Data fragmentation transmission method and system based on logic strong isolation device

Abstract

The invention discloses a data fragmentation transmission method and system based on a logic strong isolation device, and belongs to the technical field of information processing, and the method comprises the steps: S1, classifying to-be-transmitted data based on a first transmission demand to obtain a first classification result, and fragmenting the to-be-transmitted data based on the first classification result to obtain fragmented data; s2, establishing a data exchange channel between the data sending domain side and the data receiving domain side based on the logic strong isolation device; s3, encrypting the fragmented data based on the JDBC connection to obtain encrypted data, and storing the encrypted data in a database at a data receiving domain side based on a data exchange channel; and S4, obtaining recombined data from the database based on the identification features of the fragmented data, and obtaining data to be transmitted by a data receiving network domain side based on the recombined data. The problem that data stability and safety are poor due to the fact that data penetrating through a strong isolation device are not fully protected is solved.

Description

Technical Field

[0001] The present invention relates to the field of information processing technology, and in particular to a data fragmentation transmission method and system based on a logic strong isolation device. Background Art

[0002] With the continuous improvement of the degree of informatization, the importance of data security has become increasingly prominent. Especially in some fields with extremely high requirements for data security, such as government, military, finance, electricity, energy, etc., the isolation domain is usually used to ensure the security of core data. At present, due to different security level requirements, safe, efficient and reliable system-to-system data interaction and coordination between two isolated network areas has always been a pain point in related industries. For example, the patent number CN116319068A is a method and system for improving the efficiency of penetration data processing in a strong isolation environment, in which the intranet cache queue is used to cache the data to be penetrated in the intranet business system, the intranet penetration module is used to batch obtain multiple data to be penetrated in the intranet cache queue, obtain batch data, and store them in the penetration library, the external network penetration module is used to penetrate the strong isolation device through the database communication protocol, obtain batch data from the penetration library, and transmit the batch data to the external network business system. The above scheme can obtain batch data through one penetration by setting the intranet cache queue, the intranet penetration module and the external network penetration module. Compared with the method in which only one piece of data to be penetrated can be obtained in one penetration, the penetration data processing efficiency can be improved without expanding the penetration resources. However, the above scheme only protects the transmitted data through a strong isolation device. Once the strong isolation device fails or is attacked, it will affect the stability and security of the entire data transmission. Therefore, it can be seen that the above scheme has shortcomings in the data protection mechanism. Summary of the invention

[0003] In view of the problem that the prior art does not adequately protect the data passing through the strong isolation device, resulting in poor data stability and security, the present invention provides a data sharding transmission method and system based on a logical strong isolation device, by classifying the data to be transmitted, distinguishing important data from secondary data, and then sharding the important data and secondary data respectively, and executing SQL statements containing encryption logic through JDBC connection to encrypt each shard data, and then transmitting the encrypted shard data to the data receiving domain side, and through the dual protection mechanism set, significantly improving the security and stability of the data. The problem of poor data stability and security caused by insufficient protection of the data passing through the strong isolation device is solved.

[0004] To solve the above technical problems, the present invention provides a data fragmentation transmission method based on a logical strong isolation device, comprising the following steps: S1: classifying the data to be transmitted based on a first transmission requirement to obtain a first classification result, and fragmenting the data to be transmitted based on the first classification result to obtain fragmented data; S2: Establishing a data exchange channel between the data sending network domain side and the data receiving network domain side based on a logical strong isolation device; S3: Encrypt the shard data based on the JDBC connection to obtain encrypted data, and save the encrypted data in the database on the data receiving domain side based on the data exchange channel; S4: Reorganized data is obtained from the database based on the identification features of the fragmented data, and the data receiving domain side obtains the data to be transmitted based on the reorganized data.

[0005] After adopting the above technical solution, the present invention has the following advantages: Since important data often contains sensitive information, the loss caused by leakage is large. By classifying the data to be transmitted and distinguishing between important data and secondary data, it is convenient to formulate a more secure slicing scheme for important data than for secondary data. After slicing, the SQL statement containing encryption logic can be executed through JDBC connection to encrypt each shard data. Through the multiple security barriers set up, the security and stability of the data are significantly improved; By classifying the data to be transmitted, important data and secondary data can be distinguished, and it is also convenient to formulate corresponding slicing plans for secondary data. While ensuring the security of secondary data, it also saves resources and improves transmission efficiency; The problem of poor data stability and security due to insufficient protection of data passing through a strong isolation device is solved.

[0006] Preferably, the S1 comprises: S11: constructing a first initial sensitive data table based on the first transmission requirement, and constructing a first data matrix corresponding to the first initial sensitive data table based on the intuitive fuzzy correspondence table; S12: calculating the sensitivity value of each data in the first initial sensitive data table based on the first data matrix, removing the data in the first initial sensitive data table whose sensitivity value is less than the first preset sensitivity value, thereby obtaining a first final data table; S13: Compare the data in the data to be transmitted with the data in the first final data table, mark the data in the data to be transmitted that has been successfully compared as first classified data, mark the data in the data to be transmitted that has not been successfully compared as second classified data, and fragment the data to be transmitted based on the first classified data and the second classified data to obtain fragmented data.

[0007] The first transmission requirement is the transmission requirements of various fields, such as government, military, finance, etc. Since the important data in different fields are inconsistent, the first initial sensitive data table is constructed based on the first transmission requirement. By calculating the sensitive value of each data in the first initial sensitive data table, the sensitivity of the data can be quantified, thereby distinguishing the data that requires more stringent protection. The first classified data is highly sensitive data, and the second classified data is low-sensitive data. By separating high-sensitive data from low-sensitive data, stricter encryption and transmission measures can be taken for high-sensitive data, thereby improving data security; at the same time, eliminating low-sensitive data reduces the amount of data to be processed subsequently, and reduces the cost and complexity of encryption, transmission and storage; by constructing an intuitive fuzzy correspondence table and a data matrix to calculate the sensitive value, the solution has certain flexibility and scalability, and the first preset sensitive value can be adjusted or the sensitive data table can be updated according to actual needs to adapt to different business scenarios and changes.

[0008] Preferably, in S11, constructing a first data matrix corresponding to the first initial sensitive data table based on the intuitive fuzzy correspondence table includes: The sensitivity evaluation value of each data in the first initial sensitive data table is calculated based on the intuitive fuzzy correspondence table, and the first data matrix corresponding to the first initial sensitive data table is constructed based on the sensitivity evaluation value of each data in the first initial sensitive data table. The first data matrix is ​​Q ij =(q ij ) n*n , where q ij =(a ij , b ij ), i∈(1, n), j∈(1, n), n is the number of data in the first initial sensitive data table, a ij Indicates that the sensitivity evaluation value of the i-th data in the first initial sensitive data table is greater than the sensitivity evaluation value of the j-th data in the first initial sensitive data table, b ij Indicates that the sensitivity evaluation value of the i-th data in the first initial sensitive data table is less than or equal to the sensitivity evaluation value of the j-th data in the first initial sensitive data table. Through the intuitive fuzzy correspondence table, the sensitivity of each data in the first initial sensitive data table can be converted into a specific sensitivity evaluation value, which not only considers the direct sensitivity of the data, but also the relative sensitivity between the data, thereby more comprehensively reflecting the sensitivity of the data, improving the accuracy of sensitive data evaluation, and thus improving the security of the data.

[0009] Preferably, in S13, the step of slicing the data to be transmitted based on the first classification data and the second classification data to obtain slicing data includes: Acquire a first slice size corresponding to each first classification data based on a sensitivity evaluation value of each first classification data in the data to be transmitted, and acquire a second slice size corresponding to each second classification data in the data to be transmitted based on the network bandwidth; Based on the first slice size corresponding to each first classification data, first classification data larger than the corresponding first slice size in the data to be transmitted are segmented to obtain first slice data, and first classification data less than or equal to the corresponding first slice size in the data to be transmitted are marked as second slice data; Based on the second slice size corresponding to each second classification data, the second classification data in the data to be transmitted that is larger than the corresponding second slice size is segmented to obtain the third slice data, and the second classification data in the data to be transmitted that is less than or equal to the corresponding second slice size is marked as the fourth slice data, and the first slice data, the second slice data, the third slice data and the fourth slice data are the slice data. The first classification data usually contains higher sensitivity, so it is necessary to determine the slice size according to its sensitivity evaluation value. The data with a higher sensitivity evaluation value may have a smaller slice size, so as to facilitate more detailed control and encryption during the transmission process, thereby improving data security. The second classification data is relatively less sensitive, so its slice size can be determined according to the network bandwidth, which can more effectively utilize the network bandwidth and reduce transmission delay and packet loss rate.

[0010] Preferably, S3 includes: S31: Based on the JDBC connection, use the encryption protocol to generate a first encryption key, determine whether the length of each first encryption key is greater than a preset length, if so, execute S32, if less than or equal to, continue to execute S31; S32: Generate a second encryption key based on the first encryption key, traverse each bit of the second encryption key in turn, regard the consecutive bits with the same value corresponding to the bits in the bit positions as a run, and determine whether the total number of runs of the second encryption key meets the preset requirements, if so, continue to execute S33, if not, continue to execute S32; S33: Encrypt the sliced ​​data based on the second encryption key to obtain encrypted data, and store the encrypted data in a database on the data receiving domain side via the data exchange channel.

[0011] The first encryption key is generated using an encryption protocol, and the second encryption key is generated through further processing. At the same time, the length and run-length characteristics of the encryption key are verified to ensure that the generated key has sufficient complexity and randomness. Even if one layer of keys is cracked, there is another layer of keys as protection. This multi-layer encryption mechanism can significantly improve data security.

[0012] Preferably, the S31 includes: S311: Based on the JDBC connection, the data sending domain side sends a request to the data receiving domain side; S312: The data receiving domain side generates feedback based on the request and sends the feedback to the data sending domain side. After receiving the feedback, the data sending domain side determines whether the feedback meets the preset feedback conditions. If not, S312 is executed; if yes, S313 is executed. S313: The data sending domain generates a public key and a master key based on an asymmetric encryption algorithm, and the public key and the master key are the first encryption key. Through pre-communication interaction and feedback verification, it can be ensured that both parties are in a good communication state before the encryption operation, thereby avoiding encryption failure or data loss caused by communication problems, and improving communication efficiency and stability; using the public key and the master key generated by the asymmetric encryption algorithm as the first encryption key provides a high-intensity security guarantee for data encryption and enhances data security.

[0013] Preferably, S4 includes: S41: judging whether to start the data reorganization process based on the identification features of the shard data just stored in the database, and executing S42 if the identification features of the shard data just stored in the database meet the preset conditions; and continuing to execute S41 if the identification features of the shard data just stored in the database do not meet the preset conditions; S42: Obtaining reorganized data based on the identification features of the fragmented data stored in the database, and obtaining data to be transmitted based on the reorganized data. By determining whether the identification features of the fragmented data meet the preset conditions, it can be ensured that the data reorganization process is started only after all the fragmented data have been correctly stored in the database, thereby ensuring the integrity of the data.

[0014] Preferably, it also includes: After receiving the data to be transmitted, the data receiving domain generates response data, determines whether the size of the response data is greater than a preset response threshold, and if so, classifies the response data based on the second transmission requirement to obtain a second classification result, slices the response data based on the second classification result to obtain segmented data, and sends the response data to the data sending domain based on the segmented data. The second transmission requirement is set according to the data in each response data, and by classifying the response data, important data and secondary data are distinguished, so as to facilitate the formulation of a more secure slicing scheme for important data than for secondary data, and avoid the outside world predicting the content of the data to be transmitted by obtaining important data in the response data, thereby improving the security of the data.

[0015] Preferably, classifying the response data based on the second transmission requirement to obtain a second classification result includes: Constructing a second initial sensitive data table based on the second transmission requirement, and constructing a second data matrix corresponding to the second initial sensitive data table based on the intuitive fuzzy correspondence table; Calculate the sensitivity value of each data in the second initial sensitive data table based on the second data matrix, remove the data in the second initial sensitive data table whose sensitivity value is less than the second preset sensitivity value, and thus obtain a second final data table; Compare the data in the response data with the data in the second final data table, mark the data in the response data that are successfully matched as the first category data, and mark the data in the response data that are not successfully matched as the second category data. The first category data and the second category data are the second classification results. By calculating the sensitivity value of each data in the second initial sensitive data table, the sensitivity of the data can be quantified, so as to distinguish the data that needs stricter protection. The first category data is highly sensitive data, and the second category data is low-sensitive data. By separating high-sensitive data from low-sensitive data, stricter encryption and transmission measures can be taken for high-sensitive data, thereby improving data security; at the same time, eliminating low-sensitive data reduces the amount of data to be processed later, and reduces the cost and complexity of encryption, transmission and storage; by constructing an intuitive fuzzy correspondence table and a second data matrix to calculate the sensitive value, the scheme has certain flexibility and scalability, and can adjust the second preset sensitive value or update the sensitive data table according to actual needs to adapt to different business scenarios and changes.

[0016] Beneficial effects of this program: Since important data often contains sensitive information, the loss caused by leakage is large. By classifying the data to be transmitted and distinguishing between important data and secondary data, it is convenient to formulate a more secure slicing scheme for important data than for secondary data. After slicing, the SQL statement containing encryption logic can be executed through JDBC connection to encrypt each shard data. Through the multiple security barriers set up, the security and stability of the data are significantly improved; By classifying the data to be transmitted, important data and secondary data can be distinguished, and it is also convenient to formulate corresponding slicing plans for secondary data. While ensuring the security of secondary data, it also saves resources and improves transmission efficiency; The problem of poor data stability and security due to insufficient protection of data passing through a strong isolation device is solved.

[0017] The present invention also provides a data fragmentation transmission system based on a logic strong isolation device, comprising: A classification module, the classification module is used to classify the data to be transmitted based on the first transmission requirement to obtain a first classification result, and is also used to classify the response data based on the second transmission requirement to obtain a second classification result; The slicing module is used to slice the data to be transmitted based on the first classification result to obtain sliced ​​data, and is also used to slice the response data based on the second classification result to obtain segmented data.

[0018] Beneficial effects of this program: By classifying the data to be transmitted and the response data, and distinguishing between important data and secondary data, it is convenient to formulate a slicing plan for important data that is more secure than that for secondary data. While ensuring the security of important data and secondary data, it also saves resources and improves transmission efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Other features, objects and advantages of the present invention will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings. The drawings are only for the purpose of illustrating preferred embodiments and are not to be considered as limiting the present invention. Also, the same reference symbols are used throughout the drawings to represent the same parts.

[0020] Figure 1 It is a method flow diagram of a data slicing transmission method based on a logic strong isolation device of the present invention; Figure 2 It is an overall schematic diagram of slice data transmission in the data slice transmission method based on the logic strong isolation device of the present invention; Figure 3 It is a transmission activity diagram of data to be transmitted in the data fragmentation transmission method based on the logic strong isolation device of the present invention; Figure 4 It is a transmission activity diagram of response data in the data slicing transmission method based on the logic strong isolation device of the present invention. DETAILED DESCRIPTION

[0021] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific implementation method described herein is only an optimal embodiment of the present invention, which is only used to explain the present invention and does not limit the scope of protection of the present invention. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0022] Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow charts describe the operations (or steps) as sequential processes, many of the operations (or steps) therein can be implemented in parallel, concurrently, or simultaneously. In addition, the order of the operations can be rearranged. The process can be terminated when its operation is completed, but can also have additional steps not included in the drawings; the process can correspond to a method, function, procedure, subroutine, subprogram, etc.

[0023] Embodiment 1: like Figure 1 As shown, the data fragmentation transmission method based on the logic strong isolation device includes the following steps: S1: classifying the data to be transmitted based on a first transmission requirement to obtain a first classification result, and fragmenting the data to be transmitted based on the first classification result to obtain fragmented data.

[0024] The S1 includes: S11: constructing a first initial sensitive data table based on the first transmission requirement, and constructing a first data matrix corresponding to the first initial sensitive data table based on the intuitive fuzzy correspondence table; S12: calculating the sensitivity value of each data in the first initial sensitive data table based on the first data matrix, removing the data in the first initial sensitive data table whose sensitivity value is less than the first preset sensitivity value, thereby obtaining a first final data table; S13: Compare the data in the data to be transmitted with the data in the first final data table, mark the data in the data to be transmitted that has been successfully compared as first classified data, mark the data in the data to be transmitted that has not been successfully compared as second classified data, and fragment the data to be transmitted based on the first classified data and the second classified data to obtain fragmented data.

[0025] In S11, constructing a first data matrix corresponding to the first initial sensitive data table based on the intuitive fuzzy correspondence table includes: The sensitivity evaluation value of each data in the first initial sensitive data table is calculated based on the intuitive fuzzy correspondence table, and the first data matrix corresponding to the first initial sensitive data table is constructed based on the sensitivity evaluation value of each data in the first initial sensitive data table. The first data matrix is ​​Q ij =(q ij ) n*n , where q ij =(a ij , b ij ), i∈(1, n), j∈(1, n), n is the number of data in the first initial sensitive data table, a ijIndicates that the sensitivity evaluation value of the i-th data in the first initial sensitive data table is greater than the sensitivity evaluation value of the j-th data in the first initial sensitive data table, b ij It indicates that the sensitivity evaluation value of the i-th data in the first initial sensitive data table is less than or equal to the sensitivity evaluation value of the j-th data in the first initial sensitive data table.

[0026] In S13, the step of fragmenting the data to be transmitted based on the first classification data and the second classification data to obtain fragmented data includes: Acquire a first slice size corresponding to each first classification data based on a sensitivity evaluation value of each first classification data in the data to be transmitted, and acquire a second slice size corresponding to each second classification data in the data to be transmitted based on the network bandwidth; Based on the first slice size corresponding to each first classification data, first classification data larger than the corresponding first slice size in the data to be transmitted are segmented to obtain first slice data, and first classification data less than or equal to the corresponding first slice size in the data to be transmitted are marked as second slice data; Based on the second slice size corresponding to each second classified data, the second classified data larger than the corresponding second slice size in the data to be transmitted is split to obtain third slice data, and the second classified data less than or equal to the corresponding second slice size in the data to be transmitted is marked as fourth slice data, and the first slice data, the second slice data, the third slice data and the fourth slice data are slice data.

[0027] In this embodiment, the data to be transmitted is a request body, and the HTTP request with a large amount of data is a request to send the data to be transmitted. After receiving the HTTP request, the data to be transmitted is parsed to determine whether it is necessary to perform sharding on the data to be transmitted. The sharded data to be transmitted is classified based on the first transmission requirement. The first transmission requirement is the transmission requirement of various fields, such as government, military, finance and other fields. For example, if it is the financial field, the first initial sensitive data table includes bank account information, transaction information, credit report information, etc. The intuitive fuzzy correspondence table includes two elements a ij , b ij , at this time the first data matrix is: The elements of each row in the first data matrix are added to obtain the sensitivity value of the first data, and the data whose sensitivity value is less than the first preset sensitivity value in the first initial sensitive data table are removed to obtain the first final data table. If the sensitivity values ​​of the first data and the third data in the first initial sensitive data table are less than the first preset sensitivity value, and if n is 5, the first final data table is: Data to be transmitted 22 ,q 24 . . ...q 55The corresponding data is the first classification data, and the data not in the first final data table is the second classification data. The first classification data and the second classification data are sliced. The larger the sensitivity evaluation value of the first classification data in the data to be transmitted, the smaller the first slice size corresponding to the first classification data. The second slice size corresponding to the second classification data is determined according to the network bandwidth. Under the premise of ensuring that there is no network congestion, the second slice is made as large as possible to avoid wasting resources and improve data transmission efficiency. By calculating the sensitivity value of each data in the first initial sensitive data table, the sensitivity of the data can be quantified, thereby distinguishing the data that needs stricter protection. The first classification data is highly sensitive data, and the second classification data is low-sensitive data. By separating high-sensitive data from low-sensitive data, stricter encryption and transmission measures can be taken for high-sensitive data, thereby improving data security; at the same time, eliminating low-sensitive data reduces the amount of data to be processed later, and reduces the cost and complexity of encryption, transmission and storage; by constructing an intuitive fuzzy correspondence table and a data matrix to calculate the sensitive value, the scheme has certain flexibility and scalability, and the first preset sensitive value can be adjusted or the sensitive data table can be updated according to actual needs to adapt to different business scenarios and changes.

[0028] S2: Establish a data exchange channel between the data sending domain side and the data receiving domain side based on the logical strong isolation device.

[0029] In this embodiment, the logical strong isolation device is a network gate. In addition, it can also be other devices with similar functions to the network gate.

[0030] The logical strong isolation device ensures that the data exchange between the internal and external networks is carried out in a strictly isolated environment through physical or logical means, effectively preventing the spread and attack of malware such as viruses and Trojans. This isolation mechanism can reduce the risk of internal network penetration by external threats, thereby ensuring data security. The data exchange channel established by the logical strong isolation device can achieve fine control over data transmission, and specific transmission rules, permissions and audit mechanisms can be set to ensure that only authorized data can flow between different domains. This helps to improve the compliance and traceability of data exchange.

[0031] S3: Encrypt the shard data based on the JDBC connection to obtain encrypted data, and save the encrypted data in the database on the data receiving domain side based on the data exchange channel.

[0032] The S3 includes: S31: Based on the JDBC connection, use the encryption protocol to generate a first encryption key, determine whether the length of each first encryption key is greater than a preset length, if so, execute S32, if less than or equal to, continue to execute S31; S32: Generate a second encryption key based on the first encryption key, traverse each bit of the second encryption key in turn, regard the consecutive bits with the same value corresponding to the bits in the bit positions as a run, and determine whether the total number of runs of the second encryption key meets the preset requirements, if so, continue to execute S33, if not, continue to execute S32; S33: Encrypt the sliced ​​data based on the second encryption key to obtain encrypted data, and store the encrypted data in a database on the data receiving domain side via the data exchange channel.

[0033] The S31 includes: S311: Based on the JDBC connection, the data sending domain side sends a request to the data receiving domain side; S312: The data receiving domain side generates feedback based on the request and sends the feedback to the data sending domain side. After receiving the feedback, the data sending domain side determines whether the feedback meets the preset feedback conditions. If not, S312 is executed; if yes, S313 is executed. S313: The data sending domain generates a public key and a master key based on an asymmetric encryption algorithm, and the public key and the master key are the first encryption key.

[0034] The encryption protocol is SSL / TLS. The data-sending domain initiates a TCP connection request to the server on the data-receiving domain, indicating in the request that it supports the SSL / TLS protocol. The server on the data-receiving domain responds to the data-sending domain and sends an SSL / TLS certificate, which is feedback. The certificate is used to verify the identity of the server and ensure communication between the data-sending domain and the data-receiving domain. The data-sending domain verifies whether the certificate is valid. If the verification fails, the connection with the data-receiving domain is terminated to protect the data. If the verification is successful, the data-sending domain generates a temporary public key, private key pair and master key based on the asymmetric statement. The data The sending domain side uses the public key to encrypt the master key. The public key and the encrypted master key are the first encryption key. It is determined whether the length of the public key and the encrypted master key are both greater than the preset length. If both are greater, the first encrypted data, random number and algorithm suite are used to generate the second encrypted data. The random number is generated by the data sending domain side and the data receiving domain side server in the handshake phase, and the algorithm suite is negotiated in the handshake phase. It is determined whether the second encrypted data meets the preset requirements. If it meets the requirements, the obtained second encrypted data is used to encrypt the slice data. The preset requirements are set according to the requirements. If the randomness of the second encrypted data is required to be greater, the preset value in the preset requirements is greater, otherwise it is smaller. The first encryption key is generated using the encryption protocol, and the second encryption key is generated through further processing. At the same time, the length and run characteristics of the encryption key are verified to ensure that the generated key has sufficient complexity and randomness. Even if a layer of keys is cracked, there is another layer of keys as protection. This multi-layer encryption mechanism can significantly improve the security of data.

[0035] S4: Reorganized data is obtained from the database based on the identification features of the fragmented data, and the data receiving domain side obtains the data to be transmitted based on the reorganized data.

[0036] The S4 includes: S41: judging whether to start the data reorganization process based on the identification features of the shard data just stored in the database, and executing S42 if the identification features of the shard data just stored in the database meet the preset conditions; and continuing to execute S41 if the identification features of the shard data just stored in the database do not meet the preset conditions; S42: Obtain reorganized data based on identification features of the fragmented data stored in the database, and obtain data to be transmitted based on the reorganized data.

[0037] In this embodiment, each shard data is marked according to the order of segmentation. At this time, the identification feature of the first shard data is 1, the identification feature of the second shard data is 2, and so on. If the identification feature of the last shard data is 200, if the identification feature of the shard data just saved in the database is 200, the data reorganization process is started. If it is 199, continue to monitor until the shard data with the identification feature of 200 is monitored. All received shard data are sorted and reorganized according to the identification feature, and the complete data to be transmitted, i.e., the HTTP request body, is restored. This process is performed by a dedicated thread to ensure efficient processing speed. By judging whether the identification feature of the shard data meets the preset conditions, it can be ensured that the data reorganization process is started only after all the shard data have been correctly saved in the database, thereby ensuring the integrity of the data.

[0038] Also includes: After receiving the data to be transmitted, the data receiving domain side generates response data and determines whether the size of the response data is greater than a preset response threshold. If so, the response data is classified based on the second transmission requirement to obtain a second classification result, and the response data is segmented based on the second classification result to obtain segmented data, and the response data is sent to the data sending domain side based on the segmented data.

[0039] The classifying the response data based on the second transmission requirement to obtain a second classification result includes: Constructing a second initial sensitive data table based on the second transmission requirement, and constructing a second data matrix corresponding to the second initial sensitive data table based on the intuitive fuzzy correspondence table; Calculate the sensitivity value of each data in the second initial sensitive data table based on the second data matrix, remove the data in the second initial sensitive data table whose sensitivity value is less than the second preset sensitivity value, and thus obtain a second final data table; The data in the response data are compared with the data in the second final data table, the data in the response data that are successfully compared are marked as first category data, and the data in the response data that are not successfully compared are marked as second category data, and the first category data and the second category data are the second classification results.

[0040] After the data receiving domain receives the data to be transmitted, i.e., the HTTP request body, the HTTP request is sent to the target server for processing through the real HTTP protocol. At this time, the system is still listening to the response of the target server. After the target server processes the HTTP request, it returns the processing result. If the response data, i.e., the amount of response data, exceeds the threshold set by the system, the response data is fragmented. The second transmission requirement is set according to the data in each response data. The intuitive fuzzy correspondence table includes two elements a ij , b ij , then the second data matrix is: p 11 to p nn for a ij or b ij , add the elements of each row in the second data matrix to obtain the sensitivity value of the first data, remove the data whose sensitivity value is less than the second preset sensitivity value in the second initial sensitive data table, and then obtain the second final data table. If the sensitivity values ​​of the first data and the third data in the second initial sensitive data table are less than the first preset sensitivity value, if n is 4, then the first final data table is: Data to be transmitted 22 to p 44 The corresponding data is the first category data, and the data not in the second final data table is the second category data. The first category data and the second category data are sharded. By calculating the sensitivity value of each data in the second initial sensitive data table, the sensitivity of the data can be quantified, thereby distinguishing the data that requires stricter protection. The first category data is highly sensitive data, and the second category data is low-sensitive data. By separating high-sensitive data from low-sensitive data, stricter encryption and transmission measures can be taken for high-sensitive data, thereby improving data security; at the same time, eliminating low-sensitive data reduces the amount of data to be processed later, and reduces the cost and complexity of encryption, transmission and storage; by constructing an intuitive fuzzy correspondence table and a second data matrix to calculate the sensitive value, the solution has certain flexibility and scalability, and can adjust the second preset sensitive value or update the sensitive data table according to actual needs to adapt to different business scenarios and changes.

[0041] After the first category data and the second category data, i.e., the response data, are returned to the request end through the JDBC connection, they are stored in the corresponding database. After the request end system listens to the segmented data, it sorts and reorganizes it, restores the complete response body, and returns it to the client. In the entire transmission process, asynchronous operations are supported, allowing multiple requests and responses to be processed simultaneously to avoid blocking. Through the multi-threading mechanism, the transmission and reorganization of multiple data fragments can be processed in parallel, which significantly improves the transmission efficiency and system response speed. When the complete HTTP request and response transmission, reorganization, and forwarding are all completed, the process is officially ended, the user receives the processing results, and the log of the entire process is recorded for subsequent auditing and analysis. Through the above detailed implementation process, it is possible to safely, efficiently, and automatically transmit and process large amounts of HTTP requests and responses in an environment across isolated network domains, ensuring the integrity, security, and efficient processing speed of the data.

[0042] In this embodiment, the data sending network domain side corresponds to network domain 1, the data receiving network domain side corresponds to network domain 2, and the data to be transmitted corresponds to the request body, such as Figure 2As shown, when the data to be transmitted is transmitted from application A to application B, the size of the request body in application A, the unique identifier of the request body and the request body are transmitted to the cross-domain exchange system, and the cross-domain interaction system divides and encrypts the request body. The request body is the main part of the request, and the request body includes multiple encrypted data. For example, shard1-shard8 in the figure are encrypted data. The Header, i.e., the header, including the size and unique identifier of the request body is transmitted first, so that the data receiving end knows the basic situation of the data, and then the encrypted data is transmitted through the isolated domain device, i.e., the logical strong isolation device. After the current encrypted data is successfully transmitted, feedback information is generated to request the next encrypted data, until the data transmission is completed and the write end flag, i.e., the end signal, is issued. After the encrypted data is transmitted successfully, the cross-domain interaction system assembles the encrypted data to obtain a complete request body, and transmits the request body to application B.

[0043] like Figure 3 As shown, the transmission activity of the data to be transmitted includes two parts: the upstream logic of the large data request and the downstream logic of the large data request. In this embodiment, the transmission request of the data to be transmitted is a large data body request, and the Actor is a system role. The upstream logic of the large data request includes: the request client obtains the large data request, and sends the large data request to the shard server. The shard server determines the large data request and performs shard processing, and cuts the large data request body into a shard set and then performs shard batch loop processing. The shard batch loop processing includes: the shard server performs shard calculation and batch aggregation processing. When the asynchronous task is turned on, the token queue token lock is acquired, and the data shard concurrent asynchronous write library thread pool is used to batch shard data and asynchronously concurrently write to the library, and the number of shards that successfully write to the library is fed back to the shard service layer. All asynchronous tasks of the shard service layer synchronously wait for the result to be aggregated. The shard service layer feeds back the total number of shards requested to the request client, and the request client encapsulates the request, and then continues to complete the downstream logic of the large data request.

[0044] The downstream logic of large data volume request includes: request polling listening to obtain the data shard identification information in the request, and determine whether to process in shards according to the shard identification and the preset slice size, the shard service layer processes the shard request data, and reads the library in a loop according to the shard number sequence, and reads the library in a loop according to the shard number sequence, including: shard number calculation, when the asynchronous task is turned on, the token queue token lock is obtained, the data shard concurrent library reading thread pool batch pulls data according to the shard number and reads the library asynchronously and concurrently, after the shard data is read in batches, the data shard concurrent library reading thread pool feedbacks the shard byte data of this batch, and aggregates the data in a loop according to the shard number sequence, and aggregates the data in a loop according to the shard number sequence, including: after the shard service layer waits for the asynchronous task of reading data with the specified sequential shard number to complete, the data shard asynchronous ordered aggregation thread pool batch appends the aggregated data bytes according to the shard sequence number, and then appends the mode aggregated data bytes, the data shard asynchronous ordered aggregation thread pool feedbacks the current request large data volume real data to the shard service layer, the shard service layer waits for the asynchronous aggregation data byte task to succeed and returns the processed current request large data real data, and the shard service layer feedbacks the completion of the real request The Body is encapsulated into the request polling listener, and the proxy request execution logic continues.

[0045] like Figure 4 As shown, Actor is a system role, and the transmission activity of the response data also includes two parts: the upstream logic of the large-volume request and the downstream logic of the large-volume request. The difference from the transmission activity of the data to be transmitted is that the upstream logic of the large-volume response in the transmission activity of the response data basically corresponds to the downstream logic of the large-volume request in the transmission activity of the data to be transmitted, and the downstream logic of the large-volume response in the transmission activity of the response data basically corresponds to the upstream logic of the large-volume request in the transmission activity of the data to be transmitted. The difference is that 1. The request client in the upstream logic of the large-volume request in the transmission activity of the data to be transmitted is the business agent executor in the downstream logic of the large-volume response in the transmission activity of the response data, and at the same time, the first step and the last step of the downstream logic of the large-volume response in the transmission activity of the response data are the business agent executor proxy request execution and the business agent executor encapsulation completion, and then the large-volume response upstream logic is completed. 2. The request polling monitor in the downstream logic of the large-volume request in the transmission activity of the data to be transmitted is the request client in the upstream logic of the large-volume response in the transmission activity of the response data, and at the same time, the last step of the upstream logic of the large-volume response in the transmission activity of the response data is the request client feedback response complete large-volume.

[0046] Embodiment 2: The data fragmentation transmission system based on the strong logic isolation device includes: A classification module, the classification module is used to classify the data to be transmitted based on the first transmission requirement to obtain a first classification result, and is also used to classify the response data based on the second transmission requirement to obtain a second classification result; The slicing module is used to slice the data to be transmitted based on the first classification result to obtain sliced ​​data, and is also used to slice the response data based on the second classification result to obtain segmented data.

[0047] The first transmission requirement is for various fields, such as government, military, finance and other fields. For example, if it is in the financial field, the first initial sensitive data table includes bank account information, transaction information, credit report information, etc. The second transmission requirement is set according to the data in each response data.

[0048] The specific implementation described above is a preferred implementation of the data sharding transmission method and system based on a logical strong isolation device of the present invention, and is not intended to limit the specific implementation scope of the present invention. The scope of the present invention includes but is not limited to this specific implementation. All equivalent changes made in accordance with the shape and structure of the present invention are within the protection scope of the present invention.

Claims

1. A data fragmentation transmission method based on a logical strong isolation device, characterized in that: The following steps are involved: S1: classifying the data to be transmitted based on a first transmission requirement to obtain a first classification result, and fragmenting the data to be transmitted based on the first classification result to obtain fragmented data; S2: Establishing a data exchange channel between the data sending network domain side and the data receiving network domain side based on a logical strong isolation device; S3: Encrypt the shard data based on the JDBC connection to obtain encrypted data, and save the encrypted data in the database on the data receiving domain side based on the data exchange channel; S4: Reorganized data is obtained from the database based on the identification features of the fragmented data, and the data receiving domain side obtains the data to be transmitted based on the reorganized data.

2. The data fragmentation transmission method based on the logic strong isolation device according to claim 1 is characterized in that: The S1 includes: S11: constructing a first initial sensitive data table based on the first transmission requirement, and constructing a first data matrix corresponding to the first initial sensitive data table based on the intuitive fuzzy correspondence table; S12: calculating the sensitivity value of each data in the first initial sensitive data table based on the first data matrix, removing the data in the first initial sensitive data table whose sensitivity value is less than the first preset sensitivity value, thereby obtaining a first final data table; S13: Compare the data in the data to be transmitted with the data in the first final data table, mark the data in the data to be transmitted that has been successfully compared as first classified data, mark the data in the data to be transmitted that has not been successfully compared as second classified data, and fragment the data to be transmitted based on the first classified data and the second classified data to obtain fragmented data.

3. The data fragmentation transmission method based on the logic strong isolation device according to claim 2 is characterized in that: In S11, constructing a first data matrix corresponding to the first initial sensitive data table based on the intuitive fuzzy correspondence table includes: The sensitivity evaluation value of each data in the first initial sensitive data table is calculated based on the intuitive fuzzy correspondence table, and the first data matrix corresponding to the first initial sensitive data table is constructed based on the sensitivity evaluation value of each data in the first initial sensitive data table. The first data matrix is ​​Q ij =(q ij ) n*n , where q ij =(a ij , b ij ), i∈(1, n), j∈(1, n), n is the number of data in the first initial sensitive data table, a ij Indicates that the sensitivity evaluation value of the i-th data in the first initial sensitive data table is greater than the sensitivity evaluation value of the j-th data in the first initial sensitive data table, b ij It indicates that the sensitivity evaluation value of the i-th data in the first initial sensitive data table is less than or equal to the sensitivity evaluation value of the j-th data in the first initial sensitive data table.

4. The data fragmentation transmission method based on the logic strong isolation device according to claim 2 is characterized in that: In S13, the step of fragmenting the data to be transmitted based on the first classification data and the second classification data to obtain fragmented data includes: Acquire a first slice size corresponding to each first classification data based on a sensitivity evaluation value of each first classification data in the data to be transmitted, and acquire a second slice size corresponding to each second classification data in the data to be transmitted based on the network bandwidth; Based on the first slice size corresponding to each first classification data, first classification data larger than the corresponding first slice size in the data to be transmitted are segmented to obtain first slice data, and first classification data less than or equal to the corresponding first slice size in the data to be transmitted are marked as second slice data; Based on the second slice size corresponding to each second classified data, the second classified data larger than the corresponding second slice size in the data to be transmitted is split to obtain third slice data, and the second classified data less than or equal to the corresponding second slice size in the data to be transmitted is marked as fourth slice data, and the first slice data, the second slice data, the third slice data and the fourth slice data are slice data.

5. The data fragmentation transmission method based on the logic strong isolation device according to claim 1 is characterized in that: The S3 includes: S31: Based on the JDBC connection, use the encryption protocol to generate a first encryption key, determine whether the length of each first encryption key is greater than a preset length, if so, execute S32, if less than or equal to, continue to execute S31; S32: Generate a second encryption key based on the first encryption key, traverse each bit of the second encryption key in turn, regard the consecutive bits with the same value corresponding to the bits in the bit positions as a run, and determine whether the total number of runs of the second encryption key meets the preset requirements, if so, continue to execute S33, if not, continue to execute S32; S33: Encrypt the sliced ​​data based on the second encryption key to obtain encrypted data, and store the encrypted data in a database on the data receiving domain side via the data exchange channel.

6. The data fragmentation transmission method based on the logic strong isolation device according to claim 5 is characterized in that: The S31 includes: S311: Based on the JDBC connection, the data sending domain side sends a request to the data receiving domain side; S312: The data receiving domain side generates feedback based on the request and sends the feedback to the data sending domain side. After receiving the feedback, the data sending domain side determines whether the feedback meets the preset feedback conditions. If not, S312 is executed; if yes, S313 is executed. S313: The data sending domain generates a public key and a master key based on an asymmetric encryption algorithm, and the public key and the master key are the first encryption key.

7. The data fragmentation transmission method based on the logic strong isolation device according to claim 1 is characterized in that: The S4 includes: S41: judging whether to start the data reorganization process based on the identification features of the shard data just stored in the database, and executing S42 if the identification features of the shard data just stored in the database meet the preset conditions; and continuing to execute S41 if the identification features of the shard data just stored in the database do not meet the preset conditions; S42: Obtain reorganized data based on identification features of the fragmented data stored in the database, and obtain data to be transmitted based on the reorganized data.

8. The data fragmentation transmission method based on the logic strong isolation device according to claim 1 is characterized in that: Also includes: After receiving the data to be transmitted, the data receiving domain side generates response data and determines whether the size of the response data is greater than a preset response threshold. If so, the response data is classified based on the second transmission requirement to obtain a second classification result, and the response data is segmented based on the second classification result to obtain segmented data, and the response data is sent to the data sending domain side based on the segmented data.

9. The data fragmentation transmission method based on the logic strong isolation device according to claim 8 is characterized in that: The classifying the response data based on the second transmission requirement to obtain a second classification result includes: Constructing a second initial sensitive data table based on the second transmission requirement, and constructing a second data matrix corresponding to the second initial sensitive data table based on the intuitive fuzzy correspondence table; Calculate the sensitivity value of each data in the second initial sensitive data table based on the second data matrix, remove the data in the second initial sensitive data table whose sensitivity value is less than the second preset sensitivity value, and thus obtain a second final data table; The data in the response data are compared with the data in the second final data table, the data in the response data that are successfully compared are marked as first category data, and the data in the response data that are not successfully compared are marked as second category data, and the first category data and the second category data are the second classification results.

10. A data fragmentation transmission system based on a strong logic isolation device, applicable to the data fragmentation transmission method based on a strong logic isolation device according to any one of claims 1 to 9, characterized in that: include: A classification module, the classification module is used to classify the data to be transmitted based on the first transmission requirement to obtain a first classification result, and is also used to classify the response data based on the second transmission requirement to obtain a second classification result; The slicing module is used to slice the data to be transmitted based on the first classification result to obtain sliced ​​data, and is also used to slice the response data based on the second classification result to obtain segmented data.

Images