Data transmission method based on service characteristics

Abstract

The data transmission method based on service characteristics comprises the following steps: a sub-node obtains data from a center node: the sub-node sends a data obtaining request to the center node; the center node queries target data according to the data obtaining request, extracts a feature according to a service to which the target data belongs, generates a first key, encrypts the target data by using the first key to obtain a first data packet, and transmits the first data packet to the sub-node in pieces; the sub-node assembles the first data packet by receiving all the pieces of the first data packet, extracts a second key according to the feature of the service to which the target data belongs, and decrypts the first data packet by using the second key; if the logic of the features of the service to which the target data belongs is the same, the decryption is successful, and the sub-node obtains the target data. The application avoids the problem that the traditional static key is easily cracked, greatly increases the diversity and security of the key, and makes the data encryption more flexible and secure.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data transmission, and in particular to a data transmission method based on service characteristics. BACKGROUND

[0002] In today's era of rapid development of informatization, secure transmission of data has become a key requirement for various business systems. Especially in some multi-point distributed and highly confidential business data systems, data security issues are particularly prominent. In the prior art, a single-point isolation independent deployment method is usually used to ensure data security. However, with the continuous progress of data security technology and the overall promotion of informatization work, the single-point isolation independent deployment method has gradually failed to meet the actual needs, and the multi-point interconnection deployment method has gradually become the mainstream. However, in the process of connecting the network between multiple points and building a large local area network, the risk of data leakage is also increased.

[0003] Currently, the protection of business data transmission mainly focuses on protection during data flow, but there is no encryption protection method specifically for business modules. The existing technical solutions are often vulnerable to various attacks during data transmission, such as man-in-the-middle attacks, data interception, etc., greatly increasing the risk of data leakage and tampering. In addition, the data encryption methods in the prior art are mostly static and cannot dynamically adjust the key according to the changes in business characteristics, which greatly reduces the flexibility and security of data encryption. SUMMARY

[0004] In order to solve the problems existing in the prior art, the present application aims to provide an end-to-end data transmission protection method based on service characteristics, which greatly improves the security during data transmission by dynamically generating keys and using fragmentation encryption, prevents data leakage and tampering, and ensures the secure and reliable transmission of business data in complex network environments.

[0005] In order to achieve the above-mentioned application purposes, the technical solutions provided by the present application include:

[0006] The data transmission method based on service characteristics comprises the steps of:

[0007] The sub-node sends a data acquisition request to the center node; the center node queries target data according to the data acquisition request, and extracts a first key according to the characteristics of the service to which the target data belongs, and encrypts the target data with the first key to obtain a first data packet;

[0008] The center node transmits the first data packet fragments to the sub-node; after receiving all the fragments of the first data packet, the sub-node assembles the first data packet, generates a second key according to the feature extraction logic of the service to which the target data belongs, and decrypts the first data packet using the second key;

[0009] If the center node and the sub-node have the same feature extraction logic according to the service to which the target data belongs, the decryption is successful, and the sub-node obtains the target data.

[0010] The data transmission method based on service features provided by the application further includes the step of uploading data from the sub-node to the center node:

[0011] The sub-node sends a data upload request to the center node; the center node queries and returns the feature extraction logic of the service module to which the uploaded data belongs according to the data upload request;

[0012] The sub-node compares the feature extraction logic stored by itself with the feature extraction logic returned by the center node, and if they are the same, generates a third key according to the feature extraction logic and encrypts the uploaded data using the third key to obtain a second data packet;

[0013] The sub-node transmits the second data packet fragments to the center node; after receiving all the fragments of the second data packet, the center node assembles the second data packet, generates a fourth key according to the feature extraction logic of the service to which the uploaded data belongs, and decrypts the second data packet using the fourth key to obtain the uploaded data.

[0014] Preferably, if the center node and the sub-node have different feature extraction logics according to the service to which the target data belongs, the decryption fails, the sub-node queries and obtains the feature extraction logic of the corresponding service module from the center node, and generates a second key according to the feature extraction logic.

[0015] Preferably, if the feature extraction logic stored by the sub-node itself is different from the feature extraction logic returned by the center node, the sub-node replaces the feature extraction logic stored by itself with the feature extraction logic returned by the center node.

[0016] Preferably, an encryption channel is configured between the sub-node and the center node, and the data transmission between the two is received and transmitted in the encryption channel after being encrypted normally.

[0017] Preferably, the method for the center node to transmit the first data packet fragments to the sub-node includes:

[0018] The center node randomly splits the first data packet into a plurality of first segments, and encrypts each first segment according to a corresponding fifth key selected according to the size of the first segment; the fifth key corresponds to the size of the first segment in a one-to-one manner.

[0019] Preferably, the method for the sub-node to transmit the second data packet fragments to the center node comprises:

[0020] The sub-node randomly splits the second data packet into a plurality of second segments, and encrypts each second segment according to a corresponding sixth key selected according to the size of the second segment; the sixth key corresponds to the size of the second segment in a one-to-one manner.

[0021] Preferably, the method for the sub-node to assemble the first data packet after receiving all the first data packet fragments comprises:

[0022] The sub-node receives all the first data packet fragments, decrypts each first segment according to a corresponding fifth key selected according to the size of the first segment, and assembles all the decrypted first data packet fragments into a first data packet.

[0023] Preferably, the method for the center node to assemble the second data packet after receiving all the second data packet fragments comprises:

[0024] The center node receives all the second data packet fragments, decrypts each second segment according to a corresponding sixth key selected according to the size of the second segment, and assembles all the decrypted second data packet fragments into a second data packet.

[0025] Preferably, the method for generating a key according to the characteristics of the data belonging to a service comprises:

[0026] r = (base64(aX+bY+cZ)).substr(0,64);

[0027] wherein r is a target key; X is a short name of a service module, Y is a communication initiator unit name, Z is a service main table display column, a, b, and c are weights; base64(aX+bY+cZ) is base64 encoding of the string aX+bY+cZ, and substr(0,64) is an operation of intercepting the first 64 bits of the base64 encoded data.

[0028] Beneficial effects

[0029] Dynamic key generation: the application dynamically generates a key according to the characteristics of a service module, avoiding the problem that a traditional static key is easily cracked. By using the characteristics extraction logic of different service modules to generate a key, the diversity and security of the key are greatly increased, making data encryption more flexible and secure.

[0030] Fragmented encryption transmission: The invention introduces a fragmented encryption mechanism, which randomly splits data packets into multiple fragments and selects corresponding keys for encryption according to the size of the fragments. This fragmented encryption method can effectively prevent large data packets from being intercepted or tampered with during transmission, even if a single fragment is cracked, it is difficult to restore the entire data packet, further improving the security of data transmission.

[0031] Encrypted channel transmission: By configuring an encrypted channel between the sub-node and the center node, it is ensured that the data in the transmission process is transmitted and received in the encrypted channel after being encrypted regularly, providing double encryption protection. Even if the transmission channel is monitored, the data content is difficult to be directly read.

[0032] Flexibility of business feature extraction logic: The business feature extraction logic of the invention has high flexibility, which can customize feature extraction parameters according to different business needs, and generate keys suitable for each business module. This flexibility not only improves the adaptability of the system, but also adjusts the encryption strategy according to the specific business needs to ensure the security of data transmission in each business module.

[0033] Security and reliability enhancement: By combining dynamic key generation, fragmented encryption and encrypted channel transmission, the invention greatly improves the security and reliability of data transmission. Each link in the transmission process of data is encrypted, effectively preventing data leakage and tampering, and ensuring the safe and reliable transmission of business data in complex network environments.

[0034] Wide applicability: The end-to-end data transmission protection method and system provided by the invention is suitable for various business systems with high data security requirements, including but not limited to finance, medical care, military and other fields, and can meet the data security transmission needs in various scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0035] Figure 1 Flowchart of the sub-node obtaining data from the center node in the data transmission method based on business features provided by the invention;

[0036] Figure 2 Flowchart of the sub-node uploading data to the center node in the data transmission method based on business features provided by the invention; DETAILED DESCRIPTION

[0037] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described below with reference to the drawings. In the description of the present application, it should be understood that the terms "upper", "lower", "front", "rear", "left", "right", "top", "bottom", "inner", "outer" and the like indicate the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the devices or elements referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation on the present application.

[0038] Embodiment 1

[0039] The present application is applied to a communication system deployed in multiple points, which comprises at least one center node and a plurality of sub-nodes, the sub-nodes are connected with each other through a local area network signal, and each sub-node is connected with the center node. Each node is configured with complete front-end and back-end and server hardware. The communication system is configured with a plurality of service modules according to the needs of users and the service architecture during construction, and each service module is configured with an independent service feature extraction method for dynamically extracting feature data according to different contents of the service module.

[0040] As the first line of defense for data protection of the communication system, in some preferred embodiments, an encryption channel is considered to be allocated between the sub-nodes and the center node, and the data transmission between the two is received and transmitted in the encryption channel after being encrypted in a conventional manner. Specifically, a channel encryption device can be installed at the entrance and exit of each point network, and the encryption method can be a conventional encryption method in the art or other encryption methods matched with the present application. The subsequent export encryption and decryption steps in the data transmission process will not be described again.

[0041] The data transmission of the present application mainly involves two cases, one is that the sub-nodes obtain data from the center node, and the other is that the sub-nodes upload data to the center node. The present embodiment mainly makes a detailed description of the first case.

[0042] As shown in Figure 1 The present embodiment provides a data transmission method based on service features, comprising the steps of:

[0043] S11, the sub-node sends a data acquisition request to the center node; the center node queries target data according to the data acquisition request, and generates a first key according to the service to which the target data belongs, encrypts the target data with the first key to obtain a first data packet.

[0044] The data acquisition request is used by the sub-node to acquire specific business data, which includes the specific content of the request, i.e., the relevant information of the target data, specifically including but not limited to the following parameters: start time, end time, unit name, data version number, the business module, etc.

[0045] The business extraction feature to which the target data belongs refers to extracting specific business features according to the business module to which the target data belongs, such as inventory management, user information, order processing, etc. These features can include but are not limited to the name, function point, data structure, display column, etc. of the business module. For example, for the inventory management module, the business module abbreviation (such as "inventory"), the communication initiation unit name (such as "warehouse A"), the business main table display column (such as "product ID"), etc. can be extracted. A first key is generated according to the extracted business features. The business feature extraction method can use business type, business function point, technical implementation method, data display method, etc. as extraction parameters to extract the content data and convert it into a string, then perform bit shift transformation on the string, and then convert it into a data encryption key through a common encryption algorithm (AES, 3DES, RSA, etc.). It should be understood that there are many methods for generating the first key, and the present embodiment does not make further limitations, and the main purpose is to enhance the security and flexibility of data encryption through dynamic feature extraction and key generation methods. The following are several common methods:

[0046] 1. Generate a key based on a business identifier, use a business identifier (such as a business ID, order ID, user ID, etc.) for hash processing to generate a fixed-length key.

[0047] 2. Generate a key based on business context features, extract multiple features such as timestamps, business types, user roles, etc. from the business context, concatenate the features into a string, and then perform hash processing to generate a key;

[0048] 3. Generate a key based on dynamic business data, generate a key based on dynamic business data such as transaction amount, inventory quantity, etc. Process the real-time acquired business data to generate a key through AES encryption method.

[0049] S12, the center node transmits the first data packet fragments to the sub-node; the sub-node receives all the first data packet fragments and assembles them into a first data packet, and generates a second key according to the business extraction feature to which the target data belongs, and decrypts the first data packet using the second key.

[0050] When the sub-node receives the fragments of the first data packet, it needs to determine whether the currently received fragment is the final fragment. If not, the received fragment can be stored in a temporary area, and after receiving the final fragment, all fragments of the first data packet are assembled into the first data packet.

[0051] The fragmentation transmission is a technology of splitting a large data packet into multiple small fragments for transmission. There are many implementation ways, and its main purpose is to improve transmission efficiency and data security, especially in the case of unstable network or high security requirement. Fragmentation transmission can reduce the risk of data packet loss and interception. In some preferred embodiments, a preferred first data packet fragmentation method is given, that is, the method of the center node transmitting the first data packet fragments to the sub-node, which specifically includes: the center node randomly splits the first data packet into a plurality of first fragments, and selects a corresponding fifth key for encryption according to the size of each first fragment; the fifth key corresponds to the size of the first fragment one by one. Correspondingly, the method of the sub-node assembling the first data packet after receiving all the fragments of the first data packet specifically includes: the sub-node receives all the first fragments of the first data packet, selects a corresponding fifth key for decryption according to the size of each first fragment, and assembles all the decrypted first fragments into a first data packet. It should be understood that the fifth key is built into the data storage device of the center node and sub-node, and is configured with a mapping relationship table of the fifth key and the fragment size, as shown in Table 1 below.

[0052]

[0053] Table 1: Mapping relationship table of key and fragment size in a preferred embodiment.

[0054] S13, if the center node and the sub-node have the same logic of extracting features according to the business to which the target data belongs, the decryption is successful, and the sub-node obtains the target data. At this time, if the center node and the sub-node have different logic of extracting features according to the business to which the target data belongs, the decryption cannot be successful. Since the key of the application is generated according to the logic of extracting features, and the logic of extracting features is dynamically changed according to data request, the logic of extracting features determines the generation mode of the key. Different business feature logic will generate different keys. Only when the logic is the same, the generated key is consistent, and the decryption will be successful.

[0055] When the decryption of the sub-node fails, it indicates that the service feature extraction logics on both ends are inconsistent. In order to correct this situation, a mechanism is needed to re-synchronize the service feature extraction logic. In some preferred embodiments, the following synchronization method is proposed: the sub-node applies to the center node for querying and obtaining the feature extraction logic of the corresponding service module, and regenerates the second key according to the feature extraction logic. The sub-node applies to the center node for querying the correct service feature extraction logic and updates the local logic to ensure that the subsequent decryption operation can be successful.

[0056] Embodiment 2

[0057] This embodiment mainly makes a detailed description of the case that the sub-node uploads data to the center node. As shown in Figure 2 The embodiment provides a data transmission method based on service features, comprising:

[0058] S21, the sub-node sends a data upload request to the center node; the center node queries and returns the feature extraction logic of the service module to which the uploaded data belongs according to the data upload request. The data upload request refers to the request sent by the sub-node to the center node to upload specific business data. The request involves a series of steps, including but not limited to encryption, transmission, reception, decryption, verification and storage and other processes.

[0059] S22, the sub-node compares whether the feature extraction logic stored by itself is the same as the feature extraction logic returned by the center node, if yes, a third key is generated according to the feature extraction logic, and the uploaded data is encrypted by using the third key to obtain a second data packet. In some preferred embodiments, if the feature extraction logic stored by the sub-node is different from the feature extraction logic returned by the center node, the feature extraction logic stored by the sub-node is replaced by the feature extraction logic returned by the center node.

[0060] S23, the sub-node transmits the second data packet to the center node; the center node receives all the fragments of the second data packet, assembles them into a second data packet, and generates a fourth key according to the feature extraction of the service to which the uploaded data belongs, and decrypts the second data packet by using the fourth key to obtain the uploaded data.

[0061] When the center node receives the fragments of the second data packet, it needs to judge whether the currently received fragment is the final fragment, if not, the received fragment can be stored in a temporary area, and after receiving the final fragment, all the fragments of the second data packet are assembled into a second data packet.

[0062] In some preferred embodiments, a method for transmitting the second data packet fragments by the sub-node to the center node is given, which specifically comprises: the sub-node randomly splits the second data packet into a plurality of second fragments, and selects a corresponding sixth key for encryption according to the size of each second fragment; the sixth key corresponds to the size of the second fragment one by one. Correspondingly, the method for assembling the second data packet after the center node receives all the second data packet fragments specifically comprises: the center node receives all the second data packet fragments, selects a corresponding sixth key for decryption according to the size of each second fragment, and assembles all the decrypted second data packet fragments into a second data packet. As in the case of embodiment 1, the sixth key is built into the data storage device of the center node and the sub-node, and is configured with a mapping relationship table of the sixth key and the fragment size.

[0063] Embodiment 3

[0064] This embodiment is based on the above-mentioned embodiments 1 or 2, and this embodiment gives a method for generating a key according to the characteristics of the data belonging to the service, which specifically comprises:

[0065] r = (base64(aX+bY+cZ)).substr(0,64);

[0066] Wherein, r is the target key; X is the abbreviation of the service module, Y is the name of the communication initiation unit, Z is the display column of the service master table, a, b, c are weights; base64(aX+bY+cZ) is to encode the string aX+bY+cZ by base64, and substr(0,64) is to intercept the first 64 bits of the base64 encoded data.

[0067] It should be understood that the weights a, b, and c represent the number of repetitions of the corresponding string, which are dynamically configured by those skilled in the art, so as to generate a dynamic secret key; it should be understood that the center node and the sub-node should use uniform weights when generating the corresponding key, so as to ensure the generation of the same key, thereby performing data encryption and decryption operations

[0068] The key generation method of this embodiment will be described below in conjunction with a specific example.

[0069] Taking the warehouse management scenario as an example, the service module required by the communication system to record the data at this time is the warehouse management module, its abbreviation X = INVENTORY, the communication initiation unit is warehouse A, its name Y = WAREHOUSE_A, and the requested display column of the service master table is the item name, so Z = ITEM_ID. At this time, the weights a = 1, b = 2, and c = 3 are allocated, and the generated characteristic string is

[0070] "INVENTORY WAREHOUSE_AWAREHOUSE_AITEM_ID ITEM_ID ITEM_ID" ;

[0071] The feature string is Base64 encoded, and the result is as follows:

[0072] "SU5WRU5UT1JZV0FSRUhPVVNFX0FXQVJFSE9VU0VfQUlURU1fSURJVEVNX0lESVRFTV9JRA==" ;

[0073] The first 64 bits are intercepted to obtain the target key:

[0074] "SU5WRU5UT1JZV0FSRUhPVVNFX0FXQVJFSE9VU0VfQUlURU1fSURJVEVNX0lESVRF".

[0075] The above shows and describes the basic principles, main features and advantages of the present application. Those skilled in the art should understand that the present application is not limited to the above examples, and the above examples and descriptions in the specification are only to illustrate the principles of the present application. Without departing from the spirit and scope of the present application, various changes and improvements can be made to the present application, and these changes and improvements all fall within the scope of the present application. The scope of protection of the present application is defined by the appended claims and their equivalents.

Claims

1. A data transmission method based on service characteristics, characterized by, The method comprises the following steps of: The sub-node sends a data acquisition request to the center node; the center node queries target data according to the data acquisition request, extracts a feature of a business to which the target data belongs to generate a first key, encrypts the target data by using the first key to obtain a first data packet; The center node transmits the first data packet to the sub-node in fragments; the sub-node assembles the first data packet after receiving all the fragments of the first data packet, extracts a second key according to the feature of the business to which the target data belongs, and decrypts the first data packet by using the second key; If the logic of extracting the feature of the business to which the target data belongs is the same in the center node and the sub-node, the decryption is successful, and the sub-node obtains the target data; If the logic of extracting the feature of the business to which the target data belongs is different in the center node and the sub-node, the decryption fails, the sub-node applies to the center node to query and obtain the feature extraction logic of the corresponding business module, and regenerates a second key according to the feature extraction logic; The method for generating a key according to a feature of a business to which data belongs comprises: r=(base64(aX+bY+cZ)).substr(0,64); Wherein, r is a target key; X is a short name of a business module, Y is a communication initiation unit name, Z is a business master table display column, a, b, and c are weights; base64(aX+bY+cZ) is base64 encoding of the string aX+bY+cZ, and substr(0,64) is an operation of intercepting the first 64 bits of the base64 encoded data.

2. A data transmission method based on service characteristics, characterized by, The method comprises the following steps of uploading data by the sub-node to the center node: The sub-node sends a data upload request to the center node; the center node queries and returns a feature extraction logic of a business module to which the uploaded data belongs according to the data upload request; The sub-node compares whether the feature extraction logic stored by itself is the same as the feature extraction logic returned by the center node, and if yes, generates a third key according to the feature extraction logic and encrypts the uploaded data by using the third key to obtain a second data packet; The sub-node transmits the second data packet to the center node in fragments; the center node assembles the second data packet after receiving all the fragments of the second data packet, extracts a fourth key according to the feature of the business to which the uploaded data belongs, and decrypts the second data packet by using the fourth key to obtain the uploaded data; If the feature extraction logic stored by the sub-node is different from the feature extraction logic returned by the center node, the sub-node replaces the feature extraction logic stored by itself with the feature extraction logic returned by the center node; The method for generating a key according to a feature of a business to which data belongs comprises: r=(base64(aX+bY+cZ)).substr(0,64); Wherein, r is the target key; X is the abbreviation of the business module, Y is the name of the communication initiation unit, Z is the business main table display column, a, b, c are weights; base64(aX+bY+cZ) is to encode the string aX+bY+cZ by base64, and substr(0,64) is to intercept the first 64 bits of the base64 encoded data.

3. The data transmission method based on service characteristics according to claim 1 or 2, characterized by: The sub-node and the center node are equipped with an encryption channel, and the data transmission between the two is received and transmitted in the encryption channel after being encrypted.

4. The data transmission method based on service characteristics according to claim 1, characterized by: The method for the center node to transmit the first data packet fragments to the sub-node comprises: The center node randomly splits the first data packet into a plurality of first segments, and selects a corresponding fifth key for encryption according to the size of each first segment; the fifth key corresponds to the size of the first segment one by one.

5. The data transmission method based on service characteristics according to claim 2, characterized by: The method for the sub-node to transmit the second data packet fragments to the center node comprises: The sub-node randomly splits the second data packet into a plurality of second segments, and selects a corresponding sixth key for encryption according to the size of each second segment; the sixth key corresponds to the size of the second segment one by one.

6. The data transmission method based on service characteristics according to claim 4, characterized by: The method for the sub-node to assemble the first data packet after receiving all the first data packet fragments comprises: The sub-node receives all the first data packet fragments, selects a corresponding fifth key for decryption according to the size of each first segment, and assembles all the decrypted first data packet fragments into a first data packet.

7. The data transmission method based on service characteristics according to claim 5, characterized by: The method for the center node to assemble the second data packet after receiving all the second data packet fragments comprises: The center node receives all the second data packet fragments, selects a corresponding sixth key for decryption according to the size of each second segment, and assembles all the decrypted second data packet fragments into a second data packet.

Images