Method, device and system for transmitting heterogeneous data

Abstract

The disclosed embodiments provide a method, device and system for transmitting heterogeneous data, and relate to the field of electronic information technology technology. The specific implementation of the method includes: the transmission method is applied to a data processing server of a transmission system for heterogeneous data, and the transmission method includes: receiving an encrypted public key and an access request sent by a requester; wherein the access request includes an access token and an access target of the requester; in response to the access request, performing token authentication and address authentication on the access token; when the authentication result of the identity authentication of the access token is a successful authentication, searching for target data corresponding to the access target; encrypting the target data to obtain an encrypted ciphertext, and returning the encrypted ciphertext to the requester. This implementation can improve the accuracy and security of heterogeneous data transmission, reduce the risk of heterogeneous data leakage, and improve the response speed of data access and processing. At the same time, queue management optimizes system performance and reduces the data maintenance costs of operators.

Description

Technical Field

[0001] The present disclosure relates to the field of electronic information technology, and in particular to a method, device, and system for transmitting heterogeneous data. Background Art

[0002] Heterogeneous data refers to data with varying structures, formats, semantics, and uses. This data typically originates from diverse database systems, operating systems, platforms, and devices, including relational and non-relational databases, file systems, IoT devices, testing equipment, and application programming interfaces (APIs). With the widespread adoption of big data, the need to acquire, process, and utilize heterogeneous data from diverse systems, enabling data sharing and transparent access, is increasing.

[0003] In the process of existing clients accessing heterogeneous data, due to the huge differences in the sources, language structures, and formats of heterogeneous data, there are many problems in the data transmission (for example, sending, receiving, etc.), including theft by attackers through data packet capture, malicious attacks on interfaces by attackers resulting in abnormally frequent interface calls, data loss, untimely responses, etc., resulting in frequent polling calls of upstream and downstream systems, etc., resulting in low data security and accuracy, low processing speed, slow response to user requests, waste of data resources and poor data usage experience. Summary of the Invention

[0004] In view of this, the embodiments of the present disclosure provide a method, device and system for transmitting heterogeneous data, which can solve the problems of low data security and accuracy, slow processing speed, slow response to user requests, waste of data resources and poor data usage experience.

[0005] To achieve the above objectives, according to one aspect of the present disclosure, a method for transmitting heterogeneous data is provided. The method is applied to a data processing server of a heterogeneous data transmission system, and the method includes:

[0006] Receiving an encrypted public key and an access request sent by a requester; wherein the access request includes an access token of the requester and an access target;

[0007] In response to the access request, performing token authentication and address authentication on the access token;

[0008] When the authentication results of the token authentication and the address authentication of the access token are successful, searching for target data corresponding to the access target;

[0009] The target data is encrypted to obtain an encrypted ciphertext, and the encrypted ciphertext is returned to the requesting party.

[0010] According to another aspect of the present disclosure, a device for transmitting heterogeneous data is provided. The device is applied to a data processing server of a heterogeneous data transmission system. The device includes:

[0011] A receiving module, configured to receive an encrypted public key and an access request sent by a requester; wherein the access request includes an access token of the requester and an access target;

[0012] an authentication module, configured to perform token authentication and address authentication on the access token in response to the access request;

[0013] A search module, configured to search for target data corresponding to the access target when the authentication results of the token authentication and the address authentication of the access token are successful;

[0014] The encryption module is used to encrypt the target data to obtain an encrypted ciphertext, and return the encrypted ciphertext to the requesting party.

[0015] According to another aspect of the present disclosure, a method for transmitting heterogeneous data is provided. The method is applied to a requester of a heterogeneous data transmission system, and the method includes:

[0016] receiving the encrypted ciphertext, and extracting a first ciphertext value and a second ciphertext value from the encrypted ciphertext;

[0017] Calculating a dot product of the encrypted private key and the first ciphertext value to obtain an intermediate value;

[0018] Subtracting the intermediate amount from the second ciphertext value to obtain an intermediate difference;

[0019] The intermediate difference is decoded to obtain the target data.

[0020] According to another aspect of an embodiment of the present disclosure, a device for transmitting heterogeneous data is provided. The device is applied to a requester of a heterogeneous data transmission system, and includes:

[0021] A receiving module, configured to receive the encrypted ciphertext and extract a first ciphertext value and a second ciphertext value from the encrypted ciphertext;

[0022] a calculation module, configured to calculate a dot product of the encrypted private key and the first ciphertext value to obtain an intermediate value;

[0023] a data processing module, configured to subtract the intermediate amount from the second ciphertext value to obtain an intermediate difference;

[0024] A decoding module is used to decode the intermediate difference to obtain the target data.

[0025] According to another aspect of an embodiment of the present disclosure, a system for transmitting heterogeneous data is provided, including: a data processing server and a requester, wherein the data processing server includes a transmission device for heterogeneous data, and the requester includes a transmission device for heterogeneous data.

[0026] According to another aspect of the embodiments of the present disclosure, there is provided an electronic device, including:

[0027] processor; and

[0028] Memory for storing programs,

[0029] The program includes instructions, which, when executed by the processor, cause the processor to execute the heterogeneous data transmission method.

[0030] According to another aspect of the embodiments of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the heterogeneous data transmission method.

[0031] One or more technical solutions provided in the embodiments of the present application can improve the accuracy and security of heterogeneous data transmission, reduce the risk of heterogeneous data leakage, and improve the response speed of data access and processing by issuing access tokens, receiving access requests, token authentication, address authentication, matching target data, encrypted transmission, and penalties. At the same time, queue management optimizes system performance and reduces the data maintenance costs of operators. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A flowchart showing a method for transmitting heterogeneous data according to a first exemplary embodiment of the present disclosure is shown;

[0033] Figure 2 A schematic diagram illustrating a system for transmitting heterogeneous data according to an exemplary embodiment of the present disclosure is shown;

[0034] Figure 3 A flowchart illustrating a token authentication and address authentication method of an access token according to an exemplary embodiment of the present disclosure is shown;

[0035] Figure 4 A flowchart illustrating a process of applying for an access token according to an exemplary embodiment of the present disclosure is shown;

[0036] Figure 5 A flowchart illustrating a process of issuing an access token according to an exemplary embodiment of the present disclosure is shown;

[0037] Figure 6 A flowchart of a method for generating an encrypted ciphertext according to an exemplary embodiment of the present disclosure is shown;

[0038] FIG7( a ) shows a flowchart of a method for determining an encryption key and base point coordinates according to an exemplary embodiment of the present disclosure;

[0039] FIG7( b ) shows a schematic diagram of a reference ellipse and base points according to an exemplary embodiment of the present disclosure;

[0040] Figure 8 A flowchart illustrating a method for transmitting heterogeneous data according to a second exemplary embodiment of the present disclosure is shown;

[0041] Figure 9 A flowchart of a method for pre-responding to an access request according to an exemplary embodiment of the present disclosure is shown;

[0042] Figure 10 A flowchart illustrating a penalty method after an access request response according to an exemplary embodiment of the present disclosure is shown;

[0043] Figure 11 A flowchart showing a method for adjusting a service request response according to an exemplary embodiment of the present disclosure is shown;

[0044] Figure 12 A schematic block diagram showing a device for transmitting heterogeneous data according to a first exemplary embodiment of the present disclosure is shown;

[0045] Figure 13 A schematic block diagram showing a device for transmitting heterogeneous data according to a second exemplary embodiment of the present disclosure is shown;

[0046] Figure 14 A structural block diagram of an exemplary electronic device that can be used to implement the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0047] The following describes embodiments of the present disclosure in more detail with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0048] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0049] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to". The term "based on" means "at least partially based on". The term "in an embodiment of the present disclosure" means "at least one embodiment"; the term "another exemplary embodiment" means "at least one other embodiment". The relevant definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc. mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0050] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, they should be understood as "one or more".

[0051] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0052] Aspects of the present disclosure are described below with reference to the accompanying drawings.

[0053] Figure 1 A flow chart of a method for transmitting heterogeneous data according to a first exemplary embodiment of the present disclosure is shown. Figure 1 As shown, the method for transmitting heterogeneous data in the first embodiment of the present disclosure includes the following steps:

[0054] In the embodiment of the present disclosure, the heterogeneous data transmission method of the present disclosure is executed by a heterogeneous data transmission system, such as Figure 2 As shown, the heterogeneous data transmission system disclosed herein includes a client, a firewall, a load balancer, a reverse proxy server, and a data processing server. The client can act as a requester to initiate access requests to each data processing server; alternatively, each data processing server can act as a requester to initiate access requests to other data processing servers. The data processing servers can be different types of data systems, such as relational servers, non-relational servers, file systems, IoT devices, detection equipment, application programming interfaces, etc. The transmission of heterogeneous data can be data transmission between the client and different types of servers, or data transmission between different types of servers.

[0055] Furthermore, firewalls are used to whitelist the requester. Both load balancers and reverse proxy servers can be used to distribute traffic. The difference is that load balancers are used to load balance access requests initiated by the requester and determine the data processing server where the access request is located. Reverse proxy servers, after determining the data processing server where the access request is located, then load balance the service nodes that respond to the access request. The reverse proxy server can determine the data processing server corresponding to the access target based on the weight, region, and capacity of each service node.

[0056] Step 101: Receive an encrypted public key and an access request sent by a requester; wherein the access request includes an access token of the requester and an access target.

[0057] In the embodiment of the present disclosure, the requester may be a client or server of a heterogeneous data transmission system. When the requester is a client, the server that executes the heterogeneous data transmission method of the first embodiment of the present disclosure may be any server of the heterogeneous data transmission system, that is, the server that executes the heterogeneous data transmission method of the first embodiment of the present disclosure acts as a responder and receives the encrypted public key and access request sent by the client as the requester; when the requester is a server, the server corresponding to the requester is different from the server that executes the heterogeneous data transmission method of the first embodiment of the present disclosure, that is, the server that executes the heterogeneous data transmission method of the first embodiment of the present disclosure acts as a responder and receives the encrypted public key and access request sent by other servers as requesters.

[0058] Furthermore, the encrypted public key and access request can be received sequentially or simultaneously. For example, the requester can first send the encrypted public key and then initiate the access request, and the server can first receive the encrypted public key and then the access request. Alternatively, the client can send the encrypted public key along with the first access request, and the server can receive both the encrypted public key and the access request simultaneously.

[0059] Furthermore, the access request also includes a requester ID.

[0060] Step 102: In response to the access request, perform token authentication and address authentication on the access token.

[0061] In the embodiment of the present disclosure, Figure 2 As shown, the access request reaches the data processing server after passing through the firewall, load balancer, and reverse proxy server. The identity authentication of the access request includes whitelist authentication, token authentication, and address authentication. The whitelist authentication is performed by the firewall, and the token authentication and address authentication are performed by the data processing server. Only when the authentication results of the whitelist authentication, token authentication, and address authentication are all successful, can the authentication result of the identity authentication of the access request be confirmed to be successful.

[0062] Furthermore, the firewall stores a firewall whitelist for whitelist authentication of the source address of the access request. Only when the source address of the access request exists in the firewall whitelist - that is, the authentication result of the whitelist authentication is successful, the firewall will transmit the access request to the data processing server.

[0063] Furthermore, after receiving the access request, the data processing server performs token authentication on the access token of the access request and performs address authentication on the requesting IP of the access request to ensure the identity security of the requesting party, such as Figure 3 As shown, the token authentication and address authentication method of the access token disclosed in the present invention includes the following steps:

[0064] Step 301: Look up the requester token, token generation time, token validity period, and application address of the requester according to the requester ID.

[0065] In the embodiment of the present disclosure, since the requester has applied for an access token from the data processing server before initiating an access request, when initiating an access request to the corresponding data processing server, the data processing server will compare the access token carried by the requester with the requester token stored during the application process to perform token authentication on the access token.

[0066] Furthermore, if Figure 4 As shown, the application process for the access token disclosed herein includes the following steps:

[0067] In the embodiment of the present disclosure, the application process of the access token of the present disclosure is performed by the requester.

[0068] Step 401: Initiate a token application request to a data processing server.

[0069] Step 402: Receive a token application form returned by the data processing server in response to the token application request.

[0070] In the embodiment of the present disclosure, the token application form includes a requester ID, a requester key, an application address, etc. The application address may be in the form of an IP address.

[0071] Step 403: Fill in the token application form using the requester ID, requester key, and application address, and send the filled-in token application form to the data processing server.

[0072] In the disclosed embodiment, the requester ID may be represented by requestId, the requester key may be represented by requestSecret, and the application address may be represented by requestIP. The requester key may be arbitrarily set according to the character format required by the data processing server.

[0073] Step 404: Receive the access token returned by the data processing server.

[0074] Furthermore, if Figure 5 As shown, the process of issuing the access token disclosed in the present invention includes the following steps:

[0075] In the embodiment of the present disclosure, the process of issuing the access token of the present disclosure is executed by the data processing server.

[0076] Step 501: Receive the token application request, and in response to the token application request, send a token application form to the requesting party.

[0077] Step 502: Receive the completed token application form and send the application address to the firewall.

[0078] In the embodiment of the present disclosure, after the data processing server receives the completed token application form sent by the requester, it sends the application address in the completed token application form to the firewall. The firewall will add the application address to the firewall whitelist, and then subsequently perform whitelist authentication on the application address of the access request transmitted through the firewall to ensure the legitimacy of the requester and ensure data security.

[0079] Step 503: Determine the access rights of the requester, combine the requester ID and the corresponding access rights, and obtain a requester token.

[0080] In the disclosed embodiment, the data processing server can determine the data range that the requester can access based on the level of the requester ID, and then determine the access rights of the requester, and combine the requester ID and the corresponding access rights into a requester token.

[0081] Step 504: Perform a first encoding process on the requesting party token to obtain encoding result one.

[0082] In the embodiment of the present disclosure, in order to prevent the access token from being leaked by malicious attacks or other means during transmission, the requester token is subjected to multiple protection processes before being sent to the requester.

[0083] Furthermore, the encoding algorithm of the first encoding process can be selectively set as needed, for example, the base64 encoding method.

[0084] Step 505: Perform a first encryption process on the encoding result 1 to generate an access token of the requester, and store the corresponding relationship between the requester ID, the requester token, token generation time, token validity period and the application address.

[0085] In the embodiment of the present disclosure, the encryption algorithm of the first encryption process can be selectively set as needed. For example, the encryption algorithm of the first encryption process is the MD5 algorithm.

[0086] Furthermore, the data processing server stores the requester ID, requester token, token generation time, token validity period and application address of the requester in the local cache, and the requester token, token generation time, token validity period, and / or application address can be directly read through the requester ID in the subsequent token authentication process.

[0087] Step 506: Send the access token to the requesting party.

[0088] In the embodiment of the present disclosure, through the application and issuance process of the access token disclosed in the present disclosure, mutual recognition between the requester and the data processing server can be achieved to ensure the legitimacy of the requester's identity, thereby ensuring the security of heterogeneous data.

[0089] Step 302 : Determine whether the access token has expired based on the token generation time and token validity period. If yes, go to step 309 ; if not, go to step 303 .

[0090] In an embodiment of the present disclosure, the data processing server calculates the sum of the token generation time and the token validity period based on the token generation time and the token validity period as the expiration time of the requesting party's token; then compares the current time with the expiration time of the requesting party's token. If the current time is earlier than the expiration time of the requesting party's token, it is determined that the access token has not expired; otherwise, it is determined that the access token has expired.

[0091] Step 303: Perform a first encoding process on the requesting party token to obtain a second encoding result.

[0092] Furthermore, when the access token has not expired, the data processing server re-encodes the read requester token to obtain encoding result two.

[0093] Step 304: Perform a first encryption process on the second encoding result to obtain a first encryption result.

[0094] Step 305 , compare the encryption result 1 with the access token to determine whether the encryption result 1 and the access token are the same. If yes, go to step 306 ; if not, go to step 309 .

[0095] Step 306: extract the source address in the request header of the access request.

[0096] In an embodiment of the present disclosure, for the same requester ID, when the first encryption result and the access token are identical, the authentication result of the token authentication of the access token of the access request is determined to be authentication success.

[0097] Furthermore, if Figure 2 As shown, the access request passes through the firewall, load balancer, and reverse proxy server before reaching the data processing server. During this process, in addition to the requester address, the firewall address, load balancer address, and reverse proxy server address will be added to the request header of the access request by the firewall, load balancer, and reverse proxy server, respectively. That is, the request header (expressed as header) of the access request received by the data processing server includes the object addresses of all objects in the access request transmission process. For example, the request header of the access request includes X-Real-IP and X-Forwarded-For, X-Real-IP is the real source address, and X-Forwarded-For includes the firewall address, load balancer address, and reverse proxy server address. Therefore, when the authentication result of the token authentication of the access request is successful, the source address of the access request continues to be authenticated, and the data processing server extracts the source address in the request header of the access request. The source address can be in the form of an IP address.

[0098] Step 307 , compare the source address with the application address to determine whether the source address and the application address are the same. If yes, go to step 308 ; if not, go to step 309 .

[0099] Step 308: Determine that the authentication result of the identity authentication of the access request is successful.

[0100] In the embodiment of the present disclosure, when the source address is the same as the application address, the authentication result of the address authentication of the access request is determined to be successful, that is, the authentication result of the identity authentication of the requester is successful.

[0101] Step 309: Determine that the authentication result of the identity authentication of the access request is authentication failure.

[0102] In the embodiment of the present disclosure, when the access token expires, the encryption result is different from the access token, or the source address is different from the application address, it indicates that the authentication result of the token authentication is authentication failure, or the authentication result of the address authentication is authentication failure. The failure of either the token authentication or the address authentication indicates that the identity authentication of the access request has failed.

[0103] In the embodiment of the present disclosure, the token authentication and address authentication method of the access token of the present disclosure is used to authenticate whether the identity of the requester is legitimate, so as to ensure the legitimacy of the identity of the requester and further protect the security of heterogeneous data.

[0104] Step 103 : When the authentication results of the token authentication and the address authentication of the access token are successful, searching for target data corresponding to the access target.

[0105] In the embodiment of the present disclosure, when the identity authentication result of the requesting party is successful, the data processing server searches for the corresponding target data according to the access target, wherein the target data is in JSON format.

[0106] Furthermore, when reading the target data, the data processing server uses a distributed lock to perform a uniqueness check on the read target data. If the uniqueness check succeeds, the distributed lock is canceled and the target data is subjected to a standard verification using an annotation tool. The verification conditions of the standard verification are determined according to the requester's requirements, including data length, data format, etc. If the standard verification of the target data succeeds, the target data is processed into encrypted ciphertext. The distributed lock tool can be Redisson.

[0107] Step 104: encrypt the target data to obtain encrypted ciphertext, and return the encrypted ciphertext to the requesting party.

[0108] In the embodiment of the present disclosure, the data processing server encrypts the target data and returns it to the requester to ensure data security and prevent data leakage. Figure 6 As shown, the method for generating encrypted ciphertext disclosed in the present invention includes the following steps:

[0109] Step 601: Receive the encrypted public key and base point coordinates sent by the requesting party.

[0110] In the embodiment of the present disclosure, before receiving the access request, the data processing server has received the base point coordinates and encrypted public key sent by the requester. The base point coordinates and encrypted public key can be sent in plain text. Since the encrypted ciphertext corresponding to the target data is encrypted data, even if the base point coordinates and encrypted public key are leaked, the encrypted ciphertext cannot be cracked. Therefore, the target data can be protected and data security is effectively improved.

[0111] Furthermore, as shown in FIG7 , the method for determining the encryption key and base point coordinates of the present disclosure includes the following steps:

[0112] In the embodiment of the present disclosure, the method for determining the encryption public key and base point coordinates of the present disclosure is executed by the requesting party.

[0113] Step 701: randomly generate a reference ellipse.

[0114] In the embodiment of the present disclosure, Figure 8As shown, a reference ellipse RE is randomly generated in the rectangular coordinate system xOy, and the major axis length a and the minor axis length b of the reference ellipse RE can be selectively set as needed.

[0115] Step 702: randomly select a point on the elliptic curve of the reference ellipse as a base point.

[0116] In the embodiment of the present disclosure, a point is arbitrarily selected from the reference ellipse RE as the base point G, with coordinates (x1, y1).

[0117] Step 703: Calculate the dot product of the base point coordinates of the base point and the encrypted private key to obtain the encrypted public key.

[0118] In the embodiment of the present disclosure, the base point coordinates G(x1, y1) and the encryption private key S are calculated. a The dot product of a =G⊙S a Among them, the encrypted private key S a The requester keeps it and can set the characters and digits as needed.

[0119] Step 704: Send the encrypted public key and the base point coordinates to the data processing server.

[0120] In the embodiment of the present disclosure, through the method for determining the encryption public key and base point coordinates of the present disclosure, the requester can arbitrarily set the encryption private key, and use the encryption private key and the reference ellipse to generate an encryption public key, which is sent to the data processing server for storage. The target data can then be encrypted and decrypted, further ensuring the security of heterogeneous data and improving data security.

[0121] Step 602: randomly generate a first random number.

[0122] In the embodiment of the present disclosure, the data processing server randomly generates a first random number Q. The requirements for the characters and the number of digits of the first random number Q can be selectively set as needed. For example, the first random number Q is randomly selected from 32 uppercase letters AZ, lowercase letters az, numbers 0-9, and punctuation marks (".", ","?", " / ", "\", "|", "*", "&", "#", "@", "!"), which must include numbers and letters.

[0123] Step 603: Calculate the dot product of the first random number and the base point coordinates as a first ciphertext value.

[0124] In the embodiment of the present disclosure, the dot product of the first random number Q and the base point coordinate G (x1, y1) is calculated to obtain the first ciphertext value C1 = Q⊙G.

[0125] Step 604: Perform a second encoding process on the target data to obtain a third encoding result.

[0126] In the embodiment of the present disclosure, the target data is represented by M, and a second encoding process encoding2() is performed on the target data to obtain an encoding result encoding2(M). The encoding algorithm of the second encoding process can be the same as or different from the encoding algorithm of the first encoding process, and can be selectively set as needed.

[0127] Step 605: triple-superimpose the dot product of the first random number and the encryption public key and the encoding result to obtain a second ciphertext value.

[0128] In the embodiment of the present disclosure, the first random number Q and the encryption public key P are first calculated. a The dot product Q⊙P a , then combine the encoding result encoding2(M) with the first random number Q and the encryption public key P a The dot product Q⊙P a Superposition, get the second ciphertext value C2 = Q⊙P a + encoding2(M).

[0129] Step 606: Combine the first ciphertext value and the second ciphertext value to obtain the encrypted ciphertext.

[0130] In the embodiment of the present disclosure, the data processing server combines the first ciphertext value C1 and the second ciphertext value C2 to obtain an encrypted ciphertext C=(C1, C2).

[0131] Step 607: Send the encrypted ciphertext to the requesting party.

[0132] In the embodiment of the present disclosure, the data processing server sends the encrypted ciphertext C after encrypting the target data M to the requester. When the data processing server sends the encrypted ciphertext to the requester, it can be in the form of message encapsulation.

[0133] In the embodiment of the present disclosure, the target data is encoded and then encrypted through the encryption ciphertext generation method of the present disclosure, so that the target data is sent in the form of encrypted ciphertext, which greatly improves the security of the target data, reduces the risk of leakage, and ensures the transmission security of heterogeneous data.

[0134] In the embodiments of the present disclosure, the heterogeneous data transmission method of the present disclosure can improve the security and accuracy of data transmission, prevent data loss, greatly reduce the risk of leakage, and ensure the security of heterogeneous data.

[0135] In the embodiment of the present disclosure, after receiving the encrypted ciphertext, the requester processes the encrypted ciphertext to obtain the target data, thereby achieving secure and accurate data transmission and ensuring the security of heterogeneous data. Figure 8 As shown, the method for transmitting heterogeneous data in the second embodiment of the present disclosure includes the following steps:

[0136] Step 801: Receive the encrypted ciphertext, and extract a first ciphertext value and a second ciphertext value from the encrypted ciphertext.

[0137] Step 802: Calculate the dot product of the encrypted private key and the first ciphertext value to obtain an intermediate value.

[0138] In the embodiment of the present disclosure, the requester calculates the encryption private key S a The product of the first ciphertext value C1 is the intermediate quantity S a ⊙C1. Since C1=Q⊙G, the intermediate quantity S a ⊙C1=S a ⊙Q⊙G.

[0139] Step 803: Subtract the intermediate value from the second ciphertext value to obtain an intermediate difference.

[0140] In the embodiment of the present disclosure, the second ciphertext value C2 is subtracted from the intermediate value S a ⊙C1, get the middle difference C2-S a ⊙C1=C2-S a ⊙Q⊙G. Since C2=Q⊙P a + encoding2(M), encrypted public key P a =G⊙S a , so the middle difference is C2-S a ⊙Q⊙G=Q⊙P a +encoding2(M)-S a ⊙Q⊙G=Q⊙G⊙S a +encoding2(M)-S a ⊙Q⊙G=encoding2(M).

[0141] Step 804: Decode the intermediate difference to obtain the target data.

[0142] In the embodiment of the present disclosure, the intermediate difference encoding2(M) is decoded to obtain the target data M. The decoding process corresponds to the encoding algorithm of the second encoding process.

[0143] In the embodiment of the present disclosure, through the heterogeneous data transmission method disclosed in the present disclosure, the requester processes the encrypted ciphertext returned by the data processing server to obtain the target data corresponding to the access request, thereby ensuring the accuracy and security of the target data.

[0144] In the embodiment of the present disclosure, before responding to an access request, the data processing server introduces a queue tool to manage the access request, including sorting, retrying, priority adjustment, penalty, etc., in order to ensure the timeliness of the access request response, improve the response speed of the access request, and ensure the optimal performance of the system, so as to ensure the security and accuracy of data transmission.

[0145] Furthermore, if Figure 9 As shown, the pre-response method for access request disclosed in the present invention includes the following steps:

[0146] Step 901: In response to the access request, increment the request count of the access request.

[0147] In the embodiment of the present disclosure, before searching for target data corresponding to the access target, for the same access request, the data processing server automatically increments the request count of the access request each time the requesting party makes a request.

[0148] Step 902 , determining whether the number of access requests within a unit time exceeds a preset first threshold number. If yes, go to step 903 ; if not, go to step 907 .

[0149] In the embodiment of the present disclosure, the first number threshold can be selectively set as needed, for example, the first number threshold is 5 times.

[0150] Step 903: Add the requester ID of the access request and the source address of the access request as queue elements to a penalty queue.

[0151] In the embodiment of the present disclosure, the queue tool includes a request queue, a penalty queue, etc. The queue tool can be selectively set as needed, for example, the queue tool is a Disruptor.

[0152] Furthermore, since the requester may send the same access request multiple times and frequently, there may be authentication failures, sender failures, etc. Therefore, when the number of requests per unit time exceeds the first number threshold, a penalty warning will be issued to the requester, the access request will be added to the penalty queue, and the access request from the requester and the source address will be refused.

[0153] Step 904: Determine whether the queue entry time of each queue element in the penalty queue exceeds the corresponding first penalty time. If yes, proceed to step 905; if not, proceed to step 906. The first penalty time of the queue element is determined by the number of penalties on the access request corresponding to the queue element.

[0154] In an embodiment of the present disclosure, the first penalty time of a queue element can be selectively set as needed. For example, the time value of the first penalty time of a queue element is half of the number of penalties for access requests corresponding to the queue element, and the time unit of the first penalty time is min.

[0155] Furthermore, the judgment period of the first penalty time can be selectively set as needed, for example, once every 10 seconds.

[0156] Step 905: Re-match the target request queue for the access request corresponding to the queue element.

[0157] In an embodiment of the present disclosure, when the enqueue time of a queue element exceeds the corresponding penalty time, a target request queue is re-matched for the access request corresponding to the queue element.

[0158] Step 906, continue waiting and go to step 904.

[0159] In the embodiment of the present disclosure, when the enqueue time of the queue element does not exceed the corresponding penalty time, the judgment cycle of the next penalty time continues to be waited for.

[0160] Step 907: Match the access request with a target request queue.

[0161] In the embodiment of the present disclosure, if the number of access request requests per unit time does not exceed the first number threshold, it indicates that the access request is normal, and a request queue is selected as the target request queue for the access request and processed in sequence.

[0162] Furthermore, the matching method of the target request queue can be determined according to the queue length of each request queue, and the shortest or shorter request queue is preferentially matched to the access request as the target request queue.

[0163] In the embodiment of the present disclosure, through the pre-response method for access requests disclosed in the present disclosure, before processing the access requests, a queue tool is used to manage each access request, thereby ensuring a timely response to each access request, improving the response speed of the access request, and thus optimizing the utilization of system performance, improving system efficiency and user access experience.

[0164] In the embodiment of the present disclosure, the requester can return the decryption result of the encrypted ciphertext to the data processing server, and the data processing server will determine whether to punish the requester and / or source address of the access request based on the decryption result of the encrypted ciphertext, thereby further ensuring the security and accuracy of data transmission. Figure 10 As shown, the penalty method after the access request response disclosed in the present invention includes the following steps:

[0165] Step 1001: Receive the decryption result returned by the requesting party.

[0166] Step 1002 , determine whether the decryption result is a decryption failure. If yes, go to step 1003 ; if not, go to step 1011 .

[0167] Step 1003: increment the number of decryption failures of the access request.

[0168] In an embodiment of the present disclosure, when the decryption result of the encrypted ciphertext is a decryption failure, the data processing server records the number of decryption failures of the requesting party.

[0169] Step 1004 , determine whether the number of decryption failures exceeds a preset second threshold value. If yes, go to step 1005 ; if not, go to step 1006 .

[0170] In the embodiment of the present disclosure, the second number threshold can be selectively set as needed, for example, the second number threshold is 10 times.

[0171] Step 1005: Block the requester ID and the source address of the access request.

[0172] In the embodiment of the present disclosure, when the number of decryption failures of an access request exceeds a second threshold, it indicates that the danger level of the requester is too high, so the requester and / or the source address is ultimately punished by directly banning the requester ID and the source address, and rejecting the access request of the requester ID and the source address.

[0173] Step 1006 , determine whether the number of decryption failures exceeds a preset third number threshold. If yes, go to step 1007 ; if not, go to step 1011 .

[0174] In the disclosed embodiment, if the number of decryption failures in an access request does not exceed the second threshold, it indicates that the risk of the requesting party has not reached an unacceptable level. Therefore, the third threshold is used to further assess the requesting party's risk of data leakage. The third threshold is lower than the second threshold and can be set as needed. For example, the second threshold is 5 times.

[0175] Step 1007: Add the requester ID of the access request and the source address of the access request as queue elements to a penalty queue.

[0176] In the embodiment of the present disclosure, when the number of decryption failures of an access request exceeds the third threshold, a temporary penalty is imposed on the requester and / or source address, and the requester ID and source address are added to the penalty queue, and the response is rejected within a certain period of time. Step 1007 is the same as step 903.

[0177] Step 1008 , determining whether the queue entry time of each queue element in the penalty queue exceeds the corresponding second penalty time; if so, proceed to step 1009 ; if not, proceed to step 1010 .

[0178] In the embodiment of the present disclosure, the time value and time unit of the second penalty time of the queue element can be selectively set as needed. For example, the first penalty time of the queue element is 1 day.

[0179] Furthermore, the judgment period of the second penalty time can be selectively set as needed, for example, once every 10 seconds.

[0180] Step 1009: Re-match the target request queue for the access request corresponding to the queue element.

[0181] Step 1010, continue waiting and go to step 1008.

[0182] Step 1011, determine the next decryption result and go to step 1002.

[0183] In the disclosed embodiment, when the decryption result of the encrypted ciphertext is successful decryption, and / or the number of decryption failures of the access request does not exceed the third number threshold, the data processing server continues to determine the next decryption result.

[0184] In the embodiment of the present disclosure, through the penalty method after responding to an access request disclosed in the present disclosure, after responding to the access request, the leakage risk of the requesting party is further judged based on the decryption result of the requesting party, and then it is determined whether to impose penalties such as ban on the requesting party, so as to ensure the security of heterogeneous data and improve system security.

[0185] In the embodiment of the present disclosure, after the requester obtains the target data, it will process the data according to the business request corresponding to the target data to obtain the corresponding business processing result. In order to ensure the timeliness of the response to the business request and improve the user experience, the business processing result is monitored and timely warning is issued to ensure the response speed of the requester.

[0186] Furthermore, the requester can also use a queue tool to process the service request. The queue tool of the requester includes a service queue for storing various service requests, such as Figure 11 As shown, the adjustment method after the service request response of the present disclosure includes the following steps:

[0187] In the embodiment of the present disclosure, the adjustment method after the service request response of the present disclosure is executed by the requesting party.

[0188] Step 1101 , determine whether the business processing result of the business request corresponding to the target data is a processing failure. If yes, go to step 1102 ; if not, go to step 1106 .

[0189] Step 1102: Increment the number of processing failures.

[0190] In an embodiment of the present disclosure, when the service processing result of the service request corresponding to the target data is a processing failure, the number of processing failures of the service request is incremented.

[0191] Step 1103 , determine whether the number of processing failures exceeds a preset fourth threshold value. If yes, go to step 1104 ; if not, go to step 1105 .

[0192] Step 1104: Send an early warning notification to the initiator of the service request.

[0193] In an embodiment of the present disclosure, if the number of service request processing failures exceeds a fourth threshold, the requestor will provide a warning notification to the initiator of the service request. The warning notification can be a strong reminder, allowing the initiator's service personnel to promptly perform compensatory processing to ensure the normal operation of the service. The compensation processing method may be to locate the service failure, re-initiate the service request, etc.

[0194] Step 1105: lower the request level of the service request.

[0195] In an embodiment of the present disclosure, if the number of service request processing failures does not exceed the fourth threshold, the request level of the service request is lowered. The lowering of the request level of the service request can be processed by adjusting the order of the service request in the service queue backward.

[0196] Step 1106, determine the next business processing result and go to step 1101.

[0197] In an embodiment of the present disclosure, when the business processing result of the business request corresponding to the target data is successful, the data processing server continues to determine the next business processing result.

[0198] In the embodiment of the present disclosure, through the adjustment method after the business request response of the present disclosure, the requesting party judges the business processing result of the business request corresponding to the target data, further ensuring the timely response and normal and stable operation of the entire data chain, and improving the user's business usage experience.

[0199] Figure 12 FIG. 1 is a schematic diagram of main modules of a device for transmitting heterogeneous data according to a first embodiment of the present disclosure. Figure 12As shown, the heterogeneous data transmission device 1200 of the present disclosure is applied to a data processing server of a heterogeneous data transmission system, including:

[0200] The receiving module 1201 is configured to receive an encrypted public key and an access request sent by a requesting party; wherein the access request includes an access token of the requesting party and an access target.

[0201] The authentication module 1202 is configured to perform token authentication and address authentication on the access token in response to the access request.

[0202] The search module 1203 is configured to search for target data corresponding to the access target when the authentication result of the identity authentication of the access token is successful.

[0203] The encryption module 1204 is configured to encrypt the target data to obtain an encrypted ciphertext, and return the encrypted ciphertext to the requesting party.

[0204] Figure 13 FIG. 1 is a schematic diagram of main modules of a device for transmitting heterogeneous data according to a second embodiment of the present disclosure. Figure 13 As shown, the heterogeneous data transmission device 1300 of the present disclosure is applied to the requesting party of the heterogeneous data transmission system, including:

[0205] The receiving module 1301 is configured to receive the encrypted ciphertext and extract a first ciphertext value and a second ciphertext value from the encrypted ciphertext.

[0206] The calculation module 1302 is configured to calculate a dot product of the encrypted private key and the first ciphertext value to obtain an intermediate value.

[0207] The data processing module 1303 is configured to subtract the intermediate amount from the second ciphertext value to obtain an intermediate difference.

[0208] The decoding module 1304 is configured to decode the intermediate difference to obtain the target data.

[0209] In the embodiment of the present disclosure, in summary, as described above, Figure 2 The interaction process of the heterogeneous data transmission system shown includes the following steps:

[0210] The requesting party receives a service request; wherein the service request includes an access target;

[0211] The requester initiates a token application request based on the data processing server to which the access target belongs;

[0212] In response to the token application request, the data processing server sends a token application form to the requester;

[0213] The requester fills in the token application form using the requester ID, requester key, and application address, and sends the filled token application form to the data processing server;

[0214] The data processing server sends the application address to the firewall;

[0215] The data processing server determines the access rights of the requester, combines the requester ID and the corresponding access rights, and obtains a requester token;

[0216] The data processing server performs a first encoding process on the requester token to obtain an encoding result 1, then performs a first encryption process on the encoding result 1 to generate an access token for the requester, and stores a correspondence between the requester ID, the requester token, token generation time, token validity period, and the application address;

[0217] The data processing server sends the access token to the requester;

[0218] The requesting party randomly generates a reference ellipse, selects a point on the elliptic curve of the reference ellipse as a base point, calculates the dot product of the base point coordinates of the base point and the encryption private key to obtain an encryption public key, and sends the encryption public key and the base point coordinates to a data processing server;

[0219] The data processing server receives the encrypted public key sent by the requester;

[0220] The firewall performs a whitelist authentication on the source address of the access request initiated by the requester, and if the authentication result of the whitelist authentication is successful, sends the access request to the data processing server via the load balancing server and the reverse proxy server;

[0221] The data processing server receives an access request; wherein the access request includes the access token of the requester and the access target;

[0222] In response to the access request, the data processing server increments the request count of the access request, determines whether the request count of the access request within a unit time exceeds a first count threshold, and matches the access request to a target request queue if the request count of the access request within the unit time does not exceed the first count threshold. The target request queue processes the access requests in the queue in order.

[0223] When processing the access request, the data processing server searches for the requester token, token generation time, token validity period, and application address of the requester according to the requester ID;

[0224] The data processing server determines whether the access token has expired based on the token generation time and the token validity period. If the access token has not expired, the data processing server performs a first encoding process on the requesting party token to obtain an encoding result 2, and then performs a first encryption process on the encoding result 2 to obtain an encryption result 1. The encryption result 1 is compared with the access token. If the encryption result 1 and the access token are the same, the data processing server extracts the source address in the request header of the access request, compares the source address with the application address, and if the source address and the application address are the same, determines that the authentication result of the identity authentication of the access request is authentication success; or, if the access token has expired, the encryption result 1 is different from the access token, or the source address is different from the application address, determines that the authentication result of the identity authentication of the access request is authentication failure, and rejects the access request.

[0225] When the authentication result of the identity authentication of the access token is successful, the data processing server searches for target data corresponding to the access target;

[0226] The data processing server randomly generates a first random number, calculates the dot product of the first random number and the base point coordinates as a first ciphertext value, then performs a second encoding process on the target data to obtain an encoding result three, superimposes the dot product of the first random number and the encryption public key with the encoding result three to obtain a second ciphertext value, then combines the first ciphertext value and the second ciphertext value to obtain the encrypted ciphertext, and sends the encrypted ciphertext to the requesting party.

[0227] The requesting party extracts the first ciphertext value and the second ciphertext value from the encrypted ciphertext, calculates the dot product of the encrypted private key and the first ciphertext value to obtain an intermediate quantity, then subtracts the intermediate quantity from the second ciphertext value to obtain an intermediate difference, and finally decodes the intermediate difference to obtain the target data.

[0228] When the number of requests of the access request within the unit time exceeds the first number threshold, the data processing server adds the requester ID of the access request and the source address of the access request as queue elements to the penalty queue, and determines whether the entry time of each queue element in the penalty queue exceeds the corresponding first penalty time. When the entry time of the queue element exceeds the corresponding first penalty time, the target request queue is re-matched for the access request corresponding to the queue element; when the entry time of the queue element does not exceed the corresponding first penalty time, the server continues to wait for the next judgment cycle to be reached and then makes a new judgment.

[0229] The data processing server receives the decryption result returned by the requester, and determines whether the decryption result is a decryption failure. If so, in the case that the decryption result is a decryption failure, the data processing server increments the number of decryption failures of the access request, and determines whether the number of decryption failures exceeds a second number threshold. In the case that the number of decryption failures exceeds the second number threshold, the data processing server blocks the requester ID and the source address of the access request; in the case that the number of decryption failures does not exceed the second number threshold, the data processing server determines whether the number of decryption failures exceeds a preset third number threshold.

[0230] Furthermore, when the number of decryption failures exceeds the third number threshold, the requester ID of the access request and the source address of the access request are added to the penalty queue as queue elements, and it is determined whether the entry time of each queue element in the penalty queue exceeds the corresponding second penalty time. When the entry time of the queue element exceeds the corresponding second penalty time, the target request queue is re-matched for the access request corresponding to the queue element; when the entry time of the queue element exceeds the corresponding second penalty time, the judgment is continued after the next judgment cycle is reached.

[0231] When the number of decryption failures exceeds a third number threshold, the next decryption result is determined.

[0232] The requesting party determines whether the business processing result of the business request corresponding to the target data is successful. If the business processing result is a processing failure, the number of processing failures is incremented, and it is determined whether the number of processing failures exceeds the preset fourth number threshold. If the number of processing failures exceeds the fourth number threshold, an early warning notification is sent to the initiator of the business request; if the number of processing failures does not exceed the fourth number threshold, the request level of the business request is lowered.

[0233] Furthermore, when the business processing result is successful, the next business processing result is determined.

[0234] The exemplary embodiments of the present disclosure further provide an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, the computer program being configured to cause the electronic device to perform a method according to an exemplary embodiment of the present disclosure when executed by the at least one processor.

[0235] Exemplary embodiments of the present disclosure further provide a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to perform a method according to an embodiment of the present disclosure.

[0236] Exemplary embodiments of the present disclosure further provide a computer program product, including a computer program, wherein when the computer program is executed by a processor of a computer, it is used to cause the computer to perform the method according to the embodiment of the present disclosure.

[0237] refer to Figure 14 , a block diagram of an electronic device 1400 that can serve as a server or client of the present disclosure will now be described, which is an example of a hardware device that can be applied to various aspects of the present disclosure. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0238] like Figure 14 As shown, electronic device 1400 includes a computing unit 1401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 1402 or a computer program loaded from a storage unit 1408 into a random access memory (RAM) 1403. Various programs and data required for the operation of device 1400 can also be stored in RAM 1403. Computing unit 1401, ROM 1402, and RAM 1403 are connected to each other via a bus 1404. An input / output (I / O) interface 1405 is also connected to bus 1404.

[0239] Multiple components within electronic device 1400 are connected to I / O interface 1405, including an input unit 1406, an output unit 1407, a storage unit 1408, and a communication unit 1409. Input unit 1406 can be any type of device capable of inputting information into electronic device 1400. Input unit 1406 can receive input numeric or character information and generate key input signals related to user settings and / or function control of the electronic device. Output unit 1407 can be any type of device capable of presenting information and may include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. Storage unit 1408 may include, but is not limited to, a magnetic disk or an optical disk. Communication unit 1409 allows electronic device 1400 to exchange information / data with other devices via computer networks such as the Internet and / or various telecommunication networks, and may include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication transceiver and / or chipset, such as a Bluetooth™ device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0240] The computing unit 1401 may be a variety of general and / or specialized processing components with processing and computing capabilities. Some examples of the computing unit 1401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit 1401 performs the various methods and processes described above. For example, in some embodiments, Figure 1 、 Figures 3 to 11 The method can be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as the storage unit 1408. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 1400 via the ROM 1402 and / or the communication unit 1409. In some embodiments, the computing unit 1401 can be configured to execute the computer program by any other suitable means (for example, by means of firmware). Figure 1 、 Figures 3 to 11 method.

[0241] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0242] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0243] As used in this disclosure, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and / or device (e.g., a magnetic disk, an optical disk, a memory, a programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term "machine-readable signal" refers to any signal used to provide machine instructions and / or data to a programmable processor.

[0244] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0245] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0246] Computer systems may include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The client and server relationship arises through computer programs running on the respective computers and having a client-server relationship to each other.

Claims

1. A method for transmitting heterogeneous data, characterized in that: The transmission method is applied to a data processing server of a heterogeneous data transmission system, and the transmission method includes: The data processing server receives a token application request initiated by a requester, and sends a token application form to the requester in response to the token application request; The data processing server receives a completed token application form sent by the requester, the completed token application form including a requester ID and an application address, sends the application address to the firewall, determines the access rights of the requester, combines the requester ID and the corresponding access rights to obtain a requester token; performs a first encoding process on the requester token to obtain an encoding result 1; performs a first encryption process on the encoding result 1 to generate an access token for the requester, and stores a correspondence between the requester ID, the requester token, token generation time, token validity period, and the application address; The data processing server sends the access token to the requester; The data processing server receives the encrypted public key and access request sent by the requester; wherein the access request includes the access token of the requester and the access target; In response to the access request, performing token authentication and address authentication on the access token; When the authentication results of the token authentication and the address authentication of the access token are successful, searching for target data corresponding to the access target; The target data is encrypted to obtain an encrypted ciphertext, and the encrypted ciphertext is returned to the requesting party.

2. The transmission method according to claim 1, wherein: The performing token authentication and address authentication on the access token includes: According to the requester ID, find the requester token, token generation time, token validity period and application address of the requester; Determine whether the access token has expired based on the token generation time and token validity period; If the access token has not expired, performing a first encoding process on the requester token to obtain a second encoding result; Performing a first encryption process on the second encoding result to obtain a first encryption result, comparing the first encryption result with the access token, and if the first encryption result and the access token are identical, extracting a source address from a request header of the access request; The source address is compared with the application address, and if the source address is identical to the application address, it is determined that the authentication result of the identity authentication of the access request is successful.

3. The transmission method according to claim 1, wherein: The step of encrypting the target data to obtain encrypted ciphertext includes: Receiving the encrypted public key and base point coordinates sent by the requesting party; Randomly generate a first random number, and calculate the dot product of the first random number and the base point coordinates as a first ciphertext value; Performing a second encoding process on the target data to obtain a third encoding result; Triple-superimpose the dot product of the first random number and the encryption public key and the encoding result to obtain a second ciphertext value; The first ciphertext value and the second ciphertext value are combined to obtain the encrypted ciphertext.

4. A method for transmitting heterogeneous data, characterized in that: The transmission method is applied to a requester of a heterogeneous data transmission system, and the transmission method includes: The requesting party sends a token application request to the data processing server, and receives a token application form sent by the data processing server; The requesting party sends a completed token application form to the data processing server, wherein the completed token application form includes the requesting party ID and the application address; The data processing server sends the application address to the firewall, determines the access rights of the requester, combines the requester ID and the corresponding access rights to obtain a requester token; performs a first encoding process on the requester token to obtain an encoding result 1; performs a first encryption process on the encoding result 1 to generate an access token for the requester; The requesting party receives the access token sent by the data processing server; The requesting party sends an encrypted public key and an access request to a data processing server; wherein the access request includes an access token of the requesting party and an access target; the access token is used by the data processing server to perform token authentication and address authentication in response to the access request; the access target is used by the data processing server to search for target data based on the access target after both token authentication and address authentication are successfully authenticated; the encrypted public key is used to encrypt the target data to obtain an encrypted ciphertext; The requesting party receives the encrypted ciphertext returned by the data processing server, and extracts a first ciphertext value and a second ciphertext value from the encrypted ciphertext; Calculating a dot product of the encrypted private key and the first ciphertext value to obtain an intermediate value; Subtracting the intermediate amount from the second ciphertext value to obtain an intermediate difference; The intermediate difference is decoded to obtain the target data.

5. The transmission method according to claim 4, wherein: Before receiving the encrypted ciphertext, the method further includes: Randomly generate a reference ellipse and select a point on the elliptic curve of the reference ellipse as a base point; Calculating the dot product of the base point coordinates of the base point and the encrypted private key to obtain an encrypted public key; The encrypted public key and the base point coordinates are sent to the data processing server.

6. The transmission method according to claim 5, wherein: Before randomly generating the reference ellipse, the method further includes: Initiate a token application request to the data processing server; receiving a token application form returned by the data processing server in response to the token application request; Fill out the token application form using the requester ID, requester key, and application address, and send the filled-in token application form to the data processing server; Receive the access token returned by the data processing server.

7. A device for transmitting heterogeneous data, characterized in that: The transmission device is applied to a data processing server of a heterogeneous data transmission system, and the transmission device includes: A receiving module, configured for the data processing server to receive an encrypted public key and an access request sent by a requester; wherein the access request includes an access token of the requester and an access target; an authentication module, configured to perform token authentication and address authentication on the access token in response to the access request; A search module, configured to search for target data corresponding to the access target when the authentication result of the identity authentication of the access token is successful; An encryption module, configured to encrypt the target data to obtain an encrypted ciphertext, and return the encrypted ciphertext to the requesting party; Before the data processing server receives the encrypted public key and access request sent by the requester, the transmission device is also used for the data processing server to receive the token application request initiated by the requester, and in response to the token application request, to send a token application form to the requester; the data processing server receives the filled-in token application form sent by the requester, and the filled-in token application form includes the requester ID and the application address, sends the application address to the firewall, determines the access rights of the requester, combines the requester ID and the corresponding access rights, and obtains the requester token; performs a first encoding process on the requester token to obtain an encoding result one; performs a first encryption process on the encoding result one to generate the access token of the requester, and stores the correspondence between the requester ID, the requester token, the token generation time, the token validity period and the application address; the data processing server sends the access token to the requester.

8. A device for transmitting heterogeneous data, characterized in that: The transmission device is applied to a requesting party of a heterogeneous data transmission system, and the transmission device includes: A receiving module, configured for the requesting party to receive the encrypted ciphertext returned by the data processing server, and extract a first ciphertext value and a second ciphertext value from the encrypted ciphertext; A calculation module, configured to calculate a dot product of the encryption private key and the first ciphertext value to obtain an intermediate value; a data processing module, configured to subtract the intermediate amount from the second ciphertext value to obtain an intermediate difference; A decoding module, configured to decode the intermediate difference to obtain target data; Before the requesting party receives the encrypted ciphertext returned by the data processing server, the transmission device is also used for the requesting party to send a token application request to the data processing server and receive a token application form sent by the data processing server; the requesting party sends a completed token application form to the data processing server, and the completed token application form includes a requesting party ID and an application address; the data processing server sends the application address to the firewall, determines the access rights of the requesting party, combines the requesting party ID and the corresponding access rights, and obtains a requesting party token; performs a first encoding process on the requesting party token to obtain an encoding result one; performs a first encryption process on the encoding result one to generate an access token for the requesting party; the requesting party receives the access token sent by the data processing server; the requesting party sends an encrypted public key and an access request to the data processing server; wherein the access request includes the access token of the requesting party and an access target; the access token is used by the data processing server to perform token authentication and address authentication in response to the access request, and after the access target is successfully authenticated for both token authentication and address authentication, the data processing server searches for the target data based on the access target, and the encrypted public key is used to encrypt the target data to obtain an encrypted ciphertext.

9. A heterogeneous data transmission system, characterized in that: include: A data processing server and a requester, wherein the data processing server includes the heterogeneous data transmission device according to claim 7, and the requester includes the heterogeneous data transmission device according to claim 8.

Images