Data transmission method, apparatus, device, medium, and program product

Abstract

The application discloses a data transmission method, device, equipment, medium and program product; comprising: in response to a data transmission request sent by a first client, a data management device determines first data; the first data includes a plurality of slice data; the plurality of slice data at least includes a first slice set in a target encryption state and a second slice set not in the target encryption state; the first slice set corresponds to a first private data set with a privacy level greater than or equal to a preset level; the first data corresponds to at least part of data sent by a second client to the data management device; the privacy level of data corresponding to the second slice set is less than the preset level; the first slice set is decrypted to obtain the first private data set; the first private data set and the second slice set are integrated to obtain transmission data; the transmission data is encrypted, and the encrypted transmission data is transmitted to the first client. The scheme can meet the demand of private data safe transmission.

Description

Technical Field

[0001] This application relates to the field of data transmission technology, and in particular to a data transmission method, apparatus, device, medium, and program product. Background Technology

[0002] In data transmission scenarios, data storage devices typically store source files sent by the originating device using content addressing and block storage. Furthermore, the data storage device divides the source file into data blocks ranging in size from 256KB to MB based on its content boundaries. However, this data segmentation and storage operation cannot protect and process important data within the source file, thus failing to meet the security requirements for data transmission between different devices or systems. Summary of the Invention

[0003] Based on the above technical problems, embodiments of this application provide a data transmission method, apparatus, device, medium, and program product.

[0004] The technical solution provided in this application is as follows:

[0005] This application first provides a data transmission method, the method including:

[0006] In response to a data transmission request sent by a first client, a data management device determines first data; wherein the first data includes multiple slice data; the multiple slice data includes at least a first slice set in a target encryption state and a second slice set not in the target encryption state; the first slice set corresponds to a first private data set with a privacy level greater than or equal to a preset level; the first data corresponds to at least a portion of the data sent by the second client to the data management device; the privacy level of the data corresponding to the second slice set is less than the preset level;

[0007] Decrypt the first slice set to obtain the first private data set;

[0008] The first private data set and the second slice set are integrated to obtain the transmission data;

[0009] The transmitted data is encrypted, and the encrypted transmitted data is transmitted to the first client.

[0010] In some embodiments, before the data management device determines the first data in response to a data transmission request sent by the first client, the method further includes:

[0011] A second set of private data in the source file sent by the second client is determined to have a privacy level greater than or equal to the preset level; wherein, the second set of private data includes the first set of private data;

[0012] Encrypt the data in the second private data set to obtain the first encrypted data set;

[0013] The source file is processed based on the first encrypted data set to obtain an intermediate file;

[0014] The intermediate file is encrypted to obtain and store the target file; wherein the target file includes at least the first data.

[0015] In some embodiments, the k-th encrypted data in the first encrypted data set corresponds to the k-th private data in the second private data set; wherein, k is an integer greater than or equal to 1 and less than or equal to K; K is greater than 1 and is the number of private data in the second private data set; the step of processing the source file based on the first encrypted data set to obtain an intermediate file includes:

[0016] Determine the identifier for the private field;

[0017] Based on the private field identifier, the encrypted data in the first encrypted data set is processed to obtain the first encrypted data set after identifier;

[0018] Based on the k-th data in the first encrypted data set after identification, the k-th private data in the source file is replaced to obtain the intermediate file.

[0019] In some embodiments, encrypting the intermediate file to obtain and store the target file includes:

[0020] Determine the set of offset positions of the private field identifiers in the intermediate file;

[0021] The intermediate file is sliced ​​based at least on the set of offset positions to obtain a third set of slices;

[0022] A portion of the slice data in the third slice set is encrypted to obtain a fourth slice set, and the fourth slice set is determined as the target file and stored.

[0023] In some embodiments, encrypting a portion of the slice data in the third slice set to obtain the fourth slice set includes:

[0024] Obtain the partial slice data corresponding to the second private data set from the third slice set;

[0025] The first key is determined based on the first piece of private data in the second set of private data;

[0026] The slice data in the partial slice data is encrypted based on the first key to obtain the fourth slice set.

[0027] In some embodiments, the method further includes:

[0028] Determine the set of slice identifiers corresponding to the slice data in the fourth slice set;

[0029] The first root identifier corresponding to the target file is determined based on the slice identifier set.

[0030] In some embodiments, before the data management device determines the first data, the method further includes:

[0031] The data transmission request is parsed to determine the transmission parameters sent by the first client; wherein the transmission parameters include at least the data index of the data requested by the first client.

[0032] The second root identifier of the data requested by the first client is determined at least based on the data index; wherein the second root identifier is associated with the plurality of slice data;

[0033] Obtain the digital signature corresponding to the second root identifier;

[0034] Based at least on the second root identifier and the digital signature, a smart contract is generated and sent to the first client, so that the first client can parse the smart contract to obtain the digital signature and the second root identifier.

[0035] In some embodiments, before generating and sending the smart contract to the first client based at least on the second root identifier and the digital signature, the method further includes:

[0036] Generate public and private keys;

[0037] The digital signature is generated based on the private key and the second root identifier; wherein the first client is used to obtain the public key and verify the second root identifier based at least on the public key and the digital signature.

[0038] In some embodiments, the smart contract further includes a first list and a second list; wherein the first list includes a list of data access permissions associated with the first client; the second list includes a list of the privacy levels of data requested by the first client; the method further includes:

[0039] The data access operations of the first client within a specified time period are controlled based on the first list;

[0040] An access policy is determined based on the second list, and the data access operation is processed based on the access policy; wherein the access policy and the data access operation are associated with the privacy level list.

[0041] In some embodiments, decrypting the first slice set to obtain the first private data set includes:

[0042] Obtain a second key; wherein the second key is associated with the first private data in the data file corresponding to the first slice set;

[0043] Based on the second key, the private data in the first slice set is decrypted to obtain the second encrypted data set;

[0044] Decrypt the second encrypted data set to obtain the first private data set.

[0045] This application embodiment also provides a data transmission device, the data transmission device comprising:

[0046] A determination module is configured to determine first data in response to a data transmission request sent by a first client; wherein the first data includes multiple slice data; the multiple slice data includes at least a first slice set in a target encryption state and a second slice set not in the target encryption state; the first slice set corresponds to a first private data set with a privacy level greater than or equal to a preset level; the first data corresponds to at least a portion of the data sent by the second client to the data management device; the privacy level of the data corresponding to the second slice set is less than the preset level;

[0047] The processing module is used to decrypt the first slice set to obtain the first private data set; integrate the first private data set and the second slice set to obtain the transmission data; and encrypt the transmission data.

[0048] The transmission module is used to transmit the encrypted transmission data to the first client.

[0049] This application also provides a data management device, which includes a processor and a memory; the memory stores a computer program; when the computer program is executed by the processor, it can implement the data transmission method as described above.

[0050] This application also provides a computer-readable storage medium storing a computer program; when the computer program is executed by a processor of an electronic device, it can implement the data transmission method as described above.

[0051] This application also provides a computer program product, which includes a computer program; when the computer program is executed by the processor of an electronic device, it can implement the data transmission method as described above.

[0052] The data transmission request provided in this application embodiment involves a data management device responding to a data transmission request sent by a first client to determine first data. The first data includes multiple slice data, including a first slice set in a target encryption state and a second slice set not in a target encryption state. The first slice set corresponds to a first private data set with a privacy level greater than or equal to a preset level, while the data corresponding to the second slice set has a privacy level less than the preset level. Therefore, the data management device can manage the security of different slice data corresponding to private data based on the relationship between the data's privacy level and the preset level, thereby improving the security of the first slice set corresponding to the first private data set with a privacy level greater than or equal to the preset level. Since the second slice set is not in the target encryption state, the privacy level of the data corresponding to the second slice set is lower than the preset level. This allows for differentiated encryption processing of data with different privacy levels, reducing the computational load caused by uniform encryption of all data. Simultaneously, by decrypting the first slice set, a first private data set is obtained. Integrating the first private data set with the second slice set yields the transmitted data. This achieves targeted decryption of the first slice set and improves the integrity and comprehensiveness of the transmitted data. Furthermore, by encrypting the transmitted data and transmitting the encrypted data to the first client, the security of data transmission between the data management device and the first client is improved. In summary, the technical solution provided by this application can perform differentiated encryption processing on data with different privacy levels and improve the security of data transmission between the data management device and the first client, thereby meeting the security requirements for storage of data with different privacy levels on the data management device and for transmission between the data management device and the first client. Attached Figure Description

[0053] Figure 1 A flowchart illustrating the data transmission method provided in an embodiment of this application;

[0054] Figure 2 A schematic diagram of the first identifier generation process provided in an embodiment of this application;

[0055] Figure 3 This is a schematic diagram of the structure generated by the first identifier provided in an embodiment of this application;

[0056] Figure 4 A schematic diagram illustrating the digital signature generation process provided in this application embodiment;

[0057] Figure 5 This is a schematic diagram of the process for obtaining the target file provided in an embodiment of this application;

[0058] Figure 6 This is a schematic diagram of the data transmission architecture provided in the embodiments of this application;

[0059] Figure 7 This is a schematic diagram of the structure of the data transmission device provided in the embodiments of this application;

[0060] Figure 8 This is a schematic diagram of the structure of the data management device provided in the embodiments of this application. Detailed Implementation

[0061] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0062] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0063] In actual data circulation and data transmission schemes, it is impossible to simultaneously address the needs of user identity authentication, data content protection, and data usage control. This leads to concerns among data providers about data duplication, unauthorized use, and secondary circulation after data circulation and sharing. Consequently, data providers have low willingness and significant concerns about data circulation and sharing, resulting in situations where both data providers and data users are unable, unwilling, or unable to circulate data.

[0064] Furthermore, in actual data circulation and data transmission schemes, for datasets and data reports, data providers typically use Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS) to upload or deliver data files, implemented through a request-response model. For example, in the data delivery platform of the Data Switching Service Network (DSSN) project, if the dataset or data report is large and the network stability is insufficient, upload failures are likely to occur when the data provider uploads the dataset or data report via HTTP. Therefore, the above scheme has at least the following drawbacks: downloading files from a single server at a time leads to low data transmission or delivery efficiency; data transmission status depends on server performance and network resources, resulting in excessively high network bandwidth costs during data transmission; data copying operations also require significant storage space; and as the centralization of servers and providers increases, network censorship is strengthened.

[0065] To address the shortcomings of the aforementioned solutions, related technologies also provide a technical approach for data transmission via distributed storage and file systems in the InterPlanetary File System (IPFS). Compared to downloading files from a single server via HTTP, this solution utilizes multi-node distributed storage and enables efficient distribution of large amounts of data through content-based addressing.

[0066] In practical applications, IPFS stores data files using content-addressed and block-based storage. It divides data files into blocks based on a distributed hash table algorithm, which can divide the file data stream into blocks ranging from 256KB to 1MB according to content boundaries. However, this approach is not aligned with real-world data sharing scenarios, thus failing to provide corresponding protection for sensitive data. Furthermore, IPFS does not encrypt the resulting data blocks. Therefore, it cannot meet the security requirements for data transmission between different devices or systems.

[0067] Based on the above technical problems, embodiments of this application provide a data transmission method, apparatus, device, medium, and program product.

[0068] This application first provides a data transmission method. Figure 1 This is a flowchart illustrating the data transmission method provided in an embodiment of this application, as shown below. Figure 1As shown, the method may include the following steps:

[0069] Step 101: In response to the data transmission request sent by the first client, the data management device determines the first data.

[0070] The first data includes multiple slice data; the multiple slice data includes at least a first slice set in the target encryption state and a second slice set not in the target encryption state; the first slice set corresponds to a first private data set with a privacy level greater than or equal to a preset level; the first data corresponds to at least a portion of the data sent by the second client to the data management device; the privacy level of the data corresponding to the second slice set is less than the preset level.

[0071] In one implementation, the first client may include a client device that requests data; for example, the first client may include a physical machine device or a virtual machine device.

[0072] In one implementation, the data management device can be used to store data, manage data, and receive and respond to data transmission requests. Exemplarily, the data management device can also implement permission management for a first client and / or a second client, wherein the second client can provide data to the data management device for slicing, encrypting, and distributing the provided data. Exemplarily, permission management can include managing the permissions of the first client and / or the second client to the data management device's data storage space, the access time of the stored data, the number of accesses, and whether access is permitted.

[0073] In one implementation, the data management device can be built on IPFS and Apache Flink.

[0074] In one implementation, the second client may include a physical machine device or a virtual machine device, which can send data to the data management device.

[0075] In one implementation, the target encryption state may include a state of encryption based on a specified key; for example, the specified key may be associated with or correspond to private data in a first set of private data.

[0076] In one implementation, the first private data set may include a set of sensitive or secret data transmitted by the second client to the data management device.

[0077] In one implementation, the data transmission request may include a data identifier of the data requested to be transmitted by the first client. In this way, when the data management device determines that the first client has data access rights, it can filter the data set it manages based on the data identifier to determine the first data. For example, the data identifier may include the data name, number, and storage path, etc.

[0078] In one implementation, the amount of data in each slice of the first slice set may be the same or different.

[0079] In one implementation, the amount of data in each slice of the second slice set may be the same or different.

[0080] In one implementation, the amount of data in the slice data in the first slice set may be different from the amount of data in the slice data in the second slice set.

[0081] In one implementation, the data management device can perform differentiated segmentation processing on the data sent by the second client to obtain a first segment set and a second segment set. That is, the data management device can perform segmentation processing on data with a privacy level greater than or equal to a preset level differently than it can perform segmentation processing on data with a privacy level less than the preset level. For example, the data management device can also encrypt the segmented data with a privacy level greater than or equal to the preset level so that the encrypted segmented data is in a target encrypted state, while the segmented data with a privacy level less than the preset level can be left unencrypted.

[0082] Step 102: Decrypt the first slice set to obtain the first private data set.

[0083] In one implementation, the first private data set may include multiple private data sets; for example, the first private data set can be obtained in the following way:

[0084] The data management device obtains a designated key associated with the first private data set, and then decrypts the slice data in the first slice set sequentially based on the designated key to obtain the first private data set.

[0085] Step 103: Integrate the first private data set and the second slice set to obtain the transmission data.

[0086] In one implementation, the transmitted data can be represented in the form of a file.

[0087] In one implementation, the transmitted data can be obtained in the following way:

[0088] The private data in the first private data set carries first offset information, and the slice data in the second slice set carries second offset information. At this time, the data management device can perform position integration on the private data in the first private data set and the slice data in the second slice set based on the first offset information and the second offset information to obtain the transmission data. The first offset information can represent the set of position offsets of the private data in the first private data set relative to the first character of the file in which it is located, and the second offset information can include the set of displacement offsets of the slice data in the second slice set relative to the first character of the file in which it is located.

[0089] Step 104: Encrypt the transmitted data and transmit the encrypted data to the first client.

[0090] In one implementation, encrypted data can be transmitted to the first client via a secure connection between the data management device and the first client.

[0091] In one implementation, to ensure secure data transmission between the data transmission device and the first client, the transmitted data can be encrypted, and the encrypted transmitted data can be transmitted to the first client. For example, the key used to encrypt the transmitted data here may be different from the designated key.

[0092] As can be seen from the above, in the data transmission request provided in this application embodiment, the data management device determines the first data in response to the data transmission request sent by the first client. The first data includes multiple slice data, including a first slice set in the target encryption state and a second slice set not in the target encryption state. The first slice set corresponds to a first private data set with a privacy level greater than or equal to a preset level, and the privacy level of the data corresponding to the second slice set is less than the preset level. Therefore, the data management device can perform different security management on the slice data corresponding to the private data according to the relationship between the privacy level of the data and the preset level, thereby improving the security of the first slice set corresponding to the first private data set with a privacy level greater than or equal to the preset level. Furthermore, since the second slice set is not in the target encryption state, the privacy level of the data corresponding to the second slice set is lower than the preset level. This allows for differentiated encryption processing of data with different privacy levels and reduces the computational load caused by uniform encryption of all data. Simultaneously, by decrypting the first slice set, a first private data set is obtained. Integrating the first private data set with the second slice set yields the transmitted data. This achieves targeted decryption of the first slice set and improves the integrity and comprehensiveness of the transmitted data. Based on this, encrypting the transmitted data and transmitting the encrypted data to the first client enhances the security of data transmission between the data management device and the first client. In summary, the technical solution provided by this application can perform differentiated encryption processing on data with different privacy levels and improve the security of data transmission between the data management device and the first client, thereby meeting the security requirements for storing data with different privacy levels on the data management device and for transmitting data between the data management device and the first client.

[0093] Based on the foregoing embodiments, in the data transmission method provided in this application, before the data management device determines the first data in response to the data transmission request sent by the first client, the following steps may also be performed:

[0094] Step A1: Determine the set of second private data in the source file sent by the second client, whose privacy level is greater than or equal to the preset level.

[0095] The second private data set includes the first private data set.

[0096] In one implementation, the data upload module of the data management device can receive source files sent by a second client.

[0097] In one implementation, the data in the second private data set may be sensitive or private data contained in the source file.

[0098] In one implementation, the second private data set can be determined in any of the following ways:

[0099] Before sending the source file, the second client can mark the second private data set in the source file so that the data management device can obtain the second private data set from the source file based on the mark.

[0100] By writing custom processing functions in a Flink application to inspect the source file, the set of privacy fields in the source file is determined, and the set is identified as the second set of private data. For example, this method is suitable for scenarios where the privacy field logic is simple.

[0101] The source file is screened for privacy fields using a Natural Language Processing (NLP) model set in Flink, and the screening results are used to determine the second private data set. For example, this method is applicable to scenarios with logically complex privacy fields.

[0102] Step A2: Encrypt the data in the second private data set to obtain the first encrypted data set.

[0103] In one implementation, the first encrypted data set can be obtained in the following way:

[0104] The data in the second private data set is encrypted according to a pre-set encryption algorithm to obtain the first encrypted data set; for example, the pre-set encryption algorithm can be implemented by the Flink operator of the Advanced Encryption Standard (AES).

[0105] Step A3: Process the source file based on the first encrypted data set to obtain the intermediate file.

[0106] In one implementation, the intermediate file may not contain the first private data set, but may contain the first encrypted data set.

[0107] In one implementation, the intermediate file can be obtained in the following way:

[0108] The third offset information of the first private data set is determined, and then the first private data set in the source file is replaced with the first encrypted data set based on the offset address represented by the third offset information, thereby obtaining the intermediate file.

[0109] Step A4: Encrypt the intermediate file to obtain and store the target file.

[0110] The target file must include at least the first data.

[0111] In one implementation, the target file can be obtained in the following way:

[0112] The intermediate file is sliced ​​to obtain a slice set, and then the slice set is encrypted to obtain and store the target file.

[0113] In one implementation, the target files can be stored in a distributed manner in IPFS.

[0114] As can be seen from the above, the data transmission method provided in this application embodiment achieves automated and intelligent identification of private data in the source file sent by the second client by determining a second private data set whose privacy level is greater than or equal to a preset level, and the second private data set includes a first private data set; furthermore, by encrypting the data in the second private data set to obtain a first encrypted data set, targeted encryption of the private data in the source file is achieved; on the other hand, by processing the source file based on the first encrypted data set to obtain an intermediate file, flexible and targeted processing of the source file based on the first encrypted data set is achieved; on this basis, by encrypting the intermediate file, a target file containing at least the first data is obtained and stored, thus achieving a second encryption of the intermediate file corresponding to the source file sent by the second client, thereby improving the security of the target file stored in the data management device.

[0115] Based on the foregoing embodiments, in the data transmission method provided in this application, the kth encrypted data in the first encrypted data set corresponds to the kth private data in the second private data set; wherein, k is an integer greater than or equal to 1 and less than or equal to K; K is greater than 1 and is the number of private data in the second private data set.

[0116] In one implementation, the private data in the second private data set can be distributed across the source files.

[0117] Accordingly, processing the source file based on the first encrypted data set to obtain the intermediate file can be achieved through the following steps:

[0118] Step B1: Determine the private field identifier.

[0119] In one implementation, the private field identifier can be predetermined or adjusted according to the different source files or the different privacy levels of the private data in the second private data set.

[0120] In one implementation, the private field identifier can be represented in the form of a combination of characters or a combination of numbers; for example, the private field identifier can include a combination of binary numbers, such as 1111100000.

[0121] Step B2: Process the encrypted data in the first encrypted data set based on the private field identifier to obtain the first encrypted data set after identification.

[0122] In one implementation, processing encrypted data in the first encrypted data set based on a private field identifier can be achieved in the following way:

[0123] The private field identifier is used as a prefix and / or suffix for each encrypted data in the first encrypted data set to achieve identification processing of the encrypted data in the first encrypted data set; for example, any encrypted data in the first encrypted data set is

[0124] In the case of EIPFS, the encrypted data following the corresponding identifier can be:

[0125] 1111100000a9a7064fb8005e6b7b6fbfd5f6f5c30c1d5a0a25e4a4fbdc4f0eb9c95a173b06EIPFS1111100000.

[0126] Step B3: Based on the k-th data in the first encrypted data set after identification, replace the k-th private data in the source file to obtain the intermediate file.

[0127] In one implementation, the intermediate file can be obtained in the following way:

[0128] The k-th replacement position is determined based on the offset of the k-th private data in the source file. Then, the k-th private data at the k-th replacement position in the source file is replaced accordingly. When the value of k changes from 1 to K, the above replacement operation is recursively executed to obtain the intermediate file.

[0129] As can be seen from the above, the data transmission method provided in this application, after determining the private field identifier, processes the encrypted data in the first encrypted data set based on the private field identifier to obtain the first encrypted data set after identification. In this way, the first encrypted data set is targetedly marked. On this basis, the k-th private data in the source file is replaced by the k-th data in the first encrypted data set after identification to obtain an intermediate file. In this way, the intermediate file can carry the private field identifiers corresponding to the position and number of the second private data set, thereby improving the intuitiveness and clarity of the distribution state of the first encrypted data set after identification in the intermediate file.

[0130] Based on the foregoing embodiments, the data transmission method provided in this application, which encrypts the intermediate file to obtain and store the target file, can be achieved through the following steps:

[0131] Step C1: Determine the set of offset positions for the private field identifiers in the intermediate file.

[0132] In one implementation, the offset position set may include a set of offset positions of each private field identifier in the intermediate file relative to the first character of the intermediate file.

[0133] In one implementation, the set of offset positions can be achieved in the following way:

[0134] The data in the intermediate file is filtered based on the private field identifiers, the offset position of each private field identifier relative to the first character of the intermediate file is determined, and the set of the above offset positions is determined as the offset position set.

[0135] Step C2: Slice the intermediate file based at least on the offset position set to obtain a third slice set.

[0136] In one approach, the third slice data can be obtained as follows:

[0137] If the amount of consecutive first data in the intermediate file that does not contain a private field identifier is greater than or equal to the first threshold, it indicates that the privacy level of the first data is less than the preset level. In this case, the first data can be divided according to the content boundary to obtain the first division result. If the amount of consecutive second data that does not contain a private field identifier is less than the first threshold, the second data is determined as the second division result. For the third data in the intermediate file other than the first and second data, the third data can be divided according to the offset position set to obtain the third division result represented by the first encrypted data set. Then, according to the offset of the data corresponding to the first division result, the offset of the data corresponding to the second division result, and the offset of the data corresponding to the third division result, the first division result to the third division result are integrated, and the integrated result is determined as the third slice set.

[0138] Step C3: Encrypt a portion of the slice data in the third slice set to obtain the fourth slice set, and then use the fourth slice set as the target file and store it.

[0139] In one implementation, a portion of the slice data may include a third partitioning result, namely, a set of slice data corresponding to the first encrypted data set.

[0140] In one implementation, the fourth slice set can be obtained in the following way:

[0141] A specified key can be predetermined, and then a portion of the slice data can be encrypted based on the specified key to obtain a first encryption result. Then, the set of slice data other than the partial slice data in the fourth slice set and the set of the first encryption result are determined as the fourth slice set.

[0142] As can be seen from the above, in the data transmission method provided in this application embodiment, after determining the set of offset positions of the private field identifiers in the intermediate file, the intermediate file is sliced ​​based at least on the set of offset positions to obtain a third slice set. In this way, targeted slicing processing of the data associated with the private field identifiers in the intermediate file is achieved. Furthermore, a fourth slice set is obtained by encrypting some slice data in the third slice set, and the fourth slice set is determined as the target file and stored. In this way, targeted encryption processing of some slice data in the third slice set is achieved, thereby reducing the probability of excessive computation caused by uniformly encrypting all slice data in the third slice set.

[0143] Based on the foregoing embodiments, the data transmission method provided in this application, which encrypts a portion of the slice data in the third slice set to obtain the fourth slice set, can be achieved through the following steps:

[0144] Step D1: Obtain the partial slice data corresponding to the second private data set from the third slice set.

[0145] Step D2: Determine the first key based on the first private data in the second private data set.

[0146] In one implementation, the first key can be obtained in the following way:

[0147] The content identifier (CID) of the first private data in the second private data set is determined as the first key.

[0148] Step D3: Encrypt the slice data in the partial slice data based on the first key to obtain the fourth slice set.

[0149] In one implementation, symmetric encryption can be performed on each slice data in the partial slice data based on the first key to obtain a second encryption result. Then, the second encryption result and the set of slice data in the third slice set excluding the partial slice data are determined as the fourth slice set.

[0150] As can be seen from the above, the data transmission method provided in this application, after obtaining partial slice data corresponding to the second private data set from the third slice set, determines the first key based on the first private data in the second private data set. In this way, the association between the first key and the first private data in the second private data set is realized, which not only improves the flexibility of determining the first key, but also improves the security of the first key. Furthermore, the slice data in the partial slice data is encrypted based on the first key to obtain the fourth slice set, which realizes targeted encryption processing of the slice data in the third slice data corresponding to the second private data set, thereby improving the security of the slice data corresponding to the second private data set.

[0151] Based on the foregoing embodiments, the data transmission method provided in this application can also perform the following operations:

[0152] Determine the slice identifier set corresponding to the slice data in the fourth slice set; determine the first root identifier corresponding to the target file based on the slice identifier set.

[0153] In one implementation, the slice identifier in the slice identifier set can represent the number or name of the entire slice data in the fourth slice set.

[0154] In one implementation, the slice identifier in the slice identifier set can be the CID of each slice data in the fourth slice set.

[0155] Figure 2A schematic diagram of the first identifier generation process provided in the embodiments of this application, as shown below. Figure 2 As shown, the process may include the following steps:

[0156] Step 201: Privacy field screening.

[0157] For example, the privacy field can be a second set of private data in the source file in the aforementioned example.

[0158] For example, the source file can be screened for privacy fields using the method provided in the foregoing embodiments to obtain a second set of private data.

[0159] Step 202: Privacy field replacement and tagging.

[0160] For example, the privacy field can be encrypted first to obtain a first encrypted data set. After determining the privacy field identifier, the privacy field identifier can be used as the prefix and suffix data of the encrypted data in the first encrypted data set, thereby marking the first encrypted data set corresponding to the privacy field. Then, the marked first encrypted data set can be used to replace the second private data set in the source file to obtain an intermediate file.

[0161] Step 203: Slicing.

[0162] For example, the data in the intermediate file corresponding to the first encrypted data set can be sliced ​​based on the private field identifier, while the data in the intermediate file that is outside the first encrypted data set after being marked can be sliced ​​using a uniform slicing method to obtain a third slice set.

[0163] Step 204: Encrypt data slices.

[0164] For example, a fourth slice set can be obtained by encrypting a portion of the slice data in the third slice set that corresponds to the first encrypted data set based on the first key.

[0165] Step 205: Construct a Directed Acyclic Graph (DAG).

[0166] For example, a DAG can be constructed based on the distributed hash values ​​of the data from each slice in the fourth slice set.

[0167] Step 206: Generate the first CID.

[0168] For example, the first CID can be the first identifier in the aforementioned embodiments.

[0169] Through the above process, not only is dual encryption processing achieved for the second private data set contained in the source file, but also targeted slicing processing is achieved for the encrypted data corresponding to the second private data set, thereby improving the security of the private data in the second private data set from multiple dimensions.

[0170] Figure 3 This is a schematic diagram of the structure generated by the first identifier provided in an embodiment of this application, such as... Figure 3 As shown, the first identifier can be implemented using a combination of IPFS and Flink. Figure 3 As shown, after the source file is sent to Flink's preprocessing unit, the preprocessing unit can perform privacy field screening, privacy field replacement, and tagging operations as described above to obtain an intermediate file, and send the intermediate file to the slicing unit so that the slicing unit can perform the slicing processing operations as provided in the aforementioned embodiments to obtain and send the third slice set to the encryption unit; at this time, the encryption unit can determine the CID of the first private data in the second private data set as the first key p, and encrypt the data in the intermediate file corresponding to the second private data set based on the first key p to obtain the fourth slice set.

[0171] For example, if the fourth slice set includes n slice data, the CID of each slice data can be calculated separately to obtain CID 1 to CID n. Then, a DAG is constructed, and the first root CID, i.e. the first root identifier, is determined and sent to the key management module for subsequent generation of smart contracts. Here, n can be a positive integer greater than 3.

[0172] Through the above structure, leveraging the efficiency and stability of data storage and processing in Flink and IPFS, it is possible to achieve fast and accurate processing of source files of any number of levels, further improve the security of the second private data set in the source files, and provide data support for key management in the key management module.

[0173] As can be seen from the above, the data transmission method provided in this application determines the set of slice identifiers corresponding to the slice data in the fourth slice set, and determines the first root identifier corresponding to the target file based on the set of slice identifiers. Thus, the first root identifier enables fast and accurate indexing and management of the target file, thereby improving the efficiency of the data management device in managing the target file.

[0174] Based on the foregoing embodiments, in the data transmission method provided in this application, before the data management device determines the first data, the following operations may also be performed:

[0175] Step E1: Parse the data transmission request to determine the transmission parameters sent by the first client.

[0176] The transmission parameters include at least the data index of the data requested by the first client.

[0177] In one implementation, the data index may include the name, number, or storage address of the data requested or obtained by the first client.

[0178] In one implementation, when a user browses data managed by a data management device through a first client, the first client can lock the name, number, or storage address of the data managed by the data management device in response to the user's selection operation or instruction input, thereby determining the data index.

[0179] In one implementation, the transmission parameters may further include detailed information such as the user or authentication information of the first client, the data description of the data requested by the first client, the number of times the data is used, and the duration of use; for example, the data description may include the data volume and / or data type of the data requested by the first client.

[0180] In one implementation, after the transmission parameters are determined, the transmission parameters can be encapsulated according to the data transmission protocol between the first client and the data management device, thereby generating and sending a data transmission request to the data management device, so that the data management device can parse the data transmission request and determine the transmission parameters.

[0181] Step E2: Determine the second root identifier of the data requested by the first client based at least on the data index.

[0182] The second identifier is associated with multiple slice data.

[0183] In one implementation, if the data requested by the first client is the same as the data uploaded by the second client, then the first root identifier and the second root identifier can be the same.

[0184] In one implementation, for a data management device, there can be an association between the data index of any data it manages and the root identifier corresponding to the data. Thus, once the data index is determined, the second root identifier of the data requested by the first client can be determined based on the data index and the aforementioned association.

[0185] Step E3: Obtain the digital signature corresponding to the second root identifier.

[0186] In one implementation, the digital signature can be generated by a key management module in a data management device. For example, the key management module can process a second identifier, such as a second CID, using a secure hash algorithm to generate an irreversible message digest. Then, it can encrypt the message digest using a private key to generate a digital signature. The digital signature and the second identifier can be correlated. Thus, once the second identifier is obtained, its corresponding digital signature can be obtained. The secure hash algorithm may include SHA-256.

[0187] In one implementation, the private key can be generated by the Certificate Authority (CA) associated with the data management device and sent to the key management module.

[0188] Step E4: Based at least on the second root identifier and the digital signature, generate and send the smart contract to the first client so that the first client can parse the smart contract to obtain the digital signature and the first root identifier.

[0189] In one implementation, a smart contract may include a first client and its users access time and / or access permissions to the data they request.

[0190] In one implementation, the smart contract may include a second root identifier and digital signature of the data requested by the first client; exemplarily, the smart contract may also include data usage conditions for the data requested by the first client, wherein the data usage conditions may include access counts, download counts, access duration, and file storage duration; exemplarily, the smart contract may also construct counters corresponding to the data usage conditions, determine the upper limit value of each counter, and initialize the count count of each counter to 0, in order to constrain and manage the access or usage status of the data requested by the first client.

[0191] In one implementation, for the same client, the smart contract may vary depending on the source, type, privacy level of the data requested by the client, and the time when the data transmission request is sent.

[0192] In one implementation, the smart contract can vary depending on the client.

[0193] In one implementation, after obtaining the digital signature and the second root identifier, the first client can use the second root identifier for authentication and security verification, and can also decrypt the data it requests to obtain the plaintext data it requests.

[0194] As can be seen from the above, the data transmission method provided in this application involves a data management device parsing a data transmission request to determine the transmission parameters sent by the first client, which include at least the data index of the requested data. The device also determines the second root identifier of the requested data based on the data index, and the second root identifier is associated with multiple data slices. Thus, by parsing the data transmission request, the second root identifier can be accurately located. Furthermore, after obtaining the digital signature corresponding to the second root identifier, a smart contract is generated and sent to the first client, based at least on the second root identifier and the digital signature. Through these operations, a direct association between the smart contract and the second root identifier and the digital signature is achieved, as well as an indirect association between the smart contract and the data transmission request. This improves the coupling between the smart contract and the data transmission request actually received by the data management device, thereby enhancing the smart contract's specificity and security. Based on this, the smart contract is sent to the first client for the first client to parse and obtain the digital signature and the first root identifier, providing data support for the first client to subsequently verify and decrypt the data.

[0195] Based on the foregoing embodiments, in the data transmission method provided in this application, before generating and sending the smart contract to the first client based at least on the second root identifier and digital signature, the following operations may also be performed:

[0196] Step F1: Generate public and private keys.

[0197] In one implementation, the key management module of the data management device can generate public and private keys through its associated CA; for example, public and private keys can be generated through a specific encryption algorithm; wherein, the specific encryption algorithm may include Rivest-Shamir-Adleman (RSA) or Elliptic Curve Cryptography (ECC).

[0198] Step F2: Generate a digital signature based on the private key and the second root identifier.

[0199] The first client is used to obtain the public key and verify the second root identifier based on at least the public key and the digital signature.

[0200] In one implementation, the message digest corresponding to the second identifier can be encrypted based on the private key to generate a digital signature.

[0201] Figure 4 This is a schematic diagram of the digital signature generation process provided in the embodiments of this application, such as... Figure 4As shown, after the second CID, or second identifier, is determined, the second identifier is processed by a secure hash algorithm to generate a message digest. Then, the message digest is encrypted using a private key to obtain a digital signature.

[0202] In one implementation, after the public key is generated, the data management device can embed the public key into a digital certificate issued by a CA and provide a URL link to the digital certificate so that a first client can obtain the digital certificate based on the link, thereby enabling the first client to obtain the public key.

[0203] In one implementation, after the first client obtains the second CID and digital signature from the smart contract and obtains the public key, it can decrypt the digital signature based on the public key to obtain a message digest. At the same time, it uses a secure hash algorithm to calculate the digest of the second CID to obtain a calculation result. If the calculation result is the same as the message digest obtained by decryption, it can be determined that the second CID received by the first client is a secure and complete CID.

[0204] In one implementation, if the first client determines that the second CID is in a fully secure state, it can access the first data managed by the data management device based on the second CID.

[0205] As can be seen from the above, the data transmission method provided in this application involves the data management device generating a public key and a private key, then generating a digital signature based on the private key and the second root identifier. The first client, after obtaining the public key, verifies the second root identifier based on the public key and the digital signature. Thus, this method improves the security of the second root identifier transmitted between the data management device and the first client, and also enables the first client to perform secure authentication of the second root identifier.

[0206] Based on the foregoing embodiments, the data transmission method provided in this application further includes a first list and a second list in the smart contract; wherein, the first list includes a list of data access permissions associated with the first client; and the second list includes a list of the privacy levels of the data requested by the first client.

[0207] In one implementation, data access permissions may include the data usage conditions described in the foregoing embodiments; for example, data access permissions may include role-based access control (RBAC) and access control lists (ACLs); wherein, the ACL can be implemented as a component, which can record whether a client, user, or node has the right to access and execute the data access operations agreed upon in the smart agreement.

[0208] In practical applications, ACLs can be dynamically managed or updated by the administrator of the data management device, ensuring that only authorized clients, users, or nodes can execute the data access operations specified in the smart contract. 。

[0209] In one implementation, the privacy level list may include a list of the privacy levels of sub-data contained in the first data requested by the first client.

[0210] Accordingly, the above method can also perform the following operations:

[0211] The first list controls the data access operations of the first client within a specified time period; the second list determines the access policy, and the data access operations are decrypted and processed based on the access policy.

[0212] In particular, access operations and data access operations are associated with a privacy level list.

[0213] In one implementation, the specified time period can be set or determined by a smart contract; for example, the first list may include the specified time period.

[0214] In one implementation, controlling the data access operations of the first client during a specified time period can be achieved in the following way:

[0215] The data management device tracks and records each access address of the first client, and records the first access count of the first client to each access address. It also records whether the first access count is equal to the second access count set in the first list. If the first access count is less than the second access count, the first client is enabled to continue accessing the above access address through the IPFS gateway. If the first access count is equal to the second access count, the first client is prohibited from accessing the above access address.

[0216] For example, in the above process, a counter or timer can also be used to manage the number of accesses performed by the first client.

[0217] In one implementation, after the data usage conditions in the first list are not met or the access time window corresponding to the specified time period expires, the data management device can revoke the data access permissions of the first client and perform necessary data cleanup operations.

[0218] In one implementation, the access policy may include at least one of the following: performing decryption operations on encrypted data by setting up a data management device, redirecting access operations on encrypted data, and intercepting data access requests by activating file filtering driver technology.

[0219] In one implementation, data access operations may include reading, downloading, copying, and taking screenshots of encrypted data.

[0220] In one implementation, processing data access operations based on access policies can be achieved in the following way:

[0221] By using file filtering driver technology set in the operating system of the data management device, data access requests for encrypted data sent by the first client can be redirected. For example, when the first client attempts to access encrypted data, the file filtering driver technology can intercept the data access request and redirect it to the encryption / decryption module. This triggers the encryption / decryption module to perform desensitization processing on the encrypted data to obtain desensitized data. The desensitized data is then transmitted to the file filtering driver, which then sends the desensitized data back to the first client. This allows control over the first client's access to encrypted data. The privacy level of the encrypted data can be matched with the privacy level in the privacy level list.

[0222] When the first client sends a data download request for encrypted data, the data management device can also use the application programming interface (API) hook technology of the application layer software to set the permission identifier for the data file requested by the first client. This triggers the underlying software of the operating system to control whether the data file is allowed to be edited, printed, screenshotted, copied and pasted, saved as, and remotely accessed. This enables fine-grained control over each condition in the data usage conditions.

[0223] As can be seen from the above, the data transmission method provided in this application embodiment includes a first list and a second list in the smart contract. The first list includes a list of data access permissions associated with the first client, and the second list includes a list of the privacy levels of data request data sent by the first client. The method can control the data access operations of the first client within a specified time period based on the first list, determine an access policy based on the second list, and process data access operations based on the access policy. The access policy and data access operations are associated with the privacy level list. Thus, not only is precise control over the data access operations of the first client achieved in terms of data access permissions, but also fine-grained control over the data access operations of the first client can be achieved from the level of the privacy level list of the data itself targeted by the data access operations.

[0224] Based on the foregoing embodiments, the data transmission method provided in this application, which decrypts the first slice set to obtain the first private data set, can be achieved through the following steps:

[0225] Step G1: Obtain the second key.

[0226] The second key is associated with the first private data in the data file corresponding to the first slice set.

[0227] In one implementation, the second key can be the CID identifier corresponding to the first private data in the data file corresponding to the first slice set.

[0228] In one implementation, the second root identifier can be parsed to obtain the second key.

[0229] Step G2: Decrypt the private data in the first slice set based on the second key to obtain the second encrypted data set.

[0230] In one implementation, the private slice data may include a set of slice data corresponding to the first private data set contained in the first slice set.

[0231] In one implementation, the second encrypted data set may be in an encrypted state by a Flink operator with AES encryption.

[0232] Step G3: Decrypt the second encrypted data set to obtain the first private data set.

[0233] In one implementation, the encrypted data in the second encrypted data set can be decrypted using Flink operators based on AES encryption to obtain the first private data set.

[0234] Figure 5 This is a schematic diagram of the process for obtaining the target file provided in an embodiment of this application, such as... Figure 5 As shown, after obtaining the second root CID, the data management device can obtain CID 1 to CID n based on the second root identifier; where CID 1 to CID n are the CID identifiers of n slices in the first slice set, respectively.

[0235] For example, for the private data set in the first slice set, the private data set can be decrypted by the decryption unit based on the second key to obtain the second encrypted data set; at this time, the second encrypted data set and the slice data in the first slice set excluding the private data set constitute the field encrypted file; for example, at this time, the second encrypted data in the field encrypted file can be decrypted by the Flink operator based on the AES encryption function to obtain the target file, and the target file is sent to the first client.

[0236] Through the above process, targeted decryption of the first slice set corresponding to the second root CID was achieved.

[0237] As can be seen from the above, in the data transmission method provided in this application embodiment, after obtaining the second key, the data processing device decrypts the private data in the first slice set based on the second key to obtain a second encrypted data set, and then decrypts the second encrypted data set to obtain the first private data set. Furthermore, the second key is associated with the first private data in the data file corresponding to the first slice. Thus, the targeted decryption of the private data in the first slice set is achieved through the above method.

[0238] Figure 6 This is a schematic diagram of the data transmission architecture provided in an embodiment of this application. Figure 6 As shown, the data transmission architecture 6 may include a data provider, an operation management platform, and a data demander; wherein, the operation management platform may correspond to a data management device, and the data provider and the data demander may correspond to a second client and a first client, respectively.

[0239] For example, after the data provider uploads the source file, the data upload module can use the method provided in the foregoing embodiments to identify, encrypt and replace the private fields of the source file to obtain the root CID, i.e. the first root identifier, and send the root CID to the key management module.

[0240] For example, the key management module can obtain public and private keys from the CA and generate a digital signature based on the private key and the root CID; for example, when a data requester sends a data transmission request or data access request to the operation management platform, the operation management platform can generate a smart contract based on the digital signature through the contract generation module and send the smart contract to the data usage module.

[0241] For example, the contract generation module can provide explicit operational permissions to data providers, data requesters, and data operation management platform administrators based on RBAC and ACL mechanisms, thereby improving the stability of the data transmission architecture and the security of the data. For example, the roles of data providers and data requesters can be granted only the permission to view smart contracts, enabling them to read the content of smart contracts but not to modify or edit them. For example, the administrator role of the data management platform can have higher-level permissions, which may include the permission to create new contracts, modify existing contracts, and maintain the system's ACLs.

[0242] For example, the data usage module can also download a digital certificate from the CA to obtain a public key, and then verify the digital signature in the smart contract based on the public key to determine the security and legitimacy of the root CID; for example, the data control module can also manage different data access requests according to a first list and a second list in the smart contract.

[0243] The above architecture fully leverages the advantages of IPFS in data transmission and storage, thereby reducing the probability of single points of failure during data upload. Furthermore, by combining IPFS with a stream processing framework, IPFS can perform efficient and precise slicing according to privacy field identifiers and flexibly encrypt the slice data corresponding to private data. At the same time, through the data management module, different management methods can be adopted to improve the compliance and security of the data access module during data access operations.

[0244] Based on the foregoing embodiments, this application also provides a data transmission device. Figure 7 This is a schematic diagram of the structure of the data transmission device provided in the embodiments of this application, such as... Figure 7 As shown, the data transmission device 7 may include:

[0245] The determining module 701 is used to determine first data in response to a data transmission request sent by a first client; wherein the first data includes multiple slice data; the multiple slice data includes at least a first slice set in a target encryption state and a second slice set not in a target encryption state; the first slice set corresponds to a first private data set with a privacy level greater than or equal to a preset level; the first data corresponds to at least a portion of the data sent by the second client to the data management device; the privacy level of the data corresponding to the second slice set is less than the preset level;

[0246] Processing module 702 is used to decrypt the first slice set to obtain the first private data set; integrate the first private data set and the second slice set to obtain the transmission data; and encrypt the transmission data.

[0247] The transmission module 703 is used to transmit the encrypted transmission data to the first client.

[0248] In some embodiments, the determining module 701 is used to determine a second set of private data in the source file sent by the second client with a privacy level greater than or equal to a preset level; wherein the second set of private data includes a first set of private data;

[0249] The processing module 702 is used to encrypt the data in the second private data set to obtain a first encrypted data set; process the source file based on the first encrypted data set to obtain an intermediate file; encrypt the intermediate file to obtain and store the target file; wherein the target file includes at least the first data.

[0250] In some embodiments, the k-th encrypted data in the first encrypted data set corresponds to the k-th private data in the second private data set; where k is an integer greater than or equal to 1 and less than or equal to K; K is greater than 1 and is the number of private data in the second private data set;

[0251] Module 701 is used to determine the identifier of the private field.

[0252] Processing module 702 is used to process the encrypted data in the first encrypted data set based on the private field identifier to obtain the first encrypted data set after identification; and to replace the k-th private data in the source file with the k-th data in the first encrypted data set after identification to obtain an intermediate file.

[0253] In some embodiments, the determining module 701 is used to determine the set of offset positions identified by the private field in the intermediate file;

[0254] The processing module 702 is used to slice the intermediate file based at least on the offset position set to obtain a third slice set; to encrypt some slice data in the third slice set to obtain a fourth slice set; and to determine the fourth slice set as the target file and store the target file.

[0255] In some embodiments, the determining module 701 is configured to obtain partial slice data corresponding to the second private data set from the third slice set; and determine the first key based on the first private data in the second private data set;

[0256] Processing module 702 is used to encrypt the slice data in a portion of the slice data based on the first key to obtain a fourth slice set.

[0257] In some embodiments, the determining module 701 is used to determine the slice identifier set corresponding to the slice data in the fourth slice set; and to determine the first root identifier corresponding to the target file based on the slice identifier set.

[0258] In some embodiments, the determining module 701 is configured to parse the data transmission request and determine the transmission parameters sent by the first client; wherein the transmission parameters include at least the data index of the data requested by the first client; and determine a second root identifier of the data requested by the first client based at least on the data index; wherein the second root identifier is associated with multiple slice data.

[0259] The processing module 702 is used to obtain the digital signature corresponding to the second root identifier; and to generate and send a smart contract to the first client based at least on the second root identifier and the digital signature, so that the first client can parse the smart contract to obtain the digital signature and the second root identifier.

[0260] In some embodiments, the processing module 702 is used to generate a public key and a private key; and to generate a digital signature based on the private key and a second root identifier; wherein, the first client is used to obtain the public key and to verify the second root identifier based at least on the public key and the digital signature.

[0261] In some embodiments, the smart contract further includes a first list and a second list; wherein the first list includes a list of data access permissions associated with the first client; and the second list includes a list of the privacy levels of the data requested by the first client.

[0262] The processing module 702 is used to control the data access operations of the first client within a specified time period based on a first list; determine the access policy based on a second list; and process the data access operations based on the access policy; wherein the access policy and the data access operations are associated with a privacy level list.

[0263] In some embodiments, the processing module 702 is configured to obtain a second key; wherein the second key is associated with the first private data in the data file corresponding to the first slice set;

[0264] The processing module 702 is used to decrypt the private slice data in the first slice set based on the second key to obtain the second encrypted data set; and to decrypt the second encrypted data set to obtain the first private data set.

[0265] Based on the foregoing embodiments, this application also provides a data management device. Figure 8 This is a schematic diagram of the structure of the data management device provided in the embodiments of this application, such as... Figure 8 As shown, the data management device 8 includes a processor 801 and a memory 802; the memory 802 stores a computer program; when the computer program is executed by the processor 801, it can implement any of the aforementioned data transmission methods.

[0266] Based on the foregoing embodiments, this application also provides a computer-readable storage medium storing a computer program; when the computer program is executed by the processor of an electronic device, it can implement any of the aforementioned data transmission methods.

[0267] Based on the foregoing embodiments, this application also provides a computer program product, which includes a computer program; when the computer program is executed by the processor of an electronic device, it can implement any of the aforementioned data transmission methods.

[0268] The description of the various embodiments above tends to emphasize the differences between the various embodiments. The similarities or similarities between them can be referred to, and for the sake of brevity, they will not be repeated here.

[0269] The methods disclosed in the various method embodiments provided in this application can be arbitrarily combined to obtain new method embodiments without conflict.

[0270] The features disclosed in the various product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0271] The features disclosed in the various method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method or device embodiments.

[0272] It should be noted that the aforementioned computer-readable storage media can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM), etc.; or it can be various electronic devices that include one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0273] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0274] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0275] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware nodes. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0276] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0277] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0278] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0279] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A data transmission method, characterized by, The method includes: In response to a data transmission request sent by a first client, a data management device determines first data; wherein the first data includes multiple slice data; the multiple slice data includes at least a first slice set in a target encryption state and a second slice set not in the target encryption state; the first slice set corresponds to a first private data set with a privacy level greater than or equal to a preset level; the first data corresponds to at least a portion of the data sent by the second client to the data management device; the privacy level of the data corresponding to the second slice set is less than the preset level; Decrypt the first slice set to obtain the first private data set; The first private data set and the second slice set are integrated to obtain the transmission data; The transmitted data is encrypted, and the encrypted transmitted data is transmitted to the first client; The private data in the first private data set carries first offset information, and the slice data in the second slice set carries second offset information; The process of integrating the first private data set and the second slice set to obtain the transmission data includes: Based on the first offset information and the second offset information, the private data in the first private data set and the slice data in the second slice set are integrated to obtain the transmission data; the first offset information represents the set of position offsets of the private data in the first private data set relative to the first character of the file in which it is located, and the second offset information includes the set of displacement offsets of the slice data in the second slice set relative to the first character of the file in which it is located. Before the data management device determines the first data in response to a data transmission request sent by the first client, the method further includes: A second set of private data in the source file sent by the second client is determined to have a privacy level greater than or equal to the preset level; wherein, the second set of private data includes the first set of private data; Encrypt the data in the second private data set to obtain the first encrypted data set; The source file is processed based on the first encrypted data set to obtain an intermediate file; The intermediate file is encrypted to obtain and store the target file; wherein the target file includes at least the first data; The step of processing the source file based on the first encrypted data set to obtain an intermediate file includes: determining the third offset information of the first private data set, and replacing the first private data set in the source file with the first encrypted data set based on the offset address represented by the third offset information to obtain the intermediate file; The process of decrypting the first slice set to obtain the first private data set includes: Obtain a second key; wherein the second key is associated with the first private data in the data file corresponding to the first slice set; Based on the second key, the private data in the first slice set is decrypted to obtain the second encrypted data set; Decrypt the second encrypted data set to obtain the first private data set.

2. The method of claim 1, wherein, The k-th encrypted data in the first encrypted data set corresponds to the k-th private data in the second private data set; where k is an integer greater than or equal to 1 and less than or equal to K; K is greater than 1 and is the number of private data in the second private data set; the step of processing the source file based on the first encrypted data set to obtain an intermediate file includes: Determine the identifier for the private field; Based on the private field identifier, the encrypted data in the first encrypted data set is processed to obtain the first encrypted data set after identification; Based on the k-th data in the first encrypted data set after identification, the k-th private data in the source file is replaced to obtain the intermediate file.

3. The method of claim 1, wherein, The step of encrypting the intermediate file to obtain and store the target file includes: Determine the set of offset positions of the private field identifiers in the intermediate file; The intermediate file is sliced ​​based at least on the set of offset positions to obtain a third set of slices; A portion of the slice data in the third slice set is encrypted to obtain a fourth slice set, and the fourth slice set is determined as the target file and stored.

4. The method of claim 3, wherein, The step of encrypting a portion of the slice data in the third slice set to obtain the fourth slice set includes: Obtain the partial slice data corresponding to the second private data set from the third slice set; The first key is determined based on the first piece of private data in the second set of private data; The slice data in the partial slice data is encrypted based on the first key to obtain the fourth slice set.

5. The method according to claim 3 or 4, characterized in that, The method further includes: Determine the set of slice identifiers corresponding to the slice data in the fourth slice set; The first root identifier corresponding to the target file is determined based on the slice identifier set.

6. The method according to claim 1, characterized in that, Before the data management device determines the first data, the method further includes: The data transmission request is parsed to determine the transmission parameters sent by the first client; wherein the transmission parameters include at least the data index of the data requested by the first client. The second root identifier of the data requested by the first client is determined at least based on the data index; wherein the second root identifier is associated with the plurality of slice data; Obtain the digital signature corresponding to the second root identifier; Based at least on the second root identifier and the digital signature, a smart contract is generated and sent to the first client, so that the first client can parse the smart contract to obtain the digital signature and the second root identifier.

7. The method according to claim 6, characterized in that, Before generating and sending the smart contract to the first client based at least on the second root identifier and the digital signature, the method further includes: Generate public and private keys; The digital signature is generated based on the private key and the second root identifier; wherein the first client is used to obtain the public key and verify the second root identifier based at least on the public key and the digital signature.

8. The method according to claim 6, characterized in that, The smart contract further includes a first list and a second list; wherein, the first list includes a list of data access permissions associated with the first client; the second list includes a list of the privacy levels of data requested by the first client; the method further includes: The data access operations of the first client within a specified time period are controlled based on the first list; An access policy is determined based on the second list, and the data access operation is processed based on the access policy; wherein the access policy and the data access operation are associated with the privacy level list.

9. A data transmission device, characterized in that, The data transmission device includes: A determining module is configured to determine first data in response to a data transmission request sent by a first client; wherein the first data includes multiple slice data; the multiple slice data includes at least a first slice set in a target encryption state and a second slice set not in the target encryption state; the first slice set corresponds to a first private data set with a privacy level greater than or equal to a preset level; the first data corresponds to at least a portion of the data sent by the second client to the data transmission device; the privacy level of the data corresponding to the second slice set is less than the preset level; The processing module is used to decrypt the first slice set to obtain the first private data set; integrate the first private data set and the second slice set to obtain the transmission data; and encrypt the transmission data. The transmission module is used to transmit the encrypted data to the first client; The private data in the first private data set carries first offset information, and the slice data in the second slice set carries second offset information; The transmission module is further configured to perform position integration on the private data in the first private data set and the slice data in the second slice set based on the first offset information and the second offset information to obtain transmission data; the first offset information represents the set of position offsets of the private data in the first private data set relative to the first character of the file in which it is located, and the second offset information includes the set of displacement offsets of the slice data in the second slice set relative to the first character of the file in which it is located. The determining module is used to determine a second set of private data in the source file sent by the second client whose privacy level is greater than or equal to the preset level; wherein, the second set of private data includes the first set of private data; The processing module is used to encrypt the data in the second private data set to obtain a first encrypted data set; process the source file based on the first encrypted data set to obtain an intermediate file; encrypt the intermediate file to obtain and store a target file; wherein the target file includes at least the first data. The processing module is used to determine the third offset information of the first private data set, and based on the offset address represented by the third offset information, to replace the first private data set in the source file with the first encrypted data set to obtain an intermediate file. The processing module is used to obtain a second key; wherein the second key is associated with the first private data in the data file corresponding to the first slice set; decrypt the private slice data in the first slice set based on the second key to obtain a second encrypted data set; and decrypt the second encrypted data set to obtain the first private data set.

10. A data management device, characterized in that, The data management device includes a processor and a memory; the memory stores a computer program; when the computer program is executed by the processor, it can implement the data transmission method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The storage medium stores a computer program; when the computer program is executed by the processor of the electronic device, it can implement the data transmission method as described in any one of claims 1 to 8.

12. A computer program product, characterized in that, The program product includes a computer program; when the computer program is executed by the processor of an electronic device, it is capable of implementing the data transmission method as described in any one of claims 1 to 8.

Images