Data transmission system based on service characteristics

Abstract

The application discloses a data transmission system based on service features, comprising: at least one central node; a plurality of sub-nodes connected with each other through a local area network; the sub-node comprises: a request sending unit configured to send a data acquisition request or a data upload request to the central node; a first key management unit configured to generate and / or store a first key generated according to service extraction features to which target data belongs; and a first fragmentation encryption and decryption unit configured to combine complete data packets after receiving fragmented data packets sent by the central node and decrypted by the first key, or send the complete data packets fragmented after being encrypted by the first key to the central node; the central node comprises: a request response unit configured to respond to the data acquisition request or the data upload request sent by the sub-node; a second key management unit configured to generate and / or store a second key generated according to service extraction features to which target data belongs; and a second fragmentation encryption and decryption unit configured to combine complete data packets after receiving fragmented data packets sent by the sub-node and decrypted by the second key, or send the complete data packets fragmented after being encrypted by the second key to the sub-node.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and in particular to a data transmission system based on service characteristics. Background Art

[0002] In today's era of rapid information development, secure data transmission has become a critical requirement for all types of business systems. Data security is particularly prominent in business data systems with multiple locations and high confidentiality requirements. Existing technologies typically employ a single-point, isolated, and independently deployed approach to ensure data security. However, with the continuous advancement of data security technology and the comprehensive advancement of information technology, this single-point, isolated, and independently deployed approach is no longer sufficient to meet actual needs, and multi-point interconnected deployment is becoming the mainstream. However, connecting multiple locations to form large-scale local area networks also increases the risk of data leakage.

[0003] Currently, protection for business data transmission primarily focuses on protecting data during the data transfer process, but there is no encryption protection method specifically designed for business modules. Existing technical solutions are often vulnerable to various attacks during the data transmission process, such as man-in-the-middle attacks and data interception, significantly increasing the risk of data leakage and tampering. Furthermore, most existing data encryption methods are static and cannot dynamically adjust keys based on changing business characteristics, significantly reducing the flexibility and security of data encryption. Summary of the Invention

[0004] In order to address the shortcomings of the existing technology, the present invention aims to provide an end-to-end data transmission protection system based on business characteristics. By dynamically generating keys and sharding encryption methods, the security of the data transmission process is greatly improved, data leakage and tampering are prevented, and the safe and reliable transmission of business data in a complex network environment is ensured.

[0005] In order to achieve the above-mentioned object of the invention, the technical solution provided by the present invention includes:

[0006] 1. Data transmission system based on business characteristics, including:

[0007] At least one central node; a plurality of sub-nodes interconnected via a local area network, said sub-nodes being signal-connected to said central node;

[0008] The sub-nodes include:

[0009] a request sending unit, configured to send a data acquisition request or a data upload request to the central node;

[0010] A first key management unit is configured to generate and / or store a first key generated according to characteristics extracted from the business to which the target data belongs;

[0011] A first fragment encryption and decryption unit is configured to receive fragmented data packets sent by the central node and decrypt them using the first key to combine them into a complete data packet, or encrypt the complete data packet using the first key and send the fragments to the central node;

[0012] The central node includes:

[0013] a request response unit, configured to respond to a data acquisition request or a data upload request sent by the subnode;

[0014] A second key management unit is configured to generate and / or store a second key generated according to characteristics extracted from the business to which the target data belongs;

[0015] The second fragment encryption and decryption unit is configured to receive the fragmented data packets sent by the subnode and decrypt them using the second key to combine them into a complete data packet, or encrypt the complete data packet using the second key and send the fragments to the subnode.

[0016] Preferably, the sub-nodes and the central node are connected via an encrypted channel, and data transmitted in the encrypted channel is conventionally encrypted.

[0017] Preferably, the method for the key management unit to generate a key based on the business characteristics extracted from the data includes:

[0018] Methods for generating keys based on characteristics of the business to which the data belongs include:

[0019] r=(base64(aX+bY+cZ)).substr(0,64);

[0020] Where r is the target key; X is the abbreviation of the business module, Y is the name of the communication initiator, Z is the display column of the business main table, and a, b, and c are weights; base64(aX+bY+cZ) is the base64 encoding of the string aX+bY+cZ, and substr(0,64) is the operation of intercepting the first 64 bits of the base64-encoded data.

[0021] Preferably, the method in which the first fragment encryption and decryption unit and the second fragment encryption and decryption unit fragmentally send a data packet includes:

[0022] The fragment encryption and decryption unit randomly divides the data packet into several fragments, and selects a corresponding third key for encryption according to the size of each fragment; the third key has a one-to-one correspondence with the size of the fragment.

[0023] Preferably, the method for the sub-nodes to obtain data from the central node includes:

[0024] The request sending unit sends a data acquisition request to the central node;

[0025] The request response unit receives the data acquisition request and queries the target data, and sends the target data to the second key management unit;

[0026] The second key management unit generates a second key based on the business extraction feature of the target data, and sends the second key to the second shard encryption and decryption unit;

[0027] The second shard encryption and decryption unit encrypts the target data using the second key and sends the shards to the first shard encryption and decryption unit of the node;

[0028] The first key management unit generates a first key based on the business extraction characteristics of the target data, and sends the first key to the first shard encryption and decryption unit;

[0029] The first fragment encryption and decryption unit receives all fragments and combines them into a complete data packet, and decrypts them according to the first key. If the first key management unit and the second key management unit have the same logic for extracting features based on the business to which the target data belongs, the decryption is successful and the sub-node obtains the target data.

[0030] Preferably, the method for the sub-node to obtain data from the central node further includes:

[0031] If the first key management unit and the second key management unit have different logics for extracting features based on the business to which the target data belongs, decryption fails. The sub-node applies to the central node for query and obtains the feature extraction logic of the corresponding business module. The first key management unit regenerates the first key based on the feature extraction logic.

[0032] Preferably, the method for uploading data from the sub-node to the central node includes:

[0033] The request sending unit sends a data upload request to the central node;

[0034] The request response unit receives the data upload request and queries the feature extraction logic of the business module to which the uploaded data belongs, and sends the result to the first key management unit of the sub-node;

[0035] The first key management unit compares the feature extraction logic stored in the unit with the returned feature extraction logic to see if they are the same. If so, it generates a first key according to the feature extraction logic and sends it to the first shard encryption and decryption unit;

[0036] The first shard encryption and decryption unit encrypts the uploaded data using the first key and then sends the shards to the second shard encryption and decryption unit of the central node;

[0037] The second key management unit generates a second key based on the business extraction feature of the uploaded data, and sends the second key to the second shard encryption and decryption unit;

[0038] The second fragment encryption and decryption unit receives all the fragments and combines them into a complete data packet, and decrypts them according to the second key, so that the central node obtains the uploaded data.

[0039] Preferably, the method of uploading data from the sub-node to the central node further includes:

[0040] If the feature extraction logic stored in the branch node itself is different from the feature extraction logic returned by the central node, the branch node replaces the feature extraction logic stored in the branch node with the feature extraction logic returned by the central node.

[0041] Beneficial effects

[0042] 1. Dynamic Key Generation: The service-feature-based data transmission system provided by this invention avoids the vulnerability of traditional static keys to cracking by dynamically generating keys. This system generates keys based on the feature extraction logic of different service modules, significantly increasing key diversity and security, making data encryption more flexible and secure.

[0043] 2. Fragmented Encryption Transmission: This invention introduces a fragmented encryption mechanism, randomly splitting a data packet into multiple fragments and encrypting them using a key based on the fragment size. Even if a single fragment is cracked, it is difficult to recover the entire packet, further improving data transmission security.

[0044] 3. Encrypted Channel Transmission: This invention configures an encrypted channel between the sub-nodes and the central node, ensuring that data transmission is transmitted and received in an encrypted channel after conventional encryption. This provides double encryption protection, making it difficult to directly read the data even if the transmission channel is monitored.

[0045] 4. Flexibility in Service Feature Extraction Logic: The service feature extraction logic of the present invention is highly flexible, enabling customized feature extraction parameters based on diverse service requirements to generate keys suitable for each service module. This flexibility not only enhances the system's adaptability but also enables the adjustment of encryption strategies based on specific service needs, ensuring secure data transmission for each service module.

[0046] 5. Enhanced Security and Reliability: By combining dynamic key generation, fragmented encryption, and encrypted channel transmission, this invention significantly improves the security and reliability of data transmission. Data is encrypted at every stage of transmission, effectively preventing data leakage and tampering, ensuring the secure and reliable transmission of business data in complex network environments.

[0047] 6. Wide applicability: The data transmission system based on business characteristics provided by the present invention is applicable to various business systems with high data security requirements, including but not limited to finance, medical care, military and other fields, and can meet the data security transmission needs in various scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a schematic diagram of the connection structure between the central node and the sub-nodes of a data transmission system based on service characteristics in a preferred embodiment of the present invention;

[0049] Figure 2 A schematic diagram of data transmission connection between a central node and sub-nodes in a preferred embodiment of the present invention;

[0050] Figure 3 This is a schematic diagram of data transmission connections between a central node and a sub-node when a sub-node needs to obtain data in a preferred embodiment of the present invention;

[0051] Figure 4 This is a schematic diagram of data transmission connections between a central node and a sub-node when a sub-node needs to upload data in a preferred embodiment of the present invention; DETAILED DESCRIPTION

[0052] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention is further described below with reference to the accompanying drawings. In the description of the present invention, it should be understood that the terms "upper", "lower", "front", "back", "left", "right", "top", "bottom", "inner", "outer", etc., indicating directions or positional relationships, are based on the directions or positional relationships shown in the accompanying drawings and are only for the convenience of describing the present invention and simplifying the description. They do not indicate or imply that the devices or components referred to must have a specific direction, be constructed and operate in a specific direction. Therefore, they should not be understood as limiting the present invention.

[0053] Example 1

[0054] This embodiment provides a data transmission system based on service characteristics, including:

[0055] like Figure 1As shown, at least one central node; several sub-nodes interconnected through a local area network, and the sub-nodes are signal-connected to the central node. It should be understood that each node is equipped with complete front-end and back-end and server hardware. As the first line of defense for communication system data protection, in some preferred embodiments, it is considered that the sub-nodes and the central node are connected through an encrypted channel, and the data transmitted in the encrypted channel is conventionally encrypted. Specifically, channel encryption equipment can be installed at the entrance and exit of each point network, and the encryption method can be an encryption method commonly used in the field, or other encryption methods that match the present invention. The export encryption and decryption steps in the data transmission process will not be repeated later.

[0056] like Figure 2 As shown, the sub-nodes include:

[0057] The request sending unit is configured to send a data acquisition request or a data upload request to the central node. The data acquisition request is used by the sub-node to obtain specific business data, which includes the specific content of the request, that is, the relevant information of the target data, specifically including but not limited to the following parameters: start time, end time, unit name, data version number, the business module, etc. The data upload request refers to the sub-node sending a request to the central node to upload specific business data. The request involves a series of steps, including but not limited to the encryption, transmission, reception, decryption, verification and storage of the request. The data transmission of the present invention mainly involves two situations, one is that the sub-node obtains data from the central node, and the other is that the sub-node uploads data to the central node.

[0058] The first key management unit is configured to generate and / or store a first key generated based on the extracted features of the business to which the target data belongs. The extracted features of the business to which the target data belongs refer to the extraction of specific business features based on the business module to which the target data belongs, such as inventory management, user information, order processing, etc. These features may include, but are not limited to, the name, function point, data structure, display column, etc. of the business module. For example, for the inventory management module, the business module abbreviation (such as "inventory"), the name of the communication initiating unit (such as "Warehouse A"), and the display column of the business main table (such as "Product ID") may be extracted. The first key is generated based on the extracted business features. The business feature extraction method can use the business type, business function point, technical implementation method, data presentation method, etc. as extraction parameters to extract its content data and convert it into a string. The string is then subjected to a bit shift transformation and then converted into a data encryption key using a commonly used encryption algorithm (such as AES, 3DES, RSA, etc.). It should be understood that there are many methods for generating the first key, which are not further limited in this embodiment. Its main purpose is to enhance the security and flexibility of data encryption through dynamic feature extraction and key generation. The following are several common methods:

[0059] 1. Generate a key based on the business identifier. Use the business identifier (such as business ID, order ID, user ID, etc.) to perform hash processing to generate a key of fixed length.

[0060] 2. Generate a key based on business context features. This process extracts multiple features from the business context, such as timestamp, business type, and user role, concatenates these features into a string, and then performs hashing to generate a key.

[0061] 3. Generate keys based on dynamic business data. Generate keys based on dynamically changing business data, such as transaction amounts, inventory quantities, etc., and encrypt the business data obtained in real time using AES or other encryption methods to generate keys.

[0062] The first fragment encryption and decryption unit is configured to receive fragmented data packets sent by the central node and decrypt them using the first key to assemble them into a complete data packet, or to encrypt a complete data packet using the first key and then send the fragments to the central node. It should be understood that in this embodiment, whether the central node or the branch node, upon receiving a data packet fragment, needs to determine whether the currently received fragment is the final fragment. If not, the received fragment can be stored in a temporary area and then all the fragments can be reassembled into a complete data packet after the final fragment is received.

[0063] The fragmented transmission is a technology that divides a large data packet into multiple small fragments for transmission. There are many ways to implement it. Its main purpose is to improve transmission efficiency and data security. Especially in the case of unstable network or high security requirements, fragmented transmission can reduce the risk of data packet loss and interception.

[0064] In some preferred embodiments, a preferred method for a fragment encryption and decryption unit (including a first fragment encryption and decryption unit and a second fragment encryption and decryption unit) to fragmentally send a data packet is provided, specifically including:

[0065] The fragment encryption and decryption unit randomly splits the data packet into several fragments and selects a corresponding third key for encryption based on the size of each fragment; the third key corresponds to the size of the fragment. It should be understood that the third key is built into the data storage device of the central node and the sub-node, and a mapping table between the third key and the fragment size is configured, as shown in Table 1 below.

[0066]

[0067]

[0068] Table 1 is a mapping relationship table between keys and fragment sizes in a preferred embodiment.

[0069] The central node includes:

[0070] a request response unit, configured to respond to a data acquisition request or a data upload request sent by the subnode;

[0071] A second key management unit is configured to generate and / or store a second key generated according to characteristics extracted from the business to which the target data belongs;

[0072] The second fragment encryption and decryption unit is configured to receive the fragmented data packets sent by the subnode and decrypt them using the second key to combine them into a complete data packet, or encrypt the complete data packet using the second key and send the fragments to the subnode.

[0073] In some other preferred embodiments, a method is provided in which a key management unit (including a first key management unit and a second key management unit) generates a key (including but not limited to a first key and a second key) based on business extraction features to which data belongs, including:

[0074] Methods for generating keys based on characteristics of the business to which the data belongs include:

[0075] r=(base64(aX+bY+cZ)).substr(0,64);

[0076] Where r is the target key; X is the abbreviation of the business module, Y is the name of the communication initiator, Z is the display column of the business main table, and a, b, and c are weights; base64(aX+bY+cZ) is the base64 encoding of the string aX+bY+cZ, and substr(0,64) is the operation of intercepting the first 64 bits of the base64-encoded data.

[0077] It should be understood that the weights a, b, and c represent the number of repetitions of the corresponding string and are dynamically configured by those skilled in the art to generate a dynamic secret key. It should be understood that the central node and the sub-nodes should use the same weight when generating the corresponding key to ensure that the same secret key is generated to perform data encryption and decryption operations.

[0078] The key generation method of this embodiment is described below with reference to specific examples.

[0079] Taking the warehouse management scenario as an example, the business module that the communication system needs to transmit data to is the warehouse management module, whose abbreviation is X = INVENTORY. The communication initiator is warehouse A, whose name is Y = WAREHOUSE_A. The requested business main table display column is the item name, so Z = ITEM_ID. At this time, the assignment weights a = 1, b = 2, and c = 3. The generated feature string is

[0080] "INVENTORYWAREHOUSE_AWAREHOUSE_AITEM_IDITEM_IDITEM_ID";

[0081] The characteristic string is encoded using Base64, and the result is as follows:

[0082] "SU5WRU5UT1JZV0FSRUhPVVNFX0FXQVJFSE9VU0VfQUlURU1fSURJVEVNX0lESVRFTV9JRA==";

[0083] Intercept the first 64 bits to get the target key:

[0084] "SU5WRU5UT1JZV0FSRUhPVVNFX0FXQVJFSE9VU0VfQUlURU1fSURJVEVNX0lESVRF".

[0085] It should be noted that the data transmission of the present invention mainly involves two situations: one is that the sub-nodes obtain data from the central node, and the other is that the sub-nodes upload data to the central node.

[0086] The following is a brief description of the workflow for these two situations.

[0087] When a branch node needs to obtain data from a central node, a request sending unit sends a data acquisition request to the central node, a request response unit responds to the data acquisition request sent by the branch node, queries the target data and sends it to the second key management unit and the second shard encryption and decryption unit, the second key management unit generates a second key based on the business extraction characteristics of the target data and sends it to the second shard encryption and decryption unit; the second shard encryption and decryption unit encrypts the target data using the second key and sends it in pieces to the first shard encryption and decryption unit of the branch node; the first key management unit of the branch node generates a first key based on the business extraction characteristics of the target data and sends it to the first shard encryption and decryption unit; the first shard encryption and decryption unit receives the shard data packet sent by the central node, decrypts it using the first key, and combines it into a complete data packet to complete the acquisition of the target data.

[0088] When a branch node needs to upload data to the central node, the request sending unit sends a data upload request to the central node, the request response unit responds to the data upload request sent by the branch node, queries the feature extraction logic of the business module to which the uploaded data belongs, and sends it to the first key management unit of the branch node; the first key management unit compares the returned feature extraction logic with its own stored feature extraction logic, and if they are the same, generates a first key based on this and sends it to the first fragment encryption and decryption unit; the first fragment encryption and decryption unit encrypts the uploaded data with the first key and sends it to the second fragment encryption and decryption unit of the central node in fragments; the second key management unit of the central node generates a second key based on the business extraction features to which the uploaded data belongs, and sends it to the second fragment encryption and decryption unit; the second fragment encryption and decryption unit receives the fragment data packet sent by the branch node, decrypts it with the second key, and combines it into a complete data packet to complete the acquisition of the uploaded data.

[0089] However, the above specific embodiments are only preferred embodiments of the present invention and should not be regarded as limiting the claims of the present invention. Any equivalent transformations and improvements made within the scope of the claims of the present invention should be included in the protection scope of the present invention. The use of the various modules or units of the present invention may not be limited to the above embodiments, and those skilled in the art can implement various changes and replacements based on existing technologies. For example, the combination of the key management unit and the shard encryption and decryption unit can be adjusted according to actual application requirements, and the encryption and decryption methods of data transmission can also be changed according to different encryption algorithms. As long as the transformation is carried out within the technical solution of the present invention, it should be included in the protection scope of the present invention.

[0090] Example 2

[0091] like Figure 3 As shown, this embodiment is developed on the basis of the above-mentioned embodiment 1. This embodiment provides a more specific implementation method for a sub-node to obtain data from a central node.

[0092] S11. The request sending unit sends a data acquisition request to the central node.

[0093] S12. The request response unit receives the data acquisition request and queries target data, and sends the target data to the second key management unit.

[0094] S13. The second key management unit generates a second key based on the business extraction characteristics to which the target data belongs, and sends it to the second fragment encryption and decryption unit.

[0095] S14. The second shard encryption and decryption unit encrypts the target data using the second key and sends the shards to the first shard encryption and decryption unit of the node.

[0096] S15. The first key management unit generates a first key based on the business extraction characteristics to which the target data belongs, and sends it to the first fragment encryption and decryption unit.

[0097] S16. The first fragment encryption and decryption unit receives all fragments and combines them into a complete data packet, and decrypts them according to the first key. If the first key management unit and the second key management unit have the same logic for extracting features based on the business to which the target data belongs, the decryption is successful, and the sub-node obtains the target data.

[0098] At this point, if the central node and the sub-nodes use different logic based on the business feature extraction logic of the target data, decryption will not be successful. Because the key of the present invention is generated based on the business feature extraction logic, and the business feature extraction logic changes dynamically based on the data request, the business feature extraction logic determines the key generation method. Different business feature logics will generate different keys. Only when the logic is the same will the generated keys be consistent and decryption will be successful.

[0099] When the decryption of a sub-node fails, it indicates that the business feature extraction logic at both ends is inconsistent. In order to correct this situation, a mechanism is needed to resynchronize the business feature extraction logic. In some preferred embodiments, the following synchronization method is proposed: if the logic of the first key management unit and the second key management unit for extracting features according to the business to which the target data belongs is different, the decryption fails, the sub-node applies to the central node for query and obtains the feature extraction logic of the corresponding business module, and the first key management unit regenerates the first key according to the feature extraction logic.

[0100] Example 3

[0101] like Figure 4 As shown, this embodiment is developed on the basis of the above-mentioned embodiment 1. This embodiment provides a more specific implementation method for a sub-node to upload data to a central node.

[0102] S21. The request sending unit sends a data upload request to the central node.

[0103] S22: The request response unit receives the data upload request and queries the feature extraction logic of the business module to which the uploaded data belongs, and sends the result to the first key management unit of the sub-node.

[0104] S23. The first key management unit compares the feature extraction logic stored in the sub-node with the feature extraction logic transmitted back to the node to determine if they are the same. If so, the first key management unit generates a first key based on the feature extraction logic and sends the first key to the first shard encryption and decryption unit. In other preferred embodiments, if the feature extraction logic stored in the sub-node is different from the feature extraction logic transmitted back by the central node, the sub-node replaces the feature extraction logic stored in the sub-node with the feature extraction logic transmitted back by the central node.

[0105] S24. The first fragment encryption and decryption unit encrypts the uploaded data using the first key and sends the fragments to the second fragment encryption and decryption unit of the central node.

[0106] S25. The second key management unit generates a second key based on the business extraction feature of the uploaded data, and sends it to the second fragment encryption and decryption unit.

[0107] S26. The second fragment encryption and decryption unit receives all fragments and combines them into a complete data packet, and decrypts them according to the second key, and the central node obtains the uploaded data.

[0108] The basic principles, main features, and advantages of the present invention are shown and described above. Those skilled in the art should understand that the present invention is not limited to the foregoing embodiments. The foregoing embodiments and descriptions are merely illustrative of the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. A data transmission system based on business characteristics, characterized in that: include: At least one central node; A plurality of sub-nodes interconnected via a local area network, wherein the sub-nodes are signal-connected to the central node; The sub-nodes include: a request sending unit, configured to send a data acquisition request or a data upload request to the central node; A first key management unit is configured to generate and / or store a first key generated according to characteristics extracted from the business to which the target data belongs; A first fragment encryption and decryption unit is configured to receive fragmented data packets sent by the central node and decrypt them using the first key to combine them into a complete data packet, or encrypt the complete data packet using the first key and send the fragments to the central node; The central node includes: a request response unit, configured to respond to a data acquisition request or a data upload request sent by the subnode; A second key management unit is configured to generate and / or store a second key generated according to characteristics extracted from the business to which the target data belongs; A second fragment encryption and decryption unit is configured to receive the fragmented data packets sent by the subnode and decrypt them using the second key to combine them into a complete data packet, or encrypt the complete data packet using the second key and send the fragments to the subnode; The method for the key management unit to generate a key based on the business characteristics of the data includes: r=(base64(aX+bY+cZ)).substr(0,64); Where r is the target key; X is the abbreviation of the business module, Y is the name of the communication initiator, Z is the display column of the business main table, and a, b, and c are weights; base64(aX+bY+cZ) is the base64 encoding of the string aX+bY+cZ, and substr(0,64) is the operation of intercepting the first 64 bits of the base64-encoded data; The method for the first fragment encryption and decryption unit and the second fragment encryption and decryption unit to fragmentally send a data packet includes: The fragment encryption and decryption unit randomly divides the data packet into several fragments, and selects a corresponding third key for encryption according to the size of each fragment; the third key has a one-to-one correspondence with the size of the fragment.

2. The data transmission system based on service characteristics according to claim 1, wherein: The sub-nodes and the central node are connected via an encrypted channel, and data transmitted in the encrypted channel is conventionally encrypted.

3. The data transmission system based on service characteristics according to claim 1, characterized in that: The methods for sub-nodes to obtain data from the central node include: The request sending unit sends a data acquisition request to the central node; The request response unit receives the data acquisition request and queries the target data, and sends the target data to the second key management unit; The second key management unit generates a second key based on the business extraction feature of the target data, and sends the second key to the second shard encryption and decryption unit; The second shard encryption and decryption unit encrypts the target data using the second key and sends the shards to the first shard encryption and decryption unit of the node; The first key management unit generates a first key based on the business extraction characteristics of the target data, and sends the first key to the first shard encryption and decryption unit; The first fragment encryption and decryption unit receives all fragments and combines them into a complete data packet, and decrypts them according to the first key. If the first key management unit and the second key management unit have the same logic for extracting features based on the business to which the target data belongs, the decryption is successful and the sub-node obtains the target data.

4. The data transmission system based on service characteristics according to claim 3, characterized in that: The method for sub-nodes to obtain data from the central node also includes: If the first key management unit and the second key management unit have different logics for extracting features based on the business to which the target data belongs, decryption fails. The sub-node applies to the central node for query and obtains the feature extraction logic of the corresponding business module. The first key management unit regenerates the first key based on the feature extraction logic.

5. The data transmission system based on service characteristics according to claim 1, characterized in that: Methods for sub-nodes to upload data to the central node include: The request sending unit sends a data upload request to the central node; The request response unit receives the data upload request and queries the feature extraction logic of the business module to which the uploaded data belongs, and sends the result to the first key management unit of the sub-node; The first key management unit compares the feature extraction logic stored in the unit with the returned feature extraction logic to see if they are the same. If so, it generates a first key according to the feature extraction logic and sends it to the first shard encryption and decryption unit; The first shard encryption and decryption unit encrypts the uploaded data using the first key and then sends the shards to the second shard encryption and decryption unit of the central node; The second key management unit generates a second key based on the business extraction feature of the uploaded data, and sends the second key to the second shard encryption and decryption unit; The second fragment encryption and decryption unit receives all the fragments and combines them into a complete data packet, and decrypts them according to the second key, so that the central node obtains the uploaded data.

6. The data transmission system based on service characteristics according to claim 5, characterized in that: The method for uploading data from the sub-node to the central node also includes: If the feature extraction logic stored in the branch node itself is different from the feature extraction logic returned by the central node, the branch node replaces the feature extraction logic stored in the branch node with the feature extraction logic returned by the central node.

Images