Data transmission system based on service characteristics

Abstract

The invention discloses a data transmission system based on service characteristics. The system comprises at least one central node; the partial nodes are connected with one another through a local area network; each sub-node comprises: a request sending unit configured to send a data acquisition request or a data uploading request to the center node; the first key management unit is configured to generate and / or store a first key generated according to a service extraction feature to which the target data belongs; the first fragmentation encryption and decryption unit is configured to receive a fragmentation data packet sent by the center node, decrypt the fragmentation data packet by using a first key and then combine the fragmentation data packet into a complete data packet, or encrypt the complete data packet by using the first key and then send the complete data packet to the center node in a fragmentation manner; the central node comprises: a request response unit configured to respond to a data acquisition request or a data uploading request sent by the partial nodes; the second key management unit is configured to generate and / or store a second key generated according to a service extraction feature to which the target data belongs; and the second fragment encryption and decryption unit is configured to receive the fragment data packet sent by the partial node, decrypt the fragment data packet by using a second key and then combine the fragment data packet into a complete data packet, or encrypt the complete data packet by using the second key and then send the fragment data packet to the partial node.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and in particular to a data transmission system based on business characteristics. Background Art

[0002] In today's era of rapid development of informatization, secure data transmission has become a key requirement for various business systems. Especially in some business data systems with multi-point distribution and strong confidentiality, data security issues are particularly prominent. In the existing technology, a single-point isolation and independent deployment operation method is usually adopted to ensure data security. However, with the continuous advancement of data security technology and the comprehensive promotion of informatization work, the single-point isolation and independent deployment method has gradually failed to meet actual needs, and the multi-point interconnection deployment method has gradually become the mainstream. However, in the process of connecting the network between multiple points and building a large local area network, the risk of data leakage is also increased.

[0003] At present, the protection of business data transmission mainly focuses on the protection during the data flow process, but there is no encryption protection method specifically for business modules. Existing technical solutions are often vulnerable to various attacks during the data transmission process, such as man-in-the-middle attacks, data interception, etc., which greatly increases the risk of data leakage and tampering. In addition, most of the data encryption methods in the prior art are static and cannot dynamically adjust the key according to changes in business characteristics, which greatly reduces the flexibility and security of data encryption. Summary of the invention

[0004] In order to address the deficiencies in the prior art, the present invention aims to provide an end-to-end data transmission protection system based on business characteristics, which greatly improves the security of data transmission through dynamic key generation and shard encryption methods, prevents data leakage and tampering, and ensures the safe and reliable transmission of business data in a complex network environment.

[0005] In order to achieve the above-mentioned invention object, the technical solution provided by the present invention includes:

[0006] 1. Data transmission system based on business characteristics, including:

[0007] At least one central node; a plurality of sub-nodes interconnected via a local area network, the sub-nodes being signal-connected to the central node;

[0008] The sub-nodes include:

[0009] A request sending unit, configured to send a data acquisition request or a data upload request to the central node;

[0010] A first key management unit, configured to generate and / or store a first key generated according to a feature extracted from the business to which the target data belongs;

[0011] A first fragment encryption and decryption unit, configured to receive the fragment data packets sent by the central node and decrypt them using the first key to combine them into a complete data packet, or encrypt the complete data packet using the first key and send it to the central node in fragments;

[0012] The central node includes:

[0013] A request response unit, configured to respond to a data acquisition request or a data upload request sent by the subnode;

[0014] A second key management unit, configured to generate and / or store a second key generated according to the business extraction feature to which the target data belongs;

[0015] The second fragment encryption and decryption unit is configured to receive the fragment data packets sent by the subnode and decrypt them using the second key to combine them into a complete data packet, or encrypt the complete data packet using the second key and send them to the subnode in fragments.

[0016] Preferably, the sub-nodes and the central node are connected via an encrypted channel, and data transmitted in the encrypted channel is conventionally encrypted.

[0017] Preferably, the method for the key management unit to generate a key according to the business extraction feature to which the data belongs includes:

[0018] Methods for generating keys based on characteristics of the business to which the data belongs include:

[0019] r=(base64(aX+bY+cZ)).substr(0,64);

[0020] Among them, r is the target key; X is the abbreviation of the business module, Y is the name of the communication initiator, Z is the business main table display column, a, b, c are weights; base64(aX+bY+cZ) is the base64 encoding of the string aX+bY+cZ, and substr(0,64) is the operation of intercepting the first 64 bits of data after base64 encoding.

[0021] Preferably, the method in which the first fragment encryption and decryption unit and the second fragment encryption and decryption unit fragmentally send a data packet comprises:

[0022] The fragment encryption and decryption unit randomly divides the data packet into several fragments, and selects a corresponding third key for encryption according to the size of each fragment; the third key corresponds to the size of the fragment one by one.

[0023] Preferably, the method for the sub-node to obtain data from the central node includes:

[0024] The request sending unit sends a data acquisition request to the central node;

[0025] The request response unit receives the data acquisition request and queries the target data, and sends the target data to the second key management unit;

[0026] The second key management unit generates a second key according to the business extraction feature to which the target data belongs, and sends the second key to the second shard encryption and decryption unit;

[0027] The second shard encryption and decryption unit encrypts the target data using the second key and sends the shards to the first shard encryption and decryption unit of the sub-node;

[0028] The first key management unit generates a first key according to the business extraction feature to which the target data belongs, and sends the first key to the first shard encryption and decryption unit;

[0029] The first fragment encryption and decryption unit receives all fragments and combines them into a complete data packet, and decrypts them according to the first key. If the first key management unit and the second key management unit have the same logic for extracting features based on the business to which the target data belongs, the decryption is successful and the sub-node obtains the target data.

[0030] Preferably, the method for the sub-node to obtain data from the central node also includes:

[0031] If the logic of feature extraction based on the business to which the target data belongs is different between the first key management unit and the second key management unit, decryption fails, the sub-node applies to the central node for query and obtains the feature extraction logic of the corresponding business module, and the first key management unit regenerates the first key based on the feature extraction logic.

[0032] Preferably, the method for uploading data from the sub-node to the central node includes:

[0033] The request sending unit sends a data upload request to the central node;

[0034] The request response unit receives the data upload request and queries the feature extraction logic of the business module to which the uploaded data belongs, and sends it to the first key management unit of the sub-node;

[0035] The first key management unit compares the feature extraction logic stored in the first key management unit with the returned feature extraction logic to see whether they are the same. If so, a first key is generated according to the feature extraction logic and sent to the first shard encryption and decryption unit;

[0036] The first slice encryption and decryption unit encrypts the uploaded data using the first key and sends the slices to the second slice encryption and decryption unit of the central node;

[0037] The second key management unit generates a second key according to the business extraction feature to which the uploaded data belongs, and sends the second key to the second slice encryption and decryption unit;

[0038] The second fragment encryption and decryption unit receives all fragments and combines them into a complete data packet, and decrypts them according to the second key, and the central node obtains the uploaded data.

[0039] Preferably, the method for uploading data from a sub-node to a central node further includes:

[0040] If the feature extraction logic stored in the sub-node itself is different from the feature extraction logic returned by the central node, the sub-node replaces the feature extraction logic stored in the sub-node itself with the feature extraction logic returned by the central node.

[0041] Beneficial Effects

[0042] 1. Dynamic key generation: The data transmission system based on business features provided by the present invention avoids the problem that traditional static keys are easily cracked by dynamically generating keys. The system generates keys according to the feature extraction logic of different business modules, which greatly increases the diversity and security of keys, making data encryption more flexible and secure.

[0043] 2. Fragmented encryption transmission: The present invention introduces a fragmented encryption mechanism, which randomly splits the data packet into multiple fragments and selects the corresponding key for encryption according to the size of the fragment. Even if a single fragment is cracked, it is difficult to restore the entire data packet, thereby further improving the security of data transmission.

[0044] 3. Encrypted channel transmission: The present invention configures an encrypted channel between the sub-node and the central node to ensure that the data is sent and received in the encrypted channel after conventional encryption during the data transmission process. This provides double encryption protection, and even if the transmission channel is monitored, the data content is difficult to be directly read.

[0045] 4. Flexibility of business feature extraction logic: The business feature extraction logic of the present invention is highly flexible and can customize feature extraction parameters according to different business requirements to generate keys suitable for each business module. This flexibility not only improves the adaptability of the system, but also adjusts the encryption strategy according to specific business requirements to ensure the data transmission security of each business module.

[0046] 5. Enhanced security and reliability: By combining dynamic key generation, shard encryption and encrypted channel transmission, the present invention greatly improves the security and reliability of data transmission. Data is encrypted at every stage of transmission, effectively preventing data leakage and tampering, and ensuring the safe and reliable transmission of business data in a complex network environment.

[0047] 6. Wide applicability: The data transmission system based on business characteristics provided by the present invention is applicable to various business systems with high data security requirements, including but not limited to finance, medical care, military and other fields, and can meet the data security transmission needs in various scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A schematic diagram of the connection structure of a central node and sub-nodes of a data transmission system based on service characteristics in a preferred embodiment of the present invention;

[0049] Figure 2 A schematic diagram of data transmission connection between a central node and a branch node in a preferred embodiment of the present invention;

[0050] Figure 3 A schematic diagram of data transmission connection between a central node and a sub-node when a sub-node needs to obtain data in a preferred embodiment of the present invention;

[0051] Figure 4 A schematic diagram of data transmission connection between a central node and a sub-node when a sub-node needs to upload data in a preferred embodiment of the present invention; DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention is further described below in conjunction with the accompanying drawings. In the description of the present invention, it should be understood that the terms "upper", "lower", "front", "back", "left", "right", "top", "bottom", "inside", "outside" and the like indicate directions or positional relationships based on the directions or positional relationships shown in the accompanying drawings, which are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention.

[0053] Example 1

[0054] This embodiment provides a data transmission system based on service characteristics, including:

[0055] like Figure 1As shown, at least one central node; several sub-nodes interconnected through a local area network, and the sub-nodes are signal-connected to the central node. It should be understood that each node is configured with complete front-end and back-end and server hardware. As the first line of defense for communication system data protection, in some preferred embodiments, it is considered that the sub-nodes and the central node are connected through an encrypted channel, and the data transmitted in the encrypted channel is conventionally encrypted. Specifically, channel encryption equipment can be installed at the entrance and exit of each point network, and the encryption method can be an encryption method commonly used in the field, or other encryption methods that match the present invention. The export encryption and decryption steps in the data transmission process will not be repeated later.

[0056] like Figure 2 As shown, the sub-nodes include:

[0057] The request sending unit is configured to send a data acquisition request or a data upload request to the central node. The data acquisition request is used by the sub-node to obtain specific business data, which includes the specific content of the request, that is, the relevant information of the target data, including but not limited to the following parameters: start time, end time, unit name, data version number, the business module, etc. The data upload request refers to the sub-node sending a request to the central node to upload specific business data. The request involves a series of steps, including but not limited to the encryption, transmission, reception, decryption, verification and storage of the request. The data transmission of the present invention mainly involves two situations, one is that the sub-node obtains data from the central node, and the other is that the sub-node uploads data to the central node.

[0058] The first key management unit is configured to generate and / or store a first key generated according to the business extraction feature to which the target data belongs. The business extraction feature to which the target data belongs refers to extracting specific business features according to the business module to which the target data belongs, such as inventory management, user information, order processing, etc. These features may include but are not limited to the name, function point, data structure, display column, etc. of the business module. For example, for the inventory management module, the abbreviation of the business module (such as "inventory"), the name of the communication initiator unit (such as "warehouse A"), the display column of the business main table (such as "product ID"), etc. can be extracted. The first key is generated according to the extracted business features. The business feature extraction method can extract its content data and convert it into a string based on the business type, business function point, technical implementation method, data presentation method, etc. as extraction parameters, and then perform displacement transformation on the string, and then convert it into a data encryption key through a commonly used encryption algorithm (AES, 3DES, RSA, etc.). It should be understood that there are many methods for generating the first key, which are not further limited in this embodiment. Its main purpose is to enhance the security and flexibility of data encryption through dynamic feature extraction and key generation. The following are several common methods:

[0059] 1. Generate a key based on the business identifier, and use the business identifier (such as business ID, order ID, user ID, etc.) to perform hash processing to generate a key of fixed length.

[0060] 2. Generate a key based on business context features. By extracting multiple features in the business context, such as timestamp, business type, user role, etc., each feature is concatenated into a string and hashed to generate a key.

[0061] 3. Generate keys based on dynamic business data. Generate keys based on dynamically changing business data, such as transaction amounts, inventory quantities, etc., and generate keys by encrypting the business data obtained in real time using AES or other encryption methods.

[0062] The first fragment encryption and decryption unit is configured to receive the fragmented data packets sent by the central node and decrypt them using the first key to combine them into a complete data packet, or encrypt the complete data packet using the first key and send it to the central node in fragments. It should be understood that in this embodiment, whether it is a central node or a branch node, when receiving a data packet fragment, it is necessary to determine whether the currently received fragment is the final fragment. If not, the received fragment can be stored in a temporary area, and all the fragments can be assembled into a complete data packet after the final fragment is received.

[0063] The fragmented transmission is a technology that divides a large data packet into multiple small fragments for transmission. There are many ways to implement it. Its main purpose is to improve transmission efficiency and data security. Especially in the case of unstable network or high security requirements, fragmented transmission can reduce the risk of data packet loss and interception.

[0064] In some preferred embodiments, a preferred method for a fragment encryption and decryption unit (including a first fragment encryption and decryption unit and a second fragment encryption and decryption unit) to fragment and send a data packet is provided, specifically including:

[0065] The fragment encryption and decryption unit randomly divides the data packet into several fragments, and selects the corresponding third key for encryption according to the size of each fragment; the third key corresponds to the size of the fragment. It should be understood that the third key is built into the data storage device of the central node and the branch node, and is configured with a mapping relationship table between the third key and the fragment size, as shown in Table 1 below.

[0066]

[0067]

[0068] Table 1 is a mapping relationship table between keys and fragment sizes in a preferred embodiment.

[0069] The central node includes:

[0070] A request response unit, configured to respond to a data acquisition request or a data upload request sent by the subnode;

[0071] A second key management unit, configured to generate and / or store a second key generated according to the business extraction feature to which the target data belongs;

[0072] The second fragment encryption and decryption unit is configured to receive the fragment data packets sent by the subnode and decrypt them using the second key to combine them into a complete data packet, or encrypt the complete data packet using the second key and send them to the subnode in fragments.

[0073] In some other preferred embodiments, a method is provided in which a key management unit (including a first key management unit and a second key management unit) generates a key (including but not limited to a first key and a second key) according to a business extraction feature to which data belongs, including:

[0074] Methods for generating keys based on characteristics of the business to which the data belongs include:

[0075] r=(base64(aX+bY+cZ)).substr(0,64);

[0076] Among them, r is the target key; X is the abbreviation of the business module, Y is the name of the communication initiator, Z is the business main table display column, a, b, c are weights; base64(aX+bY+cZ) is the base64 encoding of the string aX+bY+cZ, and substr(0,64) is the operation of intercepting the first 64 bits of data after base64 encoding.

[0077] It should be understood that the weights a, b, and c represent the number of repetitions of the corresponding string, and are dynamically configured by those skilled in the art to generate a dynamic secret key; it should be understood that the central node and the sub-nodes should use a unified weight when generating the corresponding key to ensure that the same secret key is generated, thereby performing data encryption and decryption operations.

[0078] The key generation method of this embodiment is described below with reference to specific examples.

[0079] Take the warehouse management scenario as an example. At this time, the business module that the communication system needs to transmit data is the warehouse management module, whose abbreviation is X=INVENTORY. The communication initiator is warehouse A, whose name is Y=WAREHOUSE_A. The requested business main table display column is the item name, then Z=ITEM_ID. At this time, the assigned weights a=1, b=2, c=3. The feature string generated at this time is

[0080] "INVENTORYWAREHOUSE_AWAREHOUSE_AITEM_IDITEM_IDITEM_ID";

[0081] The characteristic string is encoded by Base64, and the result is as follows:

[0082] "SU5WRU5UT1JZV0FSRUhPVVNFX0FXQVJFSE9VU0VfQUlURU1fSURJVEVNX0lESVRFTV9JRA==";

[0083] Intercept the first 64 bits to get the target key:

[0084] "SU5WRU5UT1JZV0FSRUhPVVNFX0FXQVJFSE9VU0VfQUlURU1fSURJVEVNX0lESVRF".

[0085] It should be noted that the data transmission of the present invention mainly involves two situations: one is that the sub-nodes obtain data from the central node, and the other is that the sub-nodes upload data to the central node.

[0086] The following is a brief description of the workflow for these two situations.

[0087] When a branch node needs to obtain data from the central node, the request sending unit sends a data acquisition request to the central node, the request response unit responds to the data acquisition request sent by the branch node, queries the target data and sends it to the second key management unit and the second slice encryption and decryption unit, the second key management unit generates a second key according to the business extraction characteristics of the target data, and sends it to the second slice encryption and decryption unit; the second slice encryption and decryption unit encrypts the target data using the second key and sends it to the first slice encryption and decryption unit of the branch node in slices; the first key management unit of the branch node generates a first key according to the business extraction characteristics of the target data, and sends it to the first slice encryption and decryption unit; the first slice encryption and decryption unit receives the slice data packet sent by the central node, decrypts it using the first key, and combines it into a complete data packet to complete the acquisition of the target data.

[0088] When a branch node needs to upload data to the central node, the request sending unit sends a data upload request to the central node, and the request response unit responds to the data upload request sent by the branch node, queries the feature extraction logic of the business module to which the uploaded data belongs, and sends it to the first key management unit of the branch node; the first key management unit compares the returned feature extraction logic with the feature extraction logic stored in itself, and if they are the same, generates a first key based on this and sends it to the first slice encryption and decryption unit; the first slice encryption and decryption unit encrypts the uploaded data with the first key and sends it to the second slice encryption and decryption unit of the central node in slices; the second key management unit of the central node generates a second key based on the extracted features of the business to which the uploaded data belongs, and sends it to the second slice encryption and decryption unit; the second slice encryption and decryption unit receives the slice data packet sent by the branch node, decrypts it with the second key, and combines it into a complete data packet, thereby completing the acquisition of the uploaded data.

[0089] However, the above specific embodiments are only preferred embodiments of the present invention and should not be regarded as limitations on the claims of the present invention. Any equivalent transformations and improvements made within the scope of the claims of the present invention should be included in the protection scope of the present invention. The use of the modules or units of the present invention may not be limited to the above embodiments, and those skilled in the art can implement various changes and substitutions based on the prior art. For example, the combination of the key management unit and the shard encryption and decryption unit can be adjusted according to actual application requirements, and the encryption and decryption methods of data transmission can also be changed according to different encryption algorithms. As long as the transformation is made within the technical solution of the present invention, it should be included in the protection scope of the present invention.

[0090] Example 2

[0091] like Figure 3 As shown, this embodiment is developed on the basis of the above-mentioned embodiment 1, and this embodiment provides a more specific implementation method for a sub-node to obtain data from a central node.

[0092] S11. The request sending unit sends a data acquisition request to the central node.

[0093] S12. The request response unit receives the data acquisition request and queries target data, and sends the target data to the second key management unit.

[0094] S13. The second key management unit generates a second key according to the business extraction features to which the target data belongs, and sends it to the second fragment encryption and decryption unit.

[0095] S14. The second shard encryption and decryption unit encrypts the target data using the second key and sends the shards to the first shard encryption and decryption unit of the branch node.

[0096] S15. The first key management unit generates a first key based on the business extraction features to which the target data belongs, and sends it to the first slice encryption and decryption unit.

[0097] S16. The first fragment encryption and decryption unit receives all fragments and combines them into a complete data packet, and decrypts them according to the first key. If the first key management unit and the second key management unit have the same logic for extracting features based on the business to which the target data belongs, the decryption is successful, and the sub-node obtains the target data.

[0098] At this time, if the central node and the sub-node have different logics for extracting features according to the business to which the target data belongs, decryption cannot be successful. Since the key of the present invention is generated according to the business extraction feature logic, and the business extraction feature logic changes dynamically according to the data request, the business feature extraction logic determines the key generation method. Different business feature logics will generate different keys. Only when the logic is the same, the generated keys are consistent and decryption will be successful.

[0099] When the decryption of the sub-node fails, it indicates that the business feature extraction logics at both ends are inconsistent. In order to correct this situation, a mechanism is needed to resynchronize the business feature extraction logic. In some preferred embodiments, the following synchronization method is proposed: if the logic of extracting features according to the business to which the target data belongs by the first key management unit and the second key management unit is different, the decryption fails, the sub-node applies to the central node for query and obtains the feature extraction logic of the corresponding business module, and the first key management unit regenerates the first key according to the feature extraction logic.

[0100] Example 3

[0101] like Figure 4 As shown, this embodiment is developed on the basis of the above-mentioned embodiment 1, and this embodiment provides a more specific implementation method of uploading data from a sub-node to a central node.

[0102] S21. The request sending unit sends a data upload request to the central node.

[0103] S22: The request response unit receives the data upload request and queries the feature extraction logic of the business module to which the uploaded data belongs, and sends it to the first key management unit of the sub-node.

[0104] S23. The first key management unit compares the feature extraction logic stored in itself with the feature extraction logic transmitted back to see if they are the same. If so, a first key is generated according to the feature extraction logic and sent to the first shard encryption and decryption unit. In other preferred embodiments, if the feature extraction logic stored in the sub-node itself is different from the feature extraction logic transmitted back by the central node, the sub-node replaces the feature extraction logic stored in itself with the feature extraction logic transmitted back by the central node.

[0105] S24. The first slice encryption and decryption unit encrypts the uploaded data using the first key and sends the slices to the second slice encryption and decryption unit of the central node.

[0106] S25. The second key management unit generates a second key according to the business extraction feature to which the uploaded data belongs, and sends it to the second fragment encryption and decryption unit.

[0107] S26. The second fragment encryption and decryption unit receives all fragments and combines them into a complete data packet, and decrypts them according to the second key, and the central node obtains the uploaded data.

[0108] The above shows and describes the basic principles, main features and advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A data transmission system based on business characteristics, characterized in that: include: At least one central node; A plurality of sub-nodes interconnected via a local area network, the sub-nodes being signal-connected to the central node; The sub-nodes include: A request sending unit, configured to send a data acquisition request or a data upload request to the central node; A first key management unit, configured to generate and / or store a first key generated according to a feature extracted from the business to which the target data belongs; A first fragment encryption and decryption unit, configured to receive the fragment data packets sent by the central node and decrypt them using the first key to combine them into a complete data packet, or encrypt the complete data packet using the first key and send it to the central node in fragments; The central node includes: A request response unit, configured to respond to a data acquisition request or a data upload request sent by the subnode; A second key management unit, configured to generate and / or store a second key generated according to the business extraction feature to which the target data belongs; The second fragment encryption and decryption unit is configured to receive the fragment data packets sent by the subnode and decrypt them using the second key to combine them into a complete data packet, or encrypt the complete data packet using the second key and send them to the subnode in fragments.

2. The data transmission system based on service characteristics as claimed in claim 1, characterized in that: The sub-nodes and the central node are connected via an encrypted channel, and the data transmitted in the encrypted channel is conventionally encrypted.

3. The data transmission system based on service characteristics as claimed in claim 1, characterized in that: The method for the key management unit to generate a key according to the business characteristics extracted by the data includes: Methods for generating keys based on characteristics of the business to which the data belongs include: r=(base64(aX+bY+cZ)).substr(0,64); Among them, r is the target key; X is the abbreviation of the business module, Y is the name of the communication initiator, Z is the business main table display column, a, b, c are weights; base64(aX+bY+cZ) is the base64 encoding of the string aX+bY+cZ, and substr(0,64) is the operation of intercepting the first 64 bits of data after base64 encoding.

4. The data transmission system based on service characteristics as claimed in claim 1, characterized in that: The method for the first fragment encryption and decryption unit and the second fragment encryption and decryption unit to fragmentally send a data packet includes: The fragment encryption and decryption unit randomly divides the data packet into several fragments, and selects a corresponding third key for encryption according to the size of each fragment; the third key corresponds to the size of the fragment one by one.

5. The data transmission system based on service characteristics as claimed in claim 1, characterized in that: The methods for sub-nodes to obtain data from the central node include: The request sending unit sends a data acquisition request to the central node; The request response unit receives the data acquisition request and queries the target data, and sends the target data to the second key management unit; The second key management unit generates a second key according to the business extraction feature to which the target data belongs, and sends the second key to the second shard encryption and decryption unit; The second shard encryption and decryption unit encrypts the target data using the second key and sends the shards to the first shard encryption and decryption unit of the sub-node; The first key management unit generates a first key according to the business extraction feature to which the target data belongs, and sends the first key to the first shard encryption and decryption unit; The first fragment encryption and decryption unit receives all fragments and combines them into a complete data packet, and decrypts them according to the first key. If the first key management unit and the second key management unit have the same logic for extracting features based on the business to which the target data belongs, the decryption is successful and the sub-node obtains the target data.

6. The data transmission system based on service characteristics as claimed in claim 5, characterized in that: The method for the sub-node to obtain data from the central node also includes: If the logic of feature extraction based on the business to which the target data belongs is different between the first key management unit and the second key management unit, decryption fails, the sub-node applies to the central node for query and obtains the feature extraction logic of the corresponding business module, and the first key management unit regenerates the first key based on the feature extraction logic.

7. The data transmission system based on service characteristics as claimed in claim 1, characterized in that: The methods for sub-nodes to upload data to the central node include: The request sending unit sends a data upload request to the central node; The request response unit receives the data upload request and queries the feature extraction logic of the business module to which the uploaded data belongs, and sends it to the first key management unit of the sub-node; The first key management unit compares the feature extraction logic stored in the first key management unit with the returned feature extraction logic to see whether they are the same. If so, a first key is generated according to the feature extraction logic and sent to the first shard encryption and decryption unit; The first slice encryption and decryption unit encrypts the uploaded data using the first key and sends the slices to the second slice encryption and decryption unit of the central node; The second key management unit generates a second key according to the business extraction feature to which the uploaded data belongs, and sends the second key to the second slice encryption and decryption unit; The second fragment encryption and decryption unit receives all fragments and combines them into a complete data packet, and decrypts them according to the second key, and the central node obtains the uploaded data.

8. The data transmission system based on service characteristics as claimed in claim 7, characterized in that: The method for uploading data from the sub-node to the central node also includes: If the feature extraction logic stored in the sub-node itself is different from the feature extraction logic returned by the central node, the sub-node replaces the feature extraction logic stored in the sub-node itself with the feature extraction logic returned by the central node.

Images