Data transmission control method and device, electronic equipment and readable storage medium

Abstract

The present disclosure provides a data transmission control method, device, electronic equipment and readable storage medium. The data transmission control method is applied to a data management server, and the method comprises the following steps: sending a first public key to a first data system, wherein a first private key matched with the first public key is stored in the data management server; receiving target data sent by the first data system, wherein the target data is encrypted by the first public key by the first data system; decrypting the target data by the first private key matched with the first public key; encrypting the decrypted target data by a second public key, wherein the second public key is received from a second data system; and sending the target data encrypted by the second public key to the second data system.

Description

TECHNICAL FIELD

[0001] Embodiments of the present disclosure relate to the technical field of computer, and particularly, to a data transmission control method and device, electronic equipment and readable storage medium. BACKGROUND

[0002] With the development of information technology, information management of data has become a trend. In order to realize the interaction and utilization of data, various data usually need to be transmitted in different data systems. The data may include many important or private information. Therefore, the security and privacy need to be improved in the data transmission process. SUMMARY

[0003] Embodiments of the present disclosure provide a data transmission control method and device, data management server, electronic equipment and readable storage medium.

[0004] To solve the above problems, the present disclosure is implemented as follows:

[0005] In a first aspect, the embodiments of the present disclosure provide a data transmission control method applied to a data management server, comprising the following steps:

[0006] sending the first public key to the first data system, wherein the data management server stores a first private key matched with the first public key;

[0007] receiving target data sent by the first data system, wherein the target data is encrypted by the first public key by the first data system;

[0008] decrypting the target data by the first private key matched with the first public key;

[0009] encrypting the decrypted target data by a second public key, wherein the second public key is received from a second data system;

[0010] sending the target data encrypted by the second public key to the second data system.

[0011] In some embodiments, before the step of encrypting the decrypted target data by a second public key, the method further comprises:

[0012] digitally signing the target data in the decrypted state by using the first private key;

[0013] The step of encrypting the decrypted target data by a second public key comprises:

[0014] encrypting the target data with digital signature by a second public key.

[0015] In some embodiments, before the step of digitally signing the target data in the decrypted state by using the first private key, the method further comprises:

[0016] confirming whether the first public key is saved in the second data system;

[0017] in the case that the first public key is saved in the second data system, performing the step of digitally signing the target data in the decrypted state by using the first private key;

[0018] in the case that the first public key is not saved in the second data system, encrypting the target data in the decrypted state and not digitally signed by the second public key.

[0019] In some embodiments, the step of digitally signing the target data in the decrypted state by using the first private key comprises:

[0020] generating a hash value of the target data by a hash algorithm;

[0021] adding a time stamp and a random string in the hash value and encrypting by the first private key to obtain a digital signature; and

[0022] encrypting the digital signature by the second public key.

[0023] In some embodiments, before the step of encrypting the target data in the decrypted state by the second public key, the method further comprises:

[0024] verifying the verification information of the first data system corresponding to the target data, the verification information comprising at least one of an IP address and hardware information;

[0025] in the case that the verification information is verified, performing the step of encrypting the target data in the decrypted state by the second public key.

[0026] In some embodiments, the step of verifying the verification information of the first data system corresponding to the target data comprises:

[0027] obtaining a correspondence between an IP address and hardware information;

[0028] extracting the target hardware information contained in the target data decrypted by the first private key;

[0029] verifying whether the correspondence is satisfied between the target IP address of the first data system sending the target data and the target hardware information;

[0030] In the case that the correspondence is met, it is confirmed that the check information passes the check.

[0031] In a second aspect, the embodiments of the present disclosure provide a data transmission control device, applied to a data management server, the data transmission control device comprising:

[0032] a first public key sending module, configured to send the first public key to the first data system, wherein the data management server stores a first private key matched with the first public key;

[0033] a target data receiving module, configured to receive target data sent by the first data system, wherein the target data is encrypted by the first public key by the first data system;

[0034] a decryption module, configured to decrypt the target data by the first private key matched with the first public key;

[0035] an encryption module, configured to encrypt the decrypted target data by a second public key, wherein the second public key is received from a second data system;

[0036] a data sending module, configured to send the target data encrypted by the second public key to the second data system.

[0037] In some embodiments, the data transmission control device further comprises:

[0038] a digital signature module, configured to digitally sign the target data in the decrypted state by the first private key;

[0039] the encryption module is specifically configured to encrypt the target data after digital signature by the second public key.

[0040] In a third aspect, the embodiments of the present disclosure provide an electronic device, comprising a memory, a processor, and a program stored in the memory and capable of running on the processor; the processor is configured to read the program in the memory to implement the steps in the data transmission control method according to any one of the above.

[0041] In a fourth aspect, the embodiments of the present disclosure provide a readable storage medium for storing a program, wherein the program is executed by a processor to implement the steps in the data transmission control method according to any one of the above. BRIEF DESCRIPTION OF DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings needed to be used in the description of the embodiments of the present disclosure will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and other drawings can be obtained by those of ordinary skill in the art without creative labor under the premise of the drawings.

[0043] Figure 1 is a flow diagram of the data transmission control method provided by the embodiments of the present disclosure;

[0044] Figure 2 is an architecture diagram of the data transmission control system provided by the embodiments of the present disclosure;

[0045] Figure 3 is a structure diagram of the secret key pair management module provided by the embodiments of the present disclosure;

[0046] Figure 4 is a structure diagram of the data encryption module provided by the embodiments of the present disclosure;

[0047] Figure 5 is another flow diagram of the data transmission control method provided by the embodiments of the present disclosure

[0048] Figure 6 is a structure diagram of the data transmission control device provided by the embodiments of the present disclosure;

[0049] Figure 7 is a structure diagram of the electronic device provided by the embodiments of the present disclosure. DETAILED DESCRIPTION

[0050] The technical solutions of the embodiments of the present disclosure will be described clearly and completely in the following with reference to the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only some embodiments of the present disclosure, not all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative labor under the premise of the embodiments in the present disclosure, all belong to the scope of protection of the present disclosure.

[0051] The terms "first", "second", and the like in the embodiments of the present disclosure are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. In addition, the terms "comprise" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device comprising a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices. In addition, "and / or" is used in the present application to represent at least one of the connected objects, for example, A and / or B and / or C, which represents 7 cases including A alone, B alone, C alone, A and B both exist, B and C both exist, A and C both exist, and A, B and C all exist.

[0052] The embodiments of the present disclosure provide a data transmission control method.

[0053] As shown in Figure 1 , the method is applied to a data management server in a data transmission control system.

[0054] As shown in Figure 2 , in one exemplary embodiment, the data transmission control system includes a first data system, a data management server and a second data system, and the first data system and the second data system are in communication connection with the data management server.

[0055] As shown in Figure 2 , wherein the data management server includes an adapter module, a processor module, a controller module and a forwarder module, wherein the adapter module is used to manage the data interaction between the data management server and the first data system, and the forwarder module is used to manage the data interaction between the data management server and the second data system. The controller module is used to control the working process of the adapter module, the processor module and the forwarder module.

[0056] Please refer to Figures 2 to 4 , the processor module includes a data encryption module and a key pair management module, wherein the adapter module, the processor module, the controller module and the forwarder module data encryption module are used to perform encryption and decryption control of data, and the key pair management module is used to realize first key management, second key management, address information management and data interface function, wherein the key pair management module is based on data interface for data transmission. The data encryption module is used to generate the first key and data encryption, and the data encryption module also includes a data interface for data transmission.

[0057] As shown in Figure 1 and Figure 5 , in one embodiment, the method includes the following steps:

[0058] Step 101: sending the first public key to the first data system, wherein the data management server stores a first private key matched with the first public key.

[0059] In some embodiments, the first public key and the first private key matched with each other are generated by the data management server, and then the first public key is sent to the first data system.

[0060] Specifically, in the present embodiment, the data management server first generates a first secret key, which includes the first public key and the first private key matched with each other. It can be understood that when the first public key is used to encrypt data, the first private key is needed to decrypt the data.

[0061] When each data system accesses the data management server, the data management server sends the first public key to each data system, such as the first data system and the second data system mentioned above.

[0062] It can be understood that in implementation, the data system can be sent only to the data system having data sending demand, which refers to the data system needing to send data to other data systems through the data management platform. For the data system only needing to receive data and not needing to send data, the first public key can not be obtained.

[0063] In some other embodiments, the first public key needs to be sent to all data systems accessing the data management server, and further secondary encryption and decryption are performed on the transmitted data to further improve the data transmission security.

[0064] Taking the first data system as an example, when the first data system needs to send target data to the data management server, the first data system sends the target data encrypted by the first public key to the data management server, that is, the first data system first encrypts the target data by the first public key, and then sends the target data encrypted by the first public key to the data management server.

[0065] Step 102: receiving the target data sent by the first data system, wherein the target data is encrypted by the first public key by the first data system. The data management server in the present embodiment can be understood as providing a data management interface or a data transmission platform for data transmission. It needs to be understood that in order to realize different businesses, different data systems usually need to be provided, and in order to realize business communication, different data systems need to interact with each other.

[0066] For example, each company can manage the data information of employees through its own company data system. When it is necessary to arrange a physical examination for an employee, the data information of the employee can be exported from the company data system and then sent to the physical examination data system of the physical examination institution, so as to establish a physical examination plan and perform employee health management. In this process, data needs to be transmitted from the company data system to the physical examination data system through a data management interface.

[0067] In order to reduce the management cost, the data management interface can provide services for data interaction between multiple different data systems.

[0068] In one embodiment, the target data can include one or more of the following information: an access authorization code, an application id, a business system id, a user information object, a user primary key, an ID card, a mobile phone number, a resident name, a set of index data, an institution id, an index id, a batch id, a detection time, a detection result, an extension field, a device information object, a device SN (Serial Number) code, a device name, a product type id, a device model, a set of index definition Map, an index id, an index unit, an index code, and an index name.

[0069] Among the above information, the access authorization code is used to realize access authorization verification, and the application id and the business system id are used to represent specific businesses used by the user. The user information object, the user primary key, the ID card, the mobile phone number, and the resident name are used to represent the identity information and the contact information of the user, and related data needs to be collected and transmitted under the condition that the user's authorization is obtained and various regulations and privacy restrictions are met. The institution id, the index id, the batch id, the detection time, the detection result, the device information object, the device SN code, the device name, the product type id, and the device model are used to represent information related to the detection project, the detection result, and the device used for detection. The extension field is used to store extension information, which can be, for example, an identification code for a device that can be used by multiple people. The set of index definition Map, the index id, the index unit, the index code, and the index name are used to represent information related to the detection index.

[0070] Step 103: decrypting the target data through a first private key matched with the first public key.

[0071] Since the first private key corresponding to the first public key is stored in the data management server, after the data management server receives the target data encrypted through the first public key, the data management server can decrypt the target data sent by the first data system through the first private key.

[0072] In some embodiments, the method further includes:

[0073] checking the checking information of the first data system corresponding to the target data, the checking information including at least one of an IP address and hardware information;

[0074] In the case that the checking information passes the check, the step of encrypting the decrypted target data by a second public key is performed.

[0075] In some embodiments, in order to further improve the security of data transmission, the target data can be further checked for security before or after decryption.

[0076] In an exemplary embodiment, an IP (Internet Protocol) address white list can be established, and when the target data is decrypted, the IP address of the first data system is checked. If the IP address of the first data system is an IP address in the IP address white list, it is considered to pass the verification, and the transmission of the target data is allowed. If the IP address does not pass the verification, the transmission of the target data is prohibited, which can directly avoid unauthorized data systems sending data and improve security.

[0077] In some embodiments, the above information and IP address included in the target data can also be cross-checked.

[0078] In some embodiments, checking the checking information of the first data system corresponding to the target data includes:

[0079] Obtaining the correspondence between the IP address and the hardware information;

[0080] Extracting the target hardware information included in the target data decrypted by the first private key;

[0081] Checking whether the target IP address of the first data system sending the target data and the target hardware information satisfy the correspondence;

[0082] In the case that the correspondence is satisfied, it is confirmed that the checking information passes the check.

[0083] In an exemplary embodiment, the IP addresses of the data systems that can be the first data system and the hardware information, such as device SN code, physical address, and other hardware information, can be collected first. After the IP addresses and hardware information are collected, the correspondence is established.

[0084] In practice, when the IP address corresponding to the target information is checked, it is also checked whether the device SN code and the IP address satisfy the correspondence collected and saved in advance. If it is satisfied, it is considered to pass the check. If it is not satisfied, it is considered that the data may be tampered.

[0085] In some embodiments, the target data can be checked by physical address, hardware address, data hash value, etc. to improve the security of data transmission.

[0086] By adding the verification process, the legality of data system access can be ensured, and the possibility of secret key leakage endangering information security can be reduced.

[0087] In some embodiments, the method further comprises:

[0088] The target data in the decrypted state is digitally signed using the first private key.

[0089] Correspondingly, the decrypted target data is encrypted by a second public key, including:

[0090] The target data that has been digitally signed is encrypted by a second public key.

[0091] In some embodiments, the target data is twice encrypted by digital signature.

[0092] In some embodiments, when twice encryption and decryption are required, the target data is digitally signed by a first private key, and twice encrypted data is attached to the target data in the decrypted state.

[0093] In some embodiments, the step of digitally signing includes:

[0094] A hash value of the target data is generated by a hash algorithm;

[0095] A timestamp and a random string are added to the hash value, and the first private key is used for encryption to obtain a digital signature; the encrypted target data is encrypted by a second public key, including:

[0096] The digital signature is encrypted by the second public key.

[0097] Here, the digital signature includes a timestamp, and can also include an encryption field. For example, the encryption field can include a random string, etc. In implementation, the hash value of the target data is generated by a hash algorithm, and then a timestamp and a random string are added to the hash value to complete the digital signature of the target data.

[0098] It can be understood that twice encryption includes two encryption processes of digital signature by the first private key and encryption by the second public key. Correspondingly, the decryption process of the target data also includes two steps of decryption by the second private key and digital signature by the first public key.

[0099] Step 104: The decrypted target data is encrypted by a second public key, wherein the second public key is received from a second data system.

[0100] Next, the target data that has been digitally signed is encrypted by using the second public key.

[0101] In some embodiments, before step 104, the method further comprises:

[0102] Receiving the second public key sent by the second data system.

[0103] In this embodiment, the second public key corresponds to the second data system, specifically, each second public key uniquely corresponds to one second data system, and each second data system can correspond to one or more groups of secret keys, each group of secret keys including a public key and a secret key that match each other.

[0104] In an exemplary embodiment, the second data system first generates a group of second secret keys, which includes a second public key and a second private key.

[0105] When the second data system accesses the data management server, the second public key is sent to the data management server. When the data management server needs to send data to the second data system, the target data is encrypted by using the second public key.

[0106] It should be understood that in the above process, if the first public key is not saved in the second data system, the target data in the decrypted state does not need to be digitally signed before the data management server sends the target data to the second data system.

[0107] In some embodiments, before step 104, the method further comprises:

[0108] Digitally signing the target data in the decrypted state by using the first private key;

[0109] The encryption of the decrypted target data by the second public key comprises:

[0110] The target data that has been digitally signed is encrypted by the second public key.

[0111] If the first public key is saved in the second data system, the target data in the decrypted state can be digitally signed according to the above steps before the data management server sends the target data to the second data system, so as to further improve the security.

[0112] When the target data is digitally signed by the first public key, the step 104 comprises:

[0113] The target data and the data information are encrypted by using the second public key.

[0114] In some embodiments, before the step of digitally signing the target data in the decrypted state by using the first private key, the method further comprises:

[0115] confirming whether the first public key is saved in the second data system;

[0116] in the case that the first public key is saved in the second data system, performing the step of digitally signing the target data in the decrypted state by using the first private key;

[0117] in the case that the first public key is not saved in the second data system, encrypting the target data in the decrypted state and not digitally signed by the second public key.

[0118] In the embodiment, it can be detected whether the first public key is saved in the second data system, and in the implementation, it can be detected whether there is a sending record of sending the first public key to the second data system, or query information can be sent to the second data system, and then it is confirmed whether the first public key exists in the second data system according to the reply result of the second data system.

[0119] If the first public key exists in the second data system, the step of digitally signing is performed according to the above process.

[0120] If the first public key does not exist in the second data system, the target data can be encrypted only once, specifically, for the target data in the decrypted state, the target data is encrypted only by the second public key, and then sent to the second data system.

[0121] In some other embodiments, the first public key can be sent to the second data system first, and then the target data is encrypted twice according to the above process to ensure the security of data transmission.

[0122] Step 105: sending the target data encrypted by the second public key to the second data system.

[0123] After the target data is encrypted by the second public key, the encrypted target data is sent to the second data system.

[0124] After the second data system receives the target data, the target data is decrypted by using the second private key, and in the case that the target data is digitally signed by the first private key, the target data needs to be further digitally signed by the first public key, so that the target data required to be transmitted is obtained.

[0125] It needs to be understood that the number of data systems can be multiple, and each data system can also access multiple data management platforms. In the embodiment, since the target data is encrypted by the second public key provided by the second data system, even if the target data is incorrectly transmitted to other data systems, the other data systems cannot decrypt and verify the target data, thereby ensuring the uniqueness of the target data path confirmation, that is, the second data system can uniquely confirm the corresponding data management server through the used first public key, and at the same time, the uniqueness of the data decryption and verification and reading path is also ensured, and it is ensured that the target data cannot be read by other data systems.

[0126] The data management server is configured to perform the steps of the data transmission control method embodiments described above, and can achieve similar or the same technical effects.

[0127] The data management server is configured to perform the steps of the data transmission control method embodiments described above, and can achieve similar or the same technical effects.

[0128] The data management server generates a first public key and a first private key that match each other;

[0129] The data management server sends the first public key to the first data system and the second data system;

[0130] The first data system sends target data encrypted by the first public key to the data management server;

[0131] The data management server decrypts the target data by the first private key;

[0132] The data management server digitally signs the decrypted target data by the first private key;

[0133] The second data system generates a second public key and a second private key;

[0134] The second data system sends the second public key to the data management server;

[0135] The data management server encrypts the digitally signed target data by the second public key;

[0136] The data management server sends the target data signed by the second public key to the second data system;

[0137] The second data system decrypts the target data by the second private key;

[0138] The second book system decrypts the target data after decryption by the second private key.

[0139] The steps of the data transmission control method of the embodiment can refer to the data transmission method embodiments described above, which will not be repeated here.

[0140] The data transmission control system of the embodiment is configured to perform the steps of the data transmission control method described above.

[0141] The data transmission control system of the embodiment is configured to perform the steps of the data transmission control method described above.

[0142] As shown in FIG. 6, in one embodiment, the data transmission control device 600 includes: Figure 6

[0143] The first public key sending module 601 is configured to send the first public key to the first data system, wherein the data management server stores a first private key matched with the first public key;

[0144] The target data receiving module 602 is configured to receive target data sent by the first data system, wherein the target data is encrypted by the first public key by the first data system;

[0145] The decryption module 603 is configured to decrypt the target data by the first private key matched with the first public key;

[0146] The encryption module 604 is configured to encrypt the decrypted target data by a second public key, wherein the second public key is received from a second data system;

[0147] The data sending module 605 is configured to send the target data encrypted by the second public key to the second data system.

[0148] In some embodiments, the data transmission control device further includes:

[0149] The digital signature module is configured to digitally sign the target data in the decrypted state by the first private key;

[0150] The encryption module 604 is specifically configured to encrypt the target data after digital signature by the second public key.

[0151] In some embodiments, the data transmission control device further includes:

[0152] ​The first public key detection module is configured to determine whether the first public key is stored in the second data system.

[0153] The digital signature module is configured to, in the case where the first public key is stored in the second data system, perform the step of digitally signing the target data in the decrypted state by using the first private key.

[0154] In the case where the first public key is not stored in the second data system, the target data after decryption and before digital signature is encrypted by using the second public key.

[0155] In some embodiments, the digital signature module includes:

[0156] The hash value calculation submodule is configured to generate a hash value of the target data by using a hash algorithm.

[0157] The adding submodule is configured to add a time stamp and a random string into the hash value.

[0158] The encryption module 604 is specifically configured to encrypt the hash value added with the time stamp and the random string by using the first private key to obtain a digital signature, and encrypt the digital signature by using the second public key.

[0159] In some embodiments, the system further includes:

[0160] The verification module is configured to verify the verification information of the first data system corresponding to the target data, the verification information including at least one of an IP address and hardware information.

[0161] The encryption module 604 is configured to, in the case where the verification information passes the verification, perform the step of encrypting the target data after decryption by using the second public key.

[0162] In some embodiments, the verification module includes:

[0163] The corresponding relationship acquisition submodule is configured to acquire a corresponding relationship between the IP address and the hardware information.

[0164] The extraction submodule is configured to extract target hardware information included in the target data decrypted by using the first private key.

[0165] The verification submodule is configured to verify whether the corresponding relationship is satisfied between a target IP address of the first data system sending the target data and the target hardware information.

[0166] The confirmation submodule is configured to, in the case where the corresponding relationship is satisfied, confirm that the verification information passes the verification.

[0167] The data transmission control device 600 of the embodiment can implement each step of the data transmission control method embodiment described above and achieve substantially the same technical effects, and thus no further description is provided herein.

[0168] The embodiment of the present disclosure also provides an electronic device. Referring to Figure 7 The electronic device can include a processor 701, a memory 702, and a program 7021 stored in the memory 702 and executable on the processor 701.

[0169] The program 7021, when executed by the processor 701, can implement any step of the method embodiments described above and achieve the same beneficial effects, and thus no further description is provided herein.

[0170] Those skilled in the art can understand that all or part of the steps of the method embodiments described above can be completed by program instructions related to hardware, and the program can be stored in a readable medium.

[0171] The embodiment of the present disclosure also provides a readable storage medium, which stores a computer program. The computer program, when executed by a processor, can implement any step of the method embodiments described above and achieve the same technical effects. To avoid repetition, no further description is provided herein.

[0172] The storage medium, such as a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0173] It should be noted that the division of each module above is only a logical division of functions, and all or part of the modules can be integrated into one physical entity, or can be physically separated. These modules can all be implemented in the form of software called by a processing element, or all be implemented in the form of hardware, or part of the modules be implemented in the form of software called by a processing element and part of the modules be implemented in the form of hardware. For example, the determination module can be a separate processing element, or can be integrated into a chip of the device, or can be stored in the memory of the device in the form of program code, and called and executed by a processing element of the device. The implementation of other modules is similar. In addition, all or part of the modules can be integrated together or independently implemented. The processing element described herein can be an integrated circuit having a signal processing capability. In the implementation process, each step of the above method or each module can be completed by an integrated logic circuit of hardware or an instruction in the form of software in the processing element.

[0174] For example, each module, unit, sub-unit or sub-module can be one or more integrated circuits configured to implement the above method, for example: one or more Application Specific Integrated Circuits (ASICs), or, one or more Digital Signal Processors (DSPs), or, one or more Field Programmable Gate Arrays (FPGAs), etc. For another example, when the above certain module is implemented in the form of a processing element scheduling code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor that can invoke code. For another example, these modules can be integrated together to implement in the form of a system-on-a-chip (SOC).

[0175] The above is the preferred embodiment of the present disclosure, it should be noted that for those skilled in the art, without departing from the principles of the present disclosure, a number of improvements and refinements can also be made, which should be considered as the protection scope of the present disclosure.

Claims

1. A data transmission control method applied to a data management server, the method comprising the steps of: sending a first public key to a first data system, wherein the data management server stores a first private key matching the first public key; receiving target data sent by the first data system, wherein the target data is encrypted by the first public key by the first data system; decrypting the target data by the first private key matching the first public key; encrypting the decrypted target data by a second public key, wherein the second public key is received from a second data system; sending the target data encrypted by the second public key to the second data system; before the step of encrypting the decrypted target data by the second public key, the method further comprises: digitally signing the target data in the decrypted state by the first private key; the step of encrypting the decrypted target data by the second public key comprises: encrypting the target data with the digital signature by the second public key; the step of digitally signing the target data in the decrypted state by the first private key comprises: generating a hash value of the target data by a hash algorithm; adding a timestamp and a random string in the hash value and encrypting by the first private key to obtain a digital signature; the step of encrypting the decrypted target data by the second public key comprises: encrypting the digital signature by the second public key; before the step of digitally signing the target data in the decrypted state by the first private key, the method further comprises: confirming whether the first public key is stored in the second data system; in the case that the first public key is stored in the second data system, performing the step of digitally signing the target data in the decrypted state by the first private key; in the case that the first public key is not stored in the second data system, encrypting the decrypted target data without digital signature by the second public key; after the step of sending the target data encrypted by the second public key to the second data system, the method further comprises: after the second data system receives the target data encrypted by the second public key, decrypting the target data by a second private key, and in the case that the target data is digitally signed by the first private key, digitally signing the target data by the first public key.

2. The method of claim 1, wherein, before the step of encrypting the decrypted target data by the second public key, the method further comprises: verifying verification information of the first data system corresponding to the target data, the verification information comprising at least one of an IP address and hardware information; in the case that the verification information passes the verification, performing the step of encrypting the decrypted target data by the second public key.

3. The method of claim 2, wherein, the step of verifying the verification information of the first data system corresponding to the target data comprises: obtaining a correspondence between an IP address and hardware information; extracting target hardware information contained in the target data decrypted by the first private key; verifying whether the target IP address of the first data system sending the target data and the target hardware information satisfy the correspondence; In the case that the correspondence is met, it is confirmed that the check information passes the check.

4. A data transmission control apparatus applied to a data management server, comprising: a first public key sending module configured to send a first public key to a first data system, wherein the data management server stores a first private key matched with the first public key; a target data receiving module configured to receive target data sent by the first data system, wherein the target data is encrypted by the first public key by the first data system; a decryption module configured to decrypt the target data by the first private key matched with the first public key; an encryption module configured to encrypt the decrypted target data by a second public key, wherein the second public key is received from a second data system; a data sending module configured to send the target data encrypted by the second public key to the second data system; a digital signature module configured to digitally sign the target data in the decrypted state by the first private key; the encryption module is specifically configured to encrypt the target data with the digital signature by the second public key; the digital signature module comprises: a hash value calculation submodule configured to generate a hash value of the target data by a hash algorithm; an adding submodule configured to add a time stamp and a random string in the hash value; the encryption module is configured to encrypt the hash value with the time stamp and the random string by the first private key to obtain a digital signature, and encrypt the digital signature by the second public key; a first public key detection module configured to confirm whether the first public key is stored in the second data system; the digital signature module is configured to perform the step of digitally signing the target data in the decrypted state by the first private key in the case that the first public key is stored in the second data system; in the case that the first public key is not stored in the second data system, the target data after decryption and without digital signature is encrypted by the second public key; after the second data system receives the target data encrypted by the second public key, the target data is decrypted by a second private key, and in the case that the target data is digitally signed by the first private key, the target data is un-signed by the first public key.

5. An electronic device comprising: A memory, a processor, and a program stored in the memory and executable on the processor; the processor is configured to read the program in the memory to implement the steps in the data transmission control method according to any one of claims 1 to 3.

6. A readable storage medium for storing a program, wherein the program is executed by a processor to implement the steps in the data transmission control method according to any one of claims 1 to 3.

Images