, the first verification information is generated according to the segmented data of the first data to be transmitted. Similarly, for the second data to be transmitted, the signature device 120 can use thread 2 to segment the second data to be transmitted, determine the sending order, generate verification information, and send each segmented data of the second data to be transmitted and the corresponding verification information to the destination 200. Among them, the second verification information is generated according to the segmented data of the second data to be transmitted. In this embodiment, for the specific implementation process of the signature device 120 using thread 1 to transmit the first data to be transmitted to the destination 200, and the specific implementation process of using thread 2 to transmit the second data to be transmitted to the destination 200, please refer to the above-mentioned related description, and this embodiment will not be repeated.

[0094] Among them, the source end 100 can first start multiple transmission threads, and then divide the acquired resources to be transmitted into multiple data to be transmitted, or it can start multiple transmission threads after dividing the multiple data to be transmitted, or execute both at the same time. In this embodiment, the specific execution order of these two processes is not limited.

[0095] Accordingly, the destination end 200 may have at least two threads, which are referred to as thread 3 and thread 4 for the sake of distinction. The authentication device 210 may use thread 3 to receive the various segmented data and verification information corresponding to the first data to be transmitted sent by the source end 100 using thread 1, and perform corresponding verification on the received segmented data; at the same time, the authentication device 210 may use thread 4 to receive the various segmented data and verification information corresponding to the second data to be transmitted sent by the source end 220 using thread 2, and perform corresponding verification on the received segmented data. The specific implementation process of the verification of the segmented data by thread 3 and thread 4 can be referred to the above-mentioned relevant description, which will not be repeated here.

[0096] In order to facilitate the destination end 200 to determine that the first data to be transmitted and the second data to be transmitted are two different data to be transmitted under the same resource to be transmitted, in some possible implementations, the source end 100 sends the description data corresponding to the first data to be transmitted and the second data to be transmitted to the destination end 200, while sending the respective segmented data of the first data to be transmitted and the second data to be transmitted to the destination end 200. Specifically, the description data of the first data to be transmitted is sent to the destination end 200 through thread 1, and the description data of the second data to be transmitted is sent to the destination end 200 through thread 2. In this way, when the destination end 200 receives the segmented data of the first data to be transmitted and the segmented data of the second data to be transmitted, it can determine that the segmented data of the first data to be transmitted and the segmented data of the second data to be transmitted belong to the same resource to be transmitted according to the description data of the first data to be transmitted and the second data to be transmitted, and integrate the complete resource to be transmitted based on the respective segmented data of the first data to be transmitted and the respective segmented data of the second data to be transmitted.

[0097] As an example, the description data of the first data to be transmitted may include, for example, an identifier (resource ID) of the resource to be transmitted to which the first data to be transmitted belongs, such as a file name, a uniform resource locator (URL) or a URL after a hash operation. Furthermore, the description data may also include a slice range (range) of the first data to be transmitted. The slice range of the first data to be transmitted may be, for example, a slice size and a slice identifier of the first data to be transmitted. The description data of the second data to be transmitted is similar to the description data of the first data to be transmitted, and will not be repeated here.

[0098] Furthermore, when the signature device 120 generates the first verification information for each segmented data of the first data to be transmitted using thread 1, it can also generate it according to the sending order of the segmented data and the description data of the first data to be transmitted. For example, when the first verification information is specifically a digital signature, the signature device 120 can generate a summary for the segmented data using thread 1, and splice the summary with the sending order corresponding to the segmented data and the description data of the first data to be transmitted, and encrypt the data content obtained after splicing to obtain the digital signature corresponding to the segmented data. Correspondingly, when the authentication device 210 uses thread 3 to verify the segmented data, it can use the public key to decrypt the verification information corresponding to the received segmented data, and reversely calculate the summary corresponding to the segmented data from the decrypted data content, so as to determine whether the segmented data received by the authentication device 210 is consistent with the segmented data sent by the signature device 120 by comparing the summary with the summary generated according to the received segmented data. Similarly, for each segmented data in the second data to be transmitted, the signature device 120 may also utilize thread 2 to generate second verification information corresponding to the segmented data according to the description data of the second data to be transmitted and the sending order corresponding to the segmented data. The specific implementation method may refer to the relevant description of generating the first verification information, which will not be elaborated here.

[0099] In actual applications, the signature device 120 may also use multiple threads to sign multiple different data to be transmitted provided by the data production device 110 at the same time, and after completing the signature, transmit the multiple different data to be transmitted and the verification information in parallel to the destination. The specific implementation process is similar to the specific implementation of the signature device 120 signing and transmitting two data to be transmitted separately. Please refer to the above-mentioned related descriptions and will not be repeated here.

[0100] In some scenarios of actual application, during the process of transmitting multiple segmented data of the data to be transmitted from the source end 100 to the destination end 200, there is a possibility that some segmented data may be replaced by the attacker using segmented data of other data with the same transmission order. For example, assuming that the source end A1 sends the data a to be transmitted to the destination end A2, and the source end B1 sends the data b to be transmitted to the destination end B2, then the attacker can exchange some segmented data with the same transmission order during the process of the source end A1 and the source end A2 transmitting the segmented data. For example, assuming that source end A1 sends segmented data a1, a2, a3, a4, and a5 in the data a to be transmitted in sequence, and source end A2 sends segmented data b1, b2, b3, b4, and b5 in the data b to be transmitted in sequence, then the attacker can swap segmented data a3 in the data a to be transmitted with segmented data b3 in the data b to be transmitted, so that the segmented data received by destination end A2 are a1, a2, b3, a4, and a5 in sequence, and the segmented data received by destination end B2 are b1, b2, a3, b4, and b5 in sequence. In this way, the data received by destination ends A1 and A2 are abnormal.

[0101] Based on this, in the process of transmitting each segmented data of the data to be transmitted to the destination end 200, the transmission module 124 can first send a session identifier corresponding to the target segmented data (i.e., any one of the multiple segmented data of the data to be transmitted) to the destination end 200, and the session identifier is used to identify the session corresponding to the transmission of the target segmented data. In this way, the authentication device 210 of the destination end 200 can verify whether the received different segmented data belong to the same session based on the session identifier, so that the different segmented data received by the destination end 200 belong to the same resource to be transmitted corresponding to the session.

[0102] The session identifier, for example, may be any one or more of a task identifier (SessionID) of data transmission, a request identifier (RequestID), a universally unique identifier (UUID), a random number (RandomNumber) generated for the session, a header hash value (HeaderHash), and a header signature value (HeaderSignature), or may be a feature combination of any one or more of the above information, and the combined information is used as the session identifier of the data to be transmitted. In this embodiment, the specific implementation method of the session identifier is not limited.

[0103] In an exemplary implementation to prevent a replacement attack, the transmission module 124 may construct a request header, such as a request header based on the HTTP protocol, which carries a session identifier corresponding to the data to be transmitted. Figure 6 The request header shown in the figure, wherein some fields (header) in the request header can be used to record the attribute information of the request header, such as the request type, version number and other information; another part of the fields in the request header can be used to record the session identifier corresponding to the data to be transmitted. In actual applications, the part of the fields can be achieved by redefining the existing fields or reserved fields to use the part of the fields to record the session identifier. Then, the transmission module 124 can send the request header to the destination end 200, such as Figure 5 In this way, the destination end 200 can parse the session identifier from the received request header, and determine that the multiple segmented data received subsequently are all transmitted through the session corresponding to the session identifier.

[0104] Accordingly, when the verification information generation module 123 generates verification information for each segmented data in the data to be transmitted, the verification information can be generated according to the sending order of the segmented data and the session identifier corresponding to the segmented data (that is, the session identifier corresponding to the data to be transmitted to which the segmented data belongs). For example, when the verification information is specifically a digital signature, the verification information generation module 123 can perform data splicing on the sending order and the session identifier with the summary generated according to the segmented data, and encrypt the spliced ​​data content, then the obtained encrypted ciphertext can be the digital signature corresponding to the segmented data. Accordingly, for each segmented data received by the destination end 200, the verification module 212 can verify the segmented data according to the session identifier parsed from the request header and the receiving order corresponding to the segmented data, so as to determine whether the segmented data received by the destination end 200 is consistent with the segmented data sent by the source end 100.

[0105] In this way, when the attacker interchanges segmented data of different data to be transmitted through different sessions, the authentication device 210 (specifically, the verification module 212) in the destination end 200 can determine through the session identifier corresponding to the segmented data that the segmented data received by the destination end 200 is inconsistent with the segmented data sent by the source end 100, thereby determining that an abnormality has occurred in the transmission process of the segmented data.

[0106] In a further possible implementation, when the request header is transmitted between the source end 100 and the destination end 200, the destination end 200 may also verify the request header, specifically verifying whether the request header sent by the source end 100 is consistent with the request header received by the destination end 200, so as to determine whether the request header has been tampered with or other attacks during the transmission process. Exemplarily, the verification information generation module 123 in the source end 100 may also generate verification information for the constructed request header, and add the verification information of the request header to the verification part field in the request header, such as Figure 6 As shown. In this way, after receiving the request header in the destination end 200, the verification module 212 can parse the verification information corresponding to the request header from the verification part field in the request header, and use the verification information to verify the content in the request header. Among them, the verification part can be merged with the header, or it can be a field different from the header. For example, the verification part can be a tail field in the request header. This embodiment does not limit the specific implementation method of carrying the session identifier and verification information in the request header. When the verification module 212 determines that the request header received by the destination end 200 is consistent with the request header sent by the source end 100, the source end 100 can start to send each segmented data in the data to be transmitted to the destination end 200; and when the verification module 212 determines that the request header received by the destination end 200 has a transmission abnormality, the destination end 200 can terminate the connection with the source end 100, or require the source end 100 to retransmit the request header, etc., and the source end 100 is allowed to further transmit segmented data until the request header received by the destination end 200 is consistent with the request header sent by the source end 100.

[0107] In actual applications, when constructing a request header, the transmission module 124 in the source end 100 can also add more other information to the request header to strengthen the verification of the data to be transmitted received by the destination end 200. Exemplarily, the transmission module 124 can also add time information and / or location information to the request header. Among them, the time information, for example, can be the maximum allowed time difference between the source end 100 sending the segmented data and the destination end 200 receiving the segmented data, and of course, it can also be other applicable information for verifying the segmented data in the time dimension; the location information, for example, can be the network location / geographic location allowed by the destination end 200 that receives the segmented data, or it can be other applicable information for verifying the segmented data in the location dimension.

[0108] It is worth noting that the above examples are only used to illustrate the specific implementation methods of the source end 100 and the destination end 200 to jointly verify the segmented data, and are not used to limit its specific implementation to the above implementation methods. It should be understood that in actual applications, the above implementation methods can be combined with each other. For example, in other possible implementations, the request header generated by the source end 100 may include not only the session identifier and the digital signature corresponding to the request header, but also the above-mentioned time information and / or location information, etc. Furthermore, when the source end 100 transmits the data to be transmitted to the destination end 200 based on multiple threads, each thread can generate a corresponding request header, and the request header generated by each thread can also include description data of the sub-data transmitted by the thread, etc.

[0109] According to the data transmission process described in the above embodiments, the embodiments of the present application also provide a data transmission method, which will be introduced below from the perspective of interaction between various devices.

[0110] See also Figure 7 The flowchart of the data transmission method shown in FIG. 1 is applied to the above-mentioned data transmission system, and the data transmission system includes a source end 100 and a destination end 200. The method specifically includes the following steps:

[0111] S701: The source end 100 obtains data to be transmitted.

[0112] In actual applications, one or more applications may be running in the source end 100, and the application may generate data that needs to be transmitted to the destination end 200. For example, when the destination end 200 is an object storage service (OBS) provided by the cloud platform, the user may upload data to the bucket of the OBS service through the client on the source end 100, or the client may upload user data to the bucket at a fixed time. Then, the data to be uploaded by the client is the data to be transmitted in this embodiment.

[0113] S702: The source end 100 constructs a request header carrying a session identifier, and sends the request header to the destination end 200.

[0114] In actual applications, an attacker may replace data in different sessions during data transmission, so that the data received by the destination end 200 is not the data actually sent by the source end 100. For this reason, in this embodiment, the current session identifier can be first transmitted to the destination end 200, so that the destination end can subsequently verify the received data in combination with the session identifier.

[0115] In a further possible implementation, the source end 100 may also send verification information corresponding to the request header to the destination end, so that the destination end 200 can use the verification information to verify the received request header, thereby determining whether the information carried in the request header has been tampered with during transmission.

[0116] S703: The source end 100 divides the data to be transmitted into a plurality of segmented data.

[0117] In specific implementation, the source end 100 may divide the data to be transmitted into equal-length segments according to a fixed size, and the size of each segmented data may be the same, wherein the size of the last segmented data may be the same as or different from the sizes of other segmented data. In other examples, the source end 100 may also divide the multiple segmented data into different sizes. In this embodiment, the specific implementation of how the source end 100 divides the data to be transmitted is not limited.

[0118] S704: The source end 100 determines the sending order of each segmented data.

[0119] As an example, the source end 100 can use the order of the segmented data in the data to be transmitted as the sending order of the segmented data. For example, the first segmented data obtained by the source end 100 can be sent to the destination end first, and the second segmented data obtained by the source end 100 can be sent to the destination end second, and so on. Of course, in other examples, the sending order of each segmented data may also be different from the order of the segmented data in the data to be transmitted, and this embodiment is not limited to this.

[0120] S705: The source end 100 generates verification information for each segmented data according to each segmented data and the sending order of each segmented data.

[0121] The verification information may be a digital signature corresponding to the segmented data, or may be an HMAC. The source end 100 may generate verification information corresponding to the segmented data according to a combination of each segmented data, the order in which each segmented data is sent, and an encryption key pre-stored by the source end 100. The specific implementation thereof may refer to the relevant description in the aforementioned embodiment, and will not be described in detail here.

[0122] S706: The source end 100 sends a plurality of segmented data and verification information corresponding to the plurality of segmented data to the destination end.

[0123] For a piece of data to be transmitted, the source end 100 can start a transmission thread and use the transmission system to send the data to be transmitted to the destination end 200. In practical applications, the source end 100 can start multiple transmission threads at the same time, and use the multiple transmission threads to transmit different data to be transmitted to the destination end 200. The specific implementation process of the source end 100 using each transmission thread to transmit a piece of data to be transmitted to the destination end 200 can be similar.

[0124] In particular, when the source end 100 needs to transmit a resource to be transmitted to the destination end 200, the source end 100 can divide the resource to be transmitted into multiple different data to be transmitted, and use different transmission threads to transmit different data to be transmitted respectively. In this way, the parallel transmission of the resource to be transmitted between the source end 100 and the destination end 200 can be achieved, thereby effectively improving the resource transmission efficiency.

[0125] It is worth noting that in order to reduce the possibility that an attacker can know the sending order of the segmented data, the source end 100 does not transmit the sending order of the segmented data to the destination end 200. In this way, the attacker cannot know the sending order of the segmented data, and thus it is difficult to attack the verification information of the segmented data.

[0126] Further, in order to facilitate the integration of multiple copies of data to be transmitted by the destination end 200, the source end 100 can send the description data corresponding to each copy of the data to be transmitted to the destination end, and the description data can be, for example, the identifier and / or slice range of the resource to which the data to be transmitted belongs, so that the destination end 200 can integrate the received multiple different copies of data to be transmitted according to the description data, thereby integrating the entire resource to be transmitted. Exemplarily, the description data can be carried in the above-mentioned request header, and of course, it can also be sent separately, which is not limited in this embodiment.

[0127] S707: The destination end 200 determines the order in which each segmented data is received.

[0128] S708: The destination end 200 checks whether each segmented data in the data to be transmitted has a transmission abnormality according to each segmented data, the order in which each segmented data is received, and the verification information of each segmented data.

[0129] When the destination end 200 receives the segmented data and the verification information corresponding to the segmented data, it can record the receiving order of the segmented data, and use the receiving order of the segmented data, combined with the segmented data and the verification information of the segmented data to verify the received segmented data to determine whether there is any transmission anomaly in the transmission process of the segmented data.

[0130] It is worth noting that, during the process of transmitting a plurality of segmented data between the source end 100 and the destination end 200 , the sequence in which the segmented data are sent at the source end 100 is consistent with the sequence in which the segmented data are received at the destination end 200 .

[0131] In specific implementation, the destination end 200 can verify whether there is any transmission anomaly in the received segmented data by performing corresponding operations on the received segmented data, the receiving order of the segmented data, the key and the received verification information. The specific verification process can be found in the relevant description in the aforementioned embodiment and will not be repeated here.

[0132] In actual applications, the source end 100 can transmit segmented data one by one to the destination end 200, and after the destination end 200 completes the verification of the currently received segmented data, it notifies the source end 100 to transmit the next segmented data to the destination end 200. In this way, when any of the segmented data has a transmission anomaly during the transmission process, the destination end 200 can promptly discover it through the verification process of the segmented data, thereby improving the verification efficiency. Further, when the destination end 200 determines that the segmented data is abnormal, it can disconnect from the source end 100 or notify the source end 100 to retransmit the segmented data.

[0133] In some possible implementations, in order to inform the destination end 200 that the multiple segmented data currently transmitted are all segmented data, the source end 100 may send an end identifier to the destination end 200, and the end identifier is used to identify the last segmented data transmitted by the source end 100 to the destination end 200. In this way, the destination end 200 can determine through the end identifier that the multiple segmented data currently received are all segmented data sent by the source end 100. In addition, when the multiple segmented data are truncated by an attacker during the transmission process, the destination end 200 can determine whether the destination end 200 has received all segmented data sent by the source end 100 by not receiving the end identifier sent by the source end 100 or the value of the end identifier sent by the source end 100, so that when an attacker truncates part of the segmented data, the destination end 200 can promptly discover it.

[0134] Figures 8 to 9 A computer device is provided respectively. Figure 8 The computer device 800 shown can be used to implement the above Figure 2 The function of the signature device 120 in the source end 100 of the embodiment shown is: Fig. 9 The computer device 900 shown can be used to implement the above Figure 2 The functions of the authentication device 210 in the destination 200 in the illustrated embodiment.

[0135] The computer device 800 includes a bus 801, a processor 802, a communication interface 803, and a memory 804. The processor 802, the memory 804, and the communication interface 803 communicate with each other via the bus 801. Figure 2 as well as Figure 7 In the case of the embodiment shown, and Figure 2 as well as Figure 7 In the case where the signature device 120 in the source end 100 described in the embodiment is implemented by software, the software or program code required to execute the functions of the segmentation module 121, the sorting module 122 and the verification information generation module 123 in the signature device 120 is stored in the memory 804. The function of the transmission module 124 can be implemented through the communication interface 803, and the processor 802 is used to execute the instructions in the memory 804 to implement the method executed by the signature device 120.

[0136] The computer device 900 includes a bus 901, a processor 902, a communication interface 903, and a memory 904. The processor 902, the memory 904, and the communication interface 903 communicate with each other via the bus 901. Figure 2 as well as Figure 7 In the case of the embodiment shown, and Figure 2 as well as Figure 7 In the case where the authentication device 210 in the destination 200 described in the embodiment is implemented by software, the software or program code required to execute the function of the verification module 212 in the authentication device 210 is stored in the memory 904. The function of the transmission module 211 can be implemented through the communication interface 903, and the processor 902 is used to execute the instructions in the memory 904 to implement the method executed by the authentication device 210.

[0137] In addition, an embodiment of the present application further provides a computer-readable storage medium, which stores instructions. When the computer-readable storage medium is executed on a computer device, the computer device executes the method executed by the source end 100 described in the above embodiment.

[0138] The embodiment of the present application further provides another computer-readable storage medium, which stores instructions. When the computer-readable storage medium is executed on a computer device, the computer device executes the method executed by the destination end 200 described in the above embodiment.

[0139] The embodiment of the present application also provides a computer program product, when the computer program product is executed by a computer, the computer executes any of the aforementioned data transmission methods. The computer program product can be a software installation package, and when any of the aforementioned data providing methods is required, the computer program product can be downloaded and executed on a computer.

[0140] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0141] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0142] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0143] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

Claims

1. A data transmission method, characterized in that: The method is applied to the source end, and the method comprises: Get the data to be transmitted; Dividing the data to be transmitted into a plurality of segmented data; Determining a sending order of the plurality of segmented data; Generate verification information for each segmented data according to each segmented data and the sending order of each segmented data; The multiple segmented data and the verification information corresponding to the multiple segmented data are sent to the destination end, the sending order of the multiple segmented data is not sent to the destination end, and the verification information corresponding to the multiple segmented data is used by the destination end to verify whether the multiple segmented data are transmitted abnormally according to the receiving order of the multiple segmented data.

2. The method according to claim 1, characterized in that The step of generating verification information for each segmented data according to each segmented data and the sending order of each segmented data includes: A hash-based message authentication code HMAC operation is performed on each segmented data, the sending order of each segmented data and the key to obtain verification information of each segmented data.

3. The method according to claim 1 or 2, characterized in that The data to be transmitted is transmitted through a session; the verification information of each segmented data is generated according to each segmented data and the sending order of each segmented data, including: Generate verification information for each segmented data according to each segmented data, the sending order of each segmented data, and the identifier of the session; The method further comprises: Sending the session identifier to the destination end.

4. The method according to claim 3, characterized in that The sending the session identifier to the destination end includes: Before sending the first segmented data and the verification information of the first segmented data to the destination end, a request header carrying the identifier of the session is sent to the destination end.

5. The method according to any one of claims 1 to 4, characterized in that: The sending the plurality of segmented data and the verification information corresponding to the plurality of segmented data to the destination end includes: The last segmented data, the verification information of the last segmented data and an end mark are sent to the destination end, wherein the end mark indicates that the transmission of the multiple segmented data is completed.

6. The method according to any one of claims 1 to 5, characterized in that: Before obtaining the data to be transmitted, the method further includes: Start multiple transfer threads; Acquire resources to be transmitted, and divide the resources to be transmitted into multiple data to be transmitted; The sending the plurality of segmented data and the verification information corresponding to the plurality of segmented data to the destination end includes: At least one segmented data of the data to be transmitted and corresponding verification information are sent to the destination end through each transmission thread.

7. The method according to claim 6, characterized in that Sending at least one segment of data to be transmitted and corresponding verification information to the destination end through each transmission thread, including: Each transmission thread, before sending the first segment data of the at least one data to be transmitted and the corresponding verification information to the destination end, sends a request header carrying description data to the destination end; wherein the description data includes at least one of the following: The identifier of the resource to be transmitted and the slice range of the data to be transmitted.

8. A data transmission method, characterized in that: The method is applied to the destination end, and the method includes: Receiving a plurality of segmented data and verification information corresponding to each segmented data from a source end, wherein the plurality of segmented data are obtained by segmenting the data to be transmitted; Determining a receiving order of each segmented data, wherein the sending order of the plurality of segmented data is not sent to the destination end; According to each segmented data, the order in which each segmented data is received and the verification information of each segmented data, whether each segmented data in the data to be transmitted is abnormally transmitted, wherein the verification information of each segmented data is generated based on the order in which each segmented data is sent.

9. The method according to claim 8, characterized in that The verification information includes a hash-based message authentication code HMAC, and the verification of whether each segmented data in the data to be transmitted is abnormally transmitted according to each segmented data, the order in which each segmented data is received, and the verification information of each segmented data includes: According to each segmented data, the order in which each segmented data is received, the key and the received verification information, it is determined whether each segmented data in the data to be transmitted has a transmission abnormality.

10. The method according to claim 8 or 9, characterized in that The data to be transmitted is transmitted via a session, and the method further comprises: Receiving an identifier of the session from the source end; The step of checking whether each segmented data in the data to be transmitted has transmission abnormality according to each segmented data, the order in which each segmented data is received, and the verification information of each segmented data comprises: According to each segmented data, the order in which each segmented data is received, the verification information of each segmented data and the identifier of the session, it is verified whether each segmented data in the data to be transmitted has transmission abnormality.

11. The method according to claim 10, characterized in that The receiving the identifier of the session from the source end includes: A request header carrying an identifier of the session is received from the source end.

12. The method according to any one of claims 8 to 11, characterized in that The receiving of a plurality of segmented data and verification information corresponding to each segmented data from a source end includes: The last segmented data, the verification information of the last segmented data and an end mark are received from a source end, wherein the end mark indicates that the transmission of the plurality of segmented data is completed.

13. The method according to any one of claims 8 to 12, characterized in that The receiving of a plurality of segmented data and verification information corresponding to each segmented data from a source end includes: The segmented data of at least one data to be transmitted and corresponding verification information sent by the source end through each transmission thread are received, and different transmission threads are used to transmit different data to be transmitted obtained by segmenting the resources to be transmitted.

14. The method according to claim 13, characterized in that The receiving at least one segmented data of the data to be transmitted and the corresponding verification information sent by the source end through each transmission thread includes: Before receiving the segmented data of at least one data to be transmitted and the corresponding verification information sent by the source end through each transmission thread, receiving a request header carrying description information from the source end, wherein the description data includes at least one of the following: The identifier of the resource to be transmitted and the slice range of the data to be transmitted.

15. A data transmission system, characterized in that: The system comprises the source end as described in any one of claims 1 to 7, and the destination end as described in any one of claims 8 to 14.

16. A computing device, characterized in that: The computing device includes a processor and a memory; The processor is used to execute the instructions stored in the memory to perform the method according to any one of claims 1 to 7.

17. A computing device, characterized in that The computing device includes a processor and a memory; The processor is used to execute the instructions stored in the memory to perform the method according to any one of claims 8 to 14.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, which, when executed on a computing device, enable the computing device to execute the method according to any one of claims 1 to 7.

19. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, which, when executed on a computing device, enable the computing device to perform the method according to any one of claims 8 to 14.

Images