A data transmission method, apparatus and system

Abstract

This invention discloses a data transmission method, apparatus, and system, relating to the field of data processing technology. One specific embodiment of the method includes: monitoring the difference between the expiration time of the current key and the current time; if the difference is equal to or less than a preset threshold, sending a key change request to a second system, the key change request including a new key; receiving a feedback message from the second system regarding the key change request; if the feedback message is positive, changing the current key to the new key and synchronizing the change result with the second system; and performing encrypted data transmission with the second system based on the new key. This embodiment reduces the risk of leakage of important data information and improves the security of data transmission.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a data transmission method, apparatus and system. Background Technology

[0002] In order to prevent the leakage of important information during data transmission, people have increasingly higher requirements for the security performance of data transmission systems.

[0003] In existing systems, fixed keys are typically used to ensure data security. Specifically, once a key is generated in an existing data system, it is used for encryption in subsequent encryption processes.

[0004] As a result, with the departure or reassignment of personnel related to the data system, the range of people who know the encryption string is increasing, which may lead to key leakage and thus pose a security risk to the data system. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a data transmission method, apparatus, and system. The method monitors the difference between the expiration time of the current key and the current time; when the difference is equal to or less than a preset threshold, a key change request is sent to a second system, the key change request including a new key; feedback messages from the second system regarding the key change request are received; if the feedback message is positive, the current key is changed to the new key, and the change result is synchronized to the second system; data is transmitted encrypted with the second system based on the new key. This achieves timely replacement of the current key with a new key when the remaining validity period of the current key is less than a preset threshold, and encrypted data transmission with the second system is performed based on the new key. This prevents departing or transferred employees from knowing the new key, reducing the risk of key leakage, thereby reducing the risk of important information leakage and improving data transmission security.

[0006] To achieve the above objectives, according to one aspect of the present invention, a data transmission method is provided, applied to a first system, comprising: monitoring the difference between the expiration time of a current key and the current time; if the difference is equal to or less than a preset threshold, sending a key change request to a second system, the key change request including a new key; receiving a feedback message from the second system in response to the key change request; if the feedback message is positive, changing the current key to the new key and synchronizing the change result with the second system; and performing encrypted data transmission with the second system based on the new key.

[0007] Optionally, the method provided by the present invention further includes: sending a key change reminder message to the user of the first system when the difference is less than the preset threshold; receiving a key change instruction input by the user in response to the key change reminder message, the key change instruction including the new key; and sending the key change request to the second system according to the key change instruction.

[0008] Optionally, the method provided by the present invention further includes: if no key change instruction is received within a preset time period after the key change reminder message is sent, automatically generating the new key and sending the key change request to the second system.

[0009] Optionally, the key change request further includes the effective time and expiration time of the new key. The method provided by the present invention further includes: when the feedback message is negative feedback, determining whether the effective time of the new key is greater than the expiration time of the current key; if so, modifying the effective time of the new key so that the effective time of the modified new key is less than or equal to the expiration time of the current key; and sending the modified key change request to the second system according to the effective time of the modified new key.

[0010] Optionally, changing the current key to the new key includes: saving the new key as a file to the server of the first system, and deleting the current key.

[0011] Optionally, when the multiple interfaces included in the first system correspond to different types, the monitoring of the difference between the expiration time of the current key and the current time, and the sending of the key change request to the second system, includes: for each type, performing: monitoring the difference between the expiration time of the current key and the current time for one or more interfaces corresponding to the type; if the difference is equal to or less than the preset threshold, generating the key change request corresponding to one or more interfaces corresponding to the type, and sending the key change request to the second system.

[0012] Optionally, changing the current key to the new key includes: changing all the current keys of one or more interfaces corresponding to the type to the new key.

[0013] Optionally, the step of transmitting encrypted data to the second system using the new key includes: receiving a data processing request, the data processing request indicating data to be processed; determining a transmission interface based on the data processing request; encrypting the data to be processed using the new key of the transmission interface; and sending the encrypted data to be processed to the second system through the transmission interface.

[0014] Optionally, encrypting the data to be processed using the new key of the transmission interface includes: obtaining the corresponding new key according to the file information of the transmission interface; and encrypting the data to be processed using the new key.

[0015] To achieve the above objectives, according to another aspect of the present invention, a data transmission apparatus is provided, applied to a first system, comprising: a timing monitoring module for monitoring the difference between the expiration time of a current key and the current time; a key generation module for sending a key change request to a second system when the difference is equal to or less than a preset threshold, the key change request including a new key; a receiving module for receiving a feedback message from the second system in response to the key change request; a key change synchronization module for changing the current key to the new key and synchronizing the change result to the second system when the feedback message is positive feedback; and a first encrypted transmission module for performing encrypted data transmission with the second system based on the new key.

[0016] To achieve the above objectives, according to another aspect of the present invention, a data transmission method is provided, applied to a second system, comprising: receiving a key change request sent by a first system, the key change request including a new key; sending a feedback message to the first system in response to the key change request; receiving a change result synchronized by the first system; and performing encrypted data transmission with the first system based on the new key.

[0017] Optionally, the key change request further includes: the effective time and expiration time of the new key, and the method provided by the present invention further includes: when the effective time of the new key is less than or equal to the expiration time of the current key, sending positive feedback to the first system for the key change request.

[0018] Optionally, the method provided by the present invention further includes: when the effective time of the new key is greater than the expiration time of the current key, sending negative feedback to the first system in response to the key change request.

[0019] To achieve the above objectives, according to another aspect of the present invention, a data transmission apparatus is provided, applied to a second system, comprising: a receiving module, configured to receive a key change request sent by a first system, the key change request including the new key; a key change response module, configured to send a feedback message to the first system in response to the key change request; and a second encrypted transmission module, configured to perform encrypted data transmission with the first system according to the new key after the receiving module receives the change result synchronized by the first system.

[0020] To achieve the above objectives, according to another aspect of the present invention, a data transmission system is provided, comprising: a data transmission device applied to a first system, and a data transmission device applied to a second system.

[0021] The data transmission device applied to the first system is configured to send a key change request to the data transmission device applied to the second system when the difference between the expiration time of the current key and the current time is equal to or less than a preset threshold, the key change request including a new key; receive a feedback message from the data transmission device applied to the second system regarding the key change request; if the feedback message is positive, change the current key to the new key and synchronize the change result to the data transmission device applied to the second system; and perform encrypted data transmission with the data transmission device applied to the second system based on the new key.

[0022] To achieve the above objectives, according to another aspect of the present invention, a server is provided, comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any of the above-described data transmission methods.

[0023] To achieve the above objectives, according to another aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored, wherein the program, when executed by a processor, implements any of the data transmission methods described above.

[0024] One embodiment of the above invention has the following advantages or beneficial effects: monitoring the difference between the expiration time of the current key and the current time; when the difference is equal to or less than a preset threshold, sending a key change request to the second system, the key change request including a new key; receiving a feedback message from the second system regarding the key change request; when the feedback message is positive, changing the current key to the new key and synchronizing the change result with the second system; and performing encrypted data transmission with the second system based on the new key. This achieves timely changing of the current key to a new key when the remaining validity period of the current key is less than a preset threshold, and performing encrypted data transmission with the second system based on the new key. This prevents departing or transferred employees from knowing the new key, reducing the risk of key leakage, thereby reducing the risk of important information leakage and improving the security of data transmission.

[0025] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0026] The accompanying drawings are provided to better understand the invention and are not intended to unduly limit the scope of the invention. Wherein:

[0027] Figure 1 This is a schematic diagram of the main steps of a data transmission method according to an embodiment of the present invention;

[0028] Figure 2 This is a schematic diagram of the main steps of a data transmission method according to an embodiment of the present invention;

[0029] Figure 3 This is a schematic diagram of the main modules of a data transmission device according to an embodiment of the present invention;

[0030] Figure 4 This is a schematic diagram of the main steps of a data transmission method according to an embodiment of the present invention;

[0031] Figure 5 This is a schematic diagram of the main modules of a data transmission device according to an embodiment of the present invention;

[0032] Figure 6 This is a schematic diagram of the main modules of a data transmission system according to an embodiment of the present invention;

[0033] Figure 7 This is an exemplary system architecture diagram in which embodiments of the present invention can be applied;

[0034] Figure 8 This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present invention. Detailed Implementation

[0035] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0036] It should be noted that, unless otherwise specified, the embodiments of the present invention and the technical features thereof can be combined with each other.

[0037] The data transmission method provided in this invention can be applied to various data transmission scenarios, such as data transmission between a banking system and a customer system, data transmission between a home renovation platform and a customer system, and data transmission between an education platform and a user system. In the scenario of data transmission between a banking system and a customer system, the first system can be the banking system; the second system is the customer system that interacts with the banking system for business data, such as a car manufacturer's system. In the scenario of data transmission between a home renovation platform and a customer system, the first system can be the home renovation platform, and the second system is the customer system that interacts with the home renovation platform for business data. In the scenario of data transmission between an education platform and a user system, the first system can be the education platform, and the second system can be the user system.

[0038] In multi-system collaborative business transactions, data frequently needs to be transferred between the first and second systems. This transferred data often contains sensitive information such as important business information and user information involving privacy. For example, to promote the development of large-scale personal consumer credit business, banks subsidize the personal interest rates for installment loans for car purchases. The subsidy funds are shared between the bank and the car manufacturer according to a certain ratio. Therefore, the bank needs to verify the data of successfully disbursed car loan transactions with different car manufacturers. This requires the transfer of business data between the bank's system and the car manufacturer's system. This data contains sensitive information such as user identification, business type, transaction amount, and marketing strategies, thus requiring high security for data transmission.

[0039] In existing technologies, data transmission systems typically use a fixed key to encrypt transmitted data, and once the key is generated, it is used continuously for encryption. However, as personnel in the data system change positions or leave, more and more people become aware of the key, which may lead to the leakage of users' important information, causing economic losses or emotional distress to users.

[0040] Therefore, in order to better ensure data security, this invention proposes a data transmission method based on key periodic changes.

[0041] Figure 1 This is a schematic diagram of the main steps of a data transmission method according to an embodiment of the present invention.

[0042] like Figure 1 As shown, a data transmission method according to an embodiment of the present invention mainly includes the following steps:

[0043] Step S101: Monitor the difference between the current key's expiration time and the current time.

[0044] The current key refers to the valid key currently in use by both the first and second systems. The validity period is the time between the key's effective date and its expiration date. The current time refers to the real-time time of the monitoring action. The difference between the current key's expiration date and the current time is the remaining validity period of the current key. To ensure timely changes when the current key expires, it needs to be monitored. This monitoring can be performed periodically, such as every day or 60 minutes, calculating the difference between the current key's expiration date and the current time, i.e., the remaining validity period. Alternatively, the current key can be monitored in real-time, meaning the difference between the current key's expiration date and the current time is calculated in real-time. The monitoring period for the current key depends on its remaining validity period, i.e., the time between the key's expiration time and the current time. For example, if the remaining validity period of the current key is less than or equal to one year, the monitoring period can be set to one month; if it is less than or equal to one month, the monitoring period can be set to seven days; if it is less than or equal to seven days, the monitoring period can be set to one day; if it is less than or equal to one day, the monitoring period can be set to one hour; and if it is less than or equal to one hour, real-time monitoring can be used.

[0045] In one embodiment, the first system includes multiple interfaces, such as 20 interfaces (interfaces 1-20), and the second system also includes multiple interfaces, such as 70 interfaces (interfaces 31-100). These interfaces are categorized into various security levels based on data interaction frequency, data importance, and client security requirements. For example, interfaces 1 and 2 have the highest security level (Level 1), interfaces 3-5 have the next highest security level (Level 2), and the remaining interfaces are Level 3. Correspondingly, interfaces 31-40 are Level 1 interfaces, interfaces 41-50 are Level 2 interfaces, and the remaining interfaces are Level 3 interfaces. Different types of interfaces use different keys; for example, interfaces 1 and 3, or interfaces 1 and 45, use different keys. Interfaces of the same type use the same key; for example, interfaces 1, 2, and interfaces 31-40 use the same key. Data with high confidentiality requirements is transmitted using interfaces with higher security levels.

[0046] To enable key changes at the interface level, the method provided in this embodiment of the invention further includes: for each type, monitoring the difference between the expiration time of the current key and the current time for one or more interfaces corresponding to the type.

[0047] The current key of each type of interface is monitored. To ensure the effectiveness and accuracy of the monitoring, while also taking into account the efficiency of the system, the monitoring cycle is determined based on the difference between the expiration time of the current key of the interface and the current time, i.e., the remaining validity period.

[0048] Step S102: If the difference is equal to or less than a preset threshold, a key change request is sent to the second system, the key change request including a new key.

[0049] If the difference between the current key's expiration time and the current time, i.e., the remaining validity period of the current key, is equal to or less than a preset threshold, the first system automatically generates a new key and sends a key change request containing the new key to the second system for key change negotiation. The key change request contains all the information about the key change, such as the interface identifier, key content, key's effective time, and key's expiration time. The second system is the object with which the first system interacts with data.

[0050] In one embodiment of the present invention, to enable the user to manually generate a new key using a key generation tool to change the current key, the method includes: when the difference is equal to or less than a preset threshold, a first system sends a key change reminder message to its user; the user inputs a key change instruction to the first system in response to the key change reminder message; and the first system sends a key change request to the second system corresponding to the interface according to the key change instruction.

[0051] If the remaining validity period of the current key is equal to or less than a preset threshold, the first system sends a reminder message to its user. The user responds to the reminder message by manually generating a new key using a key generation tool and inputting a key change instruction containing the new key into the first system. The first system then generates a key change request based on the user's instruction and sends the request to the second system. The first system can send the reminder message to the user's email address or via SMS to the user's mobile phone number.

[0052] In another embodiment of the present invention, the method further includes: if no key change instruction is received within a preset time period after the key change reminder message is sent, automatically generating the new key and sending the key change request to the second system.

[0053] If a user receives a reminder message but fails to input any instructions into the first system within the predetermined time period due to reasons such as taking a vacation or being transferred to another position, or if a user fails to receive a reminder message for some reason such as unpaid mobile phone bills or email malfunction, resulting in the user failing to input any instructions into the first system within the preset time period, the first system will automatically generate a new key according to the key change agreement pre-signed with the second system and send a key change request containing the new key to the second system.

[0054] In another embodiment of the present invention, the first system monitors the current key of the interface according to the type of the interface. If the difference between the expiration time of the current key of one type of interface and the current time is equal to or less than a preset threshold, a new key is generated for one or more interfaces of the same type. At the same time, a key change request is generated and sent to the second system corresponding to one or more interfaces of the same type.

[0055] For example, when the bank system monitors that the remaining validity period of the current keys of the first-level interfaces 1 and 2 is equal to or less than a preset threshold, it generates new keys for interfaces 1 and 2, generates new key change requests based on the new keys, and sends the key change requests to the second system corresponding to interfaces 31-40 that correspond to the security levels of interfaces 1 and 2.

[0056] Step S103: Receive feedback message from the second system in response to the key change request.

[0057] After the first system sends a key change request to the second system, the second system reviews the request according to the key change agreement pre-signed with the first system. This review includes verifying the key content, its effective and expiration dates, and the interface identifier. If the key change request meets the agreement requirements, the second system sends positive feedback to the first system; otherwise, it sends negative feedback. Positive feedback indicates that the second system approves the key change request, while negative feedback indicates that the second system rejects it.

[0058] For example, when a bank system and a customer system negotiate a key change, the bank system generates a new key and sends a key change request containing the new key to the customer system. The customer system reviews the key change request and, according to the key change agreement signed by both parties in advance, can approve the content indicated by the key change request, that is, send a positive feedback message to the bank system, or it can reject the content indicated by the key change request, that is, send a negative feedback message to the bank system.

[0059] In one embodiment of the present invention, during the key change negotiation process, when the first system receives negative feedback, it determines whether the effective time of the new key is greater than the expiration time of the current key; if so, it modifies the effective time of the new key so that the effective time of the modified new key is less than or equal to the expiration time of the current key; and sends the modified key change request to the second system according to the effective time of the modified new key.

[0060] When the second system rejects the key change request sent by the first system, the first system determines whether the validity periods of the new key and the current key are incompatible. If it is determined that the validity periods of the new key and the current key are incompatible, the first system modifies the effective time of the new key to make their validity periods compatible. Simultaneously, the first system modifies the key change request and resends the modified request to the second system for further negotiation. This allows the second system to approve the key change request, and the key change is implemented only when the first and second systems reach an agreement. This facilitates subsequent data transmission using the new key, improving data transmission and processing efficiency.

[0061] The above-described embodiments of the invention employ message reminders, change requests, and change approvals to change keys. Compared to automatic key changes by the system, this reduces the risk of the key change system being technically compromised. The introduction of an approval process in the key change workflow prevents either party from unilaterally changing the key without authorization, thus protecting the data system's security and preventing losses to either party. The message reminder function ensures the timeliness of key changes. Furthermore, using message reminders, change requests, and change approvals to change keys reduces the risk of leaking important information and improves the security of data transmission.

[0062] In one embodiment of the present invention, when the first system receives negative feedback from the second system and the difference between the expiration time of the current key and the current time, i.e. the remaining validity period of the current key, is less than 1 millisecond, the first system will initiate a forced key change mode according to the agreement pre-signed with the second system, change the current key to a new key, and take the expiration time of the current key as the effective time of the new key.

[0063] In another embodiment of the present invention, if the difference between the expiration time of the current key and the current time, i.e. the remaining validity period of the current key, is less than 1 millisecond, and the first system still has not received a feedback message from the second system, then the first system will initiate a forced key change mode according to the agreement pre-signed with the second system, change the current key to a new key, and take the expiration time of the current key as the effective time of the new key.

[0064] When the solution of changing keys through message reminders, change requests, and change approvals cannot be implemented due to some objective reasons, in order to ensure that the data system is always under key protection, if the change approval process is delayed or postponed, the current key will be forced to change immediately upon expiration, ensuring that the effective time of the new key is aligned with the expiration time of the current key.

[0065] Step S104: If the feedback message is positive, change the current key to the new key and synchronize the change result to the second system.

[0066] After the key change negotiation between the first system and the second system is completed, the first system saves the new key as a file on its server, deletes the current key, and sends all the key change information to the second system. The first and second systems can query and retrieve the new key using the file name and file path.

[0067] In one embodiment of the present invention, when the current key is changed at the interface level, the first system saves the new key for one or more interfaces of the aforementioned type to its server in the form of a file, deletes the current key corresponding to the one or more interfaces of the aforementioned type, and sends all the key change information to the second system corresponding to the one or more interfaces. The first system and the second system can query and retrieve the new key for the one or more interfaces using the file name and file path.

[0068] Step S105: Encrypt data transmission with the second system using the new key.

[0069] The first system receives a data processing request sent by the second system, the data processing request indicating the data to be processed; the first system determines the transmission interface required to transmit the data to be processed according to the data processing request; the first system queries and calls the key of the transmission interface through the file path and file name of the key file corresponding to the transmission interface, uses the key to encrypt the data to be processed, and sends the encrypted data to be processed to the second system through the transmission interface.

[0070] Figure 2 This is a schematic diagram of the main steps of a data transmission method according to an embodiment of the present invention.

[0071] The following uses a banking system as the first system and an automobile manufacturer's system as the second system as an example to describe in detail the data transmission method provided in this embodiment of the invention. Figure 2 As shown, the method may include the following steps:

[0072] Step S201: The bank system monitors the remaining validity period of the current key.

[0073] The current key is a pre-agreed key used for data transmission between the banking system and the automotive manufacturer's system. The banking system may include various types of interfaces, with different types determined by security levels. The banking system monitors the remaining validity period of the current key for one or more interfaces corresponding to each type, where the remaining validity period of the current key is the difference between the current key's expiration time and the current time.

[0074] Step S202: Determine whether the remaining validity period is equal to or less than the preset threshold. If yes, proceed to step S203; otherwise, continue to step S201.

[0075] The principles for setting preset thresholds can be included in the key change agreement pre-signed between the bank system and the car manufacturer's system. The bank system determines whether the remaining validity period of one or more interfaces of a certain type is equal to or less than the preset threshold.

[0076] Step S203: The bank system sends a key change notification message to its users.

[0077] The banking system can send key change reminder messages to its users via email, SMS, or other means.

[0078] Step S204: Start recording the waiting time.

[0079] After the bank system sends a key change notification message to its users, it records the waiting time while waiting for the users to enter the key change command.

[0080] Step S205: Determine whether the waiting time is less than the preset time. If yes, proceed to step S206; otherwise, proceed to step S207.

[0081] The principle behind setting the preset duration is also included in the key change agreement pre-signed between the bank system and the car manufacturer's system. The bank system determines whether the waiting time for the user to input the key change command is within the preset duration.

[0082] Step S206: Detect whether there is a key change instruction input; if yes, proceed to step S208, otherwise proceed to step S205.

[0083] The bank system determines whether it has received a key change instruction from the user.

[0084] Step S207: The bank system automatically generates a new key and sends a key change request to the car manufacturer's system.

[0085] If the waiting time exceeds the preset time, the bank system will automatically generate a new key for one or more interfaces of a certain type if it has not received a key change instruction from the user. The new key will then be sent to the car manufacturer's system for key change negotiation.

[0086] Step S208: Reset the waiting time to zero and send a key change request to the car manufacturer's system according to the key change instruction.

[0087] If a key change instruction is received from the user within a preset time period, the bank system will wait for the time period to expire, and then send a key change request to the car manufacturer's system to negotiate a key change based on the new key of one or more interfaces of a certain type indicated by the key change instruction.

[0088] Step S209: The car manufacturer's system determines whether the effective time of the new key in the key change request is greater than the expiration time of the current key. If so, proceed to step S210; otherwise, proceed to step S212.

[0089] The car manufacturer's system determines whether the validity period of the new key is inconsistent with that of the current key.

[0090] Step S210: The car manufacturer system sends negative feedback to the bank system.

[0091] When the validity period of the new key does not align with that of the current key, the car manufacturer's system sends negative feedback to the bank's system, indicating that the key change negotiation has failed; otherwise, it sends positive feedback to the bank's system, indicating that the key change negotiation has succeeded.

[0092] Step S211: The bank system modifies the effective time of the new key and sends the modified key change request to the car manufacturer system, and then executes S209.

[0093] When the key change negotiation fails, the bank system modifies the key change request and then renegotiates with the car manufacturer's system.

[0094] Step S212: The bank system performs the key change and synchronizes the change result to the car manufacturer's system.

[0095] After successful key negotiation, the bank system saves the new key for one or more interfaces of a certain type to the bank system's server in the form of a file, deletes the current key, and sends all information about the key change to the car manufacturer's system.

[0096] Step S213: The bank system receives a data processing request sent by the car manufacturer's system.

[0097] Understandably, the data processing request specifies the data to be processed, as well as the transmission interface, etc.

[0098] Step S214: Determine the transmission interface based on the data processing request.

[0099] The transmission interface is one or more interfaces of a certain type.

[0100] Step S215: Obtain the corresponding new key based on the file information of the transmission interface.

[0101] The new key stored on the bank's server can be retrieved by using the file path and file name of the key file corresponding to the transmission interface.

[0102] Step S216: Encrypt the data to be processed using the new key.

[0103] The data to be processed requested by the car manufacturer's system is encrypted using a new key from the transmission interface, resulting in encrypted data to be processed.

[0104] Step S217: Send the encrypted data to be processed to the car manufacturer's system.

[0105] Understandably, when changing the current key of the system, one can choose the method of automatic system change, that is, when the remaining validity period is less than or equal to the preset threshold, the key is automatically generated and a key change request is sent to the second system; another option is to choose the method of user reminder and user manual key generation; yet another option is to choose the method of user reminder and system automatic key generation.

[0106] According to a data transmission method provided by an embodiment of the present invention, the difference between the expiration time of the current key and the current time is monitored. If the difference is equal to or less than a preset threshold, a key change request is sent to a second system, the key change request including a new key. A feedback message from the second system regarding the key change request is received. If the feedback message is positive, the current key is changed to the new key, and the change result is synchronized to the second system. Data is then transmitted encrypted with the second system based on the new key. This achieves timely replacement of the current key with a new key when the remaining validity period of the current key is less than a preset threshold, and encrypted data transmission with the second system is performed based on the new key. This prevents departing or transferred employees from knowing the new key, reducing the risk of key leakage, thereby reducing the risk of important information leakage and improving data transmission security.

[0107] In addition, the use of message reminders, change requests, and change approvals for key changes is to reduce the risk of the key change system being technically compromised. The introduction of change approval is to prevent either party from unilaterally modifying the key, which could jeopardize the security of the data system and cause losses to both parties. The message reminder function ensures the timeliness of key changes.

[0108] Figure 3 This is a schematic diagram of the main modules of a data transmission device according to an embodiment of the present invention.

[0109] like Figure 3 As shown, an embodiment of the present invention provides a data transmission device 300, applied to a first system, which mainly includes the following modules:

[0110] The timed monitoring module 301 is used to monitor the difference between the current key's expiration time and the current time;

[0111] The key generation module 302 is used to send a key change request to the second system when the difference is equal to or less than a preset threshold, the key change request including a new key;

[0112] The receiving module 303 is used to receive a feedback message from the second system in response to the key change request;

[0113] The key change synchronization module 304, when the feedback message is positive feedback, is used to change the current key to the new key and synchronize the change result to the second system;

[0114] The first encrypted transmission module 305 is used to perform encrypted data transmission with the second system according to the new key.

[0115] In one embodiment of the present invention, to ensure timely modification of the current key when it expires, a timed monitoring module 301 monitors the difference between the current key's expiration time and the current time, i.e., the remaining validity period of the current key. The timed monitoring module 301 can perform monitoring periodically, such as calculating the difference between the current key's expiration time and the current time, i.e., the remaining validity period, every day or 60 minutes. Alternatively, the timed monitoring module 301 can perform real-time monitoring of the current key, i.e., calculate the difference between the current key's expiration time and the current time in real time. The monitoring period for the current key depends on its remaining validity period, i.e., the time between the key's expiration time and the current time. For example, if the remaining validity period of the current key is less than or equal to one year, the monitoring period can be set to one month; if it is less than or equal to one month, the monitoring period can be set to seven days; if it is less than or equal to seven days, the monitoring period can be set to one day; if it is less than or equal to one day, the monitoring period can be set to one hour; and if it is less than or equal to one hour, real-time monitoring can be used.

[0116] In one embodiment of the present invention, in order to change the key at the interface level, the timing monitoring module 301 monitors the difference between the expiration time of the current key and the current time for one or more interfaces corresponding to each type.

[0117] The timed monitoring module 301 monitors the current key of each type of interface. In order to ensure the effectiveness and accuracy of the monitoring, while also taking into account the efficiency of the system, the monitoring cycle is determined based on the difference between the expiration time of the current key of the interface and the current time, i.e. the remaining validity period.

[0118] In one embodiment of the present invention, when the difference between the expiration time of the current key and the current time, i.e., the remaining validity period of the current key, is equal to or less than a preset threshold, the key generation module 302 automatically generates a new key and sends a key change request containing the new key to the second system for key change negotiation. The key change request contains all the information of the key change, such as interface identifier, key content, key effective time, key expiration time, etc. The second system is the object of data interaction between the first system and the second system.

[0119] In one embodiment of the present invention, the timing monitoring module 301 monitors the current key of the interface according to the type of the interface. When the difference between the expiration time of the current key of one type of interface and the current time is equal to or less than a preset threshold, the key generation module 302 generates a new key for one or more interfaces of the same type, generates a key change request, and sends the key change request to the second system corresponding to one or more interfaces of the same type.

[0120] In one embodiment of the present invention, after the key generation module 302 sends a key change request to the second system, the second system reviews the key change request according to a pre-signed key change agreement with the first system. This review includes checking the key content, the key's effective and expiration times, and the interface identifier. If the key change request is confirmed to meet the agreement requirements, positive feedback is sent to the first system; otherwise, negative feedback is sent. Positive feedback indicates that the second system approves the key change request, while negative feedback indicates that the second system rejects it. The first system receives the feedback message sent by the second system through its receiving module 303.

[0121] In one embodiment of the present invention, during the key change negotiation process, when the receiving module 303 receives negative feedback, the first system determines whether the effective time of the new key is greater than the expiration time of the current key; if so, the effective time of the new key is modified by the key generation module 302 so that the effective time of the modified new key is less than or equal to the expiration time of the current key; and according to the effective time of the modified new key, the modified key change request is sent to the second system by the key generation module 302.

[0122] When the second system rejects the key change request sent by the key generation module 302, the first system determines whether the validity periods of the new key and the current key are not compatible. If it is determined that the validity periods of the new key and the current key are not compatible, the first system modifies the effective time of the new key through the key generation module 302 so that the validity periods of the new key and the current key are compatible. At the same time, the key change request is modified and resent to the second system through the key generation module 302 to renegotiate the key change.

[0123] In one embodiment of the present invention, after the key change negotiation between the first system and the second system is completed, the key change synchronization module 304 saves the new key as a file to the server of the first system, deletes the current key, and sends all the contents of the key change to the second system. The first system and the second system can query and retrieve the new key by file name and file path.

[0124] In one embodiment of the present invention, when the current key is changed at the interface level, the key change synchronization module 304 saves the new key for one or more interfaces of the same type to the server of the first system in the form of a file, deletes the current key corresponding to the one or more interfaces of the same type, and sends all the key change content to the second system corresponding to the one or more interfaces. The first system and the second system can query and call the new key of the one or more interfaces by file name and file path.

[0125] In one embodiment of the present invention, the receiving module 303 receives a data processing request sent by the second system, the data processing request indicating data to be processed; the first encrypted transmission module 305 determines the transmission interface required to transmit the data to be processed according to the data processing request; the first encrypted transmission module 305 queries and calls the key of the transmission interface through the file path and file name of the key file corresponding to the transmission interface, uses the key to encrypt the data to be processed, and sends the encrypted data to be processed to the second system through the transmission interface.

[0126] Figure 4 This is a schematic diagram of the main steps of a data transmission method according to an embodiment of the present invention.

[0127] like Figure 4 As shown, this embodiment of the invention provides a data transmission method applied to a second system, which mainly includes the following steps:

[0128] Step S401: Receive a key change request sent by the first system, wherein the key change request includes a new key.

[0129] If the difference between the current key's expiration time and the current time, i.e., the remaining validity period of the current key, is equal to or less than a preset threshold, the first system automatically generates a new key and sends a key change request containing the new key to the second system for key change negotiation. The key change request contains all the information about the key change, such as the interface identifier, key content, key's effective time, and key's expiration time. The first system is the object of data interaction between the second system and the second system.

[0130] Step S402: Send a feedback message to the first system in response to the key change request.

[0131] After the first system sends a key change request to the second system, the second system reviews the request according to the key change agreement pre-signed with the first system. This review includes verifying the key content, its effective and expiration dates, and the interface identifier. If the key change request meets the agreement requirements, the second system sends positive feedback to the first system; otherwise, it sends negative feedback. Positive feedback indicates that the second system approves the key change request, while negative feedback indicates that the second system rejects it.

[0132] For example, when a bank system and a customer system negotiate a key change, the bank system generates a new key and sends a key change request containing the new key to the customer system. The customer system reviews the key change request and, according to the key change agreement signed by both parties in advance, can approve the content indicated by the key change request, that is, send a positive feedback message to the bank system, or it can reject the content indicated by the key change request, that is, send a negative feedback message to the bank system.

[0133] Step S403: Receive the change results synchronized by the first system.

[0134] After the key change negotiation between the first system and the second system is completed, the first system saves the new key as a file on its server, deletes the current key, and sends all the key change information to the second system. The first and second systems can query and retrieve the new key using the file name and file path.

[0135] Step S404: Encrypt data transmission with the first system using the new key.

[0136] The first system receives a data processing request sent by the second system, the data processing request indicating the data to be processed; the first system determines the transmission interface required to transmit the data to be processed according to the data processing request; the first system queries and calls the key of the transmission interface through the file path and file name of the key file corresponding to the transmission interface, uses the key to encrypt the data to be processed, and sends the encrypted data to be processed to the second system through the transmission interface.

[0137] Figure 5 This is a schematic diagram of the main modules of a data transmission device according to an embodiment of the present invention.

[0138] like Figure 5 As shown, this embodiment of the invention provides a data transmission device 500, applied to a second system, which mainly includes the following modules:

[0139] Receiving module 501 is used to receive a key change request sent by the first system, wherein the key change request includes the new key;

[0140] The key change response module 502 is used to send a feedback message to the first system in response to the key change request;

[0141] The second encrypted transmission module 503, after the receiving module receives the change result synchronized by the first system, is used to perform encrypted data transmission with the first system according to the new key.

[0142] If the difference between the current key's expiration time and the current time, i.e., the remaining validity period of the current key, is equal to or less than a preset threshold, the receiving module 501 receives a key change request sent by the first system for key change negotiation. The key change request contains all the information about the key change, such as the interface identifier, key content, key's effective time, and key's expiration time. The first system is the object of data interaction between the second system and the second system.

[0143] After receiving the key change request, the receiving module 501 reviews the key change request according to the key change agreement pre-signed with the first system. This includes reviewing the key content, its effective and expiration times, and the interface identifier. If the key change request meets the agreement requirements, the key change response module 502 sends positive feedback to the first system; otherwise, it sends negative feedback. Positive feedback indicates that the second system approves the key change request, while negative feedback indicates that the second system rejects it.

[0144] After the key change negotiation is successful, the first system changes the current key to the new key and sends the key change result to the second system. After receiving the key change result sent by the first system, the receiving module 501, during data transmission, queries and calls the key of the transmission interface through the file path and file name of the key file corresponding to the transmission interface, uses the key to encrypt the data to be processed, and sends the encrypted data to be processed to the first system through the transmission interface.

[0145] As can be seen from the data transmission method and device provided in the embodiments of the present invention, the second system reviews the key change request sent by the first system according to the pre-signed key change agreement and sends a feedback message to the first system. That is, when the second system approves the key change request, it sends positive feedback to the first system; otherwise, it sends negative feedback to the first system. When the feedback message is positive, the first system changes the current key to the new key, and the second system receives all the key change information sent by the first system, including the new key. The second system then performs encrypted data transmission with the first system based on the new key. This realizes a collaborative approach where both parties in the data interaction request and approve the key change, which reduces the risk of the key change system being technically compromised compared to the system's automatic key change method. The introduction of an approval process in the key change process can prevent either party from unilaterally changing the key without authorization, endangering the security of the data system and causing losses to both parties. On the other hand, using message reminders, change requests, and change approvals to change keys reduces the risk of important information leakage and improves the security of data transmission.

[0146] Figure 6 This is a schematic diagram of the main modules of a data transmission system according to an embodiment of the present invention.

[0147] like Figure 6 As shown, an embodiment of the present invention provides a data transmission system 600, comprising:

[0148] Data transmission device 300 applied to the first system;

[0149] Data transmission device 500 applied to the second system;

[0150] The data transmission device 300 applied to the first system is configured to send a key change request to the data transmission device 500 applied to the second system when the difference between the expiration time of the current key and the current time is equal to or less than a preset threshold. The key change request includes a new key. The device 300 also receives a feedback message from the data transmission device 500 applied to the second system regarding the key change request. If the feedback message is positive, the device 300 changes the current key to the new key and synchronizes the change result with the data transmission device 500 applied to the second system. Finally, the device 300 performs encrypted data transmission with the data transmission device 500 applied to the second system based on the new key.

[0151] The data transmission device 300 applied to the first system monitors the difference between the current key's expiration time and the current time. When the remaining validity period of the current key is equal to or less than a preset threshold, the data transmission device 300 sends a key change request to the data transmission device 500 applied to the second system. The key change request contains all the information about the key change, such as the interface identifier, key content, key's effective time, and key's expiration time. The data transmission device 500 is the object with which the data transmission device 300 interacts with data.

[0152] After receiving a key change request, the data transmission device 500 reviews the request according to the key change agreement pre-signed with the data transmission device 300. This includes reviewing the key content, its effective and expiration times, and the interface identifier. If the key change request meets the agreement requirements, the data transmission device 500 sends positive feedback to the data transmission device 300; otherwise, it sends negative feedback. Positive feedback indicates that the data transmission device 500 approves the key change request, while negative feedback indicates that it rejects it.

[0153] The data transmission device 300 receives a feedback message from the data transmission device 500 regarding the key change request; if the feedback message is positive, the data transmission device 300 changes the current key to the new key and synchronizes the change result with the data transmission device 500.

[0154] During data transmission, the data transmission device 300 receives a data processing request sent by the data transmission device 500, the data processing request indicating the data to be processed; the data transmission device 300 determines the transmission interface required to transmit the data to be processed according to the data processing request; the data transmission device 300 queries and calls the key of the transmission interface through the file path and file name of the key file corresponding to the transmission interface, uses the key to encrypt the data to be processed, and sends the encrypted data to be processed to the data transmission device 500 through the transmission interface.

[0155] The data transmission system 600 provided in this embodiment of the invention involves a data transmission device 300 in a first system monitoring the difference between the expiration time of the current key and the current time. If the difference is equal to or less than a preset threshold, a key change request, including a new key, is sent to a data transmission device 500 in a second system. The system receives a feedback message from the data transmission device 500 regarding the key change request. If the feedback message is positive, the current key is changed to the new key, and the change result is synchronized to the data transmission device 500. Data is then encrypted and transmitted between the system and the data transmission device 500 using the new key. This ensures that when the remaining validity period of the current key is less than a preset threshold, the current key is promptly changed to a new key, and data is encrypted and transmitted between the system and the data transmission device 500 using the new key. This prevents departing or transferred employees from knowing the new key, reducing the risk of key leakage and consequently reducing the risk of important information leakage, thus improving the security of data transmission.

[0156] Figure 7 An exemplary system architecture 700 is shown that can be applied to the data transmission method or a data transmission system according to embodiments of the present invention.

[0157] like Figure 7 As shown, system architecture 700 may include terminal devices 701, 702, and 703, a network 704, and a server 705. Network 704 serves as the medium for providing communication links between terminal devices 701, 702, and 703 and server 705. Network 704 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0158] Users can use terminal devices 701, 702, and 703 to interact with server 705 via network 704 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 701, 702, and 703, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc.

[0159] Terminal devices 701, 702, and 703 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0160] Server 705 can be a server providing various services, such as a backend management server supporting shopping websites browsed by users using terminal devices 701, 702, and 703. The backend management server can analyze and process received data processing requests and return the processing results (such as encrypted data) to the terminal devices.

[0161] It should be noted that the data transmission method provided in the embodiments of the present invention is generally executed by server 705, and correspondingly, the data transmission device is generally set in server 705.

[0162] It should be understood that Figure 7 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0163] The following is for reference. Figure 8 It shows a schematic diagram of the structure of a computer system 800 suitable for implementing a terminal device of the present invention. Figure 8 The terminal device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0164] like Figure 8 As shown, the computer system 800 includes a central processing unit (CPU) 801, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 802 or programs loaded from storage section 808 into random access memory (RAM) 803. The RAM 803 also stores various programs and data required for the operation of the system 800. The CPU 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0165] The following components are connected to I / O interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to I / O interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 810 as needed so that computer programs read from it can be installed into storage section 808 as needed.

[0166] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 809, and / or installed from removable medium 811. When the computer program is executed by central processing unit (CPU) 801, it performs the functions defined above in the system of this invention.

[0167] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0168] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0169] The modules described in the embodiments of the present invention can be implemented in software or hardware. The described modules can also be housed in a processor; for example, a processor may be described as including a timing monitoring module, a key generation module, a receiving module, a key change synchronization module, and a first encrypted transmission module. The names of these modules do not necessarily limit the module itself; for example, the receiving module may also be described as a "module for receiving feedback messages."

[0170] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs that, when executed by the device, cause the device to: monitor the difference between the expiration time of the current key and the current time; if the difference is equal to or less than a preset threshold, send a key change request to a second system, the key change request including a new key; receive a feedback message from the second system regarding the key change request; if the feedback message is positive, change the current key to the new key and synchronize the change result to the second system; and perform encrypted data transmission with the second system based on the new key.

[0171] According to the technical solution of this invention, the difference between the expiration time of the current key and the current time is monitored; if the difference is equal to or less than a preset threshold, a key change request is sent to a second system, the key change request including a new key; a feedback message from the second system regarding the key change request is received; if the feedback message is positive, the current key is changed to the new key, and the change result is synchronized to the second system; data is encrypted and transmitted with the second system based on the new key. This achieves timely replacement of the current key with a new key when the remaining validity period of the current key is less than a preset threshold, and data is encrypted and transmitted with the second system based on the new key. This prevents departing or transferred employees from knowing the new key, reducing the risk of key leakage, thereby reducing the risk of important information leakage and improving the security of data transmission.

[0172] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A data transmission method, characterized in that, Applied to the first system, including: Monitor the difference between the current key's expiration time and the current time; the monitoring period for the current key depends on the remaining validity period of the current key. The longer the remaining validity period, the longer the monitoring period; the shorter the remaining validity period, the shorter the monitoring period. If the difference is equal to or less than a preset threshold, a key change request is sent to the second system. The key change request includes a new key, the effective time and expiration time of the new key. Receive feedback messages from the second system in response to the key change request; If the feedback message is positive, the current key is changed to the new key, and the change result is synchronized to the second system. If the feedback message is negative feedback, determine whether the effective time of the new key is greater than the expiration time of the current key; if so, modify the effective time of the new key so that the effective time of the modified new key is less than or equal to the expiration time of the current key; and send the modified key change request to the second system according to the effective time of the modified new key. Data is encrypted and transmitted with the second system using the new key.

2. The method according to claim 1, characterized in that, Further includes: If the difference is equal to or less than the preset threshold, a key change reminder message is sent to the user of the first system; Receive the key change instruction input by the user in response to the key change reminder message, the key change instruction including the new key; The key change request is sent to the second system according to the key change instruction.

3. The method according to claim 2, characterized in that, If no key change instruction is received within a preset time period after the key change reminder message is sent, the method further includes: The new key is automatically generated, and the key change request is sent to the second system.

4. The method according to claim 1, characterized in that, Changing the current key to the new key includes: The new key is saved as a file to the server of the first system, and the current key is deleted.

5. The method according to claim 1, characterized in that, include: In cases where the multiple interfaces included in the first system correspond to different types of situations, monitoring the difference between the current key's expiration time and the current time, and sending a key change request to the second system, includes: For each of the aforementioned types, execute: Monitor the difference between the expiration time of the current key and the current time for one or more interfaces corresponding to the type; If the difference is equal to or less than the preset threshold, a key change request corresponding to one or more interfaces of the type is generated and sent to the second system.

6. The method according to claim 5, characterized in that, The step of changing the current key to the new key includes: Change all the current keys of one or more interfaces corresponding to the type to the new keys.

7. The method according to claim 6, characterized in that, The step of encrypting data transmission with the second system using the new key includes: Receive a data processing request, which indicates the data to be processed; Determine the transmission interface based on the data processing request; The data to be processed is encrypted using the new key of the transmission interface; The encrypted data to be processed is sent to the second system through the transmission interface.

8. The method according to claim 7, characterized in that, The step of encrypting the data to be processed using the new key of the transmission interface includes: The new key is obtained based on the file information of the transmission interface. The data to be processed is encrypted using the new key.

9. A data transmission device, characterized in that, Applied to the first system, including: The timed monitoring module is used to monitor the difference between the expiration time of the current key and the current time. The monitoring period for the current key depends on the remaining validity period of the current key. The longer the remaining validity period, the longer the monitoring period, and the shorter the remaining validity period, the shorter the monitoring period. The key generation module is used to send a key change request to the second system when the difference is equal to or less than a preset threshold. The key change request includes a new key, the effective time and expiration time of the new key. A receiving module is used to receive feedback messages from the second system in response to the key change request; The key change synchronization module, when the feedback message is positive, is used to change the current key to the new key and synchronize the change result to the second system; when the feedback message is negative, it determines whether the effective time of the new key is greater than the expiration time of the current key; if so, it modifies the effective time of the new key so that the effective time of the modified new key is less than or equal to the expiration time of the current key; and sends a modified key change request to the second system according to the effective time of the modified new key. The first encrypted transmission module is used to perform encrypted data transmission with the second system according to the new key.

10. A data transmission method, characterized in that, Applied to the second system, including: The system receives a key change request from a first system, the key change request including a new key, the effective time and the expiration time of the new key; the first system monitors the difference between the current key's expiration time and the current time, and sends a key change request to the second system if the difference is equal to or less than a preset threshold; wherein, the monitoring period for the current key depends on the remaining validity period of the current key, the longer the remaining validity period, the longer the monitoring period, and the shorter the remaining validity period, the shorter the monitoring period; A feedback message for the key change request is sent to the first system, so that if the feedback message is positive, the first system changes the current key to the new key and synchronizes the change result with the second system; if the feedback message is negative, it is determined whether the effective time of the new key is greater than the expiration time of the current key; if so, the effective time of the new key is modified so that the effective time of the modified new key is less than or equal to the expiration time of the current key; and based on the effective time of the modified new key, a modified key change request is sent to the second system. Receive the change results synchronized by the first system; Data is encrypted and transmitted with the first system using the new key.

11. The method according to claim 10, characterized in that, The key change request also includes: the effective time and expiration time of the new key, further including: When the effective time of the new key is less than or equal to the expiration time of the current key, a positive feedback for the key change request is sent to the first system.

12. The method according to claim 11, characterized in that, include: When the effective time of the new key is greater than the expiration time of the current key, negative feedback is sent to the first system in response to the key change request.

13. A data transmission device, characterized in that, Applied to the second system, including: The receiving module is used to receive a key change request sent by the first system. The key change request includes a new key, the effective time and the expiration time of the new key. The first system monitors the difference between the expiration time of the current key and the current time. If the difference is equal to or less than a preset threshold, the first system sends a key change request to the second system. The monitoring period for the current key depends on the remaining validity period of the current key. The longer the remaining validity period, the longer the monitoring period. The shorter the remaining validity period, the shorter the monitoring period. The key change response module is used to send a feedback message to the first system in response to the key change request, so that if the feedback message is positive, the first system changes the current key to the new key and synchronizes the change result to the second system; if the feedback message is negative, it determines whether the effective time of the new key is greater than the expiration time of the current key; if so, it modifies the effective time of the new key so that the effective time of the modified new key is less than or equal to the expiration time of the current key; and sends the modified key change request to the second system according to the effective time of the modified new key. The second encrypted transmission module, after the receiving module receives the change result synchronized by the first system, is used to perform encrypted data transmission with the first system according to the new key.

14. A data transmission system, characterized in that, include: The data transmission device for the first system as described in claim 9, and the data transmission device for the second system as described in claim 13, wherein... The data transmission device applied to the first system is used to monitor the difference between the expiration time of the current key and the current time. The monitoring period for the current key depends on its remaining validity period; a longer remaining validity period results in a longer monitoring period, and a shorter remaining validity period results in a shorter monitoring period. When the difference between the expiration time of the current key and the current time is equal to or less than a preset threshold, a key change request is sent to the data transmission device applied to the second system. The key change request includes a new key, the effective time of the new key, and its expiration time. The device receives a feedback message from the data transmission device applied to the second system regarding the key change request. If the feedback message is positive, the current key is changed to the new key, and the change result is synchronized to the data transmission device applied to the second system. If the feedback message is negative, it determines whether the effective time of the new key is greater than the expiration time of the current key. If so, the effective time of the new key is modified so that the modified effective time of the new key is less than or equal to the expiration time of the current key. Based on the modified effective time of the new key, a modified key change request is sent to the second system. Data is then encrypted and transmitted between the device and the data transmission device applied to the second system using the new key.

15. A server, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-8, 10-12.

16. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-8, 10-12.

Images