Data transmission method, device, equipment, medium and program product

Abstract

The invention provides a data transmission method and device, equipment, a medium and a program product, which can be applied to the technical field of information security or the field of financial science and technology. The data transmission method comprises the following steps: acquiring to-be-transmitted data; determining an encryption permission level for the to-be-transmitted data by identifying a sensitivity level of the to-be-transmitted data; after to-be-transmitted data are encrypted by calling a first encryption algorithm corresponding to the encryption permission level, the encrypted to-be-transmitted data and an identifier of the to-be-transmitted data are transmitted to the first cloud; after preset data are encrypted by calling a second encryption algorithm corresponding to the encryption permission level, first induction data are generated; and transmitting the first induction data and the identifier of the to-be-transmitted data to the second cloud.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology or financial technology, and more specifically to a data transmission method, device, equipment, medium and program product. Background Art

[0002] Data transmission is to transmit data from the data source to the data terminal through one or more data links in accordance with certain procedures, so as to realize the transmission and exchange of information between points. The real-time and reliability of data transmission are important indicators for evaluating data transmission methods. Data encryption refers to the conversion of plain text into cipher text through encryption algorithms and encryption keys, while data decryption refers to the restoration of cipher text to plain text through decryption algorithms and decryption keys. Data encryption is still the most reliable way for computer systems to protect information. It encrypts information through cryptographic technology to achieve information concealment, thereby playing a role in protecting information security.

[0003] In the process of implementing the inventive concept of the present disclosure, the inventors found that when data is transmitted between different terminals, although an encryption algorithm is used, sensitive data can still be obtained by decoding the encrypted data, which poses a data security risk. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a data transmission method, apparatus, device, medium and program product.

[0005] According to the first aspect of the present disclosure, a data transmission method is provided, including: obtaining data to be transmitted; determining the encryption authority level for the data to be transmitted by identifying the sensitivity level of the data to be transmitted; encrypting the data to be transmitted by calling a first encryption algorithm corresponding to the encryption authority level, and transmitting the encrypted data to be transmitted and an identification of the data to be transmitted to a first cloud; encrypting predetermined data by calling a second encryption algorithm corresponding to the encryption authority level, and generating first induced data; and transmitting the first induced data and the identification of the data to be transmitted to a second cloud.

[0006] According to an embodiment of the present disclosure, after encrypting the predetermined data by calling a second encryption algorithm corresponding to the encryption authority level, generating the first induced data includes: determining the type of induced data according to the encryption authority level; processing the predetermined data according to the induced data type to generate data to be encrypted; and encrypting the data to be encrypted by calling the second encryption algorithm to generate the first induced data.

[0007] According to an embodiment of the present disclosure, predetermined data are processed according to the induced data type to generate data to be encrypted, including: in response to the induced data type being an error type, randomly changing at least two data in the predetermined data to generate data to be encrypted; in response to the induced data type being a missing type, randomly deleting at least two data in the predetermined data to generate data to be encrypted; and in response to the induced data type being a random type, modifying any number of random data at at least two random positions in the predetermined data to generate data to be encrypted.

[0008] According to an embodiment of the present disclosure, the above method further includes: in response to receiving information indicating successful data transmission from the first cloud, deleting an operation record of performing data transmission to the first cloud.

[0009] According to an embodiment of the present disclosure, the above method also includes: in response to receiving a data interaction request from a target terminal, obtaining an identification of the target terminal and an identification of the data to be interacted; when it is determined that the identification of the target terminal is abnormal and the data to be interacted is sensitive data, obtaining second induced data corresponding to the identification of the data to be interacted from a second cloud; wherein the second induced data is generated by encrypting predetermined data using an encryption data algorithm corresponding to the sensitivity level of the data to be interacted; and sending the second induced data to the target terminal.

[0010] According to an embodiment of the present disclosure, the above method also includes: determining the sensitivity level of the data to be interacted with based on the identification of the data to be interacted with; in response to the sensitivity level being greater than a predetermined threshold, sending an early warning message to the target object; wherein the target object has operation authority for the sensitive data.

[0011] According to an embodiment of the present disclosure, the above method further includes: in response to receiving a data protection instruction for the to-be-interacted data from the target object, cutting off data communication with the target terminal.

[0012] According to an embodiment of the present disclosure, the above method further includes: in response to receiving a data protection instruction for the data to be interacted from the target object, deleting sensitive data corresponding to the identifier of the data to be interacted.

[0013] The second aspect of the present disclosure provides a data transmission device, including: an acquisition module, used to acquire data to be transmitted; an identification module, used to determine the encryption authority level for the data to be transmitted by identifying the sensitivity level of the data to be transmitted; a first transmission module, used to encrypt the data to be transmitted by calling a first encryption algorithm corresponding to the encryption authority level, and then transmit the encrypted data to be transmitted and an identification of the data to be transmitted to a first cloud; a generation module, used to encrypt predetermined data by calling a second encryption algorithm corresponding to the encryption authority level, and generate first induced data; and a second transmission module, used to transmit the first induced data and the identification of the data to be transmitted to a second cloud.

[0014] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0015] The fourth aspect of the present disclosure further provides a computer-readable storage medium on which a computer program or instruction is stored, and the steps of the above method are implemented when the above computer program or instruction is executed by a processor.

[0016] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.

[0017] According to the embodiments of the present disclosure, the corresponding level of encryption is performed according to the sensitivity level of the data to be transmitted, and the encrypted data to be transmitted is transmitted to the first cloud, so as to realize the hierarchical encryption protection of data information, ensure the security of data transmission, and enable the owner to restore sensitive data information in time after uploading to the first cloud. At the same time, for the data to be transmitted, the induced data is generated after being encrypted using the predetermined data, and transmitted to different second clouds. By generating the induced data in a targeted manner and uploading the two to different clouds for storage, the security of data transmission and storage is improved, and the possibility of sensitive data leakage during information exchange is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0019] Figure 1 The application scenario diagram of the data transmission method according to the embodiment of the present disclosure is schematically shown;

[0020] Figure 2 A flowchart of a data transmission method according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 3A Schematically shows an example flow chart of processing predetermined data when inducing data of an error type according to an embodiment of the present disclosure;

[0022] Figure 3B Schematically shows an example flow chart of processing predetermined data when inducing data of a missing type according to an embodiment of the present disclosure;

[0023] Figure 3C Schematically shows an example flow chart of processing predetermined data when random type induced data according to an embodiment of the present disclosure;

[0024] Figure 4 The structure of the data transmission device according to the embodiment of the present disclosure is schematically shown;

[0025] Figure 5 A block diagram of an electronic device according to a data transmission method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0026] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0027] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0028] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0029] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0030] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0031] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0032] Data transmission is to transmit data from the data source to the data terminal through one or more data links in accordance with certain procedures, so as to realize the transmission and exchange of information between points. The real-time and reliability of data transmission are important indicators for evaluating data transmission methods. Data encryption refers to the conversion of plain text into cipher text through encryption algorithms and encryption keys, while data decryption refers to the restoration of cipher text to plain text through decryption algorithms and decryption keys. Data encryption is still the most reliable way for computer systems to protect information. By encrypting information through cryptographic technology, information hiding is achieved, thereby playing a role in protecting information security.

[0033] In the process of implementing the inventive concept of the present disclosure, the inventors found that when data is transmitted between different terminals, although an encryption algorithm is used, sensitive data can still be obtained by decoding the encrypted data, which poses a data security risk.

[0034] In view of this, the embodiment of the present disclosure provides a data transmission method, which performs corresponding level encryption according to the sensitivity level of the data to be transmitted, and transmits the encrypted data to be transmitted to the first cloud, so as to realize the hierarchical encryption protection of data information, ensure the security of data transmission, and enable the owner to restore sensitive data information in time after uploading to the first cloud. At the same time, for the data to be transmitted, the induced data is generated after being encrypted using the predetermined data, and transmitted to different second clouds. By generating the induced data in a targeted manner and uploading the two to different clouds for storage, the security of data transmission and storage is improved, and the possibility of sensitive data leakage during information interaction is reduced.

[0035] Figure 1 The application scenario diagram of the data transmission method according to an embodiment of the present disclosure is schematically shown.

[0036] like Figure 1As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0037] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples). In addition, the user can transmit data to an external storage device through the first terminal device 101, the second terminal device 102, and the third terminal device 103.

[0038] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0039] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0040] It should be noted that the data transmission method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the data transmission device provided in the embodiment of the present disclosure can generally be set in the server 105. The data transmission method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the data transmission device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0041] It should be understood that Figure 1The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0042] The following will be based on Figure 1 The described scenario describes the data transmission method of the disclosed embodiment in detail.

[0043] Figure 2 The flowchart of the data transmission method according to the embodiment of the present disclosure is schematically shown.

[0044] like Figure 2 As shown, the data transmission method of this embodiment includes operations S210 to S250.

[0045] In operation S210, data to be transmitted is obtained.

[0046] In operation S220, an encryption permission level for the data to be transmitted is determined by identifying a sensitivity level of the data to be transmitted.

[0047] In operation S230, after encrypting the data to be transmitted by calling a first encryption algorithm corresponding to the encryption authority level, the encrypted data to be transmitted and an identifier of the data to be transmitted are transmitted to the first cloud.

[0048] In operation S240, the predetermined data is encrypted by calling a second encryption algorithm corresponding to the encryption authority level to generate first inducement data.

[0049] In operation S250, the first induction data and the identifier of the data to be transmitted are transmitted to the second cloud.

[0050] According to the embodiments of the present disclosure, the data to be transmitted includes sensitive data and non-sensitive data, and the non-sensitive data is readable characterization information. The sensitivity level of the data to be transmitted includes level 1 sensitive data, level 2 sensitive data, level 3 sensitive data, level 4 sensitive data, etc. The sensitivity level is used to characterize the importance of the data to be transmitted. For example, level 1 sensitive data means that the data is very important and will cause unpredictable risks once leaked; level 4 sensitive data means that the data contains sensitive information and will cause minor impact after leaking.

[0051] By identifying the sensitivity level of the data to be transmitted, the encryption authority level for the data to be transmitted is determined, including a one-to-one correspondence between the sensitivity level of the data to be transmitted and the encryption authority level, for example, level 1 sensitive data has level 1 encryption authority, and level 2 sensitive data has level 2 encryption authority.

[0052] Determining the encryption authority level for the data to be transmitted by identifying the sensitivity level of the data to be transmitted also includes determining the encryption authority level according to the weight coefficient of the sensitivity level of the data to be transmitted. For example, the weight coefficient of level 1 sensitive data is 0.8, the weight coefficient of level 2 sensitive data is 0.6, the weight coefficient of level 3 sensitive data is 0.4, and the weight coefficient of level 4 sensitive data is 0.2. If the data to be transmitted contains level 2 sensitive data and level 4 sensitive data, then the encryption authority coefficient is 0.6+0.2=0.8, which is in line with the level 2 encryption authority coefficient range of 0.6~1.0.

[0053] According to an embodiment of the present disclosure, the first encryption algorithm is used for encryption processing of sensitive data, including one or more encryption algorithms corresponding to the encryption authority level. For example, the first encryption algorithm includes one or more methods of Transact-SQL function, asymmetric key, symmetric key, certificate, and transparent data encryption. Users can update the first encryption algorithm in real time as needed.

[0054] The identifier of the data to be transmitted can be used as the ID identity information of the data, so that the transmitted data can be quickly identified and obtained.

[0055] The first cloud is used to store sensitive data of different levels. Users can update sensitive data in a timely manner and upload it to the first cloud as needed to update the stored sensitive data.

[0056] According to an embodiment of the present disclosure, predetermined data is used to generate induced data, including data generated by random permutations and combinations from a database, data generated by random replacement or deletion of data in a database, and non-sensitive data.

[0057] The second encryption algorithm is used for encryption processing of predetermined data, including one or more encryption algorithms corresponding to the encryption authority level. The user can update the second encryption algorithm in real time as needed, which is not limited here.

[0058] The first induction data is generated when the data to be transmitted is transmitted. Based on the level of the data to be transmitted and corresponding to different encryption permissions, the first induction data has different types.

[0059] The second cloud is used to store different levels of induced data. Correspondingly, users can update the induced data in time and upload it to the second cloud as needed to update the stored induced data. The first induced data and the identifier of the data to be transmitted are transmitted to the second cloud, which can be used as induced information to mislead abnormal data transmission behavior and prolong the data deciphering time when the abnormal device transmits data.

[0060] According to the embodiments of the present disclosure, the corresponding level of encryption is performed according to the sensitivity level of the data to be transmitted, and the encrypted data to be transmitted is transmitted to the first cloud, so as to realize the hierarchical encryption protection of data information, ensure the security of data transmission, and enable the owner to restore sensitive data information in time after uploading to the first cloud. At the same time, for the data to be transmitted, the induced data is generated after being encrypted using the predetermined data, and transmitted to different second clouds. By generating the induced data in a targeted manner and uploading the two to different clouds for storage, the security of data transmission and storage is improved, and the possibility of sensitive data leakage during information exchange is reduced.

[0061] According to an embodiment of the present disclosure, after encrypting the predetermined data by calling a second encryption algorithm corresponding to the encryption authority level, generating the first induced data includes: determining the type of induced data according to the encryption authority level; processing the predetermined data according to the induced data type to generate data to be encrypted; and encrypting the data to be encrypted by calling the second encryption algorithm to generate the first induced data.

[0062] Different encryption permissions can generate different levels of induced data. For example, the induced data includes level one induced data, level two induced data, level three induced data and level four induced data, etc. The type of induced data can be determined according to the different levels of induced data.

[0063] The types of induced data include non-sensitive data, erroneous data, missing data and randomly generated data. Different types of induced data have different processing methods to generate data to be encrypted.

[0064] Different levels of inducement data have different types of inducement data. For example, the first-level inducement data can be formed by combining multiple types of inducement data such as wrong data, missing data and randomly generated data, and the fourth-level inducement data can be formed by randomly generated inducement data. The first-level inducement data includes data generated in multiple ways, and the fourth-level inducement data only includes data generated in a single way. Therefore, the higher the level, the higher the security of the generated inducement data, and the less likely it is to be cracked.

[0065] According to the embodiments of the present disclosure, the type of induced data is determined according to the encryption authority level, and the predetermined data is processed according to the type of induced data to generate data to be encrypted. After the encrypted data is encrypted by the encryption algorithm, the induced data is generated, which prolongs the time for the induced data to be deciphered and reduces the possibility of the encrypted sensitive data being discovered.

[0066] According to an embodiment of the present disclosure, predetermined data are processed according to the induced data type to generate data to be encrypted, including: in response to the induced data type being an error type, randomly changing at least two data in the predetermined data to generate data to be encrypted; in response to the induced data type being a missing type, randomly deleting at least two data in the predetermined data to generate data to be encrypted; in response to the induced data type being a random type, adding any number of random data to at least two random positions in the predetermined data to generate data to be encrypted.

[0067] Figure 3A An example flow chart of processing predetermined data when inducing data of an error type according to an embodiment of the present disclosure is schematically shown.

[0068] According to an embodiment of the present disclosure, when the induced data is determined to be an error type, at least two data in the predetermined data are randomly changed. Figure 3A As shown, 300A includes predetermined data "ab11200h" 311, random numbers "x and y" 312, and data to be encrypted "ax1120yh" 313. Based on the encryption authority level, the predetermined data "ab11200h" 311 is generated from the database, and after the change position is determined, the data 311A ​​with the change position mark is obtained. According to the random number "x and y" 312 randomly generated by the database, the data is changed at the marked change position, and finally the data to be encrypted "ax1120yh" 313 is generated.

[0069] Figure 3B An example flowchart of processing predetermined data when inducing data of a missing type according to an embodiment of the present disclosure is schematically shown.

[0070] When the induced data is determined to be a missing type, at least two data in the predetermined data are deleted. Figure 3B As shown, 300B includes predetermined data "ab11200h" 311 and data to be encrypted "a1120h" 314. Based on the encryption authority level, the predetermined data "ab11200h" 311 is generated from the database, and after the deletion position is determined, the data 311B with the deletion position mark is obtained, and the data is deleted at the marked deletion position, and finally the data to be encrypted "a1120h" 314 is generated.

[0071] Figure 3C An example flow chart of processing predetermined data when random type induced data according to an embodiment of the present disclosure is schematically shown.

[0072] When the induced data is determined to be of a random type, modifying any amount of data at at least two random positions in the predetermined data includes randomly adding, deleting or changing any amount of data. Figure 3CAs shown, 300C includes predetermined data "ab11200h" 311, random numbers "m and n" 315 and data to be encrypted "man1120mhn" 316. Based on the encryption authority level, the predetermined data "ab11200h" 311 is generated from the database, and after the modification position is determined, the data 311C with the modification position mark is obtained. According to the random number "m and n" 315 randomly generated by the database, the data is added and replaced at the marked modification position, and finally the data to be encrypted "man1120mhn" 316 is generated.

[0073] In some embodiments, comprehensive types of induced data can also be generated according to the encryption permission level, and the length of the generated induced data can be the same as the length of the corresponding sensitive data to further increase the difficulty of cracking and improve the security of data transmission.

[0074] According to the embodiments of the present disclosure, based on the types of induced data, including error type, missing type and random type, etc., data processing corresponding to the induced data type is performed on the predetermined data to generate multiple types of data to be encrypted, thereby obtaining multiple induced data. The above method provides multiple ways of generating induced data, increases the difficulty of deciphering the induced data, and reduces the possibility of sensitive data being discovered.

[0075] According to an embodiment of the present disclosure, the above method further includes deleting an operation record of performing data transmission to the first cloud in response to receiving information indicating successful data transmission from the first cloud.

[0076] The operation record of data transmission to the first cloud includes information such as the time of data transmission, an identifier of the transmitted data, and a content summary of the transmitted data.

[0077] Deleting the operation record of data transmission to the first cloud includes automatically deleting the operation record of data transmission immediately after receiving the information of successful data transmission from the first cloud, and also includes regularly deleting the operation record of data transmission.

[0078] According to the embodiments of the present disclosure, after the first cloud data transmission is successful, the cloud backup operation record is cleared in time to reduce the possibility of sensitive data being discovered, thereby effectively reducing the risk of data theft from the cloud.

[0079] According to an embodiment of the present disclosure, the above method also includes obtaining an identification of the target terminal and an identification of the data to be interacted in response to receiving a data interaction request from the target terminal; when it is determined that the identification of the target terminal is abnormal and the data to be interacted is sensitive data, obtaining second induced data corresponding to the identification of the data to be interacted from the second cloud, wherein the second induced data is generated by encrypting predetermined data using an encryption data algorithm corresponding to the sensitivity level of the data to be interacted; and sending the second induced data to the target terminal.

[0080] According to an embodiment of the present disclosure, the target terminal includes an external storage device, such as a mobile hard disk, a USB, an optical disk, etc. Each independent external storage device has a unique target terminal identifier, that is, the target terminal identifier can be used as identity information characterizing the external storage device.

[0081] According to an embodiment of the present disclosure, determining whether the identification of the target terminal is abnormal can be done by judging whether the identification of the target terminal is in a list of abnormal target terminals. If the target terminal is in the list, it is an abnormal target terminal. Determining whether the identification of the target terminal is abnormal can also be done by judging whether the identification of the target terminal is in a list of target terminals owned by the target object. If the target terminal is not in the list, it is an abnormal target terminal.

[0082] When it is determined that the target terminal identification is normal, the encrypted sensitive data corresponding to the identification of the data to be interacted is obtained. For example, the external storage connected to the mobile terminal of the computer is identified and detected. When the owner connects the external storage used by the owner to the mobile data port of the computer for the first time, the security key and transmission channel are identified and established to obtain the encrypted sensitive data corresponding to the identification of the data to be interacted.

[0083] When it is determined that the target terminal identification is abnormal and the data to be interacted with is sensitive data, the second inducement data is sent to the target terminal. For example, when an abnormal external storage device that is not used by itself is accessed and sensitive data is transmitted, the ID is recorded and identified. After determining that the target terminal identification is abnormal, the encrypted inducement data on the mobile data end is displayed for data transmission. At the same time, the built-in security connection of the mobile end is started for sending early warning information.

[0084] According to an embodiment of the present disclosure, when a data interaction request is received from a target terminal, it is determined whether the target terminal is abnormal based on the identifier of the target terminal, and it is determined whether the data to be interacted is sensitive data based on the identifier information of the data to be interacted. When the identifier of the target terminal is abnormal and the data to be interacted is sensitive data, second induction data corresponding to the identifier of the data to be interacted obtained from the second cloud is sent to the target terminal to induce the abnormal target terminal so that it cannot obtain the real sensitive data in a short time, which provides operation time for destroying the sensitive data and reduces the probability of the abnormal target terminal reading the real data.

[0085] According to an embodiment of the present disclosure, the above method also includes determining the sensitivity level of the data to be interacted with based on the identification of the data to be interacted with; in response to the sensitivity level being greater than a predetermined threshold, sending an early warning message to the target object; wherein the target object has operation authority for the sensitive data.

[0086] According to an embodiment of the present disclosure, the predetermined threshold of the sensitivity level can be determined according to actual application conditions, and can be a level number, such as the predetermined threshold is level two, or a sensitivity level coefficient, such as the predetermined threshold is 0.5.

[0087] The warning information includes the data of the abnormal target terminal, the operation steps of the target terminal and the operation time of the target terminal. For example, the warning information is "Warning! The abnormal target terminal with address x is performing data transmission of highly sensitive data A at time t!". The warning information can be sent to the remote client of the target object to prompt the target object's mobile terminal data to be invaded.

[0088] The target object's operating permissions for sensitive data include remote operation to select forced destruction of mobile terminal data, remote operation to cut off the path of the mobile terminal data signal transmission module, remote operation to cut off the mobile terminal main power supply module, remote operation to start the backup power supply, remote operation to execute formatting instructions, etc., to promptly handle the abnormal transmission of sensitive data.

[0089] According to the embodiments of the present disclosure, the sensitivity level of the data to be interacted is determined according to the identification of the data to be interacted, and when the sensitivity level is greater than a predetermined threshold, an early warning message is sent to the target object to prompt the data owner that abnormal interaction of sensitive data has occurred. Therefore, when highly sensitive data is requested to be interacted, the target object can receive the early warning signal in time, and then promptly handle the data interaction process with risks, thereby ensuring the security of sensitive data.

[0090] According to an embodiment of the present disclosure, the above method further includes: in response to receiving a data protection instruction for the to-be-interacted data from the target object, cutting off data communication with the target terminal.

[0091] When an abnormal target terminal interacts with highly sensitive data, data communication with the target terminal is cut off, including forced destruction of mobile terminal data, cutting off the path of the mobile terminal data signal transmission module, cutting off the mobile terminal main power supply module, and starting the backup power supply, and energizing the electromagnets around the internal memory. Among them, the electromagnetic effect generated by energizing the electromagnets around the internal memory can forcibly damage the data in the mobile terminal memory, making it impossible to restore it. Even if criminals steal the owner's mobile terminal, they cannot restore the sensitive data information. The owner restores the data from the cloud and eliminates the data information on the cloud, further reducing the risk of accidental data transmission.

[0092] According to an embodiment of the present disclosure, upon receiving a data protection instruction from a target object for data to be interacted with, data communication with the target terminal can be cut off in a variety of ways, making data transmission impossible, thereby effectively reducing the risk of data leakage.

[0093] According to an embodiment of the present disclosure, the above method further includes: in response to receiving a data protection instruction for the data to be interacted from the target object, deleting sensitive data corresponding to the identifier of the data to be interacted.

[0094] According to an embodiment of the present disclosure, deleting the sensitive data corresponding to the identifier of the data to be interacted with includes performing a self-formatting operation to delete the sensitive data.

[0095] According to an embodiment of the present disclosure, after receiving a data protection instruction from a target object for data to be interacted with, the sensitive data that the abnormal target terminal wants to read is deleted, thereby effectively reducing the risk of data leakage.

[0096] Based on the above data transmission method, the present disclosure also provides a data transmission device. Figure 4 The device is described in detail.

[0097] Figure 4 The structural block diagram of the data transmission device according to an embodiment of the present disclosure is schematically shown.

[0098] like Figure 4 As shown, the data transmission device 400 of this embodiment includes an acquisition module 410 , an identification module 420 , a first transmission module 430 , a generation module 440 and a second transmission module 450 .

[0099] The acquisition module is used to acquire the data to be transmitted. In one embodiment, the acquisition module 410 can be used to perform the operation S210 described above, which will not be described in detail here.

[0100] The identification module is used to determine the encryption permission level for the data to be transmitted by identifying the sensitivity level of the data to be transmitted. In one embodiment, the identification module 420 can be used to perform the operation S220 described above, which will not be described in detail here.

[0101] The first transmission module is used to encrypt the data to be transmitted by calling the first encryption algorithm corresponding to the encryption permission level, and then transmit the encrypted data to be transmitted and the identifier of the data to be transmitted to the first cloud. In one embodiment, the first transmission module 430 can be used to perform the operation S230 described above, which will not be repeated here.

[0102] The generating module is used to generate the first induced data after encrypting the predetermined data by calling the second encryption algorithm corresponding to the encryption authority level. In one embodiment, the generating module 440 can be used to perform the operation S240 described above, which will not be described in detail here.

[0103] The second transmission module is used to transmit the first induction data and the identifier of the data to be transmitted to the second cloud. In one embodiment, the second transmission module 450 can be used to perform the operation S250 described above, which will not be repeated here.

[0104] According to an embodiment of the present disclosure, the generation module includes a first determination submodule, a predetermined data processing submodule and a data encryption submodule. The first determination submodule is used to determine the induced data type according to the encryption authority level. The predetermined data processing submodule is used to process the predetermined data according to the induced data type to generate the data to be encrypted. The data encryption submodule is used to encrypt the data to be encrypted by calling the second encryption algorithm to generate the first induced data.

[0105] According to an embodiment of the present disclosure, the predetermined data processing submodule includes a change subunit, a deletion subunit and a modification subunit. The change subunit is used to randomly change at least two data in the predetermined data in response to the induced data type being an error type to generate data to be encrypted. The deletion subunit is used to randomly delete at least two data in the predetermined data in response to the induced data type being a missing type to generate data to be encrypted. The modification subunit is used to modify any number of random data at at least two random positions in the predetermined data in response to the induced data type being a random type to generate data to be encrypted.

[0106] According to an embodiment of the present disclosure, the above-mentioned device also includes: an operation record deletion module, which is used to delete the operation record of data transmission to the first cloud in response to receiving information on successful data transmission from the first cloud.

[0107] According to an embodiment of the present disclosure, the above-mentioned device also includes: an identification acquisition module, a second induced data acquisition module and a second induced data sending module. The identification acquisition module is used to obtain the identification of the target terminal and the identification of the data to be interacted in response to receiving a data interaction request from the target terminal. The second induced data acquisition module is used to obtain the second induced data corresponding to the identification of the data to be interacted from the second cloud when it is determined that the identification of the target terminal is abnormal and the data to be interacted is sensitive data; wherein the second induced data is generated by encrypting predetermined data using an encryption data algorithm corresponding to the sensitivity level of the data to be interacted. The second induced data sending module is used to send the second induced data to the target terminal.

[0108] According to an embodiment of the present disclosure, the above-mentioned device further includes: a sensitivity level determination module and an early warning information sending module. The sensitivity level determination module is used to determine the sensitivity level of the data to be interacted with according to the identifier of the data to be interacted with. The early warning information sending module is used to send an early warning message to a target object in response to the sensitivity level being greater than a predetermined threshold; wherein the target object has the operation authority for sensitive data.

[0109] According to an embodiment of the present disclosure, the above-mentioned device also includes: a sensitive data deletion module, which is used to delete the sensitive data corresponding to the identifier of the data to be interacted in response to receiving a data protection instruction for the data to be interacted from the target object.

[0110] According to an embodiment of the present disclosure, any multiple modules among the acquisition module 410, the identification module 420, the first transmission module 430, the generation module 440, and the second transmission module 450 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 410, the identification module 420, the first transmission module 430, the generation module 440, and the second transmission module 450 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, at least one of the acquisition module 410 , the identification module 420 , the first transmission module 430 , the generation module 440 , and the second transmission module 450 may be at least partially implemented as a computer program module, which may perform corresponding functions when executed.

[0111] Figure 5 A block diagram of an electronic device according to a data transmission method according to an embodiment of the present disclosure is schematically shown.

[0112] like Figure 5 As shown, the electronic device 500 according to an embodiment of the present disclosure includes a processor 501, which can perform various appropriate actions and processes according to the program stored in the ROM 502 or the program loaded from the storage part 508 to the RAM 503. The processor 501 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include an onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0113] In RAM 503, various programs and data required for the operation of electronic device 500 are stored. Processor 501, ROM 502 and RAM 503 are connected to each other via bus 504. Processor 501 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 502 and / or RAM 503. It should be noted that the program can also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0114] According to an embodiment of the present disclosure, the electronic device 500 may further include an I / O interface 505, which is also connected to the bus 504. The electronic device 500 may further include one or more of the following components connected to the I / O interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage portion 508 as needed.

[0115] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0116] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM502 and / or RAM503 described above and / or one or more memories other than ROM502 and RAM503.

[0117] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the data transmission method provided by the embodiment of the present disclosure.

[0118] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 501. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0119] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 509, and / or installed from the removable medium 511. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0120] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the processor 501, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0121] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0122] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0123] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0124] The embodiments of the present disclosure are described above. However, these embodiments are only for the purpose of illustration and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A data transmission method, characterized in that: The method comprises: Get the data to be transmitted; Determining an encryption permission level for the data to be transmitted by identifying a sensitivity level of the data to be transmitted; After encrypting the data to be transmitted by calling a first encryption algorithm corresponding to the encryption authority level, transmitting the encrypted data to be transmitted and an identifier of the data to be transmitted to the first cloud; After encrypting the predetermined data by calling a second encryption algorithm corresponding to the encryption authority level, generating first inducement data; and The first induction data and the identifier of the data to be transmitted are transmitted to the second cloud.

2. The method according to claim 1, characterized in that After encrypting the predetermined data by calling the second encryption algorithm corresponding to the encryption authority level, generating the first induced data includes: Determining the type of induced data according to the encryption authority level; According to the induced data type, the predetermined data is processed to generate data to be encrypted; The first induced data is generated by calling the second encryption algorithm to encrypt the data to be encrypted.

3. The method according to claim 2, characterized in that The processing of the predetermined data according to the induced data type to generate data to be encrypted includes: In response to the induced data type being an error type, randomly changing at least two data in the predetermined data to generate the data to be encrypted; In response to the induced data type being a missing type, randomly deleting at least two data in the predetermined data to generate the data to be encrypted; and In response to the induced data type being a random type, an arbitrary amount of random data is modified at at least two random positions in the predetermined data to generate the data to be encrypted.

4. The method according to claim 1, characterized in that: The method further comprises: In response to receiving the information that the data transmission is successful from the first cloud, the operation record of the data transmission to the first cloud is deleted.

5. The method according to claim 1, characterized in that The method further comprises: In response to receiving a data interaction request from a target terminal, obtaining an identifier of the target terminal and an identifier of the data to be interacted with; When it is determined that the identification of the target terminal is abnormal and the data to be interacted is sensitive data, obtaining second induction data corresponding to the identification of the data to be interacted from the second cloud; wherein the second induction data is generated by encrypting predetermined data using an encryption data algorithm corresponding to the sensitivity level of the data to be interacted; and The second induction data is sent to the target terminal.

6. The method according to claim 5, characterized in that The method further comprises: Determining a sensitivity level of the data to be interacted with according to an identifier of the data to be interacted with; In response to the sensitivity level being greater than a predetermined threshold, sending a warning message to a target object; wherein the target object has operation authority for the sensitive data.

7. The method according to claim 6, characterized in that The method further comprises: In response to receiving a data protection instruction from a target object for the data to be interacted with, data communication with the target terminal is cut off.

8. The method according to claim 6, characterized in that The method further includes: in response to receiving a data protection instruction for the data to be interacted from the target object, deleting sensitive data corresponding to the identifier of the data to be interacted.

9. A data transmission device, characterized in that: The device comprises: Acquisition module, acquires data to be transmitted; An identification module, configured to determine an encryption permission level for the data to be transmitted by identifying a sensitivity level of the data to be transmitted; A first transmission module, configured to encrypt the data to be transmitted by calling a first encryption algorithm corresponding to the encryption authority level, and then transmit the encrypted data to be transmitted and an identifier of the data to be transmitted to a first cloud; a generating module, configured to generate first induced data after encrypting predetermined data by calling a second encryption algorithm corresponding to the encryption authority level; and The second transmission module is used to transmit the first induced data and the identifier of the data to be transmitted to the second cloud.

10. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images