Data reporting full-link encryption system, method and device

Abstract

The present disclosure belongs to the technical field of nuclear power and specifically relates to a data reporting full-link encryption system, method and device. The present disclosure adopts a link process of ciphertext transmission, realizing high security of data transmission. In the whole data flow process, all data are transmitted in the form of ciphertext, effectively preventing sensitive data from being leaked in the transmission process. The ciphertext data and the key are not stored in the same area, fundamentally reducing the risk of data being cracked caused by key leakage. By separately storing the key and the data, the security protection capability of the overall system is improved. Each piece of sensitive data is independently set with a unique key, ensuring that even if a key is leaked, the security of other data will not be affected. This design enables each piece of data to have an independent protection mechanism in the encryption process, enhancing the flexibility and security of data management.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of information technology, and particularly relates to a data reporting full-link encryption system, method and device. BACKGROUND

[0002] In a data transmission link, sensitive data is transmitted in plaintext form without effective encryption protection. Attackers can easily intercept transmission requests through man-in-the-middle attacks and directly obtain sensitive data, thereby causing a high risk of data leakage.

[0003] In the data processing and development process, developers with extensive permissions can not only obtain sensitive data, but also directly access encryption keys. Such excessive permission management is prone to cause internal data leakage, especially in the case of misuse of permissions or out-of-control employee behavior, the internal leakage risk is more serious and difficult to prevent.

[0004] In related technologies, the system uses a unified key pair to encrypt data. Once the key is compromised, all encrypted sensitive data will face a great security threat. Such a single point of failure security model is an easy target for attackers, and the compromise of the key will directly lead to the security collapse of the entire system.

[0005] In addition, in the current system, the key and the encrypted data are stored in the same security area. This design has serious security risks. Once the storage area is compromised, the attacker can obtain the encrypted data and the key at the same time, leading to the full disclosure of sensitive data, with extremely serious consequences. SUMMARY

[0006] To overcome the problems in the related art, a data reporting full-link encryption system, method and device are provided.

[0007] According to an aspect of an embodiment of the present disclosure, a data reporting full-link encryption system is provided. The system includes: a plurality of subordinate unit information systems and a group ERP system. In each subordinate unit information system, a unified gateway, an encryption center and a plurality of applications are configured. The encryption center is configured with an encryption and decryption model and is used to generate a storage key. The encryption center and all applications are registered and managed through the unified gateway. Each application needs to be authenticated by the unified gateway before the unified gateway calls the corresponding function of the encryption center.

[0008] For each application in each subordinate unit information system, when the application needs to transmit data to other applications in the same subordinate unit information system, the application requests the encryption center to generate a key with a unique identifier of each target data to be transmitted, the encryption center allocates and issues a unique key for the target data, and stores the mapping relationship between the unique identifier of the target data and the allocated key; the application uses the obtained key and calls the encryption function of the encryption center to encrypt the target data to form ciphertext, and transmits the ciphertext to other applications; after receiving the ciphertext, other applications request the key center to obtain the corresponding key with the unique identifier of the target data, decrypt the ciphertext with the key to obtain plaintext data, and perform corresponding processing; after the target data is allocated a key by the encryption center, the encryption and decryption operations of any application in the subordinate unit information system on the target data are performed by requesting the key center to obtain the stored key with the unique identifier of the target data;

[0009] For each application in each subordinate unit information system, when the application needs to transmit data to the group ERP system, the application obtains the public key of the group ERP system from the encryption center, encrypts the data to be transmitted using an asymmetric algorithm to form ciphertext, and synchronizes the ciphertext to the group ERP system. The group ERP system decrypts the received ciphertext with a private key to obtain plaintext data and performs corresponding processing.

[0010] In a possible implementation, for each application in each subordinate unit information system, after the application processes the received decrypted plaintext to obtain a processing result, if it is determined that the processing result is different from the decrypted plaintext before processing, the application re-requests a key from the encryption center with a unique identifier of the processing result, the encryption center allocates and issues a unique key for the processing result, and stores the mapping relationship between the unique identifier of the processing result and the corresponding key. The application uses the obtained key and calls the encryption function of the encryption center to encrypt the processing result to form ciphertext, and transmits the ciphertext to other applications.

[0011] In a possible implementation, the encryption center can batch process the requests for generating keys sent by different applications, and allocate and issue a unique key for the corresponding target data to the corresponding application in response to each request for generating a key.

[0012] The encryption center can also batch process the requests for obtaining keys sent by different applications with unique identifiers, and return the key associated with the unique identifier in the request to the corresponding application in response to each request for obtaining a key.

[0013] In a possible implementation, the group ERP system further comprises a front-end database and a big data platform.

[0014] The front-end database is configured to store the ciphertext reported by each subordinate unit information system, and a unified data integration tool is used to synchronize the stored ciphertext in a preset time period to the big data platform;

[0015] The big data platform uses the private key of the group ERP system to decrypt the received ciphertext to obtain plaintext data, and then performs calculation and processing on the plaintext data to form business data in a unified and standardized format for encrypted storage.

[0016] In a possible implementation, the big data platform further includes a plurality of mutually isolated storage spaces, each of which is configured to store the business data of one subordinate unit information system or the business data of the group ERP system.

[0017] In a possible implementation, the application of the subordinate unit information system includes a business operation platform, a data middle platform, and a data reporting platform.

[0018] The business operation platform is configured to execute the business processes and operations of the subordinate unit information system.

[0019] The data middle platform is a big data processing platform of the subordinate unit information system, configured to integrate and process the business data of the business operation platform to form summary data.

[0020] The data reporting platform is configured to perform reporting process approval, data filling, and permission management on the summary data of the data middle platform, and report the business data that passes the reporting process approval to the group ERP system.

[0021] According to another aspect of the embodiments of the present disclosure, a data reporting full-link encryption method is provided, which is based on the above-mentioned subordinate unit information system, and for each application of the subordinate unit information system, the method includes:

[0022] Step 101: When the application needs to transmit data to other applications of the same subordinate unit information system, a unique identifier of each target data is used to request the encryption center to generate a key, and the encryption center allocates and issues a unique key for the target data, and stores the mapping relationship between the unique identifier of the target data and the corresponding key;

[0023] Step 102: The application uses the obtained key and calls the encryption function of the encryption center to encrypt the target data to form ciphertext, and transmits the ciphertext to other applications; other applications receive the ciphertext, request the key center to obtain the corresponding key with the unique identifier of the target data, and use the key to decrypt the ciphertext to obtain plaintext data and perform corresponding processing; after the target data is allocated a key by the encryption center, the encryption and decryption operations of the target data by any application in the subordinate unit information system are performed by requesting the key center to obtain the stored key with the unique identifier of the target data;

[0024] Step 103, when the application needs to transmit data to the group ERP system, obtaining the public key of the group ERP system from the encryption center, encrypting the data to be transmitted by using an asymmetric algorithm to form ciphertext, and synchronizing the ciphertext to the group ERP system.

[0025] In a possible implementation, the method further includes:

[0026] Step 104, for each application in each subordinate unit information system, after the application processes the received decrypted plaintext to obtain a processing result, and needs to send the processing result to other applications in the same subordinate unit information system, if it is judged that the processing result is different from the decrypted plaintext before processing, the application re-requests a key from the encryption center with a unique identifier of the processing result, the encryption center assigns and issues a unique key for the processing result, and stores a mapping relationship between the unique identifier of the processing result and the corresponding key, the application encrypts the processing result by using the obtained key and calling the encryption function of the encryption center to form ciphertext, and transmits the ciphertext to other applications.

[0027] In a possible implementation, the encryption center can batch process the requests for generating keys sent by different applications, and assign and issue a unique key for corresponding target data to the corresponding application in response to each request for generating a key.

[0028] The encryption center can also batch process the requests for obtaining keys with unique identifiers sent by different applications, and return the key associated with the unique identifier in the request to the corresponding application in response to each request for obtaining a key.

[0029] In a possible implementation, the applications of each subordinate unit information system include a business operation platform, a data middle platform, and a data reporting platform, and the method further includes:

[0030] Step 105, the business operation platform executes the business processes and operations of the subordinate unit information system, and pushes the business data in the form of ciphertext to the data middle platform.

[0031] Step 106, the data middle platform integrates and processes the business data of the business operation platform to form summary data, and pushes the summary data in the form of ciphertext to the data reporting platform.

[0032] Step 107, the data reporting platform performs reporting process approval, data filling, and permission management on the summary data pushed by the data middle platform, and reports the summary data that passes the reporting process approval in the form of ciphertext to the group ERP system.

[0033] According to another aspect of the embodiments of the present disclosure, a data reporting full-link encryption method is provided, which is based on the above-mentioned group ERP system implementation, and the method includes:

[0034] In step 201, the group ERP system decrypts the received ciphertext using the private key to obtain plaintext data and performs corresponding processing.

[0035] In a possible implementation, the group ERP system is further configured with a front-end database and a big data platform, and step 201 further includes

[0036] In step 2011, the front-end database stores the ciphertext reported by each subordinate unit information system, and synchronizes the stored ciphertext obtained within a preset time period to the big data platform using a unified data integration tool.

[0037] In step 2012, the big data platform decrypts the received ciphertext using the private key of the group ERP system to obtain plaintext data, and then performs calculation and processing on the plaintext data to form unified and standardized format data for storage.

[0038] In a possible implementation, the big data platform further includes a plurality of isolated storage spaces, and each storage space is used to encrypt and store the business data of one subordinate unit information system or the business data of the group ERP system.

[0039] According to another aspect of the embodiments of the present disclosure, a data reporting full-link encryption device is provided, and the device includes:

[0040] a processor;

[0041] a memory for storing processor-executable instructions;

[0042] The processor is configured to execute the above method.

[0043] According to another aspect of the embodiments of the present disclosure, a non-volatile computer readable storage medium is provided, which stores computer program instructions, and the computer program instructions are executed by a processor to implement the above method.

[0044] The present disclosure has the following beneficial effects: in the data reporting full-link encryption system provided by the present disclosure, the data transmission link between each subordinate unit information system and the group ERP system is in the form of ciphertext, which realizes high security of data transmission and effectively prevents sensitive data from being leaked in the transmission process.

[0045] Each subordinate unit information system is configured with an encryption center for storing keys and encryption and decryption models, so that ciphertext data and keys are not stored in the same area, fundamentally reducing the risk of data being cracked due to simultaneous leakage of ciphertext keys. By storing keys and data separately, the overall system security protection capability is improved. And the application account of each application can only access the decrypted plaintext, and cannot access the keys and encryption and decryption models corresponding to the ciphertext decryption process, thereby preventing the abuse of rights and out-of-control behavior of developers with extensive permissions, thereby further ensuring the security of system data.

[0046] In addition, the system independently sets a unique key for each piece of sensitive data during encryption transmission, ensuring that even if a key is leaked, it will not affect the security of other data. This design makes each piece of data have an independent protection mechanism during encryption, enhancing the flexibility and security of data management. By combining keys with the general encryption and decryption model of the encryption center service to perform encryption and decryption operations, the security of data in each link is ensured. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 is a block diagram of a data reporting full-link encryption system according to an embodiment of the present disclosure.

[0048] Figure 2 is a partial block diagram of a data reporting full-link encryption system according to an embodiment of the present disclosure.

[0049] Figure 3 is a block diagram of a data reporting full-link encryption device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0050] The present disclosure will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0051] Unless otherwise defined, technical and scientific terms used in the present disclosure have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "comprising" and any variation thereof in the present disclosure is intended to cover non-exclusive inclusion. Obviously, the embodiments described in the present disclosure are only a part of the embodiments of the present disclosure, not all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative labor are within the scope of protection of the present disclosure.

[0052] Reference to“an embodiment” or“the embodiment” in this disclosure means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the disclosure. The appearances of the phrase“in one embodiment” or“in another embodiment” in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of one another. It is expressly understood that any of the embodiments described herein can be combined with any of the other embodiments unless specifically noted otherwise.

[0053] Figure 1 is a block diagram of a data reporting full-link encryption system according to an embodiment of the disclosure, Figure 2 is a partial block diagram of a data reporting full-link encryption system according to an example of the disclosure, as shown in Figure 1 and Figure 2 As shown, the system includes a plurality of subordinate unit information systems and a group ERP system, each of the subordinate unit information systems is configured with a unified gateway, an encryption center, and a plurality of applications, which can include SAP ECC, data middle platform, and data reporting platform, and the group ERP system is configured with a front-end database.

[0054] All applications (such as business application systems, data middle platforms, and data reporting platforms) in each subordinate unit information system and the integrated interface of the encryption center are registered and managed through the unified gateway. Through this unified architecture, the interface calls of all applications in the subordinate unit information system can pass through the authentication service of the unified gateway to ensure the consistency of the interface integration between the applications, and the security standards are managed uniformly, further improving the security between the systems and the reliability of data transmission.

[0055] The encryption center is a general encryption and decryption model module for the subordinate unit information system. The encryption center provides encryption and decryption services through an interface. All applications in the subordinate unit information system that need encryption and decryption can call the encryption center interface, thereby ensuring the security of data in different links. The encryption center includes a key management module for uniformly assigning a unique key to each target data to be encrypted to ensure high security of the data. The encryption center also includes an encryption and decryption model management module for providing encryption and decryption SDK and related encryption and decryption Jar packages for integrated use by various application systems, so that the encryption and decryption function is seamlessly integrated into each business process.

[0056] For each application in each subordinate unit information system, when the application needs to transmit data to other applications in the same subordinate unit information system, the application requests the encryption center to generate a key with a unique identifier of each piece of target data to be transmitted, the encryption center allocates and issues a unique key for the target data, and stores the mapping relationship between the unique identifier of the target data and the allocated key; the application uses the obtained key and calls the encryption function of the encryption center to encrypt the target data to form ciphertext, and transmits the ciphertext to other applications; after receiving the ciphertext, the other applications request the key center to obtain the corresponding key with the unique identifier of the target data, decrypt the ciphertext to obtain plaintext data with the key, and perform corresponding processing; after the target data is allocated a key by the encryption center, the encryption and decryption operations of any application in the subordinate unit information system on the target data are all performed by requesting the key center to obtain the stored key with the unique identifier of the target data. In the encryption transmission process, a unique key is independently set for each piece of sensitive data to ensure that even if a key is leaked, the security of other data will not be affected.

[0057] For each application in each subordinate unit information system, after the application processes the received decrypted plaintext to obtain a processing result, if it is determined that the processing result is different from the decrypted plaintext before processing, the application requests the encryption center for a key with a unique identifier of the processing result, the encryption center allocates and issues a unique key for the processing result, and stores the mapping relationship between the unique identifier of the processing result and the corresponding key, the application uses the obtained key and calls the encryption function of the encryption center to encrypt the processing result to form ciphertext, and transmits the ciphertext to other applications. In this way, the present disclosure ensures that a unique key is configured for each newly generated different data item in the encryption transmission and processing process, thereby ensuring that a unique key is independently set for each piece of different sensitive data, and further ensuring the security of the data.

[0058] For each application in each subordinate unit information system, when the application needs to transmit data to the group ERP system, the application obtains the public key of the group ERP system from the encryption center, encrypts the data to be transmitted using an asymmetric algorithm to form ciphertext, and synchronizes the ciphertext to the group ERP system, and the group ERP system decrypts the received ciphertext using a private key to obtain plaintext data and performs corresponding processing. In this way, the present disclosure transmits data in the form of ciphertext in the internal data transmission link of each subordinate unit information system and between each subordinate unit information system and the group ERP system, realizes high security of data transmission, and effectively prevents the leakage of sensitive data in the transmission process.

[0059] In a possible implementation, the encryption center can batch process the key generation requests sent by different applications, and assign and issue a unique key of the corresponding target data to the corresponding application in response to each key generation request; the encryption center can also batch process the key acquisition requests sent by different applications, and return the associated key uniquely identified in the request to the corresponding application in response to each key acquisition request. Thus, parallel processing of the encryption and decryption processes of each application is realized, and the efficiency of system encryption and decryption is significantly improved.

[0060] In a possible implementation, the group ERP system is further configured with a pre-database and a big data platform; the pre-database is used to store the ciphertext reported by the information system of each subordinate unit, to ensure that the data is effectively protected before entering the big data platform (such as HUDI) of the group ERP system. The pre-database uses a unified data integration tool to synchronize the stored ciphertext in a preset period to the big data platform; the big data platform uses the private key of the group ERP system to decrypt the received ciphertext to obtain plaintext data, and then calculates and processes the plaintext data to form business data in a unified standard format for encrypted storage. For subsequent in-depth analysis and application. The big data platform further includes a plurality of isolated storage spaces, and each storage space is used to store the business data of an information system of a subordinate unit or the business data of the group ERP system.

[0061] In a possible implementation, the application of the information system of the subordinate unit includes: a business operation platform, a data middle platform, and a data reporting platform. The business operation platform is used to execute the business processes and operations of the information system of the subordinate unit; the data middle platform is a big data processing platform of the information system of the subordinate unit, and is used to integrate and process the business data of the business operation platform to form summary data; the data reporting platform is used to perform reporting process approval, data filling, and permission granting management on the summary data of the data middle platform, and report the business data that passes the reporting process approval to the group ERP system.

[0062] As an example of the present embodiment, the business application system is a core business operation platform of the information system of the subordinate unit, and is used to execute key business processes and operations. A large amount of sensitive data related to the business is stored in the business application system. Through seamless integration with the encryption center, the security of the business data in the storage and transmission process is ensured.

[0063] The data middle platform is a big data processing platform of the information system of the subordinate unit, and is used to integrate and process the business data of the business application system. For example, a wide table model is constructed on the data middle platform, data processing, processing and calculation, and data aggregation operations are performed. The data middle platform ensures that the data after processing forms unified standard business data through data integration with the business application system and the data reporting platform.

[0064] The data reporting platform is used for reporting the processed business data of the data middle platform to the group ERP system. The data reporting platform covers the approval process of sensitive data, data filling, permission management and various functions of data reporting, ensures the safe and compliant transmission of data from various subordinate unit information systems to the group ERP system, and realizes unified management of the data reporting process.

[0065] In an application example, each subordinate unit information system adopts the following steps for data encryption reporting. Wherein, each application, when needing to call the encryption center interface, is authenticated by the unified gateway, and after passing the authentication, the interface of the encryption center is called by the unified gateway, and the related request is sent to the encryption center, thereby ensuring the security of the calling behavior of each application and the encryption center. In addition, the encryption center supports batch processing requests to ensure that multiple keys can be transmitted at one time.

[0066] Step one, when the user of the business application system needs to send data, for the target data to be sent, the business application system calls the key generation interface of the encryption center, sends a request for obtaining a key to the encryption center, and the request carries the unique identifier of the target data.

[0067] Step two, after the encryption center receives the request for obtaining the key from the business application system, it generates a unique key for the unique identifier carried by the request in response to the request, and returns to the business application system. The encryption center also stores the generated unique identifier and the corresponding key in the database for subsequent calling by other applications for encryption and decryption of the same target data.

[0068] Step three, after the business application system receives the key corresponding to the target data, it calls the encryption and decryption SDK Jar package provided by the encryption center, and uses the encryption function (such as SM4 symmetric encryption algorithm) corresponding to the key to encrypt the target data to form ciphertext.

[0069] Step four, the business application system synchronizes the formed ciphertext to the encryption space of the data middle platform through the data integration tool. The transmission of data is in the form of ciphertext, which ensures the security of data in the transmission process.

[0070] Step five, when the data middle platform receives the ciphertext, it is authenticated by the unified gateway, and after passing the authentication, the unified gateway calls the key obtaining interface of the encryption center, sends a request for obtaining a key to the encryption center, and the request carries the unique identifier of the target data.

[0071] Step six, the encryption center responds to the request for obtaining the key sent by the data middle platform, and returns the key associated with the unique identifier corresponding to the request to the data middle platform.

[0072] Step seven, after the data center obtains the key corresponding to the received ciphertext, and passes the unified gateway authentication, the unified gateway calls the encryption center's encryption and decryption model (such as SM4 algorithm) to decrypt the corresponding ciphertext to form plaintext, and the data center processes the plaintext according to the account instructions to form a processing result.

[0073] When the data center judges that the processing result is different from the plaintext before processing, the data center calls the encryption center's key generation interface again for the processing result, sends a request for obtaining a key to the encryption center, the request carries a unique identifier corresponding to the processing result, receives the key returned by the encryption center in response to the request, and encrypts the processing result to form ciphertext. The encryption center stores the newly generated key in association with the unique identifier. This design ensures that the decryption and calculation processes in the running state are plaintext, and the data is always in the form of ciphertext during the entire data development and transmission process, and the developer cannot directly access the key.

[0074] Step eight, the data center synchronizes the formed ciphertext to the data reporting platform through the data integration tool, and the data transmission process is still in the form of ciphertext, ensuring the security of the data in the transmission process.

[0075] Step nine, after the data reporting platform receives the ciphertext from the data center, it calls the encryption center's key acquisition interface, and sends a request for obtaining a key to the encryption center, the request carrying the unique identifier of the processing result.

[0076] Step ten, after the encryption center receives the request for obtaining a key from the data reporting platform, it returns the key associated with the unique identifier data to the data reporting platform in response to the request.

[0077] Step eleven, after the data reporting platform obtains the key corresponding to the received ciphertext, it calls the decryption algorithm using the SDKJar package packaged by the encryption center to decrypt the ciphertext and obtain the decrypted processed data.

[0078] The data reporting platform of the present disclosure sets strict permission management, only authorized users can view the decrypted processed data, and the viewing permission needs to be verified by a short message verification code. The decrypted processed data displayed on the front end of the data reporting platform also uses front-end and back-end encryption algorithms to prevent being intercepted in the transmission link.

[0079] Step twelve, the data reporting platform uses the public key provided by the group ERP system to encrypt the decrypted processed data again using an asymmetric algorithm to form ciphertext, and stores the ciphertext separately; after the reporting and approval of the decrypted processed data pass, the data reporting platform synchronizes the stored ciphertext to the front-end database of the group ERP system. This process is in the form of ciphertext, ensuring the security of the data in the transmission process.

[0080] Step thirteen, the group ERP system sets a unified front-end database to shield the inconsistency of the source-end database. The group ERP system uses a unified data integration method to synchronize the ciphertext data from the front-end database to the big data platform. The data transmission process is also a ciphertext transmission, which ensures the security of the data.

[0081] Step fourteen, the group ERP system uses a private key to call the national SM4 algorithm to decrypt the data, and then calculates, processes and stores the data to form a unified data platform to support subsequent data analysis and processing.

[0082] The link process of ciphertext transmission is adopted in the present disclosure to achieve high security of data transmission. In the whole data flow process, all data are transmitted in the form of ciphertext, which effectively prevents the leakage of sensitive data in the transmission process. The establishment of the encryption center makes the ciphertext data and the key not stored in the same area, which fundamentally reduces the risk of data being cracked due to key leakage. By separating the storage of the key and the data, the security protection capability of the whole system is improved.

[0083] A unique key is set for each piece of sensitive data to ensure that even if a key is leaked, the security of other data will not be affected. This design makes each piece of data have an independent protection mechanism in the encryption process, which enhances the flexibility and security of data management.

[0084] In the integration of the business application system and the data center, the privacy and security of the business data are effectively protected by means of ciphertext transmission and hierarchical permission management, which reduces the risk of internal data leakage. Through the process approval and encryption measures of the data reporting platform, the secure and compliant transmission of data from each block to the group is realized, which provides a reliable guarantee for the subsequent processing and analysis of data.

[0085] According to another aspect of the embodiments of the present disclosure, a data reporting full-link encryption method is provided, which is implemented based on the above subordinate unit information system. For each application of the subordinate unit information system, the method comprises:

[0086] Step 101, when the application needs to transmit data to other applications of the same subordinate unit information system, a unique identifier of each target data is used to request the encryption center to generate a key. The encryption center allocates and issues a unique key for the target data, and stores the mapping relationship between the unique identifier of the target data and the corresponding key.

[0087] Step 102, the application uses the obtained key and calls the encryption function of the encryption center to encrypt the target data to form ciphertext, and transmits the ciphertext to other applications; after receiving the ciphertext, other applications request the key center to obtain the corresponding key with the unique identifier of the target data, decrypt the ciphertext with the key to obtain plaintext data and perform corresponding processing; after the target data is assigned a key by the encryption center, any application in the subordinate unit information system performs encryption and decryption operations on the target data, and requests the key center to obtain the stored key with the unique identifier of the target data;

[0088] Step 103, when the application needs to transmit data to the group ERP system, the public key of the group ERP system is obtained from the encryption center, and the data to be transmitted is encrypted to form ciphertext by using an asymmetric algorithm, and the ciphertext is synchronized to the group ERP system.

[0089] In a possible implementation, the method further includes:

[0090] Step 104, for each application in each subordinate unit information system, after the application processes the received decrypted plaintext to obtain a processing result, if it is judged that the processing result is different from the decrypted plaintext before processing, the application re-requests a key from the encryption center with the unique identifier of the processing result, the encryption center assigns and issues a unique key for the processing result, and stores the mapping relationship between the unique identifier of the processing result and the corresponding key, the application encrypts the processing result to form ciphertext by using the obtained key and calling the encryption function of the encryption center, and transmits the ciphertext to other applications.

[0091] In a possible implementation, the encryption center can batch process the requests for generating keys sent by different applications, and assign and issue a unique key for corresponding target data to the corresponding application in response to each request for generating a key;

[0092] The encryption center can also batch process the requests for obtaining keys with unique identifiers sent by different applications, and return the key associated with the unique identifier in the request to the corresponding application in response to each request for obtaining a key.

[0093] In a possible implementation, the application of each subordinate unit information system includes a business operation platform, a data middle platform and a data reporting platform, and the method further includes:

[0094] Step 105, the business operation platform executes the business process and operation of the subordinate unit information system, and pushes the business data to the data middle platform in the form of ciphertext;

[0095] In step 106, the data middle platform integrates and processes the business data of the business operation platform to form summary data, and pushes the summary data in the form of ciphertext to the data reporting platform.

[0096] In step 107, the data reporting platform performs reporting process approval, data filling and permission management on the summary data pushed by the data middle platform, and reports the summary data that passes the reporting process approval to the group ERP system in the form of ciphertext.

[0097] According to another aspect of the embodiments of the present disclosure, a data reporting full-link encryption method is provided, which is based on the group ERP system described above, and the method comprises:

[0098] In step 201, the group ERP system decrypts the received ciphertext using a private key to obtain plaintext data and performs corresponding processing.

[0099] In a possible implementation, the group ERP system is further configured with a front-end database and a big data platform, and step 201 further comprises

[0100] In step 2011, the front-end database stores the ciphertext reported by the information system of each subordinate unit, and uses a unified data integration tool to synchronize the stored ciphertext in a preset time period to the big data platform.

[0101] In step 2012, the big data platform decrypts the received ciphertext using the private key of the group ERP system to obtain plaintext data, and then calculates and processes the plaintext data to form a unified standard format data for storage.

[0102] In a possible implementation, the big data platform further comprises a plurality of mutually isolated storage spaces, each of which is used to encrypt and store the business data of one subordinate unit information system or the business data of the group EPR system.

[0103] The description of the above method has been described in detail in the description of the above system, and will not be repeated here.

[0104] Figure 3 is a block diagram of a data reporting full-link encryption device according to an embodiment of the present disclosure. For example, the device 1900 can be provided as a server. Referring to Figure 3 , the device 1900 comprises a processing component 1922, which further comprises one or more processors, and a memory resource represented by a memory 1932, for storing instructions executable by the processing component 1922, such as an application program. The application program stored in the memory 1932 can comprise one or more than one module each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute the instructions to perform the above method.

[0105] The apparatus 1900 can also include a power supply component 1926 configured to supply power to the apparatus 1900, a wired or wireless network interface 1950 configured to connect the apparatus 1900 to a network, and an input output (I / O) interface 1958. The apparatus 1900 can operate based on an operating system stored in the memory 1932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or the like.

[0106] In an exemplary embodiment, a non-transitory computer readable storage medium, such as the memory 1932 including computer program instructions, is also provided, which can be executed by the processing component 1922 of the apparatus 1900 to implement the above method.

[0107] The present disclosure can be a system, a method, and / or a computer program product. The computer program product can include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present disclosure.

[0108] The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium can be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or punched tape, a

[0109] Computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network can comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0110] Computer readable program instructions for carrying out operations of the present disclosure can be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions can execute entirely on the user's computing device, partly on the user's computing device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, for example, through the Internet using an Internet Service Provider. In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) can execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

[0111] The computer readable program instructions can also be loaded onto a computing / processing device, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computing / processing device, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computing / processing device, other programmable apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0112] These computer readable program instructions can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions can also be stored in a computer readable storage medium that can include a non-transitory computer readable storage medium that can be a computer- readable storage medium having no data storage cycles that change state. The instructions can be executed by one or more processors of a computer, to cause a series of operational elements or steps to be performed on the computer to produce a computer implemented process. Such instructions can also be stored and / or executed by other computer-readable media. Computer-readable media storing the computer readable instructions can include computers, processors, or other programmable data processing apparatuses capable of receiving, storing, and / or executing instructions.

[0113] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational elements or steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer, other programmable elements, or other

[0114] The flow diagrams and the block diagrams in the drawings are presented to illustrate the architecture, functionality, and operations of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flow diagrams and the block diagrams can represent a module, a segment, or a portion of instructions, which comprises one or more executable instructions for implementing the specified logical functions ("instructions"). In some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flow diagrams, and combinations of blocks in the block diagrams and / or flow diagrams, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and

[0115] Embodiments of the present disclosure have been described above, and the description is intended to be illustrative of the embodiments and not exhaustive, and is not limited to the embodiments disclosed. Numerous modifications and adaptations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The choice of words in this document is intended to best explain the principles of the embodiments, practical application, or improvement to the art in the marketplace, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A data reporting full-link encryption system, characterized in that, The system comprises a plurality of subordinate unit information systems and a group ERP system, in each of the subordinate unit information systems, a unified gateway, an encryption center and a plurality of applications are configured; the encryption center is configured with an encryption and decryption model and is used to generate a storage key, and the encryption center and all the applications are registered and managed through the unified gateway, each application needs to be called by the unified gateway to call the corresponding function of the encryption center after passing the authentication of the unified gateway; For each application in each subordinate unit information system, when the application needs to transmit data to other applications in the same subordinate unit information system, the application requests the encryption center to generate a key with the unique identifier of each piece of target data to be transmitted, the encryption center allocates and issues a unique key for the target data, and stores the mapping relationship between the unique identifier of the target data and the allocated key; the application uses the obtained key and calls the encryption function of the encryption center to encrypt the target data to form ciphertext, and transmits the ciphertext to other applications; after receiving the ciphertext, other applications request the key center to obtain the corresponding key with the unique identifier of the target data, and use the key to decrypt the ciphertext to obtain plaintext data and perform corresponding processing; after the target data is allocated a key by the encryption center, any application in the subordinate unit information system performs encryption and decryption operations on the target data by requesting the key center to obtain the stored key with the unique identifier of the target data; For each application in each subordinate unit information system, when the application needs to transmit data to the group ERP system, the application obtains the public key of the group ERP system from the encryption center, uses an asymmetric algorithm to encrypt the data to be transmitted to form ciphertext, and synchronizes the ciphertext to the group ERP system, and the group ERP system uses a private key to decrypt the received ciphertext to obtain plaintext data and perform corresponding processing; For each application in each subordinate unit information system, after the application processes the received decrypted plaintext to obtain a processing result, if it is judged that the processing result is different from the decrypted plaintext before processing, the application re-requests a key from the encryption center with the unique identifier of the processing result, the encryption center allocates and issues a unique key for the processing result, and stores the mapping relationship between the unique identifier of the processing result and the corresponding key, the application uses the obtained key and calls the encryption function of the encryption center to encrypt the processing result to form ciphertext, and transmits the ciphertext to other applications.

2. The system of claim 1, wherein, The encryption center can batch process the requests for generating keys sent by different applications, and allocate and issue a unique key for the corresponding target data to the corresponding application in response to each request for generating a key; The encryption center can also batch process the requests for obtaining keys with unique identifiers sent by different applications, and return the key associated with the unique identifier in the request to the corresponding application in response to each request for obtaining a key.

3. The system of claim 1, wherein, The group ERP system is also configured with a front-end database and a big data platform; The front-end database is used to store the ciphertext reported by each subordinate unit information system, and a unified data integration tool is used to synchronize the stored ciphertext in a preset time period to the big data platform; The big data platform uses a private key of the group ERP system to decrypt received ciphertext to obtain plaintext data, and then calculates and processes the plaintext data to form business data in a unified and standardized format for encrypted storage.

4. The system of claim 3, wherein, The big data platform further comprises a plurality of mutually isolated storage spaces, each of which is used to encrypt and store business data of an affiliated unit information system or business data of the group ERP system.

5. The system of claim 1, wherein, The application of the affiliated unit information system comprises a business operation platform, a data middle platform and a data reporting platform. The business operation platform is used to execute business processes and operations of the affiliated unit information system. The data middle platform is a big data processing platform of the affiliated unit information system, and is used to integrate and process business data of the business operation platform to form summary data. The data reporting platform is used to report process approval, data filling and permission management for the summary data of the data middle platform, and report business data that passes the reporting process approval to the group ERP system.

6. A data reporting full-link encryption method, characterized in that, The method is implemented based on the data reporting full-link encryption system according to any one of claims 1 to 5, and for each application of the affiliated unit information system, the method comprises: Step 101, when the application needs to transmit data to other applications of the same affiliated unit information system, a unique identifier of each target data is used to request the encryption center to generate a key, the encryption center allocates and issues a unique key for the target data, and stores the mapping relationship between the unique identifier of the target data and the corresponding key; Step 102, the application uses the obtained key and calls the encryption function of the encryption center to encrypt the target data to form ciphertext, and transmits the ciphertext to other applications; other applications receive the ciphertext, request the key center to obtain the corresponding key with the unique identifier of the target data, decrypt the ciphertext with the key to obtain plaintext data and perform corresponding processing; after the target data is allocated a key by the encryption center, any application in the affiliated unit information system performs encryption and decryption operations on the target data by requesting the key center to obtain the stored key with the unique identifier of the target data; Step 103, when the application needs to transmit data to the group ERP system, the public key of the group ERP system is obtained from the encryption center, and the data to be transmitted is encrypted to form ciphertext using an asymmetric algorithm, and the ciphertext is synchronized to the group ERP system.

7. The method of claim 6, wherein, The method further comprises: Step 104, for each application in each affiliated unit information system, after the application processes the received decrypted plaintext to obtain a processing result, if it is determined that the processing result is different from the decrypted plaintext before processing, the application re-requests a key from the encryption center with the unique identifier of the processing result, the encryption center allocates and issues a unique key for the processing result, and stores the mapping relationship between the unique identifier of the processing result and the corresponding key, the application uses the obtained key and calls the encryption function of the encryption center to encrypt the processing result to form ciphertext, and transmits the ciphertext to other applications.

8. The method of claim 6, wherein, The encryption center can batch process the key generation requests sent by different applications, and assign and issue a unique key of the corresponding target data to the corresponding application in response to each key generation request; The encryption center can also batch process the key acquisition requests sent by different applications, and return the associated key identified by the unique identifier in the request to the corresponding application in response to each key acquisition request.

9. The method of claim 6, wherein, The application of each subordinate unit information system includes a business operation platform, a data center, and a data reporting platform, and the method further includes: Step 105, the business operation platform executes the business process and operation of the subordinate unit information system, and pushes the business data in the form of ciphertext to the data center; Step 106, the data center integrates and processes the business data of the business operation platform to form summary data, and pushes the summary data in the form of ciphertext to the data reporting platform; Step 107, the data reporting platform performs reporting process approval, data filling, and permission management on the summary data pushed by the data center, and reports the summary data that passes the reporting process approval to the group ERP system in the form of ciphertext.

10. The method of claim 6, wherein, The method includes: Step 201, the group ERP system decrypts the received ciphertext using a private key to obtain plaintext data and performs corresponding processing.

11. The method of claim 10, wherein, The group ERP system also configures a front-end database and a big data platform, and step 201 further includes: Step 2011, the front-end database stores the ciphertext reported by each subordinate unit information system, and uses a unified data integration tool to synchronize the stored ciphertext in a preset time period to the big data platform; Step 2012, the big data platform uses the private key of the group ERP system to decrypt the received ciphertext to obtain plaintext data, and then calculates and processes the plaintext data to form a unified standard format data for storage.

12. The method of claim 11, wherein, The big data platform further includes a plurality of isolated storage spaces, each of which is used to encrypt and store the business data of a subordinate unit information system or the business data of the group EPR system.

13. A data reporting full link encryption apparatus, characterized by comprising: The device includes: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the method of any one of claims 6 to 12.

14. A non-transitory computer readable storage medium having stored thereon computer program instructions, wherein, The computer program instructions are executed by the processor to implement the method of any one of claims 6 to 12.

Images