Data reporting full-link encryption system, method and device

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to a data reporting full-link encryption system, method and device. According to the invention, a link process of ciphertext transmission is adopted, and high security of data transmission is realized. In the whole data circulation process, all data are transmitted in a ciphertext form, so that the sensitive data are effectively prevented from being leaked in the transmission process. Therefore, the ciphertext data and the secret key are not stored in the same area, and the risk of data cracking caused by secret key leakage is fundamentally reduced. The secret key and the data are stored separately, so that the safety protection capability of the whole system is improved. Each piece of sensitive data is independently provided with a unique secret key, so that the safety of other data is not influenced even if a certain secret key is leaked. By means of the design, each piece of data has an independent protection mechanism in the encryption process, and the flexibility and safety of data management are enhanced.

Description

Technical Field

[0001] The present invention belongs to the field of information technology, and specifically relates to a data reporting full-link encryption system, method and device. Background Art

[0002] In the data transmission link, sensitive data is transmitted in plain text without effective encryption protection. Attackers can easily intercept transmission requests through man-in-the-middle attacks and directly obtain sensitive data, resulting in a high risk of data leakage.

[0003] During data processing and development, developers with broad permissions can not only obtain sensitive data, but also directly access encryption keys. This excessive permission management can easily lead to internal data leakage, especially in the case of abuse of permissions or uncontrolled employee behavior, the risk of internal leakage is more serious and difficult to prevent.

[0004] In related technologies, the system uses a unified key pair to encrypt data. Once the key is leaked, all encrypted sensitive data will face great security threats. This single-point failure security model is very easy to become a target for attackers, and the leakage of the key will directly lead to the security collapse of the entire system.

[0005] In addition, in the current system, keys and encrypted data are stored in the same secure area. This design poses serious security risks. Once the storage area is breached, attackers can obtain both encrypted data and keys, leading to the complete leakage of sensitive data, with extremely serious consequences. Summary of the invention

[0006] In order to overcome the problems existing in the related art, a data reporting full-link encryption system, method and device are provided.

[0007] According to one aspect of an embodiment of the present disclosure, a data reporting full-link encryption system is provided, the system comprising: the system comprising: multiple subordinate unit information systems and a group ERP system, each subordinate unit information system is configured with a unified gateway, an encryption center and multiple applications; the encryption center configures an encryption and decryption model and is used to generate storage keys, the encryption center and all applications are registered and managed through the unified gateway, and each application needs to be authenticated by the unified gateway before the unified gateway calls the corresponding function of the encryption center;

[0008] For each application in each subordinate unit's information system, when the application needs to transmit data to other applications in the same subordinate unit's information system, the application requests the encryption center to generate a key with the unique identifier of each target data to be transmitted. The encryption center allocates and issues a unique key for the target data, and stores the mapping relationship between the unique identifier of the target data and the allocated key; the application uses the obtained key and calls the encryption function of the encryption center to encrypt the target data to form a ciphertext, and transmits the ciphertext to other applications; after receiving the ciphertext, other applications request the key center to obtain the corresponding key with the unique identifier of the target data, use the key to decrypt the ciphertext to obtain the plaintext data, and perform corresponding processing; after the encryption center allocates a key to the target data, any application in the subordinate unit's information system requests the key center to obtain the stored key through the unique identifier of the target data when performing encryption and decryption operations on the target data;

[0009] For each application in the information system of each subordinate unit, when the application needs to transmit data to the group ERP system, the application obtains the public key of the group ERP system from the encryption center, uses an asymmetric algorithm to encrypt the data to be transmitted to form ciphertext, and synchronizes the ciphertext to the group ERP system. The group ERP system uses the private key to decrypt the received ciphertext to obtain plaintext data and perform corresponding processing.

[0010] In one possible implementation, for each application in each subordinate unit's information system, after the application processes the received decrypted plaintext to obtain a processing result, when it needs to send the processing result to other applications in the same subordinate unit's information system, if it is determined that the processing result is different from the decrypted plaintext before processing, the application will re-request the key from the encryption center with the unique identifier of the processing result. The encryption center will allocate and issue a unique key for the processing result, and store the mapping relationship between the unique identifier of the processing result and the corresponding key. The application obtains the key and calls the encryption function of the encryption center to encrypt the processing result to form a ciphertext, and transmits the ciphertext to other applications.

[0011] In a possible implementation, the encryption center can batch process key generation requests sent by different applications, and distribute and send a unique key corresponding to the target data to the corresponding application in response to each key generation request;

[0012] The encryption center can also batch process requests for obtaining keys with unique identifiers sent by different applications, and return the key associated with the unique identifier in the request to the corresponding application in response to each request for obtaining the key.

[0013] In one possible implementation, the group ERP system is also configured with a front-end database and a big data platform;

[0014] The front-end database is used to store the ciphertext reported by the information systems of subordinate units, and uses a unified data integration tool to synchronize the ciphertext obtained and stored within a preset period to the big data platform;

[0015] The big data platform uses the private key of the group's ERP system to decrypt the received ciphertext to obtain plaintext data, and then calculates and processes the plaintext data to form business data in a unified and standardized format for encrypted storage.

[0016] In a possible implementation, the big data platform also includes multiple isolated storage spaces, each of which is used to encrypt and store the business data of a subordinate unit information system or the business data of the group EPR system.

[0017] In one possible implementation, the application of the subordinate unit information system includes: business operation platform, data middle platform and data reporting platform;

[0018] Business operation platform, used to execute business processes and operations of subordinate units’ information systems;

[0019] The data center is a big data processing platform for subordinate units’ information systems, which is used to integrate and process the business data of the business operation platform to form summary data;

[0020] The data reporting platform is used to review and approve the reporting process, fill in data and manage the authority granted to the data summarized by the data center, and report the business data approved by the reporting process to the group ERP system.

[0021] According to another aspect of an embodiment of the present disclosure, a data reporting full-link encryption method is provided. The method is implemented based on the subordinate unit information system mentioned above. For each application of the subordinate unit information system, the method includes:

[0022] Step 101, when the application needs to transmit data to other applications in the same subordinate unit information system, the encryption center is requested to generate a key with the unique identifier of each target data. The encryption center allocates and issues a unique key to the target data and stores the mapping relationship between the unique identifier of the target data and the corresponding key;

[0023] Step 102: The application uses the acquired key and calls the encryption function of the encryption center to encrypt the target data to form ciphertext, and transmits the ciphertext to other applications; after receiving the ciphertext, the other applications request the key center to obtain the corresponding key with the unique identifier of the target data, use the key to decrypt the ciphertext to obtain the plaintext data and perform corresponding processing; after the encryption center assigns the key to the target data, any application in the subordinate unit's information system requests the key center to obtain the stored key with the unique identifier of the target data when performing encryption and decryption operations on the target data;

[0024] Step 103, when the application needs to transmit data to the group ERP system, obtain the public key of the group ERP system from the encryption center, use an asymmetric algorithm to encrypt the data to be transmitted to form a ciphertext, and synchronize the ciphertext to the group ERP system.

[0025] In a possible implementation, the method further includes:

[0026] Step 104, for each application in each subordinate unit information system, after the application processes the received decrypted plaintext to obtain a processing result, when it needs to send the processing result to other applications in the same subordinate unit information system, if it is determined that the processing result is different from the decrypted plaintext before processing, the application will re-request the key from the encryption center with the unique identifier of the processing result. The encryption center will allocate and issue a unique key for the processing result, and store the mapping relationship between the unique identifier of the processing result and the corresponding key. The application obtains the key and calls the encryption function of the encryption center to encrypt the processing result to form a ciphertext, and transmits the ciphertext to other applications.

[0027] In a possible implementation, the encryption center can batch process key generation requests sent by different applications, and distribute and send a unique key corresponding to the target data to the corresponding application in response to each key generation request;

[0028] The encryption center can also batch process requests for obtaining keys with unique identifiers sent by different applications, and return the key associated with the unique identifier in the request to the corresponding application in response to each request for obtaining the key.

[0029] In a possible implementation, the application of each subordinate unit information system includes: a business operation platform, a data middle platform and a data reporting platform, and the method further includes:

[0030] Step 105, the business operation platform executes the business processes and operations of the subordinate unit information system, and pushes the business data in encrypted form to the data center;

[0031] Step 106: The data center integrates and processes the business data of the business operation platform to form summary data, and pushes the summary data in encrypted form to the data reporting platform;

[0032] Step 107, the data reporting platform performs reporting process approval, data filling and authority granting management on the summary data pushed by the data center, and reports the summary data approved by the reporting process to the group ERP system in encrypted form.

[0033] According to another aspect of an embodiment of the present disclosure, a method for full-link encryption of data reporting is provided. The method is implemented based on the above-mentioned group ERP system, and the method includes:

[0034] Step 201, the group ERP system uses the private key to decrypt the received ciphertext to obtain the plaintext data and performs corresponding processing.

[0035] In a possible implementation, the group ERP system is also configured with a front-end database and a big data platform, and step 201 also includes

[0036] Step 211: The front-end database stores the ciphertext reported by the information systems of each subordinate unit, and uses a unified data integration tool to synchronize the ciphertext obtained and stored within a preset period to the big data platform;

[0037] In step 2012, the big data platform uses the private key of the group ERP system to decrypt the received ciphertext to obtain plaintext data, and then calculates and processes the plaintext data to form a unified standard format for storage.

[0038] In a possible implementation, the big data platform also includes multiple isolated storage spaces, each of which is used to encrypt and store the business data of a subordinate unit information system or the business data of the group EPR system.

[0039] According to another aspect of an embodiment of the present disclosure, a data reporting full-link encryption device is provided, the device comprising:

[0040] processor;

[0041] a memory for storing processor-executable instructions;

[0042] Wherein, the processor is configured to execute the above method.

[0043] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0044] The beneficial effect of the present disclosure is that in the data reporting full-link encryption system provided by the present disclosure, the data transmission links within the information systems of each subordinate unit and between the information systems of each subordinate unit and the group ERP system are all transmitted in ciphertext form, achieving high security of data transmission and effectively preventing the leakage of sensitive data during the transmission process.

[0045] Each subordinate unit information system is equipped with an encryption center for storing keys and encryption and decryption models, so that ciphertext data and keys are not stored in the same area, fundamentally reducing the risk of data being cracked due to the leakage of ciphertext and keys at the same time. By storing keys and data separately, the security protection capabilities of the overall system are improved. And the application account of each application can only access the decrypted plaintext, but cannot access the keys and encryption and decryption models corresponding to the ciphertext decryption process, thereby preventing the abuse of permissions and loss of control of behavior by developers with extensive permissions, thereby further ensuring the security of system data.

[0046] In addition, the system sets a unique key for each piece of sensitive data during the encrypted transmission process, ensuring that even if a key is leaked, it will not affect the security of other data. This design enables each piece of data to have an independent protection mechanism during the encryption process, enhancing the flexibility and security of data management. Encryption and decryption operations are performed through the key combined with the general encryption and decryption model of the encryption center service, ensuring the security of data in each circulation link. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a block diagram of a data reporting full-link encryption system shown in an embodiment of the present disclosure.

[0048] Figure 2 It is a partial block diagram of a data reporting full-link encryption system shown as an example in the present disclosure.

[0049] Figure 3 It is a block diagram of a data reporting full-link encryption device shown in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0050] The present disclosure is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0051] Unless otherwise defined, the technical and scientific terms used in the present disclosure have the same meanings as those generally understood by those skilled in the art to which the present disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "including" and any variations thereof in the present disclosure are intended to cover non-exclusive inclusions. Obviously, the embodiments described in the present disclosure are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative efforts are within the scope of protection of the present disclosure.

[0052] Reference to "embodiments" in this disclosure means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0053] Figure 1 is a block diagram of a data reporting full-link encryption system shown in an embodiment of the present disclosure, Figure 2 is a partial block diagram of a data reporting full-link encryption system shown in an example of the present disclosure, such as Figure 1 and Figure 2 As shown, the system includes: multiple subordinate unit information systems and a group ERP system. Each subordinate unit information system is configured with a unified gateway, an encryption center, and multiple applications, wherein the multiple applications may include SAP ECC, a data middle platform, and a data reporting platform. The group ERP system is configured with a front-end database.

[0054] All applications in each subordinate unit's information system (such as business application system, data center, data reporting platform) and the integrated interface of the encryption center are registered and managed through the unified gateway. Through this unified architecture, the interface calls of all applications in the subordinate unit's information system can pass through the authentication service of the unified gateway to ensure the consistency of interface integration between applications, and manage through unified security standards, further improving the security between systems and the reliability of data transmission.

[0055] The encryption center is a common encryption and decryption model module in the subordinate unit information system. The encryption center provides encryption and decryption services to the outside through interfaces. All applications that need encryption and decryption in the subordinate unit information system can call the encryption center interface to ensure the security of data in different links. The encryption center includes a key management module, which is used to uniformly assign a unique key to each target data to be encrypted to ensure high data security. The encryption center also includes an encryption and decryption model management module, which provides encryption and decryption SDK and related encryption and decryption Jar packages for integration and use of various application systems, so that encryption and decryption functions can be seamlessly integrated into various business processes.

[0056] For each application in each subordinate unit information system, when the application needs to transmit data to other applications in the same subordinate unit information system, the application requests the encryption center to generate a key with the unique identifier of each target data to be transmitted. The encryption center allocates and issues a unique key for the target data and stores the mapping relationship between the unique identifier of the target data and the allocated key; the application uses the obtained key and calls the encryption function of the encryption center to encrypt the target data to form a ciphertext, and transmits the ciphertext to other applications; after receiving the ciphertext, other applications request the key center to obtain the corresponding key with the unique identifier of the target data, use the key to decrypt the ciphertext to obtain the plaintext data and perform corresponding processing; after the target data is assigned a key by the encryption center, any application in the subordinate unit information system requests the key center to obtain the stored key through the unique identifier of the target data when performing encryption and decryption operations on the target data. During the encrypted transmission process, a unique key is set independently for each sensitive data to ensure that even if a key is leaked, it will not affect the security of other data.

[0057] For each application in each subordinate unit information system, after the application processes the received decrypted plaintext to obtain the processing result, when it needs to send the processing result to other applications in the same subordinate unit information system, if it is determined that the processing result is different from the decrypted plaintext before processing, the encryption center is used to re-request the key with the unique identifier of the processing result. The encryption center allocates and issues a unique key for the processing result, and stores the mapping relationship between the unique identifier of the processing result and the corresponding key. The application obtains the key and calls the encryption function of the encryption center to encrypt the processing result to form a ciphertext, and transmits the ciphertext to other applications. In this way, the present disclosure ensures that a unique key is configured for different newly generated data items during the encryption transmission and processing process, thereby ensuring that different sensitive data are independently set with a unique key, further ensuring the security of the data.

[0058] For each application in each subordinate unit information system, when the application needs to transmit data to the group ERP system, the application obtains the public key of the group ERP system from the encryption center, uses an asymmetric algorithm to encrypt the data to be transmitted to form a ciphertext, synchronizes the ciphertext to the group ERP system, and the group ERP system uses a private key to decrypt the received ciphertext to obtain the plaintext data and perform corresponding processing. In this way, the data transmission link within each subordinate unit information system and between each subordinate unit information system and the group ERP system adopts ciphertext transmission, achieving high security of data transmission and effectively preventing the leakage of sensitive data during the transmission process.

[0059] In a possible implementation, the encryption center can batch process key generation requests sent by different applications, and distribute the unique key corresponding to the target data to the corresponding application in response to each key generation request; the encryption center can also batch process key acquisition requests sent by different applications with unique identifiers, and return the key associated with the unique identifier in the request to the corresponding application in response to each key acquisition request. This enables parallel processing of the encryption and decryption processes of each application, significantly improving the efficiency of system encryption and decryption.

[0060] In one possible implementation, the group ERP system is also equipped with a front-end database and a big data platform; the front-end database is used to store the ciphertext reported by the information systems of each subordinate unit to ensure that the data is effectively protected before entering the big data platform (such as HUDI) of the group ERP system. The front-end database uses a unified data integration tool to synchronize the ciphertext stored within a preset period to the big data platform; the big data platform uses the private key of the group ERP system to decrypt the received ciphertext to obtain plaintext data, and then calculates and processes the plaintext data to form a unified standard format for encrypted storage of business data. For subsequent in-depth analysis and application. The big data platform also includes multiple isolated storage spaces, each of which is used to encrypt and store the business data of a subordinate unit information system or the business data of the group EPR system.

[0061] In one possible implementation, the application of the subordinate unit information system includes: business operation platform, data middle platform and data reporting platform. The business operation platform is used to execute the business process and operation of the subordinate unit information system; the data middle platform is the big data processing platform of the subordinate unit information system, which is used to integrate and process the business data of the business operation platform to form summary data; the data reporting platform is used to review and approve the reporting process, fill in data and grant permissions for the data summary data of the data middle platform, and report the business data approved by the reporting process to the group ERP system.

[0062] As an example of this embodiment, the business application system is the core business operation platform of the subordinate unit information system, which is used to execute key business processes and operations. A large amount of business-related sensitive data is stored in the business application system. Through seamless integration with the encryption center, the security of business data during storage and transmission is ensured.

[0063] The data center is a big data processing platform for subordinate units' information systems, which is used to integrate and process business data of business application systems. For example, the data center is used to build wide table models, process, process and calculate data, and aggregate data. The data center integrates data with business application systems and data reporting platforms to ensure that data is processed to form unified standard business data.

[0064] The data reporting platform is used to report the business data processed by the data center to the group ERP system. The data reporting platform covers the approval process for sensitive data, data reporting, authority management, and various functions of data reporting, ensuring the safe and compliant transmission of data from the information systems of various subordinate units to the group ERP system, while realizing the unified management of the data reporting process.

[0065] In an application example, each subordinate unit information system uses the following steps to encrypt and report data. When each application needs to call the encryption center interface, it must pass the unified gateway authentication, and then the unified gateway calls the encryption center interface and sends the relevant request to the encryption center, thereby ensuring the security of the calling behavior of each application and the encryption center. In addition, encryption supports batch processing requests to ensure that multiple keys can be transmitted at one time.

[0066] Step 1: When the user of the business application system needs to send data, the business application system calls the encryption center's key generation interface for the target data to be sent, and sends a request for obtaining a key to the encryption center, which carries the unique identifier of the target data.

[0067] Step 2: After receiving the request for obtaining the key from the business application system, the encryption center generates a unique key for the unique identifier carried in the request in response to the request and returns it to the business application system. The encryption center also stores the generated unique identifier and the corresponding key in the database so that other applications can call it when encrypting and decrypting the same target data.

[0068] Step three, after receiving the key corresponding to the target data, the business application system calls the encryption and decryption SDK Jar package provided by the encryption center, and uses the encryption function corresponding to the key (such as the SM4 symmetric encryption algorithm) to encrypt the target data to form a ciphertext.

[0069] Step 4: The business application system uses data integration tools to synchronize the generated ciphertext to the encryption space of the data center. The data is transmitted in ciphertext form, ensuring the security of the data during transmission.

[0070] Step 5: After receiving the ciphertext, the data center will authenticate the unified gateway and then call the encryption center's key acquisition interface to send a request to the encryption center for obtaining the key. The request carries the unique identifier of the target data.

[0071] Step six: In response to the request for obtaining the key sent by the data center, the encryption center returns the key associated with the unique identifier corresponding to the request to the data center.

[0072] Step seven: After the data center obtains the key corresponding to the received ciphertext, it passes the authentication by the unified gateway. The unified gateway then calls the encryption center's encryption and decryption model (such as the SM4 algorithm) to decrypt the corresponding ciphertext to form plaintext. The data center processes the plaintext according to the account instructions to form a processing result.

[0073] When the data center determines that the processing result is different from the plaintext before processing, it calls the encryption center's key generation interface again for the processing result, sends a request to the encryption center for obtaining the key, and the request carries the unique identifier corresponding to the processing result. It receives the key returned by the encryption center in response to the request, encrypts the processing result into ciphertext, and the encryption center associates the newly generated key with the unique identifier for storage. This design ensures that the decryption and calculation process in the running state is in plaintext, and the data always exists in ciphertext throughout the data development and transmission process, and developers cannot directly access the key.

[0074] Step 8: The data center synchronizes the generated ciphertext to the data reporting platform through the data integration tool. The data transmission process is still carried out in ciphertext form to ensure the security of the data during the transmission process.

[0075] Step nine, after receiving the ciphertext from the data center, the data reporting platform calls the encryption center's key acquisition interface and sends a request to the encryption center for obtaining the key. The request carries a unique identifier for the processing result.

[0076] Step 10: After receiving the request from the data reporting platform to obtain the key, the encryption center responds to the request and returns the key associated with the unique identification data to the data reporting platform.

[0077] Step 11: After obtaining the key corresponding to the received ciphertext, the data reporting platform uses the SDKJar package encapsulated by the encryption center to call the decryption algorithm to decrypt the ciphertext and obtain the decrypted processed data.

[0078] The data reporting platform disclosed in this disclosure sets strict permission management. Only authorized users can view the decrypted processing data, and the viewing permission needs to be verified through a text message verification code. The decrypted processing data displayed by the data reporting platform on the front end also uses the front-end and back-end encryption algorithms to prevent it from being intercepted in the transmission link.

[0079] Step 12: The data reporting platform uses the public key provided by the group ERP system and an asymmetric algorithm to encrypt the decrypted processing data again to form ciphertext, and stores the ciphertext separately; after the decrypted processing data is approved, the data reporting platform synchronizes the stored ciphertext to the front-end database of the group ERP system. This process is carried out in ciphertext form to ensure the security of data during transmission.

[0080] Step 13: The group ERP system sets up a unified front-end database to shield the inconsistency of the source database. A unified data integration method is used to synchronize the ciphertext data from the front-end database to the big data platform. The data transmission process is also ciphertext transmission to ensure data security.

[0081] Step 14: The group ERP system uses the private key to call the national secret SM4 algorithm to decrypt the data, and then calculates, processes and stores the data to form a unified data platform to support subsequent data analysis and processing.

[0082] The present disclosure adopts a link process of ciphertext transmission to achieve high security of data transmission. During the entire data flow process, all data is transmitted in ciphertext form, effectively preventing the leakage of sensitive data during transmission. The establishment of the encryption center ensures that ciphertext data and keys are not stored in the same area, fundamentally reducing the risk of data being cracked due to key leakage. By storing keys and data separately, the security protection capability of the overall system is improved.

[0083] Each piece of sensitive data is independently assigned a unique key to ensure that even if a key is leaked, it will not affect the security of other data. This design enables each piece of data to have an independent protection mechanism during the encryption process, enhancing the flexibility and security of data management.

[0084] In the integration of business application systems and data middle platforms, the privacy and security of business data are effectively protected with the help of encrypted transmission and hierarchical authority management, reducing the risk of internal data leakage. Through the process approval and encryption measures of the data reporting platform, the safe and compliant transmission of data from each sector to the group is achieved, providing reliable guarantee for the subsequent processing and analysis of data.

[0085] According to another aspect of an embodiment of the present disclosure, a data reporting full-link encryption method is provided. The method is implemented based on the subordinate unit information system mentioned above. For each application of the subordinate unit information system, the method includes:

[0086] Step 101, when the application needs to transmit data to other applications in the same subordinate unit information system, the encryption center is requested to generate a key with the unique identifier of each target data. The encryption center allocates and issues a unique key to the target data and stores the mapping relationship between the unique identifier of the target data and the corresponding key;

[0087] Step 102: The application uses the acquired key and calls the encryption function of the encryption center to encrypt the target data to form ciphertext, and transmits the ciphertext to other applications; after receiving the ciphertext, the other applications request the key center to obtain the corresponding key with the unique identifier of the target data, use the key to decrypt the ciphertext to obtain the plaintext data and perform corresponding processing; after the encryption center assigns the key to the target data, any application in the subordinate unit's information system requests the key center to obtain the stored key with the unique identifier of the target data when performing encryption and decryption operations on the target data;

[0088] Step 103, when the application needs to transmit data to the group ERP system, obtain the public key of the group ERP system from the encryption center, use an asymmetric algorithm to encrypt the data to be transmitted to form a ciphertext, and synchronize the ciphertext to the group ERP system.

[0089] In a possible implementation, the method further includes:

[0090] Step 104, for each application in each subordinate unit information system, after the application processes the received decrypted plaintext to obtain a processing result, when it needs to send the processing result to other applications in the same subordinate unit information system, if it is determined that the processing result is different from the decrypted plaintext before processing, the application will re-request the key from the encryption center with the unique identifier of the processing result. The encryption center will allocate and issue a unique key for the processing result, and store the mapping relationship between the unique identifier of the processing result and the corresponding key. The application obtains the key and calls the encryption function of the encryption center to encrypt the processing result to form a ciphertext, and transmits the ciphertext to other applications.

[0091] In a possible implementation, the encryption center can batch process key generation requests sent by different applications, and distribute and send a unique key corresponding to the target data to the corresponding application in response to each key generation request;

[0092] The encryption center can also batch process requests for obtaining keys with unique identifiers sent by different applications, and return the key associated with the unique identifier in the request to the corresponding application in response to each request for obtaining the key.

[0093] In a possible implementation, the application of each subordinate unit information system includes: a business operation platform, a data middle platform and a data reporting platform, and the method further includes:

[0094] Step 105, the business operation platform executes the business processes and operations of the subordinate unit information system, and pushes the business data in encrypted form to the data center;

[0095] Step 106: The data center integrates and processes the business data of the business operation platform to form summary data, and pushes the summary data in encrypted form to the data reporting platform;

[0096] Step 107, the data reporting platform performs reporting process approval, data filling and authority granting management on the summary data pushed by the data center, and reports the summary data approved by the reporting process to the group ERP system in encrypted form.

[0097] According to another aspect of an embodiment of the present disclosure, a method for full-link encryption of data reporting is provided. The method is implemented based on the above-mentioned group ERP system, and the method includes:

[0098] Step 201, the group ERP system uses the private key to decrypt the received ciphertext to obtain the plaintext data and performs corresponding processing.

[0099] In a possible implementation, the group ERP system is also configured with a front-end database and a big data platform, and step 201 also includes

[0100] Step 211: The front-end database stores the ciphertext reported by the information systems of each subordinate unit, and uses a unified data integration tool to synchronize the ciphertext obtained and stored within a preset period to the big data platform;

[0101] In step 2012, the big data platform uses the private key of the group ERP system to decrypt the received ciphertext to obtain plaintext data, and then calculates and processes the plaintext data to form a unified standard format for storage.

[0102] In a possible implementation, the big data platform also includes multiple isolated storage spaces, each of which is used to encrypt and store the business data of a subordinate unit information system or the business data of the group EPR system.

[0103] The description of the above method has been explained in detail in the description of the above system and will not be repeated here.

[0104] Figure 3 1900 is a block diagram of a data reporting full-link encryption device shown in an embodiment of the present disclosure. For example, the device 1900 can be provided as a server. Figure 3 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0105] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or the like.

[0106] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0107] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0108] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0109] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0110] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0111] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0112] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0113] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0114] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0115] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A data reporting full-link encryption system, characterized in that: The system includes: the system includes: multiple subordinate unit information systems and a group ERP system, each subordinate unit information system is configured with a unified gateway, an encryption center and multiple applications; the encryption center is configured with an encryption and decryption model and is used to generate storage keys, the encryption center and all applications are registered and managed through the unified gateway, and each application needs to be authenticated by the unified gateway before the unified gateway calls the corresponding function of the encryption center; For each application in each subordinate unit's information system, when the application needs to transmit data to other applications in the same subordinate unit's information system, the application requests the encryption center to generate a key with the unique identifier of each target data to be transmitted. The encryption center allocates and issues a unique key for the target data, and stores the mapping relationship between the unique identifier of the target data and the allocated key; the application uses the obtained key and calls the encryption function of the encryption center to encrypt the target data to form a ciphertext, and transmits the ciphertext to other applications; after receiving the ciphertext, other applications request the key center to obtain the corresponding key with the unique identifier of the target data, use the key to decrypt the ciphertext to obtain the plaintext data, and perform corresponding processing; after the encryption center allocates a key to the target data, any application in the subordinate unit's information system requests the key center to obtain the stored key through the unique identifier of the target data when performing encryption and decryption operations on the target data; For each application in the information system of each subordinate unit, when the application needs to transmit data to the group ERP system, the application obtains the public key of the group ERP system from the encryption center, uses an asymmetric algorithm to encrypt the data to be transmitted to form ciphertext, and synchronizes the ciphertext to the group ERP system. The group ERP system uses the private key to decrypt the received ciphertext to obtain plaintext data and perform corresponding processing.

2. The system according to claim 1, characterized in that For each application in each subordinate unit's information system, after the application processes the received decrypted plaintext to obtain a processing result, when it needs to send the processing result to other applications in the same subordinate unit's information system, if it is determined that the processing result is different from the decrypted plaintext before processing, the application will re-request the key from the encryption center with the unique identifier of the processing result. The encryption center will allocate and issue a unique key for the processing result, and store the mapping relationship between the unique identifier of the processing result and the corresponding key. The application obtains the key and calls the encryption function of the encryption center to encrypt the processing result to form a ciphertext, and transmits the ciphertext to other applications.

3. The system according to claim 1, characterized in that The encryption center can batch process key generation requests sent by different applications, and distribute and send a unique key corresponding to the target data to the corresponding application in response to each key generation request; The encryption center can also batch process requests for obtaining keys with unique identifiers sent by different applications, and return the key associated with the unique identifier in the request to the corresponding application in response to each request for obtaining the key.

4. The system according to claim 1, characterized in that The group's ERP system is also equipped with a front-end database and a big data platform; The front-end database is used to store the ciphertext reported by the information systems of subordinate units, and uses a unified data integration tool to synchronize the ciphertext obtained and stored within a preset period to the big data platform; The big data platform uses the private key of the group's ERP system to decrypt the received ciphertext to obtain plaintext data, and then calculates and processes the plaintext data to form business data in a unified and standardized format for encrypted storage.

5. The system according to claim 4, characterized in that The big data platform also includes multiple isolated storage spaces, each of which is used to encrypt and store the business data of a subordinate unit's information system or the business data of the group's EPR system.

6. The system according to claim 1, characterized in that The application of subordinate unit information systems includes: business operation platform, data center and data reporting platform; Business operation platform, used to execute business processes and operations of subordinate units’ information systems; The data center is a big data processing platform for subordinate units’ information systems, which is used to integrate and process the business data of the business operation platform to form summary data; The data reporting platform is used to review and approve the reporting process, fill in data and manage the authority granted to the data summarized by the data center, and report the business data approved by the reporting process to the group ERP system.

7. A data reporting full-link encryption method, characterized in that: The method is implemented based on the subordinate unit information system according to any one of claims 1 to 6, and for each application of the subordinate unit information system, the method includes: Step 101, when the application needs to transmit data to other applications in the same subordinate unit information system, the encryption center is requested to generate a key with the unique identifier of each target data. The encryption center allocates and issues a unique key to the target data and stores the mapping relationship between the unique identifier of the target data and the corresponding key; Step 102: The application uses the acquired key and calls the encryption function of the encryption center to encrypt the target data to form ciphertext, and transmits the ciphertext to other applications; after receiving the ciphertext, the other applications request the key center to obtain the corresponding key with the unique identifier of the target data, use the key to decrypt the ciphertext to obtain the plaintext data and perform corresponding processing; after the encryption center assigns the key to the target data, any application in the subordinate unit's information system requests the key center to obtain the stored key with the unique identifier of the target data when performing encryption and decryption operations on the target data; Step 103, when the application needs to transmit data to the group ERP system, obtain the public key of the group ERP system from the encryption center, use an asymmetric algorithm to encrypt the data to be transmitted to form a ciphertext, and synchronize the ciphertext to the group ERP system.

8. The method according to claim 7, characterized in that The method further comprises: Step 104, for each application in each subordinate unit information system, after the application processes the received decrypted plaintext to obtain a processing result, when it needs to send the processing result to other applications in the same subordinate unit information system, if it is determined that the processing result is different from the decrypted plaintext before processing, the application will re-request the key from the encryption center with the unique identifier of the processing result. The encryption center will allocate and issue a unique key for the processing result, and store the mapping relationship between the unique identifier of the processing result and the corresponding key. The application obtains the key and calls the encryption function of the encryption center to encrypt the processing result to form a ciphertext, and transmits the ciphertext to other applications.

9. The method according to claim 7, characterized in that: The encryption center can batch process key generation requests sent by different applications, and distribute and send a unique key corresponding to the target data to the corresponding application in response to each key generation request; The encryption center can also batch process requests for obtaining keys with unique identifiers sent by different applications, and return the key associated with the unique identifier in the request to the corresponding application in response to each request for obtaining the key.

10. The method according to claim 7, characterized in that The application of each subordinate unit's information system includes: a business operation platform, a data middle platform and a data reporting platform, and the method also includes: Step 105, the business operation platform executes the business processes and operations of the subordinate unit information system, and pushes the business data in encrypted form to the data center; Step 106: The data center integrates and processes the business data of the business operation platform to form summary data, and pushes the summary data in encrypted form to the data reporting platform; Step 107, the data reporting platform performs reporting process approval, data filling and authority granting management on the summary data pushed by the data center, and reports the summary data approved by the reporting process to the group ERP system in encrypted form.

11. A data reporting full-link encryption method, characterized in that: The method is implemented based on the group ERP system according to any one of claims 1 to 5, and the method comprises: Step 201, the group ERP system uses the private key to decrypt the received ciphertext to obtain the plaintext data and performs corresponding processing.

12. The method according to claim 11, characterized in that The group ERP system is also equipped with a front-end database and a big data platform. Step 201 also includes Step 211: The front-end database stores the ciphertext reported by the information systems of each subordinate unit, and uses a unified data integration tool to synchronize the ciphertext obtained and stored within a preset period to the big data platform; In step 2012, the big data platform uses the private key of the group ERP system to decrypt the received ciphertext to obtain plaintext data, and then calculates and processes the plaintext data to form a unified standard format for storage.

13. The method according to claim 11, characterized in that The big data platform also includes multiple isolated storage spaces, each of which is used to encrypt and store the business data of a subordinate unit's information system or the business data of the group's EPR system.

14. A data reporting full-link encryption device, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 7 to 10.

15. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 7 to 10 is implemented.

16. A data reporting full-link encryption device, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method described in any one of claims 11 to 13.

17. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 11 to 13 is implemented.

Images