Client data transmission method for security authentication

Abstract

A security certification client data transmission method comprises a server, a plurality of client computers and a certification microsystem module, and the plurality of client computers are arranged to be at least one computer group; the server is provided with a transmission scheduling module, the transmission scheduling module appoints one client computer as a first client computer on the client computer, and the authentication microsystem module performs security authentication on the client computer; when the data transmission state is 100%, the transmission scheduling module of the server appoints the first client computer to send data to the next computer, and the transmission scheduling module appoints the next computer to send data to the next computer; and the data transmission state information of all the client computers needing data transmission in the computer group is obtained by the transmission scheduling module until the data transmission state information of all the client computers needing data transmission in the computer group is 100%. The rapid configuration and maintenance efficiency of large-capacity system data files of a computer group formed by a large number of computers on the premise of security authentication is effectively improved.

Description

Technical Field

[0001] The invention relates to a secure communication technology, and in particular to a securely authenticated client data transmission method. Background Art

[0002] In the application scenario of centralized computer equipment, learning or office places consisting of multiple or even dozens or hundreds of computers, such as corporate offices and campus computer rooms, may require a large number of computer equipment to form a computer user group for the corresponding users to use together. The maintenance intensity involved in these devices is relatively high, so generally, different methods are used to ensure that each computer maintains the same system configuration and security policy settings before use. When a computer system failure or security problem occurs, the system needs to be reconfigured. The existing method is mainly to download the corresponding system file data directly from the server through the network, and reconfigure the system for each computer separately. In a computer group composed of multiple computers, each computer needs to download data from the server separately, form a local system in the local hard disk, and complete the system configuration. The methods of downloading data mainly include traditional broadcast transmission and BT transmission, but these transmission methods have many disadvantages. For computer groups containing a large number of computers, the configuration maintenance time will be too long and difficult, affecting normal work and study. At the same time, there are also many hidden dangers in the authentication and synchronization of security policies.

[0003] Traditional broadcast transmission methods have obvious disadvantages.

[0004] 1. Transmission range: Technically, broadcast packets cannot pass through VLAN and can only be transmitted in one network segment. In the case of multiple network segments, specially configured switches or agents are required.

[0005] 2. Transmission speed: There are many abnormal situations in broadcast transmission, which have a huge impact on the network environment. When there is a transmission abnormality among multiple machines, all transmission queues will be reduced to the speed of the slowest one. The transmission process may experience abnormal conditions such as packet loss, disconnection, and retransmission.

[0006] 3. Reliability: Under various abnormal circumstances, the success rate of simultaneous interpretation is not high.

[0007] 4. Flexibility: During the simultaneous interpretation process, the same standard environment must be run simultaneously to send and receive simultaneously, and no other operations are allowed during the process.

[0008] 5. Broadcast transmission is broadcast from the beginning to the end. The client joins the transmission according to the queue. In case of abnormal situation, it is broadcast again from the beginning each time.

[0009] Disadvantages of BT transmission method:

[0010] 1. The image file exceeds 200G, and it takes a long time to generate the seed file, which is very unfriendly to mechanical hard drives.

[0011] 2. Every time you update the image, you need to regenerate the seed. Generating the seed for a large image takes time and CPU power.

[0012] 3. Too many transmission threads create huge transmission pressure on the switch.

[0013] 4. The flexibility is not high. The transferred files need to enter a certain system state for centralized transfer before they can be used.

[0014] 5. All machines need to be in the BT state to share and transmit with each other. When only one of the 60 machines is abnormal, the other 59 machines do not enter the transmission state, which is equivalent to point-to-point transmission. BT is only used in the first deployment and does not play a role in daily use.

[0015] 6. In case of abnormal situation, the process will be sent again from the beginning. The process must be completed in one go. If it is not completed, the full transmission will be restarted from the beginning.

[0016] Traditional data transmission methods have high requirements for the configuration of servers and computers, put great pressure on servers and networks, and have a great impact on the network environment. They are less friendly to client computers in computer groups within the local area network of the same IP segment, resulting in low efficiency in system configuration and security authentication of computers in such computer groups, affecting the normal working needs of the computer groups and failing to achieve optimal usage results. Summary of the invention

[0017] The technical problem solved by the present invention is to provide a securely authenticated client data transmission method, which realizes system data replication from server to client and between clients by sector data mapping, and adopts a chain-type data transmission method within a local area network, so as to reduce the configuration requirements of the server and the network and reduce the pressure of network use.

[0018] The technical solution of the present invention is:

[0019] A securely authenticated client data transmission method, comprising a server, a plurality of client computers and an authentication microsystem module, wherein the plurality of client computers are arranged as at least one computer group;

[0020] The server is connected to the client computer via a network, a trusted root system module and a data pointer storage module are installed in the server, the trusted root system module stores a template file of the trusted root system, and the data pointer storage module is used to store a data pointer file from a hard disk of the client computer;

[0021] The server is provided with a transmission scheduling module, the transmission scheduling module collects the network configuration status information and data transmission status information of the client computer, designates a client computer as the first client computer, the authentication microsystem module stores a trusted authentication microsystem for comparing the data information of the server and the client computer; it is started at the same time when the client computer is started, and after the client computer passes the hardware trusted authentication, the data pointer file of the client computer stored on the server is mapped to the designated storage sector of the hard disk of the client computer; the authentication microsystem module compares the data of the trusted root system marked by the data pointer file with the data of the trusted root system of the corresponding storage sector of the hard disk, and performs security authentication on the client computer;

[0022] The server obtains the data transmission status information of the first client computer, and the transmission scheduling module specifies each client computer for subsequent one-to-one transmission, so that all client computers in the computer group that need data transmission form a one-to-one non-repetitive serial chain transmission structure; when the data transmission status of the template file of the first client computer is that the transmission has been started, the transmission scheduling module of the server specifies the first client computer to send data to the next computer in the computer group, and the transmission scheduling module sends the received data in sequence from the next client computer to the last client computer according to the one-to-one connection sequence of the transmission structure, until the transmission scheduling module obtains that the data transmission status information of the template files of all client computers in the computer group that need to transmit data is 100%.

[0023] The client data transmission method with security authentication as described above, wherein, when the client computers of the computer group have not completed 100% of the data reception, and in the transmission structure, one of the client computers other than the first client computer has an abnormality, a waiting strategy is executed to stop the data transmission of all client computers within a specified time interval, waiting for the client computer with the abnormality to restore the normal data transmission connection state; if the client computer restores the normal data transmission connection state, the data transmission state of all client computers is restored; if the client computer cannot be restored within the specified time interval, the transmission scheduling module will remove the abnormal client computer from the sequence of the transmission structure, and connect the two client computers in front and behind the client computer for data transmission, forming a new transmission structure sequence; when the client computer with the abnormality restores the normal connection state, the transmission scheduling module specifies a client computer without an output data task to transmit the file data of the system template to it.

[0024] In the securely authenticated client data transmission method as described above, the server obtains the data transmission status information of the first client computer. When the data transmission status of the template file of the first client computer is that the transmission has been started and the system template file data transmission reaches 100%, the transmission scheduling module specifies the first client computer to send data to the next computer in the computer group according to the one-to-one connection sequence of the transmission structure. When the transmission scheduling module obtains the data transmission status information of the template file of the next computer as 100%, it specifies the next computer to send data to the next computer, until the transmission scheduling module obtains the data transmission status information of the template files of all client computers in the computer group that need to transmit data as 100%.

[0025] The securely authenticated client data transmission method as described above, wherein, when the client computer receiving data has not completed 100% of the data reception, and the client computer sending data has an abnormality and stops sending data; then the transmission scheduling module designates another idle client computer that has completed 100% of the data reception as the client computer sending data according to the selection condition priority order principle, and sends system data to the client computer receiving data; or when the client computer receiving data has an abnormality and stops receiving data; then the transmission scheduling module designates another idle client computer that has not completed data reception as the client computer receiving data according to the selection condition priority order principle.

[0026] The securely authenticated client data transmission method as described above, wherein the transmission scheduling module collects the network configuration status information of the client computer, including the hardware device information of the CPU, hard disk, memory and network card of all client computers in the computer group and the network connection status information, wherein the network connection status information includes the computer client online status, computer group status, operating system status and waiting time; the data transmission status information includes whether the transmitted data is in the state of starting transmission or completing 100% transmission; the transmission scheduling module specifies a client computer to receive data according to the performance of the computer hardware device information and the network connection status information.

[0027] As described above, the securely authenticated client data transmission method, wherein the transmission scheduling module selects the designated client computer for sending data in the following priority order: the client computer is online, the network card speed is high and the network type is the same, the operating system is the same, the data transmission has been started or the transmission status is 100% completed, it is in the same computer group, and the waiting time is short; the transmission scheduling module selects the designated client computer for receiving data in the following selection condition priority order: the client computer is online, the network card speed is high and the network type is the same, the operating system is the same, it is in the same computer group, and the waiting time is short.

[0028] The client data transmission method with security authentication as described above, wherein the transmission scheduling module obtains computer group information of a first client computer designated to receive data, and further comprises confirming that the number of switch levels between the server and the first client computer is less than or equal to the number of switch levels between the server and other client computers in the computer group;

[0029] After the transmission scheduling module obtains 100% data transmission status information of other client computers other than the first client computer and designates the client computer as a client computer for sending data, if there is a first-level switch between another client computer designated as receiving data and the client computer for sending data, the other client computer is a next-level client computer of the switch, and when the number of previous-level client computers that have completed data transmission is greater than or equal to one, the next-level client computer will not be used as a client computer for sending data of the previous-level client computer.

[0030] The client data transmission method with security authentication as described above includes a local security authentication step, wherein the client computer receives 100% of the template file data, and after starting the operating system, starts the local security authentication module, automatically detects the security policy configuration in the client computer, and if it is inconsistent with the preset security policy of the trusted root system stored in the server, the client computer is prohibited from starting, and the server records the system security anomaly information of the computer; and reallocates other authenticated client computers as client computers for sending data according to the instructions, and sends the system data again to the client computer with the security authentication anomaly. After the client computer completes the reception and restarts, it starts the local security authentication module again to perform local security authentication.

[0031] The client data transmission method with security authentication as described above, wherein the hard disk of the client computer is provided with a local trusted root system storage area and a local dynamic data storage area, the local trusted root system storage area is a read-only storage area for loading a template file from the trusted root system of the server, the local dynamic data storage area is an active storage area that allows the client computer to add or modify operations, the data pointer files of the local trusted root system storage area and the local dynamic data storage area are stored in the data pointer storage module of the server, and only the data of the storage sectors with the same data pointer mark are transmitted during data transmission;

[0032] The authentication microsystem module is connected to an I / O control driver, which is used to identify and schedule input and output signals, and judge whether the trusted root system file data requested by the client computer exists in a designated sector of a local trusted root system storage area of ​​its hard disk according to the data pointer file mapped by the authentication microsystem. If not, the server loads the requested trusted root system file data from a template file of the trusted root system to the designated sector, and stores the loaded data pointer file in a data pointer storage module of the server; if it exists, the next designated sector is judged according to the data pointer file mapped by the authentication microsystem;

[0033] The I / O control driver determines the data addition or modification operation of the local dynamic data storage area of ​​the hard disk of the client computer, and sends and stores the data pointer of the storage sector where the addition or modification operation occurs to the data pointer storage module of the server.

[0034] The client data transmission method with security authentication as described above, wherein, after completing 100% data transmission to a first client computer, the server designates the first client computer to transmit data to the next client computer, thereby forming a first data transmission chain; the service designates another first client computer to perform data transmission, and after completing 100% data transmission to the other first client computer, designates the other first client computer to transmit data to the next client computer, thereby forming a second data transmission chain; the client computers in the first data transmission chain and the second data transmission chain are not repeated.

[0035] From the above description, it can be seen that the present invention has the following advantages:

[0036] The client data transmission method with security authentication of the present invention is aimed at the installation and abnormal maintenance of the system with a server and a computer group in a local area network, and realizes the security authentication of the received data. The mapping of sector data and pointer files is adopted to complete the copying and filling of data, and the data transmission control method of the computer group in the local area network is used to complete the chain-type data transmission control of the server and the client computers in the computer group, so that the client computers in the computer group can run at the same time without occupying the server, and the server and the client computer that has completed the transmission can be performed when other client computers are performing data transmission, thereby reducing the network communication pressure for network data transmission and reducing the impact on learning and work; at the same time, the hardware requirements for data transmission on the server, client computers and network configuration are reduced, the use cost is reduced, and the network impact of a large number of client computers performing data transmission and system security authentication is reduced, and the maintenance efficiency of the computers in the computer group is guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A schematic diagram of the structure of data transmission and transmission scheduling in a preferred embodiment of the present invention;

[0038] Figure 2A Schematic diagram of the real-time trusted authentication strategy of the present invention Figure 1 ;

[0039] Figure 2B FIG2 is a schematic diagram of the real-time trusted authentication strategy of the present invention. DETAILED DESCRIPTION

[0040] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, specific embodiments of the present invention are now described with reference to the accompanying drawings.

[0041] A securely authenticated client data transmission method of the present invention is particularly useful in scenarios where a server carries more than dozens to hundreds of machines in a computer room or computer-scale deployment scenario, and the data files that need to be transmitted are relatively large, and the total amount of image files made by the system and software reaches 200G or more, and the files need to be deployed to the hard disk of each machine. The securely authenticated client data transmission method of the present invention can not only realize the security authentication of each client computer, but also make large-scale data transmission no longer need to occupy a large amount of network resources, and also reduce the hardware requirements for servers and client computers, reduce the pressure on servers and networks, minimize the impact on the network environment, and improve the maintenance efficiency of computer groups.

[0042] A securely authenticated client data transmission method of the present invention, in a preferred embodiment, comprises a server, a plurality of client computers and an authentication microsystem module, wherein the plurality of client computers are configured as at least one computer group;

[0043] Reference Figure 1 As shown, the server is connected to the client computer via a network, a trusted root system module and a data pointer storage module are installed in the server, the trusted root system module stores a template file of the trusted root system, and the data pointer storage module is used to store a data pointer file from the hard disk of the client computer;

[0044] The server is provided with a transmission scheduling module, which collects the network configuration status information and data transmission status information of the client computer, designates a client computer as the first client computer, and the authentication microsystem module stores a trusted authentication microsystem for comparing the data information of the server and the client computer; it is started at the same time when the client computer is started, and after the client computer passes the hardware trusted authentication, the data pointer file of the client computer stored on the server is mapped to the designated storage sector of the hard disk of the client computer; the authentication microsystem module compares the data of the trusted root system marked by the data pointer file with the data of the trusted root system of the corresponding storage sector of the hard disk, and performs security authentication on the client computer; after passing the above-mentioned trusted authentication, according to the mapping of the data pointer file on the hard disk of the client computer, the system data is filled in the corresponding sector of the hard disk of the client computer, and then the client computer is started to perform security authentication of the hard disk system sector. Among them, by utilizing the data mapping method of separating the data pointer and the hard disk storage sector, the technology of copying the template file to the storage sector of the target hard disk is completed, so that the transmission method of the present invention performs a one-to-one corresponding security verification while completing the transmission to form a complete template file. Only when the data on the corresponding storage sector of the hard disk of the client computer that completes the data reception is completely consistent with the data content in the data pointer, the system can be started normally. In this way, the first security authentication protection layer is constructed for the transmission method of the present invention.

[0045] In addition to the preliminary authentication, the present invention also adopts a chain-type data transmission mode, and the transmission scheduling module of the server schedules the sender and receiver of the data transmission, so that each client computer can arrange the data transmission operation according to the order of the server. The server obtains the data transmission status information of the first client computer, and the transmission scheduling module specifies each client computer for subsequent one-to-one transmission, and all client computers in the computer group that need data transmission form a one-to-one non-repeating serial chain transmission structure; when the data transmission status of the template file of the first client computer is that the transmission has been started, the transmission scheduling module of the server specifies the first client computer to send data to the next computer in the computer group, and the transmission scheduling module sends the received data in sequence from the next client computer to the last client computer according to the one-to-one connection sequence of the transmission structure, until the transmission scheduling module obtains that the data transmission status information of the template files of all client computers in the computer group that need to transmit data is 100%. In this way, a large number of client computers in a computer group within the same local area network can quickly complete data transmission operations through a chain-type transmission mode. In a preferred embodiment, a form similar to that of all client computers acting as relay stations is adopted. When the first client computer receives data, it immediately transmits the received data to subsequent client computers, forming a real-time synchronous transmission mode, so that all client computers can complete the transmission of file data of the system template in an almost synchronous state; and the server and client computers all implement data transmission operations that depend on the network transmission rate of the network card within the same address segment, such as a 100M network card, a 1G network card, etc., which can achieve a very high transmission rate.

[0046] As described above, the client data transmission method of the security authentication of the present invention, in its preferred embodiment, when the client computers of the computer group have not completed 100% of the data reception, and in the transmission structure, one of the other client computers except the first client computer is abnormal, the waiting strategy is executed, the data transmission of all client computers is stopped within a specified time interval, and the client computer with the abnormality is waited for to restore the normal data transmission connection state; if the client computer restores the normal data transmission connection state, the data transmission state of all client computers is restored; if the client computer cannot be restored within the specified time interval, the transmission scheduling module will remove the abnormal client computer from the sequence of the transmission structure, and the two client computers before and after the client computer are connected to transmit data, forming a new sequence of the transmission structure; when the abnormal client computer restores the normal connection state, the transmission scheduling module specifies a client computer without output data task to transmit the file data of the system template to it. In this way, the problem of interrupted transmission caused by the abnormality of a certain computer is better solved. Preferably, the specified time interval can be a time between 5 seconds and 120 seconds, which can of course be set according to actual needs.

[0047] In another preferred embodiment of the present invention as described above, preferably, the present invention can also adopt a method in which each client computer must complete 100% of the file data transmission of the system template before transmitting data to the next client computer. This method can better provide a more complete security authentication environment and can also better reduce the environmental pressure of network use. In this embodiment, the server obtains the data transmission status information of the first client computer. When the data transmission status of the template file of the first client computer is that the transmission has been started and the data transmission of the system template file reaches 100%, the transmission scheduling module specifies the first client computer to send data to the next computer in the computer group according to the one-to-one connection sequence of the transmission structure. When the data transmission status information of the template file of the next computer obtained by the transmission scheduling module is 100%, the next computer is specified to send data to the next computer, until the transmission scheduling module obtains that the data transmission status information of the template file of all client computers that need to transmit data in the computer group is 100%. In this way, a large number of client computers in a computer group within the same local area network can quickly complete data transmission operations. Through the chain transmission mode, the server and client computers can achieve data transmission operations that rely on the network transmission rate of the network card within the same address segment, such as 100M network cards, 1G network cards, etc., which can achieve very high transmission rates.

[0048] As described above, in the preferred embodiment of the secure authentication client data transmission method of the present invention, when the client computer receiving data has not completed 100% of the data reception, and the client computer sending data has an abnormality and stops sending data; then the transmission scheduling module designates another idle client computer that has completed 100% of the data reception as the client computer sending data according to the selection condition priority order principle, and sends system data to the client computer receiving data; or when the client computer receiving data has an abnormality and stops receiving data; then the transmission scheduling module designates another idle client computer that has not completed the data reception as the client computer receiving data according to the selection condition priority order principle. Preferably, for the case of an abnormal client computer sending data, the present invention adopts the aforementioned transmission scheduling principle, and selects by comparing and judging multiple factors to designate a client computer with better transmission effect to be transmitted first, so that the overall data transmission speed is faster and the network pressure in the computer group is reduced.

[0049] For the above two preferred embodiments of the client data transmission method of the present invention, please refer to Figure 2A and Figure 2B , the server 1 is connected to the client computer 3 via a network, a trusted root system module and a data pointer storage module are installed in the server 1, the trusted root system module stores a template file of the trusted root system, and the data pointer storage module is used to store data pointer files from the client computer 3; wherein, the data pointer file is a necessary data pointer file for starting and identifying data on the hard disk 31 of the client computer. The present invention removes the data pointer files on the hard disks of each client computer 3 and stores them on the server 1, and the client computer 3 is installed with a hard disk 31 capable of loading the trusted root system from the server 1. Thereby, the data on the hard disk 31 of the client computer 3 can be identified, read or written only when the client computer 3 obtains the trust of the server 1 and is connected to the server 1; that is, Figure 2AAs shown, when the client computer 3 is out of the monitoring of the server 1, the data of the storage sector of the hard disk 31 on the client computer 3 will lose the corresponding data pointer, and its data cannot be identified and read, and the hard disk 31 is displayed as an empty hard disk. This is a data splicing technology, which separates the read and write of the hard disk, marks the shareable part, and only transmits the same data as the shared template file between the clients. There is an independent write area on the hard disk of each client computer. After they are spliced ​​with the read-only area, they can present a complete storage partition structure, and then, the operation management strategy of the server synchronization is superimposed, and the client computer can run the system or store data locally. At the same time, 100% completion of data transmission synchronization refers to the full completion of the same template data, and does not include data in other free read and write areas of the client.

[0050] The authentication microsystem module 2 of the present invention stores a trusted authentication microsystem for comparing the data information of the server 1 and the client computer 3. Figure 2A , which is configured between the server 1 and the client computer 3; the authentication microsystem is an authentication system that is started before the system layer of the client computer 3, and is started at the same time when the client computer 3 is started; during the startup and use process of the client computer 3, the authentication microsystem monitors the data changes of the client computer 3 throughout the process, and once the data changes abnormally, it is immediately determined to be untrustworthy. After the client computer 3 passes the hardware trusted authentication, the data pointer file of the client computer 3 stored on the server 1 is mapped to the hard disk 31 of the client computer 3; the authentication microsystem module 2 compares the data of the trusted root system marked by the data pointer file with the data of the trusted root system of the corresponding storage sector of the hard disk 31, and performs real-time trusted authentication on the client computer 3; if the data of the trusted root system marked by the data pointer is inconsistent with the data of the trusted root system of the storage sector, the client computer 3 is determined to be untrustworthy. That is to say, if there is already data on the client computer 3, the server 1 maps the data pointer file corresponding to the hard disk 31 of the client computer 3 to the hard disk 31 and activates the data on the hard disk 31. If the data content marked by the data pointer is inconsistent with the data on the hard disk 31, the data on the hard disk 31 cannot be recognized, and the data content indicated by the data pointer is missing. The server 1 will determine that the hard disk 31 of the client computer 3 is untrustworthy and there are illegal changes. The server 1 will immediately strip off the data pointer file, make the hard disk 31 of the client computer 3 appear empty, and terminate the operation of the client computer 3.

[0051] In a preferred embodiment, the authentication microsystem can be installed on the server side, or on the master boot area on the hard disk 31 of the client computer 3, or on the master boot area of ​​a mobile storage device, so that after the client computer 3 is powered on and started, the authentication microsystem is first connected or started to perform trusted authentication for identity verification. In a preferred case, for example, authentication of hardware devices such as CPU, memory, hard disk, and network card, the authentication microsystem then controls and manages the trusted activation and loading of data on the hard disk 31 of the client computer 3.

[0052] Preferably, when the client computer 3 writes new data to the hard disk 31, the data pointer file of the hard disk 31 is stored in the data pointer storage module of the server 1. After the client computer 3 is authorized, whether it is the data of the template file of the trusted root system loaded from the server 1 or the local data input by the client computer 3, the data pointer of the newly added data on the storage sector of the hard disk 31 will be stored in the data pointer storage module of the server 1, and will not be directly stored on the hard disk 31, which effectively ensures that the data pointer on the hard disk will not be tampered with.

[0053] As described above, in the preferred embodiment of the secure authentication client data transmission method of the present invention, the transmission scheduling module collects the network configuration status information of the client computer, including the hardware device information of the CPU, hard disk, memory and network card of all client computers in the computer group and the network connection status information, the network connection status information includes the computer client online status, computer group status, operating system status and waiting time; the data transmission status information includes whether the transmitted data is 100%; the transmission scheduling module specifies a client computer to receive data according to the performance of the computer hardware device information and the network connection status information. In this way, the server can realize the transmission scheduling of the client computer through the transmission scheduling module, and determine which client computer has a better data transmission environment condition with the server or other client computers according to the hardware device information and the network connection status information, so the selected client computer is a computer that can communicate better with the server or with the specified client computer.

[0054] In the preferred embodiment of the secure authentication client data transmission method of the present invention as described above, the transmission scheduling module selects the designated client computer for sending data according to the following priority order: the client computer is online, the network card speed is high and the network type is the same, the operating system is the same, the received data is 100%, it is in the same computer group, and the waiting time is short; the transmission scheduling module selects the designated client computer for receiving data according to the following selection condition priority order: the client computer is online, the network card speed is high and the network type is the same, the operating system is the same, it is in the same computer group, and the waiting time is short. By selecting the optimal next client computer for receiving data, the data transmission rate can be guaranteed to be kept in the optimal state, and the overall data transmission rate of the entire computer group is improved as a whole.

[0055] In the above-mentioned secure authentication client data transmission method of the present invention, in a preferred embodiment, the transmission scheduling module obtains the computer group information of the first client computer designated to receive data, and further includes confirming that the number of switch levels between the server and the first client computer is less than or equal to the number of switch levels between the server and other client computers in the computer group. For example, in the same computer group, it is possible that all client computers are connected to the server through only one switch, then there is no switch between the computers in the computer group, and the data transmission between them will not be affected by the switch.

[0056] The transmission scheduling module obtains the data transmission status information of other client computers other than the first client computer, and designates the client computer as the client computer sending data. If there is a first-level switch between the other client computer designated as receiving data and the client computer sending data, the other client computer is the next-level client computer of the switch. When the number of the previous-level client computers that have completed data transmission is greater than or equal to 1, the next-level client computer will not be used as the client computer sending data of the previous-level client computer. Therefore, in the computer group, due to the large number of computers, it is often necessary to set up more levels of switches to expand these client computers. Through the scheduling control of the present invention, the client computer that has completed 100% data reception can be made the next client computer that hides the data sent to other client computers, forming a level by level, after the transmission is full of 100%, it continues to designate the client computer receiving data at the next level, so that through the chain-type data transmission mode, the scheduling control performed in sequence completes the scheduling of all client computer system file data that need data transmission. When there is a lower-level switch in the computer group, through the identification of network information, when there is a client computer that has completed the transmission in the state of direct connection with the upper-level switch, the client computer under the lower-level switch is prohibited from transmitting data to the client computer of the upper level. This can reduce the problem of reduced transmission efficiency caused by the existence of the switch barrier and also reduce the network application pressure of the client computer under the lower-level switch.

[0057] The client data transmission method with security authentication of the present invention as described above, in its preferred embodiment, includes a local security authentication step, wherein the client computer receives 100% of the data, and after starting the operating system, starts the local security authentication module, automatically detects the security policy configuration in the client computer, and if it is inconsistent with the preset security policy of the trusted root system stored in the server, the client computer is prohibited from starting, and the server records the system security anomaly information of the computer; and reallocates other authenticated client computers as client computers sending data according to the instructions, and sends the system data again to the client computer with the security authentication anomaly, and after the client computer completes the reception and restarts, it starts the local security authentication module again to perform local security authentication.

[0058] In the preferred embodiment of the secure authentication client data storage method of the present invention, in order to better manage the data security of the client computer 3, the hard disk 31 of the client computer 3 is provided with a local trusted root system storage area 311 and a local dynamic data storage area 312, please refer to Figure 2BAs shown, the local trusted root system storage area 311 is a read-only storage area for loading the template file of the trusted root system from the server 1, that is, the storage area can only be modified by the data downloaded from the server side, and it is a read-only storage area for the user of the client computer 3; and the local dynamic data storage area 312 is an active storage area that allows the client computer 3 to add or modify operations. The local dynamic data storage area 312 is used to store user dynamic data other than the trusted root system, allowing the user to modify it. The data pointer files of the local trusted root system storage area 311 and the local dynamic data storage area 312 are stored in the data pointer storage module of the server 1, and only the data of the storage sector with the same data pointer mark is transmitted during data transmission. Whether the local trusted root system storage area 311 or the local dynamic data storage area 312 is in operation, the data pointer needs to be stored in the data pointer file on the server 1; in a preferred embodiment, after the client computer 3 is shut down, the data pointer of the local trusted root system storage area 311 of the data pointer file of the client computer 3 on the server 1 is saved, and the data pointer of its local dynamic data storage area 312 can be saved or deleted; thereby, the remotely controlled client computer 3 can still read the data in the local dynamic data storage area 312 after the next startup, or form a remote control desktop that restores the local dynamic data storage area 312 upon restart.

[0059] In the preferred embodiment of the secure authentication client data transmission method of the present invention, please refer to Figure 2A and Figure 2BAs shown, in a preferred embodiment, the authentication microsystem module 2 is connected to an I / O control driver 4, and the I / O control driver 4 is used to identify and schedule input and output signals, and judge whether the trusted root system file data requested by the client computer 3 exists in the designated sector of the local trusted root system storage area 311 of its hard disk 31 according to the data pointer file mapped by the authentication microsystem. If not, the server 1 loads the requested trusted root system file data from the template file of the trusted root system to the designated sector, and stores the loaded data pointer file in the data pointer storage module of the server 1; if it exists, the next designated sector is judged according to the data pointer file mapped by the authentication microsystem. The I / O control driver 4 can identify and schedule the file data that needs to be mounted from the server in response to the request of the client computer 3. In a specific implementation, the client computer 3 can choose to run different operating systems according to the request, and the data of different operating systems are stored in different storage sectors on the hard disk 31 with specific data pointers. Therefore, through the identification and scheduling of the I / O control driver 4, it can select to read the data of the operating system in the specified sector and start the corresponding operating system according to the request of the client computer 3. For example, in Windows and Linux systems, when the client computer 3 requests to start the Windows system, the I / O control driver 4 will select to read the data pointer with the Window trusted root system mark in the data pointer file, start the Windows system and the corresponding application, and the file data of the non-Windows system cannot be recognized under the operating system, that is, it does not exist, thereby achieving absolute isolation of data of different operating systems.

[0060] As described above, when the present invention dispatches the template file of the trusted root system on the server 1 to the hard disk 31 of the client computer 3 through the network, it adopts the monitoring of a more secure authentication microsystem. In order to ensure that multiple different operating systems can perform secure calculations in parallel on the same user hard disk 31, a slice-type data reading verification mode is adopted. The so-called slice-type is to classify different data on the hard disk 31 by the index of the data pointer in the storage sector. For example, when the user calls the Windows system, the data pointer is reorganized, and the operation track of the Windows system data block on the hard disk is notified to the hardware CPU, memory, motherboard, etc.; when calling the Linux system, the original data pointer is released to the server 1 for storage, and the new data pointer is restarted for scheduling, and the data block of the Linux system on the hard disk is called. All data blocks are stored on the hard disk in a slice-type architecture, and the data pointer is stored on the server 1, which is much more secure than the traditional discrete data storage mechanism.

[0061] As described above, in a preferred embodiment of the securely authenticated client data transmission method of the present invention, the I / O control driver 4 determines the addition or modification operation of data in the local dynamic data storage area 312 of the hard disk 31 of the client computer 3, and sends and stores the data pointer of the storage sector where the addition or modification operation occurs to the data pointer storage module of the server 1.

[0062] The authentication microsystem mechanism is introduced into the I / O control driver layer to control the operation of the terminal master boot record, partition table, IDTable, ID index, etc. While using the autonomous encryption algorithm to verify and strengthen the security of the kernel system, the IDTable will use the data pointer of the server side to present the static data of the terminal distributed data as the sector data; and the IDindex integrates the I / O controller driver and the autonomous algorithm to meet the functions of the client computer 3 such as verification, authentication and security audit. The present invention essentially solves the problems of the operation and calculation speed of the trusted terminal, the bandwidth occupation of the network, and the high requirements for the server. The personalized data (user data) of the client computer 3 is divided into the client computer 3 and the server part, that is, the data of the local dynamic data storage area 312 and the local trusted root system storage area 311, and is presented under the control of the security process and authentication microsystem of both parties. Once the client computer 3 closes the security process, it will be immediately discovered by the server, and the server 1 will prohibit the server part of the personalized data from being accessed, so that the client computer 3 cannot obtain the correct data. Similarly, if the client computer 3 is offline, the same is true. Of course, if the client computer 3 is authorized to perform offline operations, it can obtain complete personalized data content locally, effectively ensuring that the client computer 3 always runs in a trusted environment and ensuring the security of data on the client computer 3.

[0063] In a preferred embodiment, Figure 2A and Figure 2B As shown, since the server 1 mounts the necessary data in the template file of the trusted root system to the hard disk 31 of the client computer 3 according to the request of the client computer 3, it can run the operating system and application programs. At the same time, the file data of the trusted root system that has been mounted on the client computer 3 is saved through the data pointer file stored on the server 1, so that when it is started and run next time, it is no longer necessary to repeatedly load the data of the template file of the trusted root system that has been loaded. It only needs to load new data according to the request of the client computer 3, which reduces the burden of network communication of this system.

[0064] As described above, in the preferred embodiment of the client data transmission method of security authentication of the present invention, after the server completes the start transmission state of the first client computer or completes the 100% data transmission state, it designates the first client computer to transmit data to the next client computer, forming a first data transmission chain; the service designates another first client computer to perform data transmission, and after completing the start transmission state of the other first client computer or completing the 100% data transmission state, it designates the other first client computer to transmit data to the next client computer, forming a second data transmission chain; the client computers in the first data transmission chain and the second data transmission chain are not repeated. In this embodiment, in order to further improve the transmission efficiency of the double chain transmission mode, the server actively transmits data to the two first client computers respectively, and after all are transmitted to 100%, the two first client computers are used as the starting point to perform data transmission operations for subsequent client computers in turn until the transmission of all client computers is completed, which can further improve the transmission efficiency.

[0065] The client data transmission method with security authentication of the present invention is aimed at the installation and abnormal maintenance of the system with a server and a computer group in a local area network, and realizes the security authentication of the received data. The mapping of sector data and pointer files is adopted to complete the copying and filling of data, and the data transmission control method of the computer group in the local area network is used to complete the chain-type data transmission control of the server and the client computers in the computer group, so that the client computers in the computer group can run at the same time without occupying the server, and the server and the client computer that has completed the transmission can be performed when other client computers are performing data transmission, thereby reducing the network communication pressure for network data transmission and reducing the impact on learning and work; at the same time, the hardware requirements for data transmission on the server, client computers and network configuration are reduced, the use cost is reduced, and the network impact of a large number of client computers performing data transmission and system security authentication is reduced, and the maintenance efficiency of the computers in the computer group is guaranteed.

[0066] The above description is only an illustrative embodiment of the present invention and is not intended to limit the scope of the present invention. Any equivalent changes and modifications made by any person skilled in the art without departing from the concept and principle of the present invention shall fall within the scope of protection of the present invention.

Claims

1. A securely authenticated client data transmission method, characterized in that: It includes a server, a plurality of client computers and an authentication microsystem module, wherein the plurality of client computers are arranged as at least one computer group; The server is connected to the client computer via a network, a trusted root system module and a data pointer storage module are installed in the server, the trusted root system module stores a template file of the trusted root system, and the data pointer storage module is used to store a data pointer file from a hard disk of the client computer; The server is provided with a transmission scheduling module, the transmission scheduling module collects the network configuration status information and data transmission status information of the client computer, designates a client computer as the first client computer, and the authentication microsystem module stores a trusted authentication microsystem for comparing the data information of the server and the client computer; The server starts the client computer at the same time as the client computer starts. After the client computer passes the hardware trusted authentication, the server maps the data pointer file of the client computer stored on the server to the designated storage sector of the hard disk of the client computer. The authentication microsystem module compares the data of the trusted root system marked by the data pointer file with the data of the trusted root system of the corresponding storage sector of the hard disk to perform security authentication on the client computer. The server obtains the data transmission status information of the first client computer, and the transmission scheduling module specifies each client computer for subsequent one-to-one transmission, so that all client computers in the computer group that need data transmission form a one-to-one non-repetitive serial chain transmission structure; when the data transmission status of the template file of the first client computer is that the transmission has been started, the transmission scheduling module of the server specifies the first client computer to send data to the next computer in the computer group, and the transmission scheduling module sends the received data in sequence from the next client computer to the last client computer according to the one-to-one connection sequence of the transmission structure, until the transmission scheduling module obtains that the data transmission status information of the template files of all client computers in the computer group that need to transmit data is 100%.

2. The securely authenticated client data transmission method according to claim 1, characterized in that: When the client computers of the computer group have not completed 100% of the data reception, and in the transmission structure, one of the client computers other than the first client computer has an abnormality, a waiting strategy is executed to stop the data transmission of all client computers within a specified time interval, waiting for the client computer with the abnormality to restore the normal data transmission connection state; if the client computer restores the normal data transmission connection state, the data transmission state of all client computers is restored; if the client computer cannot be restored within the specified time interval, the transmission scheduling module will remove the abnormal client computer from the sequence of the transmission structure, and connect the two client computers in front and behind the client computer to transmit data, forming a new transmission structure sequence; when the client computer with the abnormality restores the normal connection state, the transmission scheduling module specifies a client computer without an output data task to transmit the file data of the system template to it.

3. The securely authenticated client data transmission method according to claim 1, characterized in that: The server obtains the data transmission status information of the first client computer. When the data transmission status of the template file of the first client computer is that the transmission has been started and the system template file data transmission reaches 100%, the transmission scheduling module specifies the first client computer to send data to the next computer in the computer group according to the one-to-one connection sequence of the transmission structure. When the transmission scheduling module obtains the data transmission status information of the template file of the next computer as 100%, it specifies the next computer to send data to the next computer, until the transmission scheduling module obtains the data transmission status information of the template files of all client computers that need to transmit data in the computer group as 100%.

4. The securely authenticated client data transmission method according to claim 3, characterized in that: When the client computer receiving data has not completed 100% of the data reception, and the client computer sending data has an abnormality and stops sending data; the transmission scheduling module designates another idle client computer that has completed 100% of the data reception as the client computer sending data according to the selection condition priority order principle, and sends system data to the client computer receiving data; Or if the client computer receiving data has an abnormality and stops receiving data, the transmission scheduling module designates another idle client computer that has not completed data reception as the client computer receiving data according to the selection condition priority order principle.

5. The secure authenticated client data transmission method according to claim 2 or 4, characterized in that: The transmission scheduling module collects the network configuration status information of the client computer, including the hardware device information of the CPU, hard disk, memory and network card of all client computers in the computer group, and the network connection status information, wherein the network connection status information includes the online status of the computer client, the computer group status, the operating system status and the waiting time; the data transmission status information includes whether the data being transmitted is in the state of starting transmission or completing 100% transmission; The transmission scheduling module designates a client computer to receive data according to the performance of the computer hardware device information and the network connection status information.

6. The securely authenticated client data transmission method according to claim 5, characterized in that: The transmission scheduling module selects the client computer designated to send data according to the following priority order: the client computer is online, has a high network card speed and the same network type, has the same operating system, has started data transmission or has completed 100% transmission status, is in the same computer group, and has a short waiting time; The transmission scheduling module selects the designated client computer for receiving data according to the following selection condition priority order: the client computer is online, has a high network card speed and the same network type, has the same operating system, is in the same computer group, and has a short waiting time.

7. The securely authenticated client data transmission method according to claim 6, characterized in that: The transmission scheduling module obtains computer group information of a first client computer designated to receive data, and further includes confirming that the number of switch levels between the server and the first client computer is less than or equal to the number of switch levels between the server and other client computers in the computer group; After the transmission scheduling module obtains 100% data transmission status information of other client computers other than the first client computer and designates the client computer as a client computer for sending data, if there is a first-level switch between another client computer designated as receiving data and the client computer for sending data, the other client computer is a next-level client computer of the switch, and when the number of previous-level client computers that have completed data transmission is greater than or equal to one, the next-level client computer will not be used as a client computer for sending data of the previous-level client computer.

8. The securely authenticated client data transmission method according to claim 7, characterized in that: The method comprises a local security authentication step, wherein the client computer receives 100% of the template file data, and after starting the operating system, starts the local security authentication module, automatically detects the security policy configuration in the client computer, and if it is inconsistent with the preset security policy of the trusted root system stored in the server, the client computer is prohibited from starting, and the server records the system security abnormality information of the computer; and reallocates other authenticated client computers as client computers for sending data according to the instructions, and sends the system data again to the client computer with the security authentication abnormality, and after the client computer completes the reception and restarts, starts the local security authentication module again to perform local security authentication.

9. The securely authenticated client data transmission method according to claim 8, characterized in that: The hard disk of the client computer is provided with a local trusted root system storage area and a local dynamic data storage area, the local trusted root system storage area is a read-only storage area for loading template files from the trusted root system of the server, the local dynamic data storage area is an active storage area that allows the client computer to add or modify operations, the data pointer files of the local trusted root system storage area and the local dynamic data storage area are stored in the data pointer storage module of the server, and only the data of the storage sectors with the same data pointer mark are transmitted during data transmission; The authentication microsystem module is connected to an I / O control driver, which is used to identify and schedule input and output signals, and determine whether the trusted root system file data requested by the client computer exists in a specified sector of the local trusted root system storage area of ​​its hard disk according to the data pointer file mapped by the authentication microsystem. If not, the server loads the requested trusted root system file data from the template file of the trusted root system to the specified sector, and stores the loaded data pointer file in the data pointer storage module of the server; If it exists, the next designated sector is determined according to the data pointer file mapped by the authentication microsystem; The I / O control driver determines the data addition or modification operation of the local dynamic data storage area of ​​the hard disk of the client computer, and sends and stores the data pointer of the storage sector where the addition or modification operation occurs to the data pointer storage module of the server.

10. The securely authenticated client data transmission method according to claim 9, characterized in that: After completing the start transmission state or the 100% data transmission state for the first client computer, the server designates the first client computer to transmit data to the next client computer to form a first data transmission chain; the service designates another first client computer to perform data transmission, and after completing the start transmission state or the 100% data transmission state for the other first client computer, designates the other first client computer to transmit data to the next client computer to form a second data transmission chain; the client computers in the first data transmission chain and the second data transmission chain are not repeated.

Images