Data transmission method, device, equipment, medium and program product

Abstract

The invention discloses a data transmission method and device, equipment, a medium and a program product. Comprising the following steps: in response to a data transmission request sent by a first client, a data management device determines first data; the first data comprises a plurality of slice data; the multiple pieces of slice data at least comprise a first slice set in a target encryption state and a second slice set not in the target encryption state; the first slice set corresponds to a first private data set of which the private level is greater than or equal to a preset level; the first data corresponds to at least part of data sent to the data management equipment by the second client; the privacy level of the data corresponding to the second slice set is smaller than a preset level; decrypting the first slice set to obtain a first private data set; integrating the first private data set and the second slice set to obtain transmission data; and encrypting the transmission data, and transmitting the encrypted transmission data to the first client. According to the scheme, the requirement of secure transmission of private data can be met.

Description

Technical Field

[0001] The present application relates to the field of data transmission technology, and in particular to a data transmission method, apparatus, device, medium and program product. Background Art

[0002] In data transmission scenarios, data storage devices typically use content-addressed, block-based storage to store source files sent by the source device. These devices segment source files into data blocks ranging in size from 256KB to MB based on their content boundaries. However, this data segmentation and storage operation fails to protect or process important data within the source files, and therefore fails to meet the security requirements for data transmission between different devices or systems. Summary of the Invention

[0003] Based on the above technical problems, the embodiments of the present application provide a data transmission method, apparatus, device, medium and program product.

[0004] The technical solution provided by the embodiments of this application is as follows:

[0005] The present invention first provides a data transmission method, which includes:

[0006] In response to a data transmission request sent by a first client, a data management device determines first data; wherein the first data includes a plurality of slice data; the plurality of slice data includes at least a first slice set in a target encryption state and a second slice set not in the target encryption state; the first slice set corresponds to a first private data set having a privacy level greater than or equal to a preset level; the first data corresponds to at least part of data sent to the data management device by a second client; and the privacy level of data corresponding to the second slice set is less than the preset level;

[0007] Decrypting the first slice set to obtain the first private data set;

[0008] Integrating the first private data set and the second slice set to obtain transmission data;

[0009] The transmission data is encrypted, and the encrypted transmission data is transmitted to the first client.

[0010] In some embodiments, before the data management device determines the first data in response to the data transmission request sent by the first client, the method further includes:

[0011] Determining a second private data set in the source file sent by the second client, the second private data set having a privacy level greater than or equal to the preset level; wherein the second private data set includes the first private data set;

[0012] encrypting the data in the second private data set to obtain a first encrypted data set;

[0013] Processing the source file based on the first encrypted data set to obtain an intermediate file;

[0014] The intermediate file is encrypted to obtain and store a target file; wherein the target file at least includes the first data.

[0015] In some embodiments, the kth encrypted data in the first encrypted data set corresponds to the kth private data in the second private data set; wherein k is an integer greater than or equal to 1 and less than or equal to K; K is greater than 1 and is the number of private data in the second private data set; processing the source file based on the first encrypted data set to obtain the intermediate file includes:

[0016] Determine the private field identifier;

[0017] processing the encrypted data in the first encrypted data set based on the private field identifier to obtain an identified first encrypted data set;

[0018] The kth private data in the source file is replaced based on the kth data in the identified first encrypted data set to obtain the intermediate file.

[0019] In some embodiments, encrypting the intermediate file to obtain and store the target file includes:

[0020] Determine a set of offset positions of private field identifiers in the intermediate file;

[0021] Slicing the intermediate file based at least on the offset position set to obtain a third slice set;

[0022] Part of the slice data in the third slice set is encrypted to obtain a fourth slice set, the fourth slice set is determined as the target file, and the target file is stored.

[0023] In some embodiments, encrypting part of the slice data in the third slice set to obtain the fourth slice set includes:

[0024] Acquire the portion of slice data corresponding to the second private data set from the third slice set;

[0025] determining a first key based on a first private data in the second private data set;

[0026] Slice data in the portion of slice data is encrypted based on the first key to obtain the fourth slice set.

[0027] In some embodiments, the method further comprises:

[0028] Determining a slice identifier set corresponding to the slice data in the fourth slice set;

[0029] A first root identifier corresponding to the target file is determined based on the slice identifier set.

[0030] In some embodiments, before the data management device determines the first data, the method further includes:

[0031] Parsing the data transmission request to determine transmission parameters sent by the first client; wherein the transmission parameters at least include a data index of the data requested by the first client;

[0032] Determine a second root identifier of the data requested by the first client based at least on the data index; wherein the second root identifier is associated with the plurality of slice data;

[0033] Obtaining a digital signature corresponding to the second root identifier;

[0034] Based at least on the second root identifier and the digital signature, a smart contract is generated and sent to the first client, so that the first client parses the smart contract to obtain the digital signature and the second root identifier.

[0035] In some embodiments, before generating and sending the smart contract to the first client based at least on the second root identifier and the digital signature, the method further includes:

[0036] Generate public and private keys;

[0037] The digital signature is generated based on the private key and the second root identifier; wherein the first client is used to obtain the public key and verify the second root identifier based at least on the public key and the digital signature.

[0038] In some embodiments, the smart contract further includes a first list and a second list; wherein the first list includes a list of data access permissions associated with the first client; the second list includes a list of privacy levels of data requested by the first client; and the method further includes:

[0039] controlling data access operations of the first client within a specified time period based on the first list;

[0040] An access policy is determined based on the second list, and the data access operation is processed based on the access policy; wherein the access policy and the data access operation are associated with the privacy level list.

[0041] In some embodiments, decrypting the first slice set to obtain the first private data set includes:

[0042] Obtaining a second key; wherein the second key is associated with the first private data in the data file corresponding to the first slice set;

[0043] Decrypting the private slice data in the first slice set based on the second key to obtain a second encrypted data set;

[0044] The second encrypted data set is decrypted to obtain the first private data set.

[0045] The present invention further provides a data transmission device, comprising:

[0046] A determination module is configured to determine first data in response to a data transmission request sent by a first client; wherein the first data includes a plurality of slice data; the plurality of slice data includes at least a first slice set in a target encryption state and a second slice set not in the target encryption state; the first slice set corresponds to a first private data set having a privacy level greater than or equal to a preset level; the first data corresponds to at least part of data sent by a second client to the data management device; and the privacy level of data corresponding to the second slice set is less than the preset level;

[0047] a processing module, configured to decrypt the first slice set to obtain the first private data set; integrate the first private data set and the second slice set to obtain transmission data; and encrypt the transmission data;

[0048] The transmission module is used to transmit the encrypted transmission data to the first client.

[0049] An embodiment of the present application further provides a data management device, which includes a processor and a memory; a computer program is stored in the memory; when the computer program is executed by the processor, it can implement any of the data transmission methods described above.

[0050] An embodiment of the present application further provides a computer-readable storage medium, wherein the storage medium stores a computer program; when the computer program is executed by a processor of an electronic device, it can implement any of the above-mentioned data transmission methods.

[0051] An embodiment of the present application further provides a computer program product, which includes a computer program; when the computer program is executed by a processor of an electronic device, it can implement any of the above-mentioned data transmission methods.

[0052] In the data transmission request provided in the embodiment of the present application, a data management device determines first data in response to the data transmission request sent by a first client, wherein the first data includes a plurality of slice data including a first slice set in a target encryption state and a second slice set not in the target encryption state, and the first slice set corresponds to a first private data set having a privacy level greater than or equal to a preset level, and the privacy level of data corresponding to the second slice set is less than the preset level. Thus, the data management device can perform different security management on the slice data corresponding to the private data based on the relationship between the privacy level of the data and the preset level, thereby improving the security of the first slice set corresponding to the first private data set having a privacy level greater than or equal to the preset level; and Since the second slice set is not in the target encryption state, the privacy level of the data corresponding to the second slice set is less than the preset level. In this way, differentiated encryption processing of data of different privacy levels can be achieved, and the amount of computation generated by uniform encryption processing of all data can be reduced. At the same time, by decrypting the first slice set, the first private data set is obtained, and the first private data set and the second slice set are integrated to obtain the transmission data. In this way, targeted decryption of the first slice set is achieved, and the integrity and comprehensiveness of the data in the transmission data can be improved. On this basis, by encrypting the transmission data and transmitting the encrypted transmission data to the first client, the security of data transmission between the data management device and the first client can be improved. In summary, the technical solution provided by the embodiment of the present application can perform differentiated encryption processing on data of different privacy levels, and can improve the security of data transmission between the data management device and the first client, thereby meeting the security requirements of storage of data of different privacy levels on the data management device and transmission between the data management device and the first client. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A flowchart of a data transmission method provided in an embodiment of the present application;

[0054] Figure 2 A schematic diagram of the first root identifier generation process provided in an embodiment of the present application;

[0055] Figure 3 A schematic diagram of the structure of the first root identifier generated in the embodiment of the present application;

[0056] Figure 4 A schematic diagram of the digital signature generation process provided in an embodiment of the present application;

[0057] Figure 5 A schematic diagram of the process of obtaining the target file provided in the embodiment of the present application;

[0058] Figure 6 A schematic diagram of the data transmission architecture provided in this embodiment.

[0059] Figure 7 A schematic diagram of the structure of a data transmission device provided in an embodiment of the present application;

[0060] Figure 8 A schematic diagram of the structure of the data management device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application.

[0062] It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application.

[0063] In actual data circulation and data transmission solutions, it is impossible to take into account the needs of user identity authentication, data content protection, and data usage control. This makes data providers worry about data duplication, unauthorized use, secondary circulation and other illegal uses after data circulation and sharing. Data providers have low willingness and great concerns about data circulation and sharing, which leads to situations where both data providers and data users cannot circulate, are unwilling to circulate, and do not know how to circulate.

[0064] Furthermore, in actual data circulation and data transmission schemes, for datasets and data reports, data providers typically upload or deliver data files using the Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS), implemented through a request-response model. For example, in the data delivery platform of the Data Switching Service Network (DSSN) project, when data deliverers upload datasets or data reports via HTTP, upload failures are likely to occur if the datasets or data reports are large and the network stability is insufficient. Therefore, these schemes have at least the following drawbacks: Single file downloads from a single server result in inefficient data transmission or delivery; data transmission status depends on server performance and network resources, resulting in excessively high network bandwidth resource costs during the data transmission process; data copying operations also require high storage space; and, with the increasing centralization of servers and providers, online censorship has intensified.

[0065] To address the shortcomings of the aforementioned solutions, related technologies also offer a technical solution for data transmission using distributed storage and file systems within the Inter Planetary File System (IPFS). Compared to downloading files from a single server via HTTP, this solution uses multi-node distributed storage and enables efficient distribution of large amounts of data through content-based addressing.

[0066] In practice, IPFS stores data files using content-addressed, block-based storage. This block-based storage is based on a distributed hash table algorithm, which divides file data streams into blocks ranging from 256KB to 1MB according to content boundaries. However, this approach is not relevant to actual data sharing scenarios and does not provide appropriate protection for sensitive data. Furthermore, IPFS does not encrypt the resulting blocks. Consequently, it fails to meet the security requirements for data transmission between different devices or systems.

[0067] Based on the above technical problems, the embodiments of the present application provide a data transmission method, apparatus, device, medium and program product.

[0068] The present invention first provides a data transmission method. Figure 1 A flow chart of a data transmission method provided in an embodiment of the present application is shown in FIG. Figure 1As shown, the method may include the following steps:

[0069] Step 101: In response to a data transmission request sent by a first client, a data management device determines first data.

[0070] In which, the first data includes multiple slice data; the multiple slice data include at least a first slice set in a target encryption state and a second slice set not in a target encryption state; the first slice set corresponds to a first private data set whose privacy level is greater than or equal to a preset level; the first data corresponds to at least part of the data sent by the second client to the data management device; the privacy level of the data corresponding to the second slice set is less than the preset level.

[0071] In one embodiment, the first client may include a client device that requests data; illustratively, the first client may include a physical machine device or a virtual machine device.

[0072] In one embodiment, the data management device can be used to store data, manage data, and receive and respond to data transmission requests; exemplarily, the data management device can also implement permission management for the first client and / or the second client, wherein the second client can provide data to the data management device so that the data management device can slice, encrypt and distribute the data provided by it; exemplarily, permission management can include managing the permissions of the first client and / or the second client to the data storage space of the data management device, the access time, number of accesses and whether the stored data can be accessed.

[0073] In one embodiment, the data management device can be built based on IPFS and Apache Flink.

[0074] In one embodiment, the second client may include a physical machine device or a virtual machine device, which may send data to the data management device.

[0075] In one embodiment, the target encryption state may include a state in which encryption is performed based on a specified key; illustratively, the specified key may be associated with or correspond to the private data in the first private data set.

[0076] In one embodiment, the first private data set may include a set of sensitive data or secret data transmitted by the second client to the data management device.

[0077] In one embodiment, the data transmission request may include a data identifier of the data requested to be transmitted by the first client. In this way, when the data management device determines that the first client has data access rights, it can filter the data set it manages according to the data identifier to determine the first data; illustratively, the data identifier may include the data name, number, storage path, etc.

[0078] In one embodiment, the data amounts of the slice data included in the first slice set may be the same or different.

[0079] In one embodiment, the data amounts of the slice data included in the second slice set may be the same or different.

[0080] In one embodiment, the data volume of the slice data in the first slice set may be different from the data volume of the slice data in the second slice set.

[0081] In one embodiment, the data management device can perform differentiated slicing processing on the data sent by the second client, thereby obtaining a first slice set and a second slice set. That is, the data management device's slicing processing of data with a privacy level greater than or equal to a preset level can be different from its slicing processing of data with a privacy level less than the preset level; exemplarily, the data management device can also encrypt slice data with a privacy level greater than or equal to the preset level so that the encrypted slice data is in a target encryption state, while slice data with a privacy level less than the preset level can be unencrypted.

[0082] Step 102: Decrypt the first slice set to obtain a first private data set.

[0083] In one embodiment, the first private data set may include multiple private data. Exemplarily, the first private data set may be obtained in the following manner:

[0084] The data management device obtains a designated key associated with the first private data set, and then decrypts the slice data in the first slice set in sequence based on the designated key to obtain the first private data set.

[0085] Step 103: Integrate the first private data set and the second slice set to obtain transmission data.

[0086] In one embodiment, the transmission data may be embodied in the form of a file.

[0087] In one embodiment, the transmission data may be obtained by:

[0088] The private data in the first private data set carries first offset information, and the slice data in the second slice set carries second offset information. At this time, the data management device can positionally integrate the private data in the first private data set and the slice data in the second slice set based on the first offset information and the second offset information to obtain transmission data; wherein the first offset information can represent a set of position offsets of the private data in the first private data set relative to the first character of the file in which it is located, and the second offset information can include a set of displacement offsets of the slice data in the second slice set relative to the first character of the file in which it is located.

[0089] Step 104: Encrypt the transmission data and transmit the encrypted transmission data to the first client.

[0090] In one embodiment, the encrypted transmission data may be transmitted to the first client via a secure connection between the data management device and the first client.

[0091] In one embodiment, in order to ensure the secure transmission of data between the data transmission device and the first client, the transmission data can be encrypted and the encrypted transmission data can be transmitted to the first client; illustratively, the key used to encrypt the transmission data here can be different from the specified key.

[0092] As can be seen from the above, in the data transmission request provided in the embodiment of the present application, the data management device determines, in response to the data transmission request sent by the first client, first data, wherein the multiple slice data included in the first data include a first slice set in a target encryption state and a second slice set not in the target encryption state, and the first slice set corresponds to a first private data set having a privacy level greater than or equal to a preset level, and the privacy level of data corresponding to the second slice set is less than the preset level. Thus, the data management device can perform different security management on the slice data corresponding to the private data based on the relationship between the privacy level of the data and the preset level, thereby improving the security of the first slice set corresponding to the first private data set having privacy level greater than or equal to the preset level. Moreover, since the second slice set is not in the target encryption state, the privacy level of the data corresponding to the second slice set is less than the preset level. In this way, differentiated encryption processing of data of different privacy levels can be achieved, and the amount of computation generated by uniform encryption processing of all data can be reduced. At the same time, by decrypting the first slice set, a first private data set is obtained, and the first private data set and the second slice set are integrated to obtain transmission data. In this way, targeted decryption of the first slice set is achieved, and the integrity and comprehensiveness of the data in the transmission data can be improved. On this basis, by encrypting the transmission data and transmitting the encrypted transmission data to the first client, the security of data transmission between the data management device and the first client can be improved. In summary, the technical solution provided by the embodiment of the present application can perform differentiated encryption processing on data of different privacy levels, and can improve the security of data transmission between the data management device and the first client, thereby meeting the security requirements of storage of data of different privacy levels on the data management device and transmission between the data management device and the first client.

[0093] Based on the foregoing embodiment, in the data transmission method provided in the embodiment of the present application, in response to the data transmission request sent by the first client, the data management device may further perform the following steps before determining the first data:

[0094] Step A1: Determine a second private data set in a source file sent by a second client, the second private data set having a privacy level greater than or equal to a preset level.

[0095] The second private data set includes the first private data set.

[0096] In one embodiment, the data upload module of the data management device may receive the source file sent by the second client.

[0097] In one embodiment, the data in the second private data set may be sensitive data or private data contained in the source file.

[0098] In one embodiment, the second private data set may be determined by any of the following methods:

[0099] Before sending the source file, the second client may mark the second private data set in the source file, so that the data management device can obtain the second private data set from the source file based on the mark.

[0100] By writing a custom processing function in the Flink application, the source file is inspected to determine the set of privacy fields in the source file, and the set is determined as the second private data set. Exemplarily, this method is suitable for scenarios with simple privacy field logic.

[0101] The source file is screened for privacy fields through the Natural Language Processing (NLP) model set in Flink, and the screening results are determined as the second private data set. Exemplarily, this method is suitable for scenarios with logically complex privacy fields.

[0102] Step A2: Encrypt the data in the second private data set to obtain a first encrypted data set.

[0103] In one embodiment, the first encrypted data set may be obtained by:

[0104] The data in the second private data set is encrypted according to a preset encryption algorithm to obtain a first encrypted data set; illustratively, the preset encryption algorithm can be implemented by a Flink operator of the Advanced Encryption Standard (AES).

[0105] Step A3: Process the source file based on the first encrypted data set to obtain an intermediate file.

[0106] In one embodiment, the intermediate file may not include the first private data set, but may include the first encrypted data set.

[0107] In one embodiment, the intermediate file can be obtained by:

[0108] The third offset information of the first private data set is determined, and then based on the offset address represented by the third offset information, the first private data set in the source file is replaced with the first encrypted data set, thereby obtaining an intermediate file.

[0109] Step A4: encrypt the intermediate file to obtain and store the target file.

[0110] The target file at least includes first data.

[0111] In one embodiment, the target file can be obtained by:

[0112] The intermediate file is sliced ​​to obtain a slice set, and then the slice set is encrypted to obtain and store the target file.

[0113] In one embodiment, the target file can be stored in IPFS in a distributed manner.

[0114] From the above, it can be seen that the data transmission method provided in the embodiment of the present application realizes automatic and intelligent identification of private data in the source file sent by the second client by determining the second private data set whose privacy level in the source file sent by the second client is greater than or equal to the preset level, and the second private data set includes the first private data set; and, by encrypting the data in the second private data set to obtain the first encrypted data set, targeted encryption of the private data in the source file is realized; on the other hand, by processing the source file based on the first encrypted data set to obtain an intermediate file, flexible and targeted processing of the source file based on the first encrypted data set is realized; on this basis, by encrypting the intermediate file, a target file including at least the first data is obtained and stored, thereby realizing re-encryption processing of the intermediate file corresponding to the source file sent by the second client, thereby improving the security of the target file stored in the data management device.

[0115] Based on the aforementioned embodiments, in the data transmission method provided by the embodiments of the present application, the kth encrypted data in the first encrypted data set corresponds to the kth private data in the second private data set; wherein k is an integer greater than or equal to 1 and less than or equal to K; K is greater than 1 and is the number of private data in the second private data set.

[0116] In one embodiment, the private data in the second private data set may be dispersed in the source files.

[0117] Accordingly, processing the source file based on the first encrypted data set to obtain the intermediate file can be achieved by the following steps:

[0118] Step B1: Determine the private field identifier.

[0119] In one embodiment, the private field identifier may be predetermined, or may be adjusted according to different source files or different privacy levels of the private data in the second private data set.

[0120] In one embodiment, the private field identifier may be embodied in the form of a character combination or a number combination; illustratively, the private field identifier may include a combination of binary numbers, for example, the private field identifier may include 1111100000.

[0121] Step B2: Process the encrypted data in the first encrypted data set based on the private field identifier to obtain the identified first encrypted data set.

[0122] In one embodiment, processing the encrypted data in the first encrypted data set based on the private field identifier can be achieved by:

[0123] The private field identifier is used as a prefix and / or suffix of each encrypted data in the first encrypted data set to implement identification processing of the encrypted data in the first encrypted data set; for example, any encrypted data in the first encrypted data set is

[0124] In the case of a9a7064fb8005e6b7b6fbfd5f6f5c30c1d5a0a25e4a4fbdc4f0eb9c95a173b06EIPFS, the corresponding identified encrypted data can be:

[0125] 1111100000a9a7064fb8005e6b7b6fbfd5f6f5c30c1d5a0a25e4a4fbdc4f0eb9c95a173b06EIPFS1111100000.

[0126] Step B3: Replace the kth private data in the source file based on the kth data in the identified first encrypted data set to obtain an intermediate file.

[0127] In one embodiment, the intermediate file can be obtained based on the following method:

[0128] The kth replacement position is determined based on the offset of the kth private data in the source file, and then the kth private data at the kth replacement position in the source file is replaced based on the kth replacement position. When the value of k changes from 1 to K, the above replacement operation is recursively performed to obtain an intermediate file.

[0129] From the above, it can be seen that the data transmission method provided in the embodiment of the present application, after determining the private field identifier, processes the encrypted data in the first encrypted data set based on the private field identifier to obtain the identified first encrypted data set, thereby achieving targeted marking of the first encrypted data set; on this basis, based on the k-th data in the identified first encrypted data set, replaces the k-th private data in the source file to obtain an intermediate file, thereby enabling the intermediate file to carry the private field identifier corresponding to the position and quantity of the second private data set, thereby improving the intuitiveness and clarity of the distribution state of the identified first encrypted data set in the intermediate file.

[0130] Based on the above embodiments, in the data transmission method provided in the embodiments of the present application, encrypting the intermediate file to obtain and store the target file can be achieved by the following steps:

[0131] Step C1: Determine the offset position set of the private field identifiers in the intermediate file.

[0132] In one embodiment, the offset position set may include a set of offset positions of each private field identifier in the intermediate file relative to the first character of the intermediate file.

[0133] In one embodiment, the offset position set can be implemented in the following manner:

[0134] The data in the intermediate file is screened based on the private field identifier, the offset position of each private field identifier relative to the first character of the intermediate file is determined, and a set of the offset positions is determined as an offset position set.

[0135] Step C2: Slice the intermediate file based at least on the offset position set to obtain a third slice set.

[0136] In one embodiment, the third slice data can be obtained by:

[0137] If the amount of continuous first data in the intermediate file that does not contain a private field identifier is greater than or equal to a first threshold, it means that the privacy level of the first data is less than a preset level. At this time, the first data can be divided according to the content boundary to obtain a first division result; if the amount of continuous second data that does not contain a private field identifier is less than the first threshold, the second data is determined as the second division result; for the third data in the intermediate file excluding the first data and the second data, the third data can be divided according to the offset position set to obtain a third division result represented by the first encrypted data set; then, according to the offset of the data corresponding to the first division result, the offset of the data corresponding to the second division result, and the offset of the data corresponding to the third division result, the first division result to the third division result are integrated, and the integrated result is determined as the third slice set.

[0138] Step C3: encrypt part of the slice data in the third slice set to obtain a fourth slice set, determine the fourth slice set as a target file, and store the target file.

[0139] In one embodiment, the partial slice data may include a third partition result, that is, a set of slice data corresponding to the first encrypted data set.

[0140] In one implementation, the fourth slice set may be obtained in the following manner:

[0141] A designated key can be determined in advance, and then part of the slice data is encrypted based on the designated key to obtain a first encryption result. Then, a set of slice data other than the part of the slice data in the fourth slice set and a set of the first encryption result are determined as the fourth slice set.

[0142] As can be seen from the above, in the data transmission method provided in the embodiment of the present application, after determining the offset position set of the private field identifier in the intermediate file, the intermediate file is sliced ​​at least based on the offset position set to obtain a third slice set. In this way, targeted slicing processing of the data associated with the private field identifier in the intermediate file is achieved; and, a fourth slice set is obtained by encrypting part of the slice data in the third slice set, and the fourth slice set is determined as the target file, and the target file is stored. In this way, targeted encryption processing of part of the slice data in the third slice set is achieved, thereby reducing the probability of excessive computational complexity caused by uniformly encrypting all slice data in the third slice set.

[0143] Based on the above embodiment, in the data transmission method provided in the embodiment of the present application, encrypting part of the slice data in the third slice set to obtain the fourth slice set can be achieved by the following steps:

[0144] Step D1: Obtain partial slice data corresponding to the second private data set from the third slice set.

[0145] Step D2: Determine the first key based on the first private data in the second private data set.

[0146] In one embodiment, the first key can be obtained by:

[0147] A content identifier (CID) of the first private data in the second private data set is determined as the first key.

[0148] Step D3: Encrypt the slice data in the partial slice data based on the first key to obtain a fourth slice set.

[0149] In one embodiment, each slice data in the partial slice data can be symmetrically encrypted based on the first key to obtain a second encryption result, and then the second encryption result and the set of slice data in the third slice set excluding the partial slice data are determined as the fourth slice set.

[0150] From the above, it can be seen that the data transmission method provided in the embodiment of the present application, after obtaining partial slice data corresponding to the second private data set from the third slice set, determines the first key based on the first private data in the second private data set. In this way, the association between the first key and the first private data in the second private data set is achieved, which not only improves the flexibility of determining the first key, but also improves the security of the first key; and, based on the first key, the slice data in the partial slice data is encrypted to obtain the fourth slice set, thereby achieving targeted encryption processing of the slice data corresponding to the second private data set in the third slice data, thereby improving the security of the slice data corresponding to the second private data set.

[0151] Based on the above embodiments, the data transmission method provided in the embodiments of the present application may further perform the following operations:

[0152] Determine a slice identifier set corresponding to the slice data in the fourth slice set; and determine a first root identifier corresponding to the target file based on the slice identifier set.

[0153] In one implementation, the slice identifier in the slice identifier set may represent the number or name of the entire slice data in the fourth slice set.

[0154] In one implementation, the slice identifiers in the slice identifier set may be CIDs of respective slice data in the fourth slice set.

[0155] Figure 2A schematic diagram of the first root identifier generation process provided in the embodiment of the present application is shown in FIG. Figure 2 As shown, the process may include the following steps:

[0156] Step 201: Privacy field screening.

[0157] Exemplarily, the privacy field may be the second private data set in the source file in the aforementioned example.

[0158] Illustratively, the source file may be screened for privacy fields using the method provided in the aforementioned embodiment, thereby obtaining a second private data set.

[0159] Step 202: Replace and mark the privacy field.

[0160] Exemplarily, the privacy field can be encrypted first to obtain a first encrypted data set, and after determining the private field identifier, the private field identifier is determined as the prefix and suffix data of the encrypted data in the first encrypted data set, thereby marking the first encrypted data set corresponding to the privacy field, and then the marked first encrypted data set is used to replace the second private data set in the source file to obtain an intermediate file.

[0161] Step 203: Slicing process.

[0162] Exemplarily, the data corresponding to the first encrypted data set in the intermediate file can be sliced ​​based on the private field identifier, while the data outside the marked first encrypted data set in the intermediate file can be sliced ​​using a uniform slicing method to obtain a third slice set.

[0163] Step 204: Encrypt the data slice.

[0164] Exemplarily, part of the slice data corresponding to the first encrypted data set in the third slice set may be encrypted based on the first key, thereby obtaining a fourth slice set.

[0165] Step 205: Construct a directed acyclic graph (DAG).

[0166] Exemplarily, a DAG may be constructed based on the distributed hash values ​​of each slice data in the fourth slice set.

[0167] Step 206: Generate a first root CID.

[0168] Exemplarily, the first root CID may be the first root identifier in the aforementioned embodiment.

[0169] Through the above process, not only is double encryption processing of the second private data set contained in the source file achieved, but also targeted slicing processing of the encrypted data corresponding to the second private data set is achieved, thereby improving the security of the private data in the second private data set from multiple dimensions.

[0170] Figure 3 A schematic diagram of the structure of the first root identifier generated by the embodiment of the present application is shown as follows: Figure 3 As shown, the first root identifier can be implemented by combining IPFS and Flink. Figure 3 As shown, after the source file is sent to the preprocessing unit of Flink, the preprocessing unit can perform the privacy field screening, privacy field replacement and marking operations as described above to obtain an intermediate file, and send the intermediate file to the slicing unit for the slicing unit to perform the slicing processing operations provided in the above embodiments to obtain and send the third slice set to the encryption unit; at this time, the encryption unit can determine the CID of the first private data in the second private data set as the first key p, and encrypt the data corresponding to the second private data set in the intermediate file based on the first key p to obtain a fourth slice set.

[0171] Exemplarily, when the fourth slice set includes n slice data, the CID of each slice data can be calculated separately to obtain CID 1 to CID n, and then the DAG is constructed, and the first root CID, i.e., the first root identifier, is determined, and the first root identifier is sent to the key management module for subsequent generation of the smart contract; wherein n can be a positive integer greater than 3.

[0172] The above structure leverages the efficiency and stability of data storage and processing in Flink and IPFS to enable fast and accurate processing of any number of source files. It also further improves the security of the second private data set in the source file and provides data support for key management in the key management module.

[0173] As can be seen from the above, the data transmission method provided in the embodiment of the present application determines the slice identifier set corresponding to the slice data in the fourth slice set, and determines the first root identifier corresponding to the target file based on the slice identifier set. In this way, the first root identifier can achieve rapid and accurate indexing and management of the target file, thereby improving the efficiency of the data management device in managing the target file.

[0174] Based on the foregoing embodiment, in the data transmission method provided in the embodiment of the present application, before the data management device determines the first data, it may further perform the following operations:

[0175] Step E1: parse the data transmission request to determine the transmission parameters sent by the first client.

[0176] The transmission parameters at least include a data index of the data requested by the first client.

[0177] In one embodiment, the data index may include the name, number, or storage address of the data requested to be accessed or obtained by the first client.

[0178] In one embodiment, when a user browses the data managed by the data management device through the first client, the first client can lock the name, number or storage address of the data managed by the data management device in response to the user's selection operation or the user's instruction input, thereby determining the data index.

[0179] In one embodiment, the transmission parameters may also include detailed information such as the user of the first client or the identity authentication information of the first client, a data description of the data requested by the first client, the number of times the data is used, and the duration of use; exemplarily, the data description may include the data volume and / or data type of the data requested by the first client.

[0180] In one embodiment, after the transmission parameters are determined, the transmission parameters can be encapsulated according to the data transmission protocol between the first client and the data management device, thereby generating and sending a data transmission request to the data management device, so that the data management device can parse the data transmission request and determine the transmission parameters.

[0181] Step E2: Determine a second root identifier of the data requested by the first client based at least on the data index.

[0182] The second root identifier is associated with multiple slice data.

[0183] In one embodiment, if the data requested by the first client is the same as the data uploaded by the second client, the first root identifier and the second root identifier may be the same.

[0184] In one embodiment, for a data management device, there may be an association between the data index of any data it manages and the root identifier corresponding to the data. In this way, once the data index is determined, the second root identifier of the data requested by the first client can be determined based on the data index and the above association.

[0185] Step E3: Obtain the digital signature corresponding to the second root identifier.

[0186] In one embodiment, the digital signature can be generated by a key management module in the data management device; illustratively, the key management module can process the second root identifier, such as the second root CID, through a secure hash algorithm to generate an irreversible message digest, and then encrypt the message digest based on the private key to generate a digital signature, and the digital signature and the second root identifier can be associated with each other. In this way, when the second root identifier is obtained, the corresponding digital signature can be obtained; wherein the secure hash algorithm can include SHA-256.

[0187] In one embodiment, the private key may be generated by a Certificate Authority (CA) associated with the data management device and sent to the key management module.

[0188] Step E4: Generate and send a smart contract to the first client based at least on the second root identifier and the digital signature, so that the first client can parse the smart contract to obtain the digital signature and the first root identifier.

[0189] In one embodiment, the smart contract may include the first client and its users' access time and / or access rights to the data they request.

[0190] In one embodiment, the smart contract may include a second root identifier and a digital signature of the data requested by the first client; exemplarily, the smart contract may also include data usage conditions for the data requested by the first client, wherein the above-mentioned data usage conditions may include the number of access times, the number of download times, the access duration, and the file storage duration; exemplarily, the smart contract may also construct counters corresponding to the data usage conditions respectively, determine the upper limit value of each counter, and initialize the count number of each counter to 0, so as to constrain and manage the first client's access to or usage status of the data requested.

[0191] In one embodiment, for the same client, the smart contract may vary depending on the source, type, privacy level of the data requested by the client and the time when the data transmission request is sent.

[0192] In one embodiment, the smart contract may vary from client to client.

[0193] In one embodiment, after obtaining the digital signature and the second root identifier, the first client can use them to perform identity authentication and security verification on the second root identifier, and can also decrypt the data it requested to obtain the requested plaintext data.

[0194] From the above, it can be seen that in the data transmission method provided in the embodiment of the present application, the data management device parses the data transmission request, determines the transmission parameters sent by the first client, which at least include the data index of the data requested by it, and determines the second root identifier of the data requested by the first client at least based on the data index, and the second root identifier is associated with multiple slice data. In this way, by parsing the data transmission request, the second root identifier can be accurately located; and after obtaining the digital signature corresponding to the second root identifier, a smart contract is generated and sent to the first client based on at least the second root identifier and the digital signature. In this way, through the above operations, a direct association between the smart contract and the second root identifier and the digital signature is achieved, and an indirect association between the smart contract and the data transmission request is also achieved, thereby improving the degree of coupling between the smart contract and the data transmission request actually received by the data management device, thereby improving the pertinence and security of the smart contract; on this basis, the smart contract is sent to the first client for the first client to parse the smart contract to obtain the digital signature and the first root identifier, thereby providing data support for the first client to subsequently verify and decrypt the data.

[0195] Based on the foregoing embodiment, in the data transmission method provided in the embodiment of the present application, before generating and sending the smart contract to the first client based on at least the second root identifier and the digital signature, the following operations may also be performed:

[0196] Step F1: Generate public key and private key.

[0197] In one embodiment, the key management module of the data management device can generate public keys and private keys through its associated CA; illustratively, the public keys and private keys can be generated through a specific encryption algorithm; wherein the specific encryption algorithm may include Rivest-Shamir-Adleman (RSA) or Elliptic Curve Cryptography (ECC).

[0198] Step F2: Generate a digital signature based on the private key and the second root identifier.

[0199] The first client is used to obtain the public key and verify the second root identifier based at least on the public key and the digital signature.

[0200] In one implementation, the message digest corresponding to the second root identifier may be encrypted based on the private key to generate a digital signature.

[0201] Figure 4 A schematic diagram of the digital signature generation process provided in the embodiment of the present application is shown in FIG. Figure 4As shown, after the second root CID, i.e., the second root identifier, is determined, the second root identifier is processed by a secure hash algorithm to generate a message digest, and then the message digest is encrypted with a private key to obtain a digital signature.

[0202] In one embodiment, after the public key is generated, the data management device may embed the public key into a digital certificate issued by the CA and provide a URL link pointing to the digital certificate for the first client to obtain the digital certificate based on the link, thereby enabling the first client to obtain the public key.

[0203] In one embodiment, after the first client obtains the second CID and digital signature from the smart contract and obtains the public key, it can decrypt the digital signature based on the public key to obtain a message digest, and simultaneously use a secure hash algorithm to perform a digest calculation on the second CID to obtain a calculation result. If the calculation result is the same as the message digest obtained by decryption, it can be determined that the second CID received by the first client is a secure and complete CID.

[0204] In one embodiment, when the first client determines that the second CID is in a complete security state, the first data managed by the data management device can be accessed based on the second CID.

[0205] As can be seen from the above, in the data transmission method provided in the embodiments of the present application, after the data management device generates the public key and private key, it generates a digital signature based on the private key and the second root identifier. After the first client obtains the public key, it verifies the second root identifier based on the public key and the digital signature. Thus, through this method, the security of the second root identifier during transmission between the data management device and the first client is improved, and the first client can also achieve secure authentication of the second root identifier.

[0206] Based on the foregoing embodiment, in the data transmission method provided in the embodiment of the present application, the smart contract also includes a first list and a second list; wherein the first list includes a list of data access permissions associated with the first client; and the second list includes a list of privacy levels of data requested by the first client.

[0207] In one embodiment, data access permissions may include the data usage conditions in the aforementioned embodiments; illustratively, data access permissions may include role-based access control (RBAC) and access control lists (ACLs); wherein the ACL may be implemented in the form of a component, which can record the data access operations that the client, user, or node has access to and executes as agreed in the smart contract.

[0208] In practical applications, ACLs can be dynamically managed or updated by administrators of data management devices so that only authorized clients, users, or nodes can perform data access operations specified in smart contracts.

[0209] In one embodiment, the privacy level list may include a list of privacy levels of sub-data included in the first data to which the first client requests access.

[0210] Accordingly, the above method can also perform the following operations:

[0211] The data access operation of the first client within a specified time period is controlled based on the first list; the access policy is determined based on the second list, and the data access operation is decrypted and processed based on the access policy.

[0212] The access operation and the data access operation are associated with the privacy level list.

[0213] In one embodiment, the designated time period may be set or determined by a smart contract; illustratively, the first list may include the designated time period.

[0214] In one embodiment, controlling the data access operation of the first client during a specified time period may be achieved by:

[0215] The data management device tracks and records each access address of the first client, and records the first access number of the first client to each access address, and whether the first access number is equal to the second access number set in the first list. If the first access number is less than the second access number, the first client is enabled to continue accessing the above access address through the IPFS gateway. If the first access number is equal to the second access number, the first client is prohibited from accessing the above access address.

[0216] Illustratively, in the above process, a counter or a timer may be used to manage the number of accesses performed by the first client.

[0217] In one embodiment, after the data usage conditions in the first list are not met or the access time window corresponding to the specified time period expires, the data management device can revoke the data access permission of the first client and perform necessary data cleaning operations.

[0218] In one embodiment, the access policy may include at least one of performing a decryption operation on encrypted data, redirecting access operations on encrypted data, and initiating a file filter driver technology to intercept data access requests through settings in the data management device.

[0219] In one embodiment, the data access operation may include operations such as reading, downloading, copying, and screenshotting the encrypted data.

[0220] In one embodiment, processing data access operations based on access policies can be achieved in the following ways:

[0221] The data access request for the encrypted data sent by the first client is redirected through the file filtering driver technology set in the operating system of the data management device; for example, when the first client attempts to access the encrypted data, the data access request can be intercepted by the file filtering driver technology and redirected to the encryption and decryption module to trigger the encryption and decryption module to desensitize the encrypted data to obtain desensitized data, and then transmit the desensitized data to the file filtering driver program, so that the driver program can send the desensitized data to the first client, thereby realizing control over the first client's access to the encrypted data operation; wherein, the privacy level of the encrypted data can match the privacy level in the privacy level list.

[0222] When the first client sends a data download request for encrypted data, the data management device can also use the application programming interface (API) Hook technology of the application layer software to set a permission identifier for the data file requested to be downloaded by the first client to trigger the underlying software of the operating system to control whether the data file is allowed to be edited, printed, screenshoted, content copied and pasted, saved as, and remote desktop accessed, thereby achieving fine-grained control of each condition in the data usage conditions.

[0223] As can be seen from the above, in the data transmission method provided by the embodiment of the present application, the smart contract also includes a first list and a second list, wherein the first list includes a list of data access permissions associated with the first client, and the second list includes a list of privacy levels of data request data sent by the first client. The first list can be used to control the data access operations of the first client within a specified time period, determine the access policy based on the second list, and process the data access operations based on the access policy, and the access policy and data access operations are associated with the privacy level list. In this way, not only is precise control of the data access operations of the first client in the dimension of data access permissions achieved, but also fine-grained control of the data access operations of the first client can be achieved from the level of the privacy level list of the data itself targeted by the data access operations of the first client.

[0224] Based on the foregoing embodiment, in the data transmission method provided in the embodiment of the present application, decrypting the first slice set to obtain the first private data set can be achieved by the following steps:

[0225] Step G1: Obtain a second key.

[0226] The second key is associated with the first private data in the data file corresponding to the first slice set.

[0227] In one embodiment, the second key may be a CID identifier corresponding to the first private data in the data file corresponding to the first slice set.

[0228] In one implementation, the second root identifier may be parsed to obtain the second key.

[0229] Step G2: Decrypt the private slice data in the first slice set based on the second key to obtain a second encrypted data set.

[0230] In one embodiment, the private slice data may include a set of slice data included in the first slice set and corresponding to the first private data set.

[0231] In one embodiment, the second encrypted data set may be in an encrypted state of a Flink operator of an AES encryption function.

[0232] Step G3: Decrypt the second encrypted data set to obtain the first private data set.

[0233] In one implementation, the encrypted data in the second encrypted data set may be decrypted using a Flink operator based on an AES encryption function to obtain the first private data set.

[0234] Figure 5 The flowchart of obtaining the target file provided in the embodiment of the present application is as follows: Figure 5 As shown, after obtaining the second root CID, that is, the second root identifier, the data management device can obtain CID 1 to CID n according to the second root identifier; wherein CID 1 to CID n are respectively the CID identifiers of the n slices in the first slice set.

[0235] Exemplarily, for the private slice set in the first slice set, the private slice set can be decrypted by the decryption unit based on the second key to obtain a second encrypted data set; at this time, the second encrypted data set and the slice data in the first slice set excluding the private slice set constitute a field encrypted file; exemplarily, at this time, the second encrypted data in the field encrypted file can be decrypted based on the Flink operator of the AES encryption function to obtain the target file, and the target file is sent to the first client.

[0236] Through the above process, targeted decryption of the first slice set corresponding to the second root CID is achieved.

[0237] As can be seen from the above, in the data transmission method provided in the embodiments of the present application, after obtaining the second key, the data processing device decrypts the private slice data in the first slice set using the second key to obtain the encrypted data set. The data processing device then decrypts the second encrypted data set to obtain the first private data set. The second key is associated with the first private data in the data file corresponding to the first slice. Thus, through the above method, targeted decryption of the private slice data in the first slice set is achieved.

[0238] Figure 6 This is a schematic diagram of the data transmission architecture provided in the embodiment of the present application. Figure 6 As shown, the data transmission architecture 6 may include a data provider, an operation management platform, and a data demander; wherein the operation management platform may correspond to a data management device, and the data provider and the data demander may correspond to the second client and the first client, respectively.

[0239] Exemplarily, after the data provider uploads the source file, the data upload module can identify, encrypt, and replace the private fields of the source file using the method provided in the aforementioned embodiment, thereby obtaining the root CID, i.e., the first root identifier, and sending the root CID to the key management module.

[0240] Exemplarily, the key management module can obtain the public key and private key from the CA, and generate a digital signature based on the private key and the root CID; exemplarily, when the data demander sends a data transmission request or a data access request to the operation management platform, the operation management platform can generate a smart contract based on the digital signature through the contract generation module, and send the smart contract to the data usage module.

[0241] Exemplarily, the contract generation module can provide clear operating permissions for data providers, data demanders, and data operation management platform administrators based on the RBAC and ACL mechanisms, thereby improving the stability of the data transmission architecture and the security of the data; exemplarily, the roles of data providers and data demanders can be granted only the permission to view smart contracts, so that data providers and data demanders can read the content of smart contracts but cannot modify or edit the smart contracts; exemplarily, the administrator role of the data management platform can have more advanced permissions, which may include the permission to create new contracts, modify existing contracts, and maintain the system's ACL.

[0242] Exemplarily, the data usage module can also download the digital certificate from the CA to obtain the public key, and then verify the digital signature in the smart contract based on the public key to determine the security and legitimacy of the root CID; exemplarily, the data control module can also manage different data access requests based on the first list and the second list in the smart contract.

[0243] Through the above architecture, the advantages of IPFS in data transmission and storage are fully utilized, thereby reducing the probability of single point failure during data upload; and, by combining IPFS with the stream processing framework, IPFS can perform efficient and precise slicing according to privacy field identifiers, and perform targeted and flexible encryption of slice data corresponding to private data; at the same time, through the data control module, different control methods are adopted to improve the compliance and security of the data usage module during data access operations.

[0244] Based on the above embodiments, the present application also provides a data transmission device. Figure 7 A schematic diagram of the structure of the data transmission device provided in the embodiment of the present application is shown as follows: Figure 7 As shown, the data transmission device 7 may include:

[0245] Determining module 701 is configured to determine first data in response to a data transmission request sent by a first client; wherein the first data includes a plurality of slice data; the plurality of slice data includes at least a first slice set in a target encryption state and a second slice set not in the target encryption state; the first slice set corresponds to a first private data set having a privacy level greater than or equal to a preset level; the first data corresponds to at least part of data sent by a second client to a data management device; and the privacy level of data corresponding to the second slice set is less than the preset level.

[0246] The processing module 702 is configured to decrypt the first slice set to obtain a first private data set; integrate the first private data set and the second slice set to obtain transmission data; and encrypt the transmission data.

[0247] The transmission module 703 is configured to transmit the encrypted transmission data to the first client.

[0248] In some embodiments, the determining module 701 is configured to determine a second private data set in a source file sent by a second client, the second private data set having a privacy level greater than or equal to a preset level; wherein the second private data set includes the first private data set;

[0249] The processing module 702 is used to encrypt the data in the second private data set to obtain a first encrypted data set; process the source file based on the first encrypted data set to obtain an intermediate file; encrypt the intermediate file to obtain and store a target file; wherein the target file includes at least the first data.

[0250] In some embodiments, the kth encrypted data in the first encrypted data set corresponds to the kth private data in the second private data set; wherein k is an integer greater than or equal to 1 and less than or equal to K; K is greater than 1 and is the number of private data in the second private data set;

[0251] Determination module 701, used to determine the private field identifier;

[0252] The processing module 702 is used to process the encrypted data in the first encrypted data set based on the private field identifier to obtain the identified first encrypted data set; based on the kth data in the identified first encrypted data set, replace the kth private data in the source file to obtain an intermediate file.

[0253] In some embodiments, the determination module 701 is configured to determine a set of offset positions of private field identifiers in the intermediate file;

[0254] The processing module 702 is configured to slice the intermediate file based at least on the offset position set to obtain a third slice set; encrypt part of the slice data in the third slice set to obtain a fourth slice set; determine the fourth slice set as a target file; and store the target file.

[0255] In some embodiments, the determining module 701 is configured to obtain, from the third slice set, a portion of slice data corresponding to the second private data set; and determine a first key based on the first private data in the second private data set.

[0256] The processing module 702 is configured to encrypt the slice data in the portion of the slice data based on the first key to obtain a fourth slice set.

[0257] In some embodiments, the determination module 701 is configured to determine a slice identifier set corresponding to the slice data in the fourth slice set; and determine a first root identifier corresponding to the target file based on the slice identifier set.

[0258] In some embodiments, the determination module 701 is configured to parse the data transmission request and determine transmission parameters sent by the first client; wherein the transmission parameters include at least a data index of the data requested by the first client; and determine a second root identifier of the data requested by the first client based at least on the data index; wherein the second root identifier is associated with the plurality of slice data.

[0259] Processing module 702 is used to obtain a digital signature corresponding to the second root identifier; based at least on the second root identifier and the digital signature, generate and send a smart contract to the first client, so that the first client can parse the smart contract to obtain the digital signature and the second root identifier.

[0260] In some embodiments, the processing module 702 is used to generate a public key and a private key; generate a digital signature based on the private key and the second root identifier; wherein the first client is used to obtain the public key and verify the second root identifier based on at least the public key and the digital signature.

[0261] In some embodiments, the smart contract further includes a first list and a second list; wherein the first list includes a list of data access permissions associated with the first client; and the second list includes a list of privacy levels of data requested by the first client.

[0262] Processing module 702 is used to control the data access operation of the first client within a specified time period based on the first list; determine the access policy based on the second list, and process the data access operation based on the access policy; wherein the access policy and data access operation are associated with the privacy level list.

[0263] In some embodiments, the processing module 702 is configured to obtain a second key; wherein the second key is associated with the first private data in the data file corresponding to the first slice set;

[0264] The processing module 702 is configured to decrypt the private slice data in the first slice set based on the second key to obtain a second encrypted data set; and decrypt the second encrypted data set to obtain the first private data set.

[0265] Based on the above embodiments, the present application also provides a data management device. Figure 8 A schematic diagram of the structure of the data management device provided in the embodiment of the present application is shown as follows: Figure 8 As shown, the data management device 8 includes a processor 801 and a memory 802; the memory 802 stores a computer program; when the computer program is executed by the processor 801, it can implement any of the above data transmission methods.

[0266] Based on the foregoing embodiments, an embodiment of the present application further provides a computer-readable storage medium, which stores a computer program; when the computer program is executed by a processor of an electronic device, it can implement any of the foregoing data transmission methods.

[0267] Based on the foregoing embodiments, an embodiment of the present application further provides a computer program product, which includes a computer program; when the computer program is executed by a processor of an electronic device, it can implement any of the foregoing data transmission methods.

[0268] The above description of the various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced with each other and will not be repeated herein for the sake of brevity.

[0269] The methods disclosed in the various method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0270] The features disclosed in the various product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0271] The features disclosed in the various method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0272] It should be noted that the above-mentioned computer-readable storage medium can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory (Flash Memory), a magnetic surface storage, an optical disc, or a compact disc read-only memory (CD-ROM); it can also be various electronic devices that include one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0273] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0274] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0275] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus necessary general hardware nodes, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0276] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0277] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0278] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0279] The above are only preferred embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A data transmission method, characterized in that: The method comprises: In response to a data transmission request sent by a first client, a data management device determines first data; wherein the first data includes a plurality of slice data; the plurality of slice data includes at least a first slice set in a target encryption state and a second slice set not in the target encryption state; the first slice set corresponds to a first private data set whose privacy level is greater than or equal to a preset level; the first data corresponds to at least part of data sent by a second client to the data management device; the privacy level of data corresponding to the second slice set is less than the preset level; Decrypting the first slice set to obtain the first private data set; Integrate the first private data set and the second slice set to obtain transmission data; The transmission data is encrypted, and the encrypted transmission data is transmitted to the first client.

2. The method according to claim 1, characterized in that Before the data management device determines the first data in response to the data transmission request sent by the first client, the method further includes: Determine a second private data set in the source file sent by the second client, the privacy level of which is greater than or equal to the preset level; wherein the second private data set includes the first private data set; Encrypting the data in the second private data set to obtain a first encrypted data set; Processing the source file based on the first encrypted data set to obtain an intermediate file; The intermediate file is encrypted to obtain and store a target file; wherein the target file at least includes the first data.

3. The method according to claim 2, characterized in that The kth encrypted data in the first encrypted data set corresponds to the kth private data in the second private data set; wherein k is an integer greater than or equal to 1 and less than or equal to K; K is greater than 1 and is the number of private data in the second private data set; the processing of the source file based on the first encrypted data set to obtain an intermediate file includes: Determine the private field identifier; Processing the encrypted data in the first encrypted data set based on the private field identifier to obtain the identified first encrypted data set; The kth private data in the source file is replaced based on the kth data in the identified first encrypted data set to obtain the intermediate file.

4. The method according to claim 2, characterized in that: The step of encrypting the intermediate file to obtain and store the target file includes: Determine a set of offset positions of private field identifiers in the intermediate file; Slicing the intermediate file based at least on the offset position set to obtain a third slice set; A fourth slice set is obtained by encrypting part of the slice data in the third slice set, and the fourth slice set is determined as the target file, and the target file is stored.

5. The method according to claim 4, characterized in that The encrypting part of the slice data in the third slice set to obtain a fourth slice set includes: Acquire the portion of slice data corresponding to the second private data set from the third slice set; Determine a first key based on the first private data in the second private data set; The slice data in the partial slice data is encrypted based on the first key to obtain the fourth slice set.

6. The method according to claim 4 or 5, characterized in that: The method further comprises: Determine a slice identifier set corresponding to the slice data in the fourth slice set; A first root identifier corresponding to the target file is determined based on the slice identifier set.

7. The method according to claim 1, characterized in that Before the data management device determines the first data, the method further includes: Parsing the data transmission request to determine the transmission parameters sent by the first client; wherein the transmission parameters at least include a data index of the data requested by the first client; Determine a second root identifier of the data requested by the first client based at least on the data index; wherein the second root identifier is associated with the plurality of slice data; Obtaining a digital signature corresponding to the second root identifier; At least based on the second root identifier and the digital signature, a smart contract is generated and sent to the first client, so that the first client can parse the smart contract to obtain the digital signature and the second root identifier.

8. The method according to claim 7, characterized in that Before generating and sending the smart contract to the first client based at least on the second root identifier and the digital signature, the method further includes: Generate public and private keys; The digital signature is generated based on the private key and the second root identifier; wherein the first client is used to obtain the public key and verify the second root identifier based at least on the public key and the digital signature.

9. The method according to claim 7, characterized in that: The smart contract further includes a first list and a second list; wherein the first list includes a list of data access permissions associated with the first client; the second list includes a list of privacy levels of data requested by the first client; the method further includes: controlling data access operations of the first client within a specified period of time based on the first list; An access policy is determined based on the second list, and the data access operation is processed based on the access policy; wherein the access policy and the data access operation are associated with the privacy level list.

10. The method according to claim 1, characterized in that The decrypting the first slice set to obtain the first private data set includes: Obtain a second key; wherein the second key is associated with the first private data in the data file corresponding to the first slice set; Decrypting the private slice data in the first slice set based on the second key to obtain a second encrypted data set; The second encrypted data set is decrypted to obtain the first private data set.

11. A data transmission device, characterized in that: The data transmission device comprises: A determination module, configured to determine first data in response to a data transmission request sent by a first client; wherein the first data includes a plurality of slice data; the plurality of slice data includes at least a first slice set in a target encryption state and a second slice set not in the target encryption state; the first slice set corresponds to a first private data set having a privacy level greater than or equal to a preset level; the first data corresponds to at least part of data sent by a second client to the data management device; the privacy level of the data corresponding to the second slice set is less than the preset level; A processing module, configured to decrypt the first slice set to obtain the first private data set; integrate the first private data set and the second slice set to obtain transmission data; and encrypt the transmission data; The transmission module is used to transmit the encrypted transmission data to the first client.

12. A data management device, characterized in that: The data management device comprises a processor and a memory; a computer program is stored in the memory; when the computer program is executed by the processor, the data transmission method according to any one of claims 1 to 10 can be implemented.

13. A computer-readable storage medium, characterized in that: The storage medium stores a computer program; when the computer program is executed by a processor of an electronic device, the data transmission method according to any one of claims 1 to 10 can be implemented.

14. A computer program product, characterized in that The program product includes a computer program; when the computer program is executed by a processor of an electronic device, it can implement the data transmission method as described in any one of claims 1 to 10.

Images