Control method, system and storage medium for secure data transmission in tunnels

Abstract

The present invention discloses a management and control method, system and storage medium for secure data transmission in a tunnel, and relates to the technical field of secure data transmission, including: obtaining basic information of all interactive processing terminals and making at least one interactive transmission path. The present invention classifies each interactive processing terminal into upper and lower levels and interactive transmission sets according to the interactive working paths of each interactive processing terminal, and then, according to the judgment of the interactive transmission sets to which the interactive request terminal and the pre-interaction processing terminal belong, performs successful pairing verification of the upper-level interactive terminal of the interactive transmission set, so that the upper-level interactive terminal of the interactive request terminal can take over the interactive authority of the upper-level interactive terminal of the pre-interaction processing terminal, so as to complete the identity authentication of the interactive request terminal only through one verification of the upper-level interactive terminal, reduce the steps of repeated verification of encryption layer by layer, and improve the efficiency of data interaction.

Description

Technical Field

[0001] The present invention relates to the technical field of secure data transmission, and in particular to a management and control method, system and storage medium for secure data transmission in a tunnel. Background Art

[0002] During the construction process of tunnel construction, various types of tunnel construction data information are continuously updated and uploaded to the decision-making layer to provide effective reference for subsequent construction decisions. Therefore, in order to ensure the security of data transmission and interaction among the tunnel construction unit area, the overall system, and the decision-making layer cloud platform, it is necessary to set up anti-intrusion, anti-virus and other network security measures for the processing and interaction of construction data such as each construction status and construction operation log to ensure the reliability, authenticity and integrity of the collected data, and to have a fault-tolerant mechanism and disaster recovery plan.

[0003] At present, in order to achieve stable, reliable and secure transmission and interaction of various types of data in tunnel construction, layer-by-layer encryption and verification are generally adopted, which makes various interaction processing processes complicated and repetitive, and easily affects the efficiency of data interaction. Summary of the invention

[0004] The purpose of the present invention is to solve the shortcomings of the prior art that various interactive processing processes for tunnel construction are complicated and repetitive, which easily affects the efficiency of data interaction, and to propose a management and control method, system and storage medium for tunnel security data transmission.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] In a first aspect, the present invention provides a method for managing and controlling tunnel security data transmission, comprising:

[0007] Obtain basic information of all interactive processing terminals and create at least one interactive transmission path;

[0008] According to the basic information of each interactive transmission path and all interactive processing terminals, interactive priorities are allocated to all interactive processing terminals, and at least one upper interactive terminal and a lower interactive terminal are determined among all interactive processing terminals;

[0009] According to the upper-level interactive end and the lower-level interactive end, and in combination with each interactive transmission path, at least one interactive transmission set is determined, and the upper-level interactive end in each interactive transmission set is authenticated and encrypted for additional processing;

[0010] According to each interactive transmission set, respectively determine the interactive transmission set category information to which the pre-interaction processing end and the interactive request end of the data interaction work belong;

[0011] According to the information of the interactive transmission set category to which the pre-interaction processing end and the interactive request end of the data interaction work belong, a feedback instruction for responding to the interactive request end is obtained;

[0012] According to the feedback instruction of the response to the interaction request end, the interaction response path of the pre-interaction processing end and the interaction request end is determined.

[0013] In a feasible solution, the method for additionally processing the verification encryption of the upper-level interactive end in each interactive transmission set includes:

[0014] Obtaining the transmission category information of each interactive transmission set;

[0015] Determine the working keyword of each interactive transmission set according to the transmission category information of each interactive transmission set;

[0016] Performing read and write feature modulation on the upper interactive end in each interactive transmission set, and respectively determining the read and write transmission features of the upper interactive end in each interactive transmission set;

[0017] According to the read and write transmission characteristics of the upper interactive terminal in each interactive transmission set and / or the working keywords of each interactive transmission set, the upper interactive terminal in each interactive transmission set is added with transmission characteristics to determine the unique identity information of the upper interactive terminal in each interactive transmission set.

[0018] In a feasible solution, the method for respectively determining the read and write transmission characteristics of the upper-level interactive terminal in each interactive transmission set includes:

[0019] Obtaining an initial read operation cycle and / or write operation cycle of an upper-level interactive terminal in a current interactive transmission set;

[0020] Determining the number of data interaction rows and the data reading and writing order of the upper-level interaction terminal according to the initial read operation cycle and / or write operation cycle of the upper-level interaction terminal;

[0021] The read and write transmission characteristics of the upper-level interactive terminal are determined according to the number of data interaction rows and the data read and write sequence of the upper-level interactive terminal.

[0022] In a feasible solution, the method for additionally processing verification and encryption of the upper-level interactive end in each interactive transmission set further includes:

[0023] According to the unique identity information of the upper-level interactive terminal in each interactive transmission set, an encryption matrix is ​​set in the upper-level interactive terminal in each interactive transmission set.

[0024] In a feasible solution, the method of setting the encryption matrix in the upper-level interactive terminal in each interactive transmission set includes:

[0025] According to the working keyword of the current interactive transmission set, specify to generate a first password sequence;

[0026] According to the read-write transmission characteristics of the upper-level interactive terminal in the current interactive transmission set, specify to generate a second password sequence;

[0027] Writing the first password sequence and / or the second password sequence into a predetermined matrix, and presetting a matrix calculation algorithm in the predetermined matrix;

[0028] According to a preset matrix calculation algorithm in the predetermined matrix, the first password number sequence and / or the second password number sequence in the predetermined matrix is ​​extracted and calculated to generate a pairing key number sequence.

[0029] In a feasible solution, the method for determining the interactive response path of the pre-interaction processing end and the interactive request end includes:

[0030] Obtaining the request interaction instruction from the interaction requesting end;

[0031] According to the request interaction instruction of the interaction request end, the read-write feature extraction information is produced, and the information is fed back to the interaction request end for response, so as to obtain the read-write feature response information of the interaction request end;

[0032] Determine the interactive transmission set to which the interactive requesting end belongs according to the read / write characteristic response information of the interactive requesting end and the interactive requesting instruction of the interactive requesting end;

[0033] Determine the interactive transmission set to which the pre-interaction processing end belongs according to the interactive request instruction of the interactive request end;

[0034] If the pre-interaction processing end and the interaction request end of the data interaction work do not belong to the same interaction transmission set, then the upper-level interaction end to which the pre-interaction processing end and the interaction request end belong is determined respectively;

[0035] The upper-level interaction end to which the interaction request end belongs generates and sends the pairing key sequence of the interaction request end using the built-in encryption matrix according to the unique identity information of the pre-interaction processing end;

[0036] The pre-interaction processing end receives the pairing key sequence of the interaction request end, performs identity authentication, and determines the interaction transmission feedback instruction between the pre-interaction processing end and the interaction request end;

[0037] According to the interactive transmission feedback instruction between the pre-interaction processing end and the interactive requesting end, and in combination with the request interaction instruction of the interactive requesting end, an interactive response path between the pre-interaction processing end and the interactive requesting end is generated.

[0038] In a feasible solution, the method for determining the interactive response path of the pre-interaction processing end and the interactive request end further includes:

[0039] If the pre-interaction processing end and the interaction request end of the data interaction work belong to the same interaction transmission set, the interaction request end is directly matched with the upper-level interaction end of the interaction transmission set to determine the interaction transmission feedback instruction of the data interaction work of the interaction request end;

[0040] According to the interactive transmission feedback instruction of the data interactive work of the interactive request end, the interactive response path of the pre-interaction processing end and the interactive request end is determined.

[0041] In a second aspect, the present invention provides a management and control system for secure data transmission in a tunnel, wherein the management and control system adopts a management and control method for secure data transmission in a tunnel as described in any one of the first aspects, and the management and control system further includes:

[0042] A port configuration module, the port configuration module is used to assign interaction priorities to all interaction processing terminals according to basic information of each interaction transmission path and all interaction processing terminals, determine at least one upper interaction terminal and a lower interaction terminal among all interaction processing terminals, and determine at least one interaction transmission set according to the upper interaction terminal and the lower interaction terminal and in combination with each interaction transmission path;

[0043] A permission configuration module, the permission configuration module is used to perform additional processing on the authentication encryption of the upper-level interactive terminal in each interactive transmission set;

[0044] An interaction pairing module, wherein the interaction pairing module is used to determine, according to each interaction transmission set, the category information of the interaction transmission set to which the pre-interaction processing end and the interaction request end of the data interaction work belong; and to obtain a feedback instruction for responding to the interaction request end according to the category information of the interaction transmission set to which the pre-interaction processing end and the interaction request end of the data interaction work belong; and to determine the interaction response path of the pre-interaction processing end and the interaction request end according to the feedback instruction for responding to the interaction request end.

[0045] In some feasible solutions, the interactive pairing module further includes:

[0046] A storage unit, the storage unit is used to store the unique identity information of the upper-level interactive terminal in each interactive transmission set;

[0047] A verification unit, the verification unit is used to verify the interactive transmission set to which the interactive requesting end belongs;

[0048] A path generation unit is used to generate an interactive response path between the pre-interaction processing end and the interactive request end in response.

[0049] In a third aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, a management and control method for tunnel secure data transmission as described in any one of the first aspects is implemented.

[0050] The beneficial effects of the present invention are:

[0051] The present invention classifies each interaction processing terminal into upper and lower levels and interaction transmission sets according to the interaction working path of each interaction processing terminal, and then performs pairing verification of the upper interaction terminal of the interaction transmission set to which the interaction request terminal and the pre-interaction processing terminal belong, and if successful, the upper interaction terminal of the interaction request terminal can take over the interaction authority of the upper interaction terminal of the pre-interaction processing terminal, so that the identity authentication of the interaction request terminal can be completed by only one verification of the upper interaction terminal, thereby reducing the steps of repeated encryption and verification at each level and improving the data interaction efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A schematic diagram of the overall process of a method for controlling tunnel secure data transmission provided in an embodiment of the present invention;

[0053] Figure 2 A partial flow chart of a method for controlling secure data transmission in a tunnel provided in an embodiment of the present invention;

[0054] Figure 3 A schematic diagram of the distribution of interactive transmission sets in a management and control method for tunnel secure data transmission provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] It should be noted that all directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of the present invention are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0057] In the present invention, unless otherwise clearly specified and limited, the terms "connection", "fixation", etc. should be understood in a broad sense. For example, "fixation" can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements, unless otherwise clearly defined. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0058] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present invention, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the meaning of "and / or" appearing in the full text includes three parallel schemes. Taking "A and / or B" as an example, it includes scheme A, or scheme B, or a scheme that satisfies both A and B. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0059] Reference Figures 1 to 3In order to solve the shortcomings of the prior art that various interactive processing processes for tunnel construction are complicated and repeated, which easily affect the efficiency of data interaction, the present invention provides a control method for tunnel security data transmission in this embodiment. The control method classifies each interactive processing terminal into upper and lower levels and interactive transmission sets according to the interactive working paths of each interactive processing terminal, and then determines the interactive transmission sets to which the interactive request terminal and the pre-interaction processing terminal belong. If the pairing verification of the upper-level interactive terminal of the interactive transmission set is successful, the upper-level interactive terminal of the interactive request terminal can take over the interactive rights of the upper-level interactive terminal of the pre-interaction processing terminal. The limit is to realize that only one verification of the superior interaction end is required, that is, when the interaction request end and the pre-interaction processing end belong to the same interaction transmission set, the interaction request end is allowed to perform verification interaction with the pre-interaction processing end through the superior interaction end; when the interaction request end and the pre-interaction processing end do not belong to the same interaction transmission set, the superior interaction end of the interaction request end is directly allowed to perform pairing verification with the superior interaction end of the pre-interaction processing end. After the pairing verification is successful, the superior interaction end of the interaction request end can take over the interaction authority of the superior interaction end of the pre-interaction processing end, so that only one verification of the superior interaction end is required to complete the identity authentication of the interaction request end, reducing the steps of repeated verification of encryption layer by layer and improving the efficiency of data interaction. That is, it effectively solves the shortcomings of the prior art that various interactive processing processes for tunnel construction are complicated and repeated, which easily affect the efficiency of data interaction.

[0060] like Figure 1As shown, specifically, a management and control method for tunnel secure data transmission, the management and control method includes: obtaining basic information of all interactive processing terminals and making at least one interactive transmission path; that is, determining the interactive transmission path of each interactive processing terminal according to the interactive transmission process and object of each interactive processing terminal, and then allocating interactive priorities to all interactive processing terminals according to each interactive transmission path and the basic information of all interactive processing terminals, and determining at least one superior interactive terminal and subordinate interactive terminal among all interactive processing terminals; that is, according to the allocation of the interactive priority set, determining the hierarchical relationship between the superior interactive terminal and the subordinate interactive terminal in the interactive transmission path, here the superior and subordinate interactive terminals can be allocated according to the weight position ratio in the interactive transmission path (such as the interactive terminals of each node of the interactive transmission) or manually. Then, according to the upper-level interaction terminal and the lower-level interaction terminal, and in combination with each interaction transmission path, at least one interaction transmission set is determined (that is, according to the interaction transmission path of the upper-level interaction terminal and the lower-level interaction terminal, an interaction transmission topology link with the upper-level interaction terminal as the main level and the lower-level interaction terminal as the sub-level is performed), that is, the upper-level interaction terminal in each interaction transmission set controls and decides the data interaction transmission of the lower-level interaction terminal. Here, in order to realize the safe and reliable interaction transmission of different interaction transmission sets, the upper-level interaction terminal in each interaction transmission set can also be verified and encrypted with additional processing to realize security verification in the interaction transmission process of different interaction transmission sets. During data interaction transmission, the interaction transmission set category information to which the pre-interaction processing end and the interaction request end of the data interaction work belong can be determined according to each interaction transmission set; then, based on the interaction transmission set category information to which the pre-interaction processing end and the interaction request end of the data interaction work belong, a feedback instruction for responding to the interaction request end can be obtained; that is, by identifying the identity of the interaction request end, it is determined whether the interaction request end can normally perform interaction transmission work with the pre-interaction processing end. If the identity identification and matching of the interaction request end is successful, a feedback instruction for responding to the interaction request end can be generated, and then the interaction response path of the pre-interaction processing end and the interaction request end can be determined according to the feedback instruction for the response to the interaction request end. That is, by pairing and identifying the identity of the interaction requesting end, it is determined whether the interaction transmission work between the interaction requesting end and the pre-interaction processing end is proceeding normally. If it is proceeding normally, it is determined whether the interaction requesting end and the pre-interaction processing end are in the same interaction transmission set. When they are in the same interaction transmission set, the interaction requesting end can be directly verified and paired with the superior interaction end in the interaction transmission set of the pre-interaction processing end to obtain the interaction transmission authority, and then the interaction requesting end and the pre-interaction processing end are interactively processed through the superior interaction end in the interaction transmission set of the pre-interaction processing end.It should be noted that, in the present embodiment, in the same interactive transmission set, the superior interactive terminal can be downwardly compatible with the subordinate interactive terminal in terms of authority, that is, the superior interactive terminal can control the subordinate interactive terminal in the same interactive transmission set to perform interactive transmission work, while the subordinate interactive terminal cannot control the superior interactive terminal. The subordinate interactive terminal can only send a request for interaction instruction to the superior interactive terminal, and then ask the superior interactive terminal to perform identity authentication.

[0061] In this embodiment, in order to facilitate understanding of how to perform additional processing on the authority encryption of the upper-level interactive terminal in each interactive transmission set, the following description is given here. The method for performing additional processing on the authority encryption of the upper-level interactive terminal in each interactive transmission set includes:

[0062] The transmission category information of each interactive transmission set is obtained; wherein the transmission category information includes but is not limited to: the data interaction purpose of the interactive terminal, such as data transmission storage, data transmission coordination, data transmission analysis and decision, etc. Then, according to the transmission category information of each interactive transmission set, the working keyword of each interactive transmission set is determined; that is, according to the working interaction purpose of each interactive transmission set, it is used as the working feature of the interactive transmission set. The working feature of the interactive transmission set is used to perform the unique identity identification information of the superior interactive terminal in the interactive transmission set. In this embodiment, the superior interactive terminal in each interactive transmission set can also be modulated by reading and writing features to respectively determine the reading and writing transmission features of the superior interactive terminal in each interactive transmission set; according to the reading and writing transmission features of the superior interactive terminal in each interactive transmission set and / or the working keyword of each interactive transmission set, the superior interactive terminal in each interactive transmission set is added with transmission features to determine the unique identity identification information of the superior interactive terminal in each interactive transmission set. That is, here, by performing unique identity identification information on the superior interactive terminal in each interactive transmission set, identity authentication can be achieved in subsequent different interactive transmission sets.

[0063] Here, in order to facilitate understanding of how to perform read and write feature modulation on the upper interactive end in each interactive transmission set, the following description is given. The method for respectively determining the read and write transmission features of the upper interactive end in each interactive transmission set includes:

[0064] The initial read operation cycle and / or write operation cycle of the upper-level interactive terminal in the current interactive transmission set is obtained; the initial read operation cycle and / or write operation cycle of the upper-level interactive terminal in the interactive transmission set can be determined by obtaining the bandwidth bit width of the upper-level interactive terminal in the current interactive transmission set. Then, according to the initial read operation cycle and / or write operation cycle of the upper-level interactive terminal, the number of data interaction rows and the data read and write sequence of the upper-level interactive terminal are determined; then, according to the number of data interaction rows and the data read and write sequence of the upper-level interactive terminal, the read and write transmission characteristics of the upper-level interactive terminal in the interactive transmission set are determined. According to the read and write transmission characteristics of the upper-level interactive terminal in the interactive transmission set, and in combination with the working keywords of the interactive transmission set, the unique identity identification information of the upper-level interactive terminal in the interactive transmission set is determined, so as to realize identity authentication in subsequent different interactive transmission sets, and avoid the unreliable interactive terminal from the outside from writing to the internal part of the interactive transmission layer for illegal reading and writing. In a feasible embodiment, in order to improve the specificity of the upper-level interactive terminal in each interactive transmission set, the upper-level interactive terminal can also be pre-adjusted, spliced ​​and widened (such as by adding) by adjusting the bit width of the upper-level interactive terminal, and the read and write transmission characteristics (such as read and write sequence, read and write interval) of each upper-level interactive terminal are specially modulated to achieve special identification of the read and write transmission characteristics of each upper-level interactive terminal. For example, a certain upper-level interactive terminal can prioritize data read operations over write operations, or prioritize data write operations over read operations, or perform continuous read operations and / or continuous write operations.

[0065] Refer to Figure 2 and Figure 3As shown, in this embodiment, in order to ensure the interaction security of each interactive transmission set and the upper-level interactive terminal, a built-in encryption means can be performed on the upper-level interactive terminal in each interactive transmission set, that is, the method for verifying and encrypting the upper-level interactive terminal in each interactive transmission set also includes: according to the unique identity information of the upper-level interactive terminal in each interactive transmission set, an encryption matrix is ​​set in the upper-level interactive terminal in each interactive transmission set. Specifically, the method for setting the encryption matrix in the upper-level interactive terminal in each interactive transmission set includes: specifying the generation of a first password sequence according to the working keywords of the current interactive transmission set; specifying the generation of a second password sequence according to the read-write transmission characteristics of the upper-level interactive terminal in the current interactive transmission set; writing the first password sequence and / or the second password sequence into a predetermined matrix, and presetting a matrix calculation algorithm in the predetermined matrix; extracting and calculating the first password sequence and / or the second password sequence in the predetermined matrix according to the preset matrix calculation algorithm in the predetermined matrix to generate a pairing key sequence. That is, the specified first password sequence and second password sequence can be generated according to the working keywords in the unique identity information of the upper-level interactive terminal in each interactive transmission set and the read-write transmission characteristics of the upper-level interactive terminal, and then the first password sequence and the second password sequence in the encryption matrix are calculated and extracted to determine the generated pairing key sequence. That is, during the interactive transmission process, the interactive request end sends an interactive request instruction and a pairing key sequence, and then the pre-interaction processing end authenticates the pairing key sequence sent by the interactive request end through its built-in encryption matrix to determine the pairing result of the interactive request end. Here is an example of how to use the encryption matrix for identity authentication:

[0066] Assume that according to the working keyword of a certain interactive transmission set, the first password sequence generated is specified as: ;

[0067] Assume that according to the read-write transmission characteristics of the upper interactive terminal in the same interactive transmission set, the second password sequence generated is specified as: ;

[0068] A predetermined matrix arrangement is performed on the first password sequence and the second password sequence, and a calculation is extracted in the predetermined matrix according to a preset matrix calculation algorithm, such as:

[0069]

[0070] In the formula, To output the results according to the preset matrix calculation algorithm, and then output the results according to the preset matrix calculation algorithm Generate a pairing key sequence. In some feasible embodiments, the preset matrix calculation algorithm can be preset according to actual conditions, and the first password sequence generated by the working keyword of each interactive transmission set and the second password sequence generated by the read-write transmission characteristics of the upper interactive end in each interactive transmission set can be stored in a data storage area, or a register can be used for data storage.

[0071] In a feasible scheme, the method for determining the interactive response path of the pre-interaction processing end and the interactive request end includes: obtaining the request interaction instruction of the interactive request end; according to the request interaction instruction of the interactive request end, making read-write feature extraction information, and feeding it back to the interactive request end for response, and obtaining the read-write feature response information of the interactive request end; that is, when receiving the interactive request from the interactive request end, the read-write feature extraction information for extracting the read-write features can be simulated and released to the interactive request end, so as to realize identity authentication according to the read-write feature response information of the interactive request end. After successful verification, the interactive transmission set to which the interactive requesting end belongs can be determined based on the read and write characteristic response information of the interactive requesting end and the request interaction instruction of the interactive requesting end; then, the interactive transmission set to which the pre-interaction processing end belongs can be determined based on the request interaction instruction of the interactive requesting end; if the pre-interaction processing end and the interactive requesting end of the data interaction work do not belong to the same interactive transmission set, the superior interactive end to which the pre-interaction processing end and the interactive requesting end belong is determined respectively; the superior interactive end to which the interactive requesting end belongs generates and sends the pairing key sequence of the interactive requesting end using the built-in encryption matrix based on the unique identity identification information of the pre-interaction processing end; the pre-interaction processing end receives the pairing key sequence of the interactive requesting end, performs identity authentication, and determines the interactive transmission feedback instruction between the pre-interaction processing end and the interactive requesting end; based on the interactive transmission feedback instruction between the pre-interaction processing end and the interactive requesting end, and in combination with the request interaction instruction of the interactive requesting end, an interactive response path between the pre-interaction processing end and the interactive requesting end is generated. That is, in this embodiment, the interaction request end is authenticated in advance through the read-write characteristic response information of the interaction request end. If the identity authentication fails, the subsequent pairing work is directly rejected. If the identity authentication passes, the category of the superior interaction end of the interaction request end is determined, and then the superior interaction end of the pre-interaction processing end is determined according to the request interaction instruction of the interaction request end. If the pre-interaction processing end and the interaction request end do not belong to the same interaction transmission set, the superior interaction end of both the pre-interaction processing end and the interaction request end is used for identity authentication. After the identity authentication is passed, the interaction request end is allowed to interact directly with the pre-interaction processing end. In addition, the method for determining the interaction response path of the pre-interaction processing end and the interaction request end also includes: if the pre-interaction processing end and the interaction request end of the data interaction work belong to the same interaction transmission set, the interaction request end is directly matched with the superior interaction end of the interaction transmission set to determine the interaction transmission feedback instruction of the data interaction work of the interaction request end; according to the interaction transmission feedback instruction of the data interaction work of the interaction request end, the interaction response path of the pre-interaction processing end and the interaction request end is determined. That is, here, if the pre-interaction processing end and the interaction request end belong to the same interaction transmission set, the interaction processing is directly performed by the upper-level interaction end in the same interaction transmission set.

[0072] Reference Figure 3As shown, in this embodiment, in order to facilitate understanding of how to perform the identity authentication of the above-mentioned pre-interaction processing end and the interaction request end, the following description is given here:

[0073] Suppose there are three interactive transmission sets A, B, and D. At this time, the interactive transmission set A has an upper-level interactive terminal a and multiple lower-level interactive terminals a1, a2,...an; the interactive transmission set B has an upper-level interactive terminal b and multiple lower-level interactive terminals b1, b2,...bn; the interactive transmission set D has an upper-level interactive terminal d and multiple lower-level interactive terminals d1, d2,...dn; if at this time there is an interactive transmission set that needs to be interacted with, then the upper-level interactive terminals a, b, and c in the three interactive transmission sets A, B, and D are authenticated respectively. After the identity of the requesting interactive terminal is determined, the permissions of the other party's multiple lower-level interactive terminals can be directly taken over, and the interactive data can be directly retrieved.

[0074] In a second aspect, the present invention provides a management and control system for secure data transmission in a tunnel, wherein the management and control system adopts a management and control method for secure data transmission in a tunnel as described in any one of the first aspects, and the management and control system further includes:

[0075] A port configuration module, an interaction pairing module and a permission configuration module, wherein the port configuration module is used to allocate interaction priorities to all interaction processing terminals according to basic information of each interaction transmission path and all interaction processing terminals, determine at least one upper interaction terminal and a lower interaction terminal among all interaction processing terminals, and determine at least one interaction transmission set according to the upper interaction terminal and the lower interaction terminal and in combination with each interaction transmission path; the permission configuration module is used to perform additional authentication and encryption processing on the upper interaction terminal in each interaction transmission set; the interaction pairing module is used to determine, according to each interaction transmission set, the category information of the interaction transmission set to which the pre-interaction processing terminal and the interaction request terminal of the data interaction work belong respectively; and obtain a feedback instruction for responding to the interaction request terminal according to the category information of the interaction transmission set to which the pre-interaction processing terminal and the interaction request terminal of the data interaction work belong; and also determine the interaction response path of the pre-interaction processing terminal and the interaction request terminal according to the feedback instruction for responding to the interaction request terminal, so as to enable the interaction pairing module to respond to generate the interaction response path of the pre-interaction processing terminal and the interaction request terminal after successfully pairing the identity of the interaction request terminal. In this embodiment, the interaction pairing module further includes: a storage unit, a verification unit, and a path generation unit. The storage unit is used to store the unique identity information of the upper interaction end in each interaction transmission set; the verification unit is used to verify the interaction transmission set to which the interaction request end belongs; and the path generation unit is used to respond to generate an interaction response path between the pre-interaction processing end and the interaction request end. In some feasible embodiments, the storage unit can be a register or a data storage area.

[0076] In some embodiments, the control system can communicate using any currently known or future developed network protocol such as HTTP (Hyper Text Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., communication network). Examples of communication networks include local area networks ("LAN"), wide area networks ("WAN"), internets (e.g., the Internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future developed networks.

[0077] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that may be used include, without limitation, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), etc.

[0078] The third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements a method for controlling tunneled secure data transmission as described in any one of the first aspects. The computer-readable medium in this embodiment can be written in one or more programming languages ​​or a combination thereof to write computer program codes for performing the operations of some embodiments of the present disclosure, wherein the programming languages ​​include object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0079] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0080] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer readable medium, and the computer program includes a program code for executing the method shown in the flowchart.

[0081] The fourth aspect of the present invention provides an electronic device, comprising: one or more processors; a storage device having one or more programs stored thereon; when the one or more programs are executed by the one or more processors, the one or more processors implement a control method for tunnel secure data transmission as described in the first aspect. The above-mentioned computer-readable medium may be included in the above-mentioned electronic device; or it may exist separately, that is, it is not assembled into the electronic device. The above-mentioned computer-readable medium carries one or more programs, and when the above-mentioned one or more programs are executed by the electronic device, the electronic device can implement a control method for tunnel secure data transmission as described in the first aspect.

[0082] A fifth aspect of the present invention provides a computer program product, comprising a computer program, which, when executed by a processor, implements a management and control method for tunnel secure data transmission as described in the first aspect.

[0083] The above descriptions are only some preferred embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above inventive concept. For example, the above features are replaced with (but not limited to) technical features with similar functions disclosed in the embodiments of the present disclosure.

Claims

1. A method for controlling tunnel security data transmission, characterized in that: include: Obtain basic information of all interactive processing terminals and create at least one interactive transmission path; According to the basic information of each interactive transmission path and all interactive processing terminals, interactive priorities are allocated to all interactive processing terminals, and at least one upper interactive terminal and a lower interactive terminal are determined among all interactive processing terminals; According to the upper-level interactive end and the lower-level interactive end, and in combination with each interactive transmission path, at least one interactive transmission set is determined, and the upper-level interactive end in each interactive transmission set is authenticated and encrypted for additional processing; According to each interactive transmission set, respectively determine the interactive transmission set category information to which the pre-interaction processing end and the interactive request end of the data interaction work belong; According to the information of the interactive transmission set category to which the pre-interaction processing end and the interactive request end of the data interaction work belong, a feedback instruction for responding to the interactive request end is obtained; Determining the interactive response path of the pre-interaction processing end and the interactive request end according to the feedback instruction of the response to the interactive request end; The method for additionally processing the verification encryption of the upper-level interactive terminal in each interactive transmission set includes: Obtaining the transmission category information of each interactive transmission set; Determine the working keyword of each interactive transmission set according to the transmission category information of each interactive transmission set; Performing read and write feature modulation on the upper interactive end in each interactive transmission set, and respectively determining the read and write transmission features of the upper interactive end in each interactive transmission set; According to the read-write transmission characteristics of the upper-level interactive terminal in each interactive transmission set and / or the working keywords of each interactive transmission set, the upper-level interactive terminal in each interactive transmission set is subjected to transmission characteristic addition, and the unique identification information of the upper-level interactive terminal in each interactive transmission set is determined; The method for additionally processing verification and encryption of the upper-level interactive terminal in each interactive transmission set further includes: According to the unique identification information of the upper-level interactive terminal in each interactive transmission set, an encryption matrix is ​​set in the upper-level interactive terminal in each interactive transmission set; Specifically, the method for determining the interactive response path of the pre-interaction processing end and the interactive request end includes: Obtaining the request interaction instruction from the interaction requesting end; According to the request interaction instruction of the interaction request end, the read-write feature extraction information is produced, and the information is fed back to the interaction request end for response, so as to obtain the read-write feature response information of the interaction request end; Determine the interactive transmission set to which the interactive requesting end belongs according to the read / write characteristic response information of the interactive requesting end and the interactive requesting instruction of the interactive requesting end; Determine the interactive transmission set to which the pre-interaction processing end belongs according to the interactive request instruction of the interactive request end; If the pre-interaction processing end and the interaction request end of the data interaction work do not belong to the same interaction transmission set, then the upper-level interaction end to which the pre-interaction processing end and the interaction request end belong is determined respectively; The upper-level interaction end to which the interaction request end belongs generates and sends the pairing key sequence of the interaction request end using the built-in encryption matrix according to the unique identity information of the pre-interaction processing end; The pre-interaction processing end receives the pairing key sequence of the interaction request end, performs identity authentication, and determines the interaction transmission feedback instruction between the pre-interaction processing end and the interaction request end; Generate an interactive response path between the pre-interaction processing end and the interactive request end according to the interactive transmission feedback instruction between the pre-interaction processing end and the interactive request end, in combination with the request interactive instruction of the interactive request end; Specifically, the method for determining the interactive response path of the pre-interaction processing end and the interactive request end further includes: If the pre-interaction processing end and the interaction request end of the data interaction work belong to the same interaction transmission set, the interaction request end is directly matched with the upper-level interaction end of the interaction transmission set to determine the interaction transmission feedback instruction of the data interaction work of the interaction request end; According to the interactive transmission feedback instruction of the data interactive work of the interactive request end, the interactive response path of the pre-interaction processing end and the interactive request end is determined.

2. A method for controlling tunnel security data transmission according to claim 1, characterized in that: The method for respectively determining the read and write transmission characteristics of the upper-level interactive end in each interactive transmission set includes: Obtaining an initial read operation cycle and / or write operation cycle of an upper-level interactive terminal in a current interactive transmission set; Determining the number of data interaction rows and the data reading and writing order of the upper-level interaction terminal according to the initial read operation cycle and / or write operation cycle of the upper-level interaction terminal; The read and write transmission characteristics of the upper-level interactive terminal are determined according to the number of data interaction rows and the data read and write sequence of the upper-level interactive terminal.

3. A control method for tunnel security data transmission according to claim 2, characterized in that: The method for setting an encryption matrix in the upper interactive terminal in each interactive transmission set includes: According to the working keyword of the current interactive transmission set, specify to generate a first password sequence; According to the read-write transmission characteristics of the upper-level interactive terminal in the current interactive transmission set, specify to generate a second password sequence; Writing the first password sequence and / or the second password sequence into a predetermined matrix, and presetting a matrix calculation algorithm in the predetermined matrix; According to a preset matrix calculation algorithm in the predetermined matrix, the first password number sequence and / or the second password number sequence in the predetermined matrix is ​​extracted and calculated to generate a pairing key number sequence.

4. A management and control system for tunnel security data transmission, characterized in that: The control system adopts a control method for tunnel security data transmission according to any one of claims 1 to 3, and the control system further includes: A port configuration module, the port configuration module is used to assign interaction priorities to all interaction processing terminals according to basic information of each interaction transmission path and all interaction processing terminals, determine at least one upper interaction terminal and a lower interaction terminal among all interaction processing terminals, and determine at least one interaction transmission set according to the upper interaction terminal and the lower interaction terminal and in combination with each interaction transmission path; A permission configuration module, the permission configuration module is used to perform additional processing on the authentication encryption of the upper-level interactive terminal in each interactive transmission set; An interaction pairing module, wherein the interaction pairing module is used to determine, according to each interaction transmission set, the category information of the interaction transmission set to which the pre-interaction processing end and the interaction request end of the data interaction work belong; and to obtain a feedback instruction for responding to the interaction request end according to the category information of the interaction transmission set to which the pre-interaction processing end and the interaction request end of the data interaction work belong; and to determine the interaction response path of the pre-interaction processing end and the interaction request end according to the feedback instruction for responding to the interaction request end.

5. A management and control system for tunnel security data transmission according to claim 4, characterized in that: The interactive pairing module also includes: A storage unit, the storage unit is used to store the unique identity information of the upper-level interactive terminal in each interactive transmission set; A verification unit, the verification unit is used to verify the interactive transmission set to which the interactive requesting end belongs; A path generation unit is used to generate an interactive response path between the pre-interaction processing end and the interactive request end in response.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: in, When the program is executed by the processor, a control method for tunnel secure data transmission as described in any one of claims 1 to 3 is implemented.

Images