System, method, device and medium for securely exchanging large-capacity files between physically isolated networks

Abstract

The present application discloses a data interaction system between physically isolated networks, wherein an Internet data ferrying task scheduling server is set on the Internet end, an intranet data ferrying task scheduling server is set on the intranet end, and an optical disk ferry machine 1 and an optical disk ferry machine 2 are set between the two task scheduling servers. The ferrying task is initiated by triggering the business system data and the ferrying result. The Internet data ferrying task scheduling server and the intranet data ferrying task scheduling server create data transmission tasks, control data subpackaging, build a data transmission fault tolerance mechanism, perform security verification, write data through the optical disk ferry machine 1 and the optical disk ferry machine 2, and control the data interaction scheduling between the internal and external networks. The present application is suitable for efficiently and accurately transmitting large files including audio and video data between physically isolated internal and external networks, and verifying the correctness of the transmitted files.

Description

Technical Field

[0001] The present application relates to the fields of computer information technology and information security technology, and specifically to the secure transmission and verification of large-capacity files between physically isolated networks. Background Art

[0002] The "Regulations on the Administration of Confidentiality of Computer Information Systems and the Internet" requires, among other things, that "computer information systems involving state secrets must not be directly or indirectly connected to the Internet or other public information networks, and must be physically isolated." According to the requirements, data exchange between physically isolated networks can only be done by burning and copying disks. This method is inefficient, involves a lot of repetitive work, is prone to errors, and cannot guarantee security.

[0003] For example, the data related to the driving test platform is in the six-in-one system of the public security network, while the public application is on the Internet. The internal network belongs to the confidential network public security intranet, which is physically isolated from the Internet. The vehicle management office needs to manage the driver's information, query, print, sign the student information, etc. The student-related information and other image data need to be directly transmitted to the intranet system, and the intranet feedback information also needs to be directly transmitted to the external network driving school and students, so that the driver's license business can be handled quickly and conveniently. The whole process requires the safe upload and management of file information. A large number of files, pictures, and materials need to be transmitted between the internal and external networks, and involve issues such as internal network information security and external network personal privacy. In order to interact and transmit data, in general, data interaction is achieved by manually copying data between two networks. The need for manual data copying takes up manpower, and there are data tampering or other risks during data exchange.

[0004] Publication number: CN110602213A, name: A method for data exchange between networks with different confidentiality levels based on CD ferrying, discloses a method for data exchange between networks with different confidentiality levels based on CD ferrying, firstly, the data export approval server receives the data export application submitted by the applicant through the client; after approval, it sends a data export burning instruction to the CD ferrying machine; the CD ferrying machine completes the burning, printing and CD ferrying operations; after the CD burning and label printing are completed, the read-only CD-ROM of the intranet intermediate audit verification device automatically reads the data, and the CD content is automatically verified and disinfected through the intermediate audit verification module; the external network read-only CD-ROM reads the CD data and uploads the data to the data management and distribution server, and the data management and distribution server distributes the data according to the task information; the applicant downloads the submitted export data through the data management and distribution server to realize the data migration between the internal and external networks. However, this application does not verify the data tampering. If there is artificial tampering of the data during the ferrying, this method cannot be identified.

[0005] Publication number CN104113532A, named "Method for automatic and secure information exchange between physically isolated networks", provides a method for physically isolated networks, including information extraction, information compression, information encryption, information transmission, information decryption, information decompression, information restoration, information exchange monitoring and other steps, to achieve a complete closed-loop information transmission mechanism, making information exchange automated. The application does not identify and distinguish all the information transmitted, and the processing efficiency is low for the situation where some images and audio and video need to be transferred.

[0006] In the data interaction process of the driving test Internet system application, in the application of internal and external network data exchange, the automatic CD-burning method for internal and external network data exchange is a relatively safe and reliable method. It also reduces manual intervention in the data exchange process, liberates manpower, and provides safe and reliable data transmission. Summary of the invention

[0007] In response to the above-mentioned problems existing in the prior art, the present application verifies the data information that needs to be transmitted interactively during the data interaction between physically isolated networks to check whether it has been tampered with, and chain-stores and encrypts the hash codes of the files that need to be transferred, thereby ensuring the validity and integrity of the data.

[0008] In view of this, based on one aspect of the present application, a large-capacity data interaction system between physically isolated networks is provided, an Internet data ferrying task scheduling server is set on the Internet end, an intranet data ferrying task scheduling server is set on the intranet end, and an optical disk ferry machine 1 and an optical disk ferry machine 2 are set between the two task scheduling servers. The ferrying task is initiated by triggering the business system data and the ferrying result. The Internet data ferrying task scheduling server and the intranet data ferrying task scheduling server create data transmission tasks, control data subpackaging, build a data transmission fault-tolerant mechanism, perform security verification, write data through the optical disk ferry machine 1 and the optical disk ferry machine 2, and control the data interaction scheduling between the internal and external networks.

[0009] Further preferably, the security verification includes: using RSA1024 encryption algorithm to generate a public-private key pair, the public key is assigned to the Internet data ferry task scheduling server, and the private key is assigned to the intranet data ferry task scheduling server; the data subpackaging management and control includes: the Internet data ferry task scheduling server records the size of the requested ferry file, determines whether to trigger the ferry according to the ferry capacity, records the file size through each HTTP request, and determines whether the capacity of the file to be ferryed reaches a threshold to trigger the ferry; the data transmission fault-tolerant mechanism includes: matching the HASH character splicing of the ferry file with the decryption key file, if they are equal, executing the ferry operation, otherwise recording the task status and writing it into the ferry data folder.

[0010] Further preferably, the control of data interaction scheduling between the internal and external networks further includes: scheduling the external network data to the internal network server through the CD ferry machine 1, scheduling the internal network data to the external network server through the CD ferry machine 2, the Internet ferry task scheduling server controls the CD ferry machine 1 to start the CD writing task, and controls the data to be written to the internal network data ferry task scheduling server; the internal network data ferry task scheduling server reads the key file and decrypts it with a private key, compares the decrypted string with the string composed of the HASH code of the sorted file, and if they are the same, writes the data to the internal network server via an HTTP request; the Internet ferry task scheduling server controls the CD ferry machine 2 to start the CD writing task, and controls the data to be written to the external network data ferry task scheduling server; the external network data ferry task scheduling server reads the key file and decrypts it with a public key, compares the decrypted string with the string composed of the HASH code of the sorted file, and if they are the same, writes the data to the external network server via an HTTP request.

[0011] Further preferably, the ferry task scheduling server sets the ferry working time, ferry task interval time, and maximum value of the ferry file, extracts the data in the ferry folder, and when the ferry capacity is reached, initiates the ferry task, and the server traverses all files in the ferry task that need to be scheduled, sorts them in ascending order by ASCII code by file name, obtains the HASH code of each file respectively and concatenates them into a string in the corresponding order, encrypts the string with the public key to obtain the ferry key and saves it in the key file, and when the ferry task is triggered, matches the ferry key with the decryption key transmitted by the corresponding CD ferry machine. If the match is successful, the file scheduling is implemented.

[0012] Further preferably, before starting the ferry task, a one-to-one correspondence table between the ferry task number and the folder name is generated, and the files to be ferried are stored in the folder. The ferry task scheduling server obtains the number of files in the ferry folder through the business system data trigger and the ferry result trigger. If the set ferry capacity threshold is reached, the ferry task is initiated, the ferry folder is traversed, the HASH values ​​of all files are obtained, and the files are arranged in ascending ASCII order according to the file names. The HASH values ​​of the files are concatenated in the same sequence to obtain a HASH string, and the concatenated HASH string is encrypted by a pre-assigned key, and the resulting string result is written into the key file, which is saved in the ferry task folder as a verification key.

[0013] According to another aspect of the present application, a method for large-capacity data interaction between physically isolated networks is proposed, which is characterized in that an Internet data ferrying task scheduling server is set on the Internet end, and an intranet data ferrying task scheduling server is set on the intranet end, and an optical disk ferry machine 1 and an optical disk ferry machine 2 are set between the two task scheduling servers, and the ferrying task is initiated by triggering business system data and ferrying results. The Internet data ferrying task scheduling server and the intranet data ferrying task scheduling server create data transmission tasks, control data subpackaging, build a data transmission fault-tolerant mechanism, and perform security verification. Data is written through the optical disk ferry machine 1 and the optical disk ferry machine 2 to control the data interaction scheduling between the internal and external networks.

[0014] Further preferably, the security verification includes: using RSA1024 encryption algorithm to generate a public-private key pair, the public key is assigned to the Internet data ferry task scheduling server, and the private key is assigned to the intranet data ferry task scheduling server; the data subpackaging management and control includes: the Internet data ferry task scheduling server records the size of the requested ferry file, determines whether to trigger the ferry according to the ferry capacity, records the file size through each HTTP request, and determines whether the capacity of the file to be ferryed reaches a threshold to trigger the ferry; the data transmission fault-tolerant mechanism includes: matching the HASH character splicing of the ferry file with the decryption key file, if they are equal, executing the ferry operation, otherwise recording the task status and writing it into the ferry data folder.

[0015] Further preferably, the control of data interaction scheduling between the internal and external networks further includes: scheduling the external network data to the internal network server through the CD ferry machine 1, scheduling the internal network data to the external network server through the CD ferry machine 2, the Internet ferry task scheduling server controls the CD ferry machine 1 to start the CD writing task, and controls the data to be written to the internal network data ferry task scheduling server; the internal network data ferry task scheduling server reads the key file and decrypts it with a private key, compares the decrypted string with the string composed of the HASH code of the sorted file, and if they are the same, writes the data to the internal network server via an HTTP request; the Internet ferry task scheduling server controls the CD ferry machine 2 to start the CD writing task, and controls the data to be written to the external network data ferry task scheduling server; the external network data ferry task scheduling server reads the key file and decrypts it with a public key, compares the decrypted string with the string composed of the HASH code of the sorted file, and if they are the same, writes the data to the external network server via an HTTP request.

[0016] Further preferably, the ferry task scheduling server sets the ferry working time, ferry task interval time, and maximum value of the ferry file, extracts the data in the ferry folder, and when the ferry capacity is reached, initiates the ferry task, and the server traverses all files in the ferry task that need to be scheduled, sorts them in ascending order by ASCII code by file name, obtains the HASH code of each file respectively and concatenates them into a string in the corresponding order, encrypts the string with the public key to obtain the ferry key and saves it in the key file, and when the ferry task is triggered, matches the ferry key with the decryption key transmitted by the corresponding CD ferry machine. If the match is successful, the file scheduling is implemented.

[0017] Further preferably, the intranet ferry task scheduling server reads the file from the CD ferried by the CD ferry machine's mechanical arm, obtains the Key file and decrypts it with the private key to obtain the spliced ​​chain HASH, reads the sorted file package from the CD ferry machine, obtains the chain HASH obtained by splicing the file HASH, and writes the file in the CD into a file package with the same chain HASH in the intranet server.

[0018] Further preferably, before starting the ferry task, a one-to-one correspondence table between the ferry task number and the folder name is generated, and the files to be ferried are stored in the folder. The ferry task scheduling server obtains the number of files in the ferry folder through the business system data trigger and the ferry result trigger. If the set ferry capacity threshold is reached, the ferry task is initiated, the ferry folder is traversed, the HASH values ​​of all files are obtained, and the files are arranged in ascending ASCII order according to the file names. The HASH values ​​of the files are concatenated in the same sequence to obtain a HASH string, and the concatenated HASH string is encrypted by a pre-assigned key, and the resulting string result is written into the key file, which is saved in the ferry task folder as a verification key.

[0019] According to another aspect of the present application, an electronic device is provided, comprising: a processor; and a memory storing a program, wherein the program comprises instructions, which, when executed by the processor, cause the processor to execute the method for data interaction between physically isolated networks as described above.

[0020] According to another aspect of the present application, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause the computer to execute the method for data interaction between physically isolated networks as described above.

[0021] This application is aimed at smart driving tests, etc., which require a large amount of audio and video data and files to be migrated and transmitted between physically isolated intranet and extranet, and to verify data tampering, so as to avoid frequent encryption and decryption of large files such as audio and video during the ferrying process, improve the ferrying processing efficiency, and can quickly identify human tampering with data during the ferrying process. It only verifies the file HASH code, significantly improves the efficiency of large file ferrying, and meets the anti-tampering security requirements in file interaction. This application is suitable for transmitting large files containing audio and video data between physically isolated intranet and extranet, and realizes the verification of the correctness of the transmitted files. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] like Figure 1 The figure is a schematic block diagram of a data interaction scheduling system with physical isolation of internal and external networks in an exemplary embodiment of the present application;

[0023] Figure 2 Shown is a schematic diagram of the data transmission task creation and security verification process in an exemplary embodiment of the present application;

[0024] Figure 3 Shown is a schematic diagram of creation and security verification of a data transmission task in an exemplary embodiment of the present application;

[0025] Figure 4 The figure shows a schematic diagram of the data subpackaging strategy control process in an example embodiment of the present application;

[0026] Figure 5 Shown is a schematic flow chart of a data transmission fault tolerance mechanism in an exemplary embodiment of the present application;

[0027] Figure 6 The figure shows a structural block diagram of an exemplary electronic device that can be used to implement the embodiments of the present application. DETAILED DESCRIPTION

[0028] The embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments described herein. Instead, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0029] It should be understood that the various steps described in the method implementation of the present application can be performed in different orders and / or performed in parallel. In addition, the method implementation may include additional steps and / or omit the steps shown. The scope of the present application is not limited in this respect.

[0030] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc. mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0031] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0032] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0033] In the driving test system, the test terminal devices are distributed in many places and the locations are scattered, which requires a lot of data interaction. The test center computers are deployed in the public security intranet. The test center network is physically isolated from the computers of the test center terminals. In general, in order to achieve data interconnection and intercommunication, it is usually necessary to copy data between the two networks to achieve data interaction and transmission. The embodiment of the present application provides a data scheduling system, which combines the use of an optical disk shuttle for data exchange and transmission, and is used for data interaction between the test terminals deployed on the Internet and the driver test center deployed on the intranet.

[0034] like Figure 1 Shown is a schematic block diagram of a data interaction scheduling system with physical isolation of internal and external networks in an exemplary embodiment of the present application.

[0035] Including, external network server (smart driving test server), Internet data ferry task scheduling server, CD ferry machine 1 and CD ferry machine 2, intranet data ferry task scheduling server, intranet server. Set up Internet data ferry task scheduling server on the Internet side, set up intranet data ferry task scheduling server on the intranet side, and set up CD ferry machine 1 and CD ferry machine 2 between the two task scheduling servers.

[0036] Generate a public and private key pair, and distribute the public and private key pairs to the intranet and extranet data ferry task scheduling servers respectively.

[0037] The exemplary embodiment of the present application may use the RSA1024 encryption algorithm to generate a public-private key pair, wherein the public key is assigned to the Internet data ferry task scheduling server, and the private key is assigned to the intranet data ferry task scheduling server.

[0038] External network data is written into the intranet: For example, when an Internet server processes the smart driving test business, the external network server submits the ferry data to the Internet ferry task scheduling server and temporarily stores it on the Internet ferry task scheduling server, including the test registration form, candidate photos, fingerprint information, identity proof, etc. The relevant information and information of each candidate are associated and packaged into a registration data packet. Since the driving test materials contain a lot of information and the files are relatively large, it is necessary to record the size of the requested ferry file and determine whether to trigger the ferry based on the ferry capacity. You can also set a scheduled ferry to regularly aggregate the data files of each driving school to the intranet for verification or convenient arrangement and scheduling.

[0039] The Internet data ferry task scheduling server starts the timer service. The smart driving test server sends data to the Internet data ferry task scheduling server through the HTTP interface. The Internet data ferry task scheduling server is responsible for task scheduling. It records the file size through each HTTP request and determines whether the capacity of the file to be ferryed triggers the ferry threshold. If the file size does not reach the threshold within the set period of the timer service, the ferry task is automatically triggered.

[0040] The Internet ferry task scheduling server sorts the files to be ferryed in ascending order of ASCII code by file name, obtains the HASH code of each file and concatenates them into a string in the corresponding order, then encrypts the string with the public key calculated by the RSA1024 encryption algorithm and saves it in the key file (key file);

[0041] The Internet ferry task scheduling server controls the CD ferry machine 1 to start the CD writing task, and controls the data to be written to the intranet data ferry task scheduling server; the intranet data ferry task scheduling server reads the key file and decrypts it with a private key, and compares the decrypted string with the string composed of the HASH encoding of the sorted file. If the comparison is correct, the data and files are written to the intranet server through an HTTP request, and the file data in CD 1 is written to the intranet server.

[0042] The CD ferry machine 1 is used to transfer the external network data to the internal network server, and the CD ferry machine 2 is used to transfer the internal network data and files from the inside to the outside. The internal network data is written into the external network, and the data flow is opposite to that of the external network data being written into the internal network.

[0043] In the data interaction scheduling system of this embodiment, the Internet data ferrying task scheduler and the intranet data ferrying task scheduler implement the following: creation and security verification of data transmission tasks, data packetization strategy management and control, data transmission fault tolerance mechanism, and automatic notification of manual verification.

[0044] The automatic CD ferry device itself does not have any storage and server functions. No data will be retained after the device is shut down and restarted, ensuring data security.

[0045] like Figure 2 Shown is a schematic diagram of the data transmission task creation and security verification process in an example embodiment of the present application.

[0046] Including setting the ferry working time, ferry task interval time, and maximum value of the ferry file, setting the timer and file ferry threshold in the ferry task scheduling server, and when the ferry working time, ferry task interval time, and maximum value threshold of the ferry file are reached, any condition is met to trigger the start of the ferry task.

[0047] Before starting the ferry task, a one-to-one correspondence between the ferry task number and the folder name is generated, and the file information that the Internet server needs to ferry is stored in the folder. The ferry task scheduling server determines whether it is in the ferry task execution stage. If so, through the business system data trigger and the ferry result trigger, the ferry task scheduling server extracts the data in the ferry folder and determines whether the trigger ferry capacity is reached. If the set threshold is reached, the ferry task scheduling server initiates the ferry task, otherwise waits for the next trigger cycle. After initiating the ferry task, the ferry task scheduling server traverses all files in the folder corresponding to the ferry task, obtains the HASH value of all files, sorts the HASH, splices the HASH characters, arranges them in ascending ASCII order according to the file name, splices the HASH codes of the files in the same sequence, and encrypts the spliced ​​HASH string with a pre-assigned key. The resulting string is written into the key file and saved in the ferry task folder for subsequent file verification.

[0048] Burn all the files in the task folder to a disc (Disc 1 or Disc 2), read the disc file through the ferry machine, the intranet data ferry task scheduling server obtains the file transmitted by the ferry machine, extracts the HASH value of all files, sorts the HASH, and splices the HASH. The sorting and splicing methods are the same as described above. After encryption, the string is obtained and matched with the text content of the decryption key file transmitted by the ferry machine. If the match is successful, perform subsequent business operations to verify whether the operation is successful. If the match is unsuccessful, record the task status and write it into the ferry quantity folder.

[0049] like Figure 3 The figure shows the creation and security verification of the data transmission task in the example embodiment of the present application, traversing all the files in the ferry task, obtaining the HASH values ​​of all the files, sorting and splicing multiple HASHes, encrypting with a pre-assigned key, writing the key file, and burning the CD.

[0050] Specifically, it includes: archiving the files that need to be transferred; generating a one-to-one correspondence between the ferrying task number and the folder name before starting the task, and storing the file information that the Internet server needs to ferry in the folder. According to the archived file information contained in each request from the Internet smart driving test server, a file list is established;

[0051] Get the HASH value of all files; the ferry task scheduling server traverses the files in the scheduling task folder to obtain the HASH value of each file;

[0052] The HASH values ​​are sorted and concatenated to obtain the chain hash of the file package. For example, the HASH of all files in a folder can be sequentially concatenated using the formula HASH = HASH1+ HASH2+ HASH3… + HASHn to obtain the chain HASH.

[0053] Data verification uses asymmetric encryption. According to the secret key assigned in advance by the dispatch server, the chain HASH is encrypted and written into the key file in the root directory of the CD. After sorting the files in the ferry file package, the HASH code of the file is concatenated into a string, the string and the public key are encrypted using the RSA1024 encryption algorithm, and the encrypted string is stored in the verification key file.

[0054] After receiving the file, the ferry receiving server decrypts the key file and compares it with the HASH of the CD file. Only if the comparison is successful will the subsequent operations be performed, otherwise the task execution fails.

[0055] The intranet ferry task scheduling server reads the file by reading the CD ferried by the CD ferry robot arm. The file contains the Key file and the file package ferried to the intranet. The Key file is decrypted by the private key to obtain the spliced ​​chain HASH. The file packages in the CD are compared after sorting, and the chain HASH obtained by splicing the file HASH is taken, and the file package with the same chain HASH is written.

[0056] like Figure 4 The diagram shows the data subpackaging strategy control process in the example embodiment of the present application. Determine whether it is in the ferry task execution time period, obtain the data in the ferry data folder according to the new data trigger of the business system and the ferry result trigger, and determine whether the ferry trigger capacity is reached. If the ferry capacity is reached, initiate the ferry task, otherwise, wait for the next trigger cycle. Including:

[0057] The ferry task scheduling server control module is managed and controlled. The policy control module deployed on the ferry task scheduling server is used to receive the ferry request data sent by the Internet server. The server records and calculates the file size for each ferry request to ensure that it does not exceed the system set threshold and the CD capacity.

[0058] Set the timing and verify the capacity to trigger the ferry task. As some areas do not allow automatic tasks to be started during non-working hours, set the data ferry task working hours on the ferry task scheduling server. After startup, the ferry task monitoring is started if the current system time is within the set time interval.

[0059] like Figure 5 Shown is a schematic flow chart of a data transmission fault tolerance mechanism in an exemplary embodiment of the present application.

[0060] Concatenate the HASH characters and match them with the decryption key file. If the match is successful and they are equal, perform subsequent business operations. If the match is unsuccessful, record the task status and write it into the ferry data folder.

[0061] The HASH of the files in ascending order is concatenated into a chain HASH, and compared with the chain HASH after the Key file content is decrypted by the private key. If the values ​​are the same, the file and data will be written to the intranet server later; if the match is unsuccessful, the written task status is also a file named after the scheduling task number, and the content is True or False, which is used to be sent back to another ferry task scheduling server to re-initiate the ferry task. The ferry task content is consistent with the task recorded in the system, realizing the task ferry retry.

[0062] The files that have passed the security check are normal business files. In case of failure in business exchange, the task status is written into the CD file and the task status is sent back for verification; the tasks with failed business status are resent; the files with successful business execution are directly deleted.

[0063] Automatically notify manual verification. When data is abnormal, such as when a task reaches the failure threshold, or when data security verification is abnormal, the Internet task scheduling server will notify maintenance personnel via SMS.

[0064] The present invention completely physically isolates the internal and external networks, and there is no human intervention in the ferrying process, thus solving the problems of high cost of data interaction transmission in physically isolated networks, poor real-time performance, and poor security.

[0065] The exemplary embodiment of the present application also provides an electronic device, comprising: at least one processor; and a memory connected to the at least one processor in communication. The memory stores a computer program that can be executed by the at least one processor, and the computer program is used to cause the electronic device to perform the method according to the embodiment of the present application when executed by the at least one processor.

[0066] The exemplary embodiment of the present application further provides a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to perform a method according to an embodiment of the present application.

[0067] The exemplary embodiments of the present application further provide a computer program product, including a computer program, wherein when the computer program is executed by a processor of a computer, it is used to enable the computer to execute the method according to the embodiment of the present application.

[0068] refer to Figure 6 , the structural block diagram of the electronic device 300 that can be used as the server or client of the present application will now be described, which is an example of a hardware device that can be applied to various aspects of the present application. The electronic device is intended to represent various forms of digital electronic computer equipment, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices and other similar computing devices. The components shown herein, their connections and relationships, and their functions are only examples, and are not intended to limit the implementation of the present application described and / or required herein.

[0069] like Figure 6 As shown, the electronic device 300 includes a computing unit 301, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 302 or a computer program loaded from a storage unit 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the device 300 can also be stored. The computing unit 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0070] A plurality of components in the electronic device 300 are connected to the I / O interface 305, including: an input unit 306, an output unit 307, a storage unit 308, and a communication unit 309. The input unit 306 may be any type of device capable of inputting information to the electronic device 300, and the input unit 306 may receive input digital or character information, and generate key signal inputs related to user settings and / or function control of the electronic device. The output unit 307 may be any type of device capable of presenting information, and may include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 308 may include, but is not limited to, a disk, an optical disk. The communication unit 309 allows the electronic device 300 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and may include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0071] The computing unit 301 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 301 performs the various methods and processes described above. For example, in some embodiments, the reconstruction and decomposition of the muscle movement trajectory redrawn according to the original trajectory of the signature stroke, and the decomposition of its logarithmic velocity curve, etc. can be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 308. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 300 via the ROM 302 and / or the communication unit 309. In some embodiments, the computing unit 301 can be configured to execute the signature handwriting dynamic acquisition implementation method in any other appropriate manner (for example, by means of firmware).

[0072] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, implements the functions / operations specified in the flow chart and / or block diagram. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0073] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0074] As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and / or device (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0075] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0076] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0077] A computer system may include clients and servers. Clients and servers are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship to each other.

Claims

1. A system for securely exchanging large-capacity files between physically isolated networks, characterized in that: An Internet data ferrying task scheduling server is set up on the Internet side, and an intranet data ferrying task scheduling server is set up on the intranet side. Optical disc ferry machine 1 and optical disc ferry machine 2 are set up between the two task scheduling servers. The ferrying task is initiated by triggering the business system data and the ferrying result. The Internet data ferrying task scheduling server and the intranet data ferrying task scheduling server create data transmission tasks, control data subpackaging, build a data transmission fault tolerance mechanism, and perform security verification. Data is written through optical disc ferry machine 1 and optical disc ferry machine 2 to control the data interaction scheduling between the internal and external networks; The control of data interaction scheduling between the internal and external networks includes: From the external network to the internal network: the Internet ferry task scheduling server controls the optical disk ferry machine 1 to write data, and the internal network data ferry task scheduling server reads the key file and decrypts it with the private key, compares the decrypted string with the string composed of the HASH code of the sorted file, and writes it to the internal network server after verification; From intranet to extranet: the Internet ferry task scheduling server controls the CD ferry machine 2 to write data, and the extranet data ferry task scheduling server uses the public key to decrypt the key file, compares the decrypted string with the string composed of the HASH encoding of the sorted file, and writes it to the extranet server after verification; The ferry task scheduling server sets the ferry time, ferry task interval time, and maximum value of the ferry file. When the ferry capacity is reached, the ferry task is initiated, and the files are sorted in ascending order by ASCII file name, and the HASH code of each file is obtained respectively and concatenated into a string in the corresponding order, and encrypted into a key file with a public key; when the ferry task is triggered, the key file is matched with the decryption key transmitted by the optical disk ferry machine, and the scheduling is executed after verification of consistency; Before starting the ferry task, a one-to-one correspondence table between the ferry task number and the folder name is generated. The ferry task is triggered based on the number of files or the capacity threshold. The HASH values ​​of all files are obtained, and the files are arranged in ascending ASCII order according to the file names. The HASH values ​​of the files are concatenated in the same sequence to obtain a HASH string. The concatenated HASH string is encrypted with a pre-assigned key, and the resulting string is written into the key file as the verification key.

2. The system according to claim 1, characterized in that The security verification includes: using RSA1024 encryption algorithm to generate a public-private key pair, the public key is assigned to the Internet data ferry task scheduling server, and the private key is assigned to the intranet data ferry task scheduling server; the data subpackaging control includes: the Internet data ferry task scheduling server records the size of the requested ferry file, determines whether to trigger the ferry based on the ferry capacity, records the file size through each HTTP request, and determines whether the capacity of the file to be ferryed reaches the threshold to trigger the ferry; the data transmission fault-tolerant mechanism includes: matching the HASH character splicing of the ferry file with the decryption key file, if they are equal, executing the ferry operation, otherwise recording the task status and writing it into the ferry data folder.

3. The system according to claim 1 or 2, characterized in that: The ferrying task is triggered based on the number of files or capacity threshold, and the files to be ferryed are stored in a folder. The ferrying task scheduling server obtains the number of files in the ferrying folder through business system data triggering and ferrying result triggering. If the set ferrying capacity threshold is reached, the ferrying task is initiated.

4. A method for securely exchanging large-capacity files between physically isolated networks, characterized in that: An Internet data ferrying task scheduling server is set up on the Internet side, and an intranet data ferrying task scheduling server is set up on the intranet side. Optical disc ferry machine 1 and optical disc ferry machine 2 are set up between the two task scheduling servers. The ferrying task is initiated by triggering the business system data and the ferrying result. The Internet data ferrying task scheduling server and the intranet data ferrying task scheduling server create data transmission tasks, control data subpackaging, build a data transmission fault tolerance mechanism, and perform security verification. Data is written through optical disc ferry machine 1 and optical disc ferry machine 2 to control the data interaction scheduling between the internal and external networks; The control of data interaction scheduling between the internal and external networks includes: From the external network to the internal network: the Internet ferry task scheduling server controls the optical disk ferry machine 1 to write data, and the internal network data ferry task scheduling server reads the key file and decrypts it with the private key, compares the decrypted string with the string composed of the HASH code of the sorted file, and writes it to the internal network server after verification; From intranet to extranet: the Internet ferry task scheduling server controls the CD ferry machine 2 to write data, and the extranet data ferry task scheduling server uses the public key to decrypt the key file, compares the decrypted string with the string composed of the HASH encoding of the sorted file, and writes it to the extranet server after verification; The ferry task scheduling server sets the ferry time, ferry task interval time, and maximum value of the ferry file. When the ferry capacity is reached, the ferry task is initiated, and the files are sorted in ascending order by ASCII file name, and the HASH code of each file is obtained respectively and concatenated into a string in the corresponding order, and encrypted into a key file with a public key; when the ferry task is triggered, the key file is matched with the decryption key transmitted by the optical disk ferry machine, and the scheduling is executed after verification of consistency; Before starting the ferry task, a one-to-one correspondence table between the ferry task number and the folder name is generated. The ferry task is triggered based on the number of files or the capacity threshold. The HASH values ​​of all files are obtained, and the files are arranged in ascending ASCII order according to the file names. The HASH values ​​of the files are concatenated in the same sequence to obtain a HASH string. The concatenated HASH string is encrypted with a pre-assigned key, and the resulting string is written into the key file as the verification key.

5. The method according to claim 4, characterized in that The security verification includes: using RSA1024 encryption algorithm to generate a public-private key pair, the public key is assigned to the Internet data ferry task scheduling server, and the private key is assigned to the intranet data ferry task scheduling server; the data subpackaging control includes: the Internet data ferry task scheduling server records the size of the requested ferry file, determines whether to trigger the ferry based on the ferry capacity, records the file size through each HTTP request, and determines whether the capacity of the file to be ferryed reaches the threshold to trigger the ferry; the data transmission fault-tolerant mechanism includes: matching the HASH character splicing of the ferry file with the decryption key file, if they are equal, executing the ferry operation, otherwise recording the task status and writing it into the ferry data folder.

6. The method according to claim 4 or 5, characterized in that: The intranet ferry task scheduling server reads the file by reading the CD ferried by the CD ferry robot, obtains the Key file and decrypts it with the private key to obtain the spliced ​​chain HASH, reads the sorted file package from the CD ferry, obtains the chain HASH spliced ​​from the file HASH, and writes the file in the CD into a file package with the same chain HASH in the intranet server.

7. The method according to claim 4 or 5, characterized in that: The ferrying task is triggered based on the number of files or capacity threshold, and the files to be ferryed are stored in a folder. The ferrying task scheduling server obtains the number of files in the ferrying folder through business system data triggering and ferrying result triggering. If the set ferrying capacity threshold is reached, the ferrying task is initiated.

8. An electronic device, comprising: processor; And a memory for storing a program, characterized in that, wherein the program includes instructions, which, when executed by the processor, enable the processor to execute the method for large-capacity data interaction between physically isolated networks according to any one of claims 4-7.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: in, The computer instructions are used to enable the computer to execute the method for large-capacity data interaction between physically isolated networks according to any one of claims 4-7.

Images