Data transmission method, system, electronic device and storage medium

Abstract

The present application provides a data transmission method, system, electronic device, and storage medium, which are applied to a data transmission system. The data transmission system includes a first server, a first switch, and a second server. When the first server receives a data transmission request, it obtains a target cipher book that matches the target message format of the target message from the first switch; the first server obtains a target transmission protocol that matches the target message format; the first server uses the target cipher book to encrypt the target message and the target transmission protocol respectively, and transmits the obtained encrypted message and encrypted transmission protocol to the first switch; the first switch uses the target cipher book to verify the encrypted message and the encrypted transmission protocol, and when it determines that the encrypted message and the encrypted transmission protocol have passed the verification, it transmits the encrypted message to the second server via the encrypted transmission protocol, so that when the second server receives the encrypted message, it decrypts the encrypted message.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and more particularly to a data transmission method, system, electronic device, and storage medium. Background Art

[0002] With the continuous development of science and technology, commercial banks are becoming more and more dependent on financial technology, especially the centralized core system architecture and distributed business system architecture have become popular trends in the banking industry. Many of the bank's businesses can no longer be operated manually without information systems.

[0003] In the process of using signal systems for data transmission, hackers can launch cyber attacks on information systems to steal important bank files.

[0004] Therefore, how to provide a data transmission method to resolve the risk of external network attacks and ensure the security of data transmission is an urgent problem that needs to be solved. Summary of the Invention

[0005] In view of this, the present invention provides a data transmission method, system, electronic device and storage medium to resolve the risk of external network attacks and ensure the security of data transmission.

[0006] A first aspect of the present invention discloses a data transmission method, which is applied to a data transmission system. The data transmission system includes a first server, a first switch, and a second server. The method includes:

[0007] When the first server receives the data transmission request, the first server obtains a target code book matching the target message format of the target message from the first switch, wherein the data transmission request includes the target message requested to be transmitted;

[0008] The first server obtains a target transmission protocol that matches the target message format;

[0009] The first server encrypts the target message and the target transmission protocol respectively using the target code book, and transmits the obtained encrypted message and encrypted transmission protocol to the first switch;

[0010] The first switch verifies the encrypted message and the encrypted transmission protocol using the target password book, and when it is determined that the encrypted message and the encrypted transmission protocol are successfully verified, transmits the encrypted message to the second server using the encrypted transmission protocol, so that the second server decrypts the encrypted message when receiving the encrypted message.

[0011] Optionally, a codebook generating device is pre-configured on the first server, and the method further includes:

[0012] When the first server detects that the time on the first server reaches a preset time, the code book generating device generates a code book corresponding to each message format according to the encryption information corresponding to each message format, and uses the code book corresponding to each message format to update each code book stored on the first switch;

[0013] The encrypted information includes at least one first designated position, first replacement information corresponding to each first designated position, at least one second designated position, and second replacement information corresponding to each second designated position.

[0014] Optionally, the first server is pre-configured with a code book acquisition chip, in which a code book acquisition program is pre-embedded. The first server obtains a target code book matching a target message format of the target message from the first switch, including:

[0015] The first server calls a code book acquisition program through the code book acquisition chip to acquire a target code book that matches a target message format of the target message from various code books pre-stored on the first switch.

[0016] Optionally, the target code book includes at least one first designated position, first replacement information corresponding to each first designated position, at least one second designated position, and second replacement information corresponding to each second designated position. The first server is pre-configured with a message national secret encryption chip. The first server uses the target code book to encrypt the target message and the target transmission protocol, respectively, and transmits the obtained encrypted message and encrypted transmission protocol to the first switch, including:

[0017] The first server replaces the information at each first designated position on the target message with corresponding first replacement information through a message national secret encryption chip, and encrypts each first replacement information on the target message using a national secret encryption algorithm to obtain an encrypted message;

[0018] The first server replaces the information at each second designated position on the target transmission protocol with corresponding second replacement information through the message national secret encryption chip, and encrypts each second replacement information on the target transmission protocol using the national secret encryption algorithm to obtain an encrypted transmission protocol;

[0019] The first server transmits the encrypted message and the encrypted transmission protocol to the first switch.

[0020] Optionally, the first switch is pre-configured with a message national encryption verification device, and the first switch uses the target code book to verify the encrypted message and the encrypted transmission protocol, including:

[0021] The first switch verifies, through the message national encryption verification device, whether the information at each first designated position on the encrypted message is encrypted, and whether the information at each second designated position on the encrypted transmission protocol is encrypted;

[0022] If the information at each of the first designated positions on the encrypted message is encrypted, and the information at each of the second designated positions on the encrypted transmission protocol is encrypted, the first switch determines that the encrypted message and the encrypted transmission protocol are authenticated.

[0023] Optionally, if the second server and the first server belong to the same local area network, the first switch transmits the encrypted message to the second server through the encrypted transmission protocol, so that the second server decrypts the encrypted message when receiving the encrypted message, including:

[0024] The first switch transmits the encrypted message to the second server through the encryption transmission protocol, so that when the second server receives the encrypted message, it obtains the target password from the first switch and uses the target password to decrypt the encrypted message.

[0025] Optionally, if the second server and the first server do not belong to the same local area network, the data transmission system further includes a second switch, and the first switch transmits the encrypted message to the second server through the encrypted transmission protocol, so that when the second server receives the encrypted message, it decrypts the encrypted message, including:

[0026] The first switch transmits the encrypted message to the second switch through the encrypted transmission protocol, so that when the second switch receives the encrypted message, it obtains the target cipher pad from the first switch and transmits the encrypted message to the second server through the encrypted transmission protocol. When the second server receives the encrypted message, it obtains the target cipher pad from the second switch and decrypts the encrypted message using the target cipher pad.

[0027] A second aspect of the present invention discloses a data transmission system, the data transmission system comprising a first server, a first switch, and a second server;

[0028] The first server is configured to, upon receiving a data transmission request, obtain a target cipher book matching a target message format of a target message from the first switch, wherein the data transmission request includes a target message requested for transmission; obtain a target transmission protocol matching the target message format; encrypt the target message and the target transmission protocol using the target cipher book, respectively, and transmit the obtained encrypted message and encrypted transmission protocol to the first switch;

[0029] The first switch is configured to verify the encrypted message and the encrypted transmission protocol using the target code book, and when it is determined that the encrypted message and the encrypted transmission protocol are successfully verified, transmit the encrypted message to the second server using the encrypted transmission protocol, so that the second server decrypts the encrypted message when receiving the encrypted message.

[0030] The third aspect of the present invention discloses an electronic device, comprising: a processor and a memory, wherein the processor and the memory are connected via a communication bus; wherein the processor is used to call and execute a program stored in the memory; and the memory is used to store a program, wherein the program is used to implement the data transmission method disclosed in the first aspect of the present invention.

[0031] A fourth aspect of the present invention discloses a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to execute the data transmission method disclosed in the first aspect of the present invention.

[0032] The present invention provides a data transmission method, system, electronic device, and storage medium, which are applied to a data transmission system. The data transmission system includes a first server, a first switch, and a second server. When the first server receives a data transmission request, it obtains a target cipher book matching a target message format of a target message from the first switch, wherein the data transmission request includes a target message to be transmitted. The first server obtains a target transmission protocol matching the target message format. The first server encrypts the target message and the target transmission protocol using the target cipher book, and transmits the obtained encrypted message and the encrypted transmission protocol to the first switch. The first switch verifies the encrypted message and the encrypted transmission protocol using the target cipher book, and when it determines that the encrypted message and the encrypted transmission protocol have been verified, transmits the encrypted message to the second server using the encrypted transmission protocol, so that the second server decrypts the encrypted message when it receives the encrypted message. The technical solution provided by the present invention encrypts the target message and the target transmission protocol using the target cipher book during data transmission, so that the encrypted message is transmitted using the encrypted transmission protocol. In this way, even if an external network attack occurs, the other party cannot obtain the real message, thereby achieving the purpose of mitigating the risk of external network attacks and ensuring the security of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0034] Figure 1 A schematic structural diagram of a data transmission system provided by an embodiment of the present invention;

[0035] Figure 2 A schematic diagram of the structure of a customer verification system provided by an embodiment of the present invention;

[0036] Figure 3 A schematic structural diagram of another data transmission system provided by an embodiment of the present invention;

[0037] Figure 4 A flowchart of a data transmission method provided by an embodiment of the present invention;

[0038] Figure 5 An example diagram of the structure of an IP protocol provided in an embodiment of the present invention;

[0039] Figure 6 A structural example diagram of a message national secret verification device provided by an embodiment of the present invention;

[0040] Figure 7 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0042] As used herein, the term "including" and its variations are open-ended, i.e., "including but not limited to." The term "based on" means "based, at least in part, on." The term "one embodiment" means "at least one embodiment," the term "another embodiment" means "at least one additional embodiment," and the term "some embodiments" means "at least some embodiments." Other terms are defined in the following description.

[0043] It should be noted that the concepts of "first" and "second" mentioned in the disclosure of the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0044] It should be noted that the modifications of "one" and "multiple" mentioned in the disclosure of the present invention are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, they should be understood as "one or more".

[0045] As can be seen from the above background technology, in the process of using signal systems for data transmission, hackers can launch network attacks on information systems to steal important files of banks.

[0046] In the prior art, output transmission can also be performed through network protocols, but these protocols are existing and well-known, and there are many vulnerabilities in these protocols. For example, the Address Resolution Protocol (APP) can identify the Media Access Control (MAC) address based on a given IP address, and the host cannot verify the source of the network data packet in the peer-to-peer network, which can easily lead to ARP spoofing. If the attacker is on the same LAN as the target, or uses an infected computer on the same network, the attacker can exploit this vulnerability (given IP address) to launch a network attack.

[0047] Another example is the Domain Name System (DNS). DNS is a hierarchical system that translates IP addresses into human-readable hostnames, where attackers can replace legitimate IP addresses and send the target audience to malicious websites, causing a leak.

[0048] Another example is File Transfer Protocol / Secure (FTP / S), a network protocol based on a client-server architecture used to transfer files between clients and servers on a computer network. When an attacker uses a web application to send malicious code to a user in the form of a browser-side script (or cookie), the attacker can use cross-site scripting to conduct network attacks, intercepting information such as usernames and passwords during transmission, and even potentially launching a man-in-the-middle (MITM) attack.

[0049] Another example is the Hypertext Transfer Protocol / Secure (HTTP / S). A major vulnerability in HTTP / S is the Drown attack, which allows attackers to break encryption and steal credit card information and passwords. Another serious bug is the Heartbleed bug, which allows the theft of information protected by TLS / SSL encryption, which is used to secure the internet. Other vulnerabilities include decomposing RSA derived keys and leaking simplified compression ratio information.

[0050] In summary, when using these protocols for data transmission, other users can launch network attacks through vulnerabilities in the protocols, thereby stealing corresponding important information and important files.

[0051] Therefore, the present application provides a data transmission method, system, electronic device and storage medium. During the data transmission process, the target message and the target transmission protocol are encrypted respectively using the target cipher book, so that the encrypted message can be transmitted using the encrypted transmission protocol. Since the transmission protocol for transmission is encrypted, even if the attacker knows the vulnerability of the transmission protocol, he cannot use the vulnerability to launch a network attack, and even if he is attacked by an external network, the other party cannot obtain the real message, thereby achieving the purpose of resolving the risk of external network attacks and ensuring the security of data transmission.

[0052] See also Figure 1 , shows a structural diagram of a data transmission system provided by an embodiment of the present invention, the data transmission system includes a first server, a first switch and a second server;

[0053] The first server is configured to, upon receiving a data transmission request, obtain a target cipher book matching a target message format of a target message from the first switch, wherein the data transmission request includes the target message requested for transmission; obtain a target transmission protocol matching the target message format; encrypt the target message and the target transmission protocol using the target cipher book, respectively, and transmit the obtained encrypted message and encrypted transmission protocol to the first switch;

[0054] The first switch is configured to verify the encrypted message and the encrypted transmission protocol using the target password book, and when it is determined that the encrypted message and the encrypted transmission protocol are successfully verified, transmit the encrypted message to the second server through the encrypted transmission protocol, so that the second server decrypts the encrypted message when receiving the encrypted message.

[0055] As a preferred embodiment of the present application, the first server is pre-configured with a code book generating device, a code book obtaining chip and a message national secret encryption chip, such as Figure 2 The code book acquisition chip is pre-embedded with a code book acquisition program.

[0056] Optionally, the first server is pre-configured with a codebook generating device;

[0057] a code book generating device, configured to generate a code book corresponding to each message format according to the encryption information corresponding to each message format when the time on the first server reaches a preset time, and upload the code book corresponding to each message format to the first switch for storage;

[0058] The encrypted information includes at least one first designated position, first replacement information corresponding to each first designated position, at least one second designated position, and second replacement information corresponding to each second designated position.

[0059] Optionally, the code book acquisition chip is used to call the code book acquisition program when the first server receives the data transmission request, and obtain a target code book that matches the target message format of the target message from various code books pre-stored on the first switch.

[0060] Optionally, a message national secret encryption chip is used to replace the information at each first designated position on the target message with the corresponding first replacement information when the code book acquisition chip obtains the target code book, and to encrypt each first replacement information on the target message using the national secret encryption algorithm to obtain an encrypted message; replace the information at each second designated position on the target transmission protocol with the corresponding second replacement information, and to encrypt each second replacement information on the target transmission protocol using the national secret encryption algorithm to obtain an encrypted transmission protocol, and transmit the encrypted message and the encrypted transmission protocol to the first switch.

[0061] Optionally, the first switch is pre-configured with a message national encryption verification device, which is used to verify whether the information at each first designated position on the encrypted message is encrypted, and whether the information at each second designated position on the encrypted transmission protocol is encrypted; if the information at each first designated position on the encrypted message is encrypted, and the information at each second designated position on the encrypted transmission protocol is encrypted, it is determined that the encrypted message and the encrypted transmission protocol have passed the verification.

[0062] Optionally, if the second server and the first server belong to the same local area network, the first switch transmits the encrypted message to the second server through an encrypted transmission protocol so that when the second server receives the encrypted message, the first switch decrypts the encrypted message, specifically configured to:

[0063] The encrypted message is transmitted to the second server through the encryption transmission protocol, so that when the second server receives the encrypted message, it obtains the target cipher book from the first exchange and decrypts the encrypted message using the target cipher book.

[0064] Optionally, if the second server and the first server do not belong to the same local area network, the data transmission system further includes a second switch, such as Figure 3 As shown, the first switch transmits the encrypted message to the second server through the encryption transmission protocol so that when the second server receives the encrypted message, it decrypts the encrypted message, specifically for:

[0065] The encrypted message is transmitted to the second switch through the encrypted transmission protocol, so that when the second switch receives the encrypted message, it obtains the target password from the first switch, and transmits the encrypted message to the second server through the encrypted transmission protocol. When the second server receives the encrypted message, it obtains the target password from the second switch and decrypts the encrypted message using the target password.

[0066] The present invention provides a data transmission system, comprising a first server, a first switch, and a second server. When the first server receives a data transmission request, it obtains a target cipher book matching a target message format of a target message from the first switch, wherein the data transmission request includes a target message to be transmitted; the first server obtains a target transmission protocol matching the target message format; the first server encrypts the target message and the target transmission protocol using the target cipher book, respectively, and transmits the obtained encrypted message and the encrypted transmission protocol to the first switch; the first switch verifies the encrypted message and the encrypted transmission protocol using the target cipher book, and upon determining that the encrypted message and the encrypted transmission protocol pass verification, transmits the encrypted message to the second server using the encrypted transmission protocol, so that the second server decrypts the encrypted message upon receiving the encrypted message. The technical solution provided by the present invention encrypts the target message and the target transmission protocol using the target cipher book during data transmission, so that the encrypted message is transmitted using the encrypted transmission protocol. In this way, even if an external network attack occurs, the other party cannot obtain the real message, thereby mitigating the risk of external network attacks and ensuring the security of data transmission.

[0067] Based on the data transmission system provided by the present invention, the present invention accordingly provides a data transmission method, such as Figure 4As shown, the data transmission method is applied to a data transmission system, and the data transmission method specifically includes the following steps:

[0068] S401: When a first server receives a data transmission request, it obtains a target code book matching a target message format of a target message from a first switch, wherein the data transmission request includes a target message requested to be transmitted.

[0069] In the embodiment of the present application, a corresponding code book generating device can be pre-configured in the first server so that the code book generating device can generate a code book for each message format on the same day, and use the generated code books to update the code books stored on the first switch to ensure that the code books stored on the first switch are all the code books for the same day. In this way, even if an attacker steals the code book, he cannot use the stolen code book to attack subsequent data transmission.

[0070] Optionally, when the first server detects that the time on the first server reaches a preset time, the code book generating device generates a code book corresponding to each message format according to the encryption information corresponding to each message format, and uses the code book corresponding to each message format to update each code book stored on the first switch; wherein the encryption information includes at least one first designated position, first replacement information corresponding to each first designated position, at least one second designated position, and second replacement information corresponding to each second designated position.

[0071] It should be noted that the encryption information is different every day, that is, the first designated positions in today's code book may be different from the first designated positions in tomorrow's code book, or the first replacement information of the first designated position in today's code book may be different from the first replacement information of the first designated position in tomorrow's code book. It can be set according to actual application and is not limited in the embodiments of the present application.

[0072] It should be noted that the first designated position is the corresponding position in the message, and the second designated position is the position in the transmission protocol.

[0073] In the specific process of executing step S401, when the first server receives the data transmission request sent by the user, it can obtain the target code book that matches the target message format of the target message requested to be transmitted in the data transmission request from the code books stored in the first switch.

[0074] Optionally, a code book acquisition chip can be pre-configured on the first server, and a pre-set code book acquisition program can be embedded in the code book acquisition chip, so that when the first server receives a data transmission request, the code book acquisition program is called through the code book acquisition chip to obtain a target code book that matches the target message format of the target message from each code book pre-stored on the first switch.

[0075] It should be noted that the code book acquisition chip can be embedded in the first server through the chip spare data pin on the first server. It can be set according to actual application and is not limited in the embodiment of the present application.

[0076] In this embodiment, the code book generated by the code book generating device is stored in the area corresponding to the first switch through a cellular network transmission mechanism, so that the code book acquisition chip calls the code book acquisition program to obtain the target code book that matches the target message format of the target message from the various code books pre-stored in the area through a dedicated 4G, WiFi, or transmission line channel.

[0077] It should be noted that storing each code book through a cellular network code book transmission mechanism can effectively prevent the centralized leakage of the code books.

[0078] It should be noted that the target message format may be a JPG format, which may be determined based on actual applications and is not limited in the embodiments of the present application.

[0079] Among them, the JPEG format (Joint Photographic Experts Group, JPEG) is a standard for continuous-tone still image compression. With file extensions like .jpg or .jpeg, it is the most commonly used image file format. It primarily utilizes a combination of predictive coding (DPCM), discrete cosine transform (DCT), and entropy coding to remove redundant image and color data. This lossy compression format compresses images into a very small storage space, which can cause some damage to the image data. In particular, using too high a compression ratio will reduce the quality of the image recovered after decompression. Therefore, if you are pursuing high-quality images, it is not advisable to use too high a compression ratio.

[0080] JPEG compression technology uses lossy compression to remove redundant image data. In other words, it achieves better image quality with less disk space. JPEG is also a very flexible format with adjustable image quality, allowing files to be compressed using varying compression ratios. It supports multiple compression levels, typically ranging from 10:1 to 40:1. A higher compression ratio results in lower image quality; conversely, a lower compression ratio results in higher quality. For the same image, a file stored in JPEG format is 10 to 120 times smaller than other file types, typically only a few tens of KB in size, with minimal quality loss, essentially unnoticeable. The JPEG format primarily compresses high-frequency information, preserving color information well, making it suitable for internet use. It reduces image transmission time and supports 24-bit true color. It is also commonly used for images requiring continuous tone.

[0081] JPEG format can be divided into three formats: standard JPEG, progressive JPEG and JPEG2000. 1. Standard JPEG format; this type can only display images in order from top to bottom when downloading a web page. The full image can only be seen after all the image data is downloaded. 2. Progressive JPEG; this type first presents a rough appearance of the image when downloading a web page, and then slowly presents the complete content. Moreover, files saved in progressive JPG format are smaller than files saved in standard JPG format, so if you want to use images on a web page, you can use this format more often. 3. JPEG2000; it is a new generation of image compression method with higher compression quality. It can also improve the mosaic phenomenon and position confusion often caused by unstable signals during wireless transmission, thereby improving the transmission quality.

[0082] S402: The first server obtains a target transmission protocol that matches the target message format.

[0083] In the specific process of executing step S402, after the first server obtains the corresponding target code book, it can further obtain a target transmission protocol that matches the target message format.

[0084] It should be noted that the target transmission protocol may be an IP protocol, and the corresponding transmission protocol may be obtained according to the actual application, and the embodiment of the present application is not limited thereto. Figure 5 shown.

[0085] The Internet Protocol (IP) is the core component of the TCP / IP protocol. To accurately locate a host on the shared internet, you need its IP address. A host has an IP address but cannot perform routing (meaning relaying and grouping data packets). Routers, on the other hand, have both an IP address and routing capabilities. Hosts and routers connected to the internet are collectively referred to as nodes.

[0086] S403: The first server encrypts the target message and the target transmission protocol using the target code book, and transmits the obtained encrypted message and encrypted transmission protocol to the first switch.

[0087] In an embodiment of the present application, after obtaining the corresponding target transmission protocol, the first server can use the target password book to process the target message and the target transmission protocol respectively, and use the national secret encryption algorithm to encrypt the processed target message and the target transmission protocol to obtain an encrypted message and an encrypted transmission protocol, and finally transmit the encrypted message and the encrypted transmission protocol to the first switch.

[0088] Optionally, a national secret encryption chip for messages can be pre-configured on the first server. After obtaining the target transmission protocol and the target cipher book, the first server can use the national secret encryption chip for messages to replace the information at each first designated position on the target message with the corresponding first replacement information, and use the national secret encryption algorithm to encrypt each first replacement information on the target message to obtain an encrypted message; and use the national secret encryption chip for messages to replace the information at each second designated position on the target transmission protocol with the corresponding second replacement information, and use the national secret encryption algorithm to encrypt each second replacement information on the target transmission protocol to obtain an encrypted transmission protocol.

[0089] In this embodiment, if the target message format is JPEG, the first designated position in the target code book may be the application specific information and thumbnail RGB bitmap in the APP0 marker in the target message. Accordingly, the replacement information corresponding to the application specific information position may be adding a national secret verification identification code, and the replacement information corresponding to the thumbnail RGB bitmap position may be replacing the target character.

[0090] It should be noted that the target message format is JPG and includes at least 8 tags, as shown in Table 1.

[0091] Table 1:

[0092] 1.SOI 0xD8 Image Start 2.APP0 0xE0 JFIF Application Data Block 3.APPn 0xE1-0xEF Other application data blocks (n, 1 to 15) 4.DQT 0xDB Quantization table 5.SOF0 0xC0 Frame Start 6.DHT 0xC4 Huffman table 7.SOS 0xDA Scan line start 8.EOI 0xD9 Image End

[0093] In order to better understand the tags defined by JPEG, the tag codes of JPEG are listed in Table 2, and the English explanations are retained.

[0094] Table 2:

[0095]

[0096]

[0097]

[0098] It should be noted that if the target transmission protocol is the IP protocol, the second designated position in the target code book can be an optional option in the IP protocol, and the corresponding second replacement information can be any one or more of the corresponding sequence number, confirmation number, URG (urgent bit), ACK (acknowledgement bit), PSH (urgent bit), RST (reset bit), SYN (synchronization bit), FIN (disconnect bit), checksum, and option information.

[0099] The sequence number represents the number of the first byte of data sent in this segment. Each byte in the byte stream transmitted in a TCP connection is sequentially numbered. Because the sequence number is represented by 32 bits, it wraps around and starts again at 0 every 2^32 bytes.

[0100] Acknowledgement number (ack): This number indicates the number of the first byte of data that the receiver expects to receive from the sender in the next segment. This number indicates whether the first byte of data sent by the sender is the acknowledgment number, indicating whether there is a problem with the transmission.

[0101] Data offset / header length: Indicates the header length of the TCP segment, a total of 4 bits. Since the TCP header contains a variable-length option part, it is necessary to specify the exact length of this TCP segment.

[0102] URG (urgent bit): Indicates whether the data sent in the message segment contains urgent data.

[0103] ACK (Acknowledgement Bit): Indicates whether the previous acknowledgment number field is valid. The acknowledgment number field is valid only when ACK = 1; when ACK = 0, the acknowledgment sequence number is invalid. TCP stipulates that ACK must be 1 after a connection is established. A TCP segment with the ACK flag is called an acknowledgment segment.

[0104] PSH (Present-Hand Bit): This bit indicates that the receiving application should immediately read data from the TCP receive buffer to make room for subsequent data. If it is 1, the receiving application should immediately submit the data to the upper-layer application instead of caching it. If the application does not read the received data, it will remain in the TCP receive buffer.

[0105] RST (Reset Bit): If a message with RST = 1 is received, it means that a serious error has occurred in the connection with the host (such as a host crash) and the connection must be released and then re-established. Or it means that there was a problem with the data sent to the host last time and the host refused to respond. The TCP segment with the RST flag is called a reset segment.

[0106] SYN (Synchronization Bit): Used when establishing a connection to synchronize sequence numbers. When SYN = 1 and ACK = 0, it indicates that this is a segment requesting a connection; when SYN = 1 and ACK = 1, it indicates that the other party agrees to establish a connection. SYN = 1 indicates that this is a segment requesting or agreeing to establish a connection. SYN is set to 1 only during the first two handshakes. TCP segments with the SYN flag are called synchronization segments.

[0107] FIN (disconnect bit): indicates that the local end is closing the connection and marks whether the data has been sent. If FIN = 1, it tells the receiver: "The sender has sent all the data and can release the connection." The TCP segment with the FIN flag is called the end segment.

[0108] Window size: Indicates the amount of data that the other party is currently allowed to send.

[0109] Checksum: provides additional reliability Urgent pointer: marks the location of urgent data in the data field.

[0110] It should also be noted that the maximum length of the optional second replacement information can be calculated based on the TCP header length in the IP protocol. The TCP header length is represented by 4 bits, and the maximum length is: (2^4-1)*4-20=40 bytes. This means that the optional second replacement information in Tianjie cannot exceed 40 bytes. The second replacement information and the current date can be entered in this position. The verification segment, encrypted using a national security algorithm (such as SM4), is then used for national security verification of the message.

[0111] S404: The first switch verifies the encrypted message and the encrypted transmission protocol using the target password. When the verification is confirmed, the first switch transmits the encrypted message to the second server using the encrypted transmission protocol, so that the second server decrypts the encrypted message when receiving the encrypted message.

[0112] During the specific execution of step S404, a message national encryption verification device can be pre-configured in the first switch so that when the first switch receives the encrypted message and the encrypted transmission protocol, the message national encryption verification device verifies whether the information at each first designated position on the encrypted message is encrypted, and whether the information at each second designated position on the encrypted transmission protocol is encrypted. If the information at each first designated position on the encrypted message is encrypted, and the information at each second designated position on the encrypted transmission protocol is encrypted, the first switch determines that the encrypted message and the encrypted transmission protocol have been verified successfully.

[0113] If any information at any first designated location on the encrypted message is not encrypted, and / or any information at any second designated location on the encrypted transmission protocol is not encrypted, it can be determined that the encrypted message and / or encrypted transmission protocol verification has failed. At this time, the encrypted message can be intercepted and it can be determined whether the current interception record exceeds a certain threshold. If it exceeds, the central early warning server can be notified and the corresponding alarm information can be output.

[0114] It should be noted that the message national secret verification device can be embedded in the computing resource mainboard of the first switch, wherein the structure of the message national secret verification device is as follows: Figure 6 shown.

[0115] In an embodiment of the present application, when the first switch determines that the encrypted message and the encrypted transmission protocol have passed verification, the first switch can transmit the encrypted message to the second server through the encrypted transmission protocol, so that when the second server receives the encrypted message, it can decrypt the encrypted message and obtain the corresponding target message.

[0116] Optionally, if the second server and the first server do not belong to the same local area network, it means that the first server and the second server can share the first switch. In this case, the first switch transmits the encrypted message to the second server through an encrypted transmission protocol, so that when the second server receives the encrypted message, it obtains the target password from the first switch and uses the target password to decrypt the encrypted message.

[0117] Optionally, if the second server and the first server do not belong to the same local area network, it means that the first server and the second server cannot share the first switch. In this case, the first switch transmits the encrypted message to the second switch through an encrypted transmission protocol, so that when the second switch receives the encrypted message, it obtains the target password book from the first switch and transmits the encrypted message to the second server through the encrypted transmission protocol, so that when the second server receives the encrypted message, it obtains the target password book from the second switch and uses the target password book to decrypt the encrypted message.

[0118] Furthermore, in an embodiment of the present application, the second server may also be pre-configured with a code book generation device, a code book acquisition chip, and a code book acquisition program pre-embedded in the code book acquisition chip, as well as a message national secret encryption chip. The second switch may also be pre-configured with a corresponding message national secret verification device, so that when the second server receives a data transmission request, it can use the second server as the first server to execute the data transmission method provided in this application to perform corresponding data transmission.

[0119] The present invention provides a data transmission method. The data transmission system includes a first server, a first switch, and a second server. When the first server receives a data transmission request, it obtains a target cipher book matching a target message format of a target message from the first switch, wherein the data transmission request includes a target message to be transmitted. The first server obtains a target transmission protocol matching the target message format. The first server encrypts the target message and the target transmission protocol using the target cipher book, and transmits the obtained encrypted message and the encrypted transmission protocol to the first switch. The first switch verifies the encrypted message and the encrypted transmission protocol using the target cipher book, and when it is determined that the encrypted message and the encrypted transmission protocol have passed the verification, transmits the encrypted message to the second server using the encrypted transmission protocol, so that the second server decrypts the encrypted message when it receives the encrypted message. The technical solution provided by the present invention encrypts the target message and the target transmission protocol using the target cipher book during the data transmission process, so that the encrypted message is transmitted using the encrypted transmission protocol. In this way, even if an external network attack occurs, the other party cannot obtain the real message, thereby achieving the purpose of mitigating the risk of external network attacks and ensuring the security of data transmission.

[0120] An embodiment of the present application also provides an electronic device, which includes: a processor and a memory, wherein the processor and the memory are connected via a communication bus; wherein the processor is used to call and execute a program stored in the memory; and the memory is used to store a program, which is used to implement a data transmission method.

[0121] Reference below Figure 7 , which shows a schematic diagram of the structure of an electronic device suitable for implementing the disclosed embodiments of the present invention. The electronic devices in the disclosed embodiments of the present invention may include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 7 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments disclosed in the present invention.

[0122] like Figure 7 As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 into a random access memory (RAM) 703. Various programs and data required for the operation of the electronic device are also stored in the RAM 703. The processing device 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0123] Typically, the following devices may be connected to the I / O interface 705: an input device 706 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 707 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 708 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 709. The communication device 709 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although Figure 7 The electronic device is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0124] In particular, according to an embodiment disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment disclosed in the present invention includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes program code for executing the data elaboration method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 709, or installed from the storage device 708, or installed from the ROM 702. When the computer program is executed by the processing device 701, the above-mentioned functions defined in the data transmission method of the embodiment disclosed in the present invention are performed.

[0125] Furthermore, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to execute the data transmission method.

[0126] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device is caused to: upon receiving a data transmission request, obtain a target cipher book that matches a target message format of a target message from the first switch, wherein the data transmission request includes a target message requested for transmission; obtain a target transmission protocol that matches the target message format; encrypt the target message and the target transmission protocol respectively using the target cipher book, and transmit the obtained encrypted message and encrypted transmission protocol to the first switch; and verify the encrypted message and the encrypted transmission protocol using the target cipher book. When determining that the encrypted message and the encrypted transmission protocol have been verified, the first switch transmits the encrypted message to the second server via the encrypted transmission protocol, so that the second server decrypts the encrypted message when receiving the encrypted message.

[0127] In the context disclosed by the present invention, a machine-readable medium can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0128] It should be noted that the computer-readable medium disclosed in the present invention may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present invention, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0129] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0130] Each embodiment in this specification is described in a progressive manner. The same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. In particular, for system or system embodiments, since they are basically similar to method embodiments, the description is relatively simple. For relevant parts, refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. A person of ordinary skill in the art can understand and implement it without making any creative efforts.

[0131] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0132] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

[0133] The above are only preferred embodiments of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data transmission method, characterized in that: Applied to a data transmission system, the data transmission system includes a first server, a first switch, and a second server, the method includes: When the first server receives the data transmission request, the first server obtains a target code book matching the target message format of the target message from the first switch, wherein the data transmission request includes the target message requested to be transmitted; The first server obtains a target transmission protocol that matches the target message format; The first server encrypts the target message and the target transmission protocol respectively using the target code book, and transmits the obtained encrypted message and encrypted transmission protocol to the first switch; The first switch verifies the encrypted message and the encrypted transmission protocol using the target password book, and when it is determined that the encrypted message and the encrypted transmission protocol are successfully verified, transmits the encrypted message to the second server using the encrypted transmission protocol, so that the second server decrypts the encrypted message when receiving the encrypted message.

2. The method according to claim 1, characterized in that The first server is pre-configured with a code book generating device, and the method further includes: When the first server detects that the time on the first server reaches a preset time, the code book generating device generates a code book corresponding to each message format according to the encryption information corresponding to each message format, and uses the code book corresponding to each message format to update each code book stored on the first switch; The encrypted information includes at least one first designated position, first replacement information corresponding to each first designated position, at least one second designated position, and second replacement information corresponding to each second designated position.

3. The method according to claim 1, characterized in that The first server is pre-configured with a code book acquisition chip, in which a code book acquisition program is pre-embedded. The first server obtains a target code book matching a target message format of a target message from the first switch, including: The first server calls a code book acquisition program through the code book acquisition chip to acquire a target code book that matches a target message format of the target message from various code books pre-stored on the first switch.

4. The method according to claim 1, wherein The target password book includes at least one first designated position, first replacement information corresponding to each first designated position, at least one second designated position, and second replacement information corresponding to each second designated position. The first server is pre-configured with a message national secret encryption chip. The first server uses the target password book to encrypt the target message and the target transmission protocol, respectively, and transmits the obtained encrypted message and encrypted transmission protocol to the first switch, including: The first server replaces the information at each first designated position on the target message with corresponding first replacement information through a message national secret encryption chip, and encrypts each first replacement information on the target message using a national secret encryption algorithm to obtain an encrypted message; The first server replaces the information at each second designated position on the target transmission protocol with corresponding second replacement information through the message national secret encryption chip, and encrypts each second replacement information on the target transmission protocol using the national secret encryption algorithm to obtain an encrypted transmission protocol; The first server transmits the encrypted message and the encrypted transmission protocol to the first switch.

5. The method according to claim 4, characterized in that The first switch is pre-configured with a message national secret verification device, and the first switch uses the target code book to verify the encrypted message and the encrypted transmission protocol, including: The first switch verifies, through the message national encryption verification device, whether the information at each first designated position on the encrypted message is encrypted, and whether the information at each second designated position on the encrypted transmission protocol is encrypted; If the information at each of the first designated positions on the encrypted message is encrypted, and the information at each of the second designated positions on the encrypted transmission protocol is encrypted, the first switch determines that the encrypted message and the encrypted transmission protocol are authenticated.

6. The method according to claim 1, wherein If the second server and the first server belong to the same local area network, the first switch transmits the encrypted message to the second server through the encryption transmission protocol, so that the second server decrypts the encrypted message when receiving the encrypted message, including: The first switch transmits the encrypted message to the second server through the encryption transmission protocol, so that when the second server receives the encrypted message, it obtains the target password from the first switch and uses the target password to decrypt the encrypted message.

7. The method according to claim 1, characterized in that If the second server and the first server do not belong to the same local area network, the data transmission system further includes a second switch, and the first switch transmits the encrypted message to the second server through the encrypted transmission protocol, so that the second server decrypts the encrypted message when receiving the encrypted message, including: The first switch transmits the encrypted message to the second switch through the encrypted transmission protocol, so that when the second switch receives the encrypted message, it obtains the target cipher pad from the first switch and transmits the encrypted message to the second server through the encrypted transmission protocol. When the second server receives the encrypted message, it obtains the target cipher pad from the second switch and decrypts the encrypted message using the target cipher pad.

8. A data transmission system, characterized in that: The data transmission system includes a first server, a first switch and a second server; The first server is configured to, upon receiving a data transmission request, obtain a target cipher book matching a target message format of a target message from the first switch, wherein the data transmission request includes a target message requested for transmission; obtain a target transmission protocol matching the target message format; encrypt the target message and the target transmission protocol using the target cipher book, respectively, and transmit the obtained encrypted message and encrypted transmission protocol to the first switch; The first switch is configured to verify the encrypted message and the encrypted transmission protocol using the target code book, and when it is determined that the encrypted message and the encrypted transmission protocol are successfully verified, transmit the encrypted message to the second server using the encrypted transmission protocol, so that the second server decrypts the encrypted message when receiving the encrypted message.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the processor and the memory are connected via a communication bus; wherein the processor is configured to call and execute a program stored in the memory; The memory is used to store a program, and the program is used to implement the data transmission method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to execute the data transmission method according to any one of claims 1 to 7.

Images