Data security protection method and platform for integrated test service platform

Abstract

The invention provides a data security protection method and platform for an integrated test service platform, and belongs to the technical field of data security. In the method, under the condition that a target node obtains first data, the target node determines whether the target node has a node of a target type in child nodes in a tree topology; wherein the first data is the data after the test data is subjected to security protection, the tree topology is used for describing a topology connection relationship among a plurality of nodes included in the integrated test service platform, and the nodes forming the routing path are partial nodes in the plurality of nodes; the nodes of the target type are nodes which do not belong to the routing path and are leaf child nodes of the target node; if the nodes of the target type exist, the target node triggers the nodes of the target type to carry out security protection on the first data to obtain second data; and the target node sends the second data according to the routing path.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a data security protection method and platform for an integrated testing service platform. Background Art

[0002] Modern testing service platforms support scenarios such as software testing, hardware verification, and AI model training by providing data upload, download, and analysis functions. Such platforms need to process test data sets uploaded by users (such as device logs, biometrics, and user behavior records) and the output analysis results. The data often contains sensitive business information or user privacy, and its transmission security directly affects corporate compliance and user trust.

[0003] For example, unencrypted plaintext transmission is vulnerable to network sniffing, and attackers can use man-in-the-middle attacks (MITM) to intercept sensitive data. The traditional HTTP protocol lacks an encryption mechanism, and even if HTTPS transmission using SSL / TLS is used, it may still lead to downgrade attacks due to outdated protocol versions (such as SSLv3) or incorrect configuration. In addition, the user's terminal device may have malware that steals data in transmission, or use public WiFi to expose data.

[0004] Therefore, how to further ensure the security of data transmission is a current research issue. Summary of the invention

[0005] The embodiments of the present application provide a data security protection method and platform for an integrated testing service platform, so as to improve the security of data transmission.

[0006] In order to achieve the above objectives, this application adopts the following technical solutions: In the first aspect, an embodiment of the present application provides a data security protection method for an integrated testing service platform, which is applied to a target node in a routing path, where the target node is any node in the routing path, and the routing path is a path for transmitting test data requested by a user, and the method includes: when the target node obtains the first data, the target node determines whether there is a target type node in the child nodes of the target node in the tree topology; wherein the first data is the data after the test data is securely protected, the tree topology is used to describe the topological connection relationship between multiple nodes included in the integrated testing service platform, the nodes constituting the routing path are some of the multiple nodes, and the target type node is a node that does not belong to the routing path and is a leaf child node of the target node; if there is a target type node, the target node triggers the target type node to securely protect the first data and obtain the second data; the target node sends the second data according to the routing path.

[0007] Optionally, in the case where the target node is a source node in a routing path, the target node obtains the first data, including: the target node receives a request, the request indicates that the user requests to obtain data of the target type for a group service; the target node obtains test data from the local target node according to the request, and determines the routing path, the test data being data of the target type; the target node performs security protection on the test data to obtain the first data; or, in the case where the target node is a non-source node in the routing path, the target node obtains the first data, including: the target node receives the first data and indication information from a parent node of the target node in the routing path, the indication information indicating that the user is a user of the group service.

[0008] Optionally, in the case that the target node is a source node in a routing path, the target node is configured with a group key for the group service, and the group key is a key shared by different users in the group service; on this basis, the target node performs security protection on the test data to obtain first data, including: in response to the user requesting to obtain data of the target type for the group service, the target node encrypts the test data on the target node through the group key to obtain the first data; accordingly, the target node sends the second data according to the routing path, including: the target node sends the second data and indication information to the child nodes of the target node in the routing path, and the child nodes of the target node in the routing path are non-leaf child nodes of the target node in the tree topology.

[0009] Optionally, the routing path includes K nodes, K is an integer greater than 1, and the target node encrypts the test data on the target node through the group key to obtain the first data, including: the target node obtains the index of each of the K nodes; the target node concatenates the index of each of the K nodes in the order of routing or the reverse order of routing to obtain a first intermediate parameter which is a string, and uses the first intermediate parameter to derive the group key to obtain a first transmission key; the target node uses the first transmission key to encrypt the test data to obtain the first data.

[0010] Optionally, the routing path includes K nodes, K is an integer greater than 1, and the target node encrypts the test data on the target node through the group key to obtain the first data, including: the target node obtains the index of each of the K nodes in the routing path; the target node sums the values ​​of the indexes of the K nodes to obtain the sum of the values ​​of the indexes, and determines the second intermediate parameter as the value according to the length value of the test data of the sum of the values; wherein the value of the second intermediate parameter is y1, y1=L2modL1, L1 is the sum of the values, L2 is the length value of the test data, mod represents the modulus operation, and L1 and L2 are both positive integers; the target node uses the second intermediate parameter to derive the group key to obtain the first transmission key; the target node uses the first transmission key to encrypt the test data to obtain the first data.

[0011] Optionally, the method is also applied to a target type of node, the target type of node is pre-configured with a user's private key, the private key is a key that the user does not share with other users in the group service, the target node triggers the target type of node to securely protect the first data and obtain the second data, including: the target node sends the first data to the target type of node; the target type of node encrypts the first data according to the information of the leaf node in the tree topology and the private key to obtain the second data; the target type of node returns the second data to the target node, and marks the second data as data encrypted by the target type of node. When the second data is data encrypted by the target type of node, the second data is no longer encrypted during the routing path routing process.

[0012] Optionally, the target type node encrypts the first data according to the information of the leaf nodes in the tree topology and the private key to obtain the second data, including: the target type node obtains the respective indexes of all the leaf nodes in the tree topology; the target type node concatenates the respective indexes of all the leaf nodes in order from small to large or from large to small to obtain a third intermediate parameter which is a string, and uses the third intermediate parameter to derive the private key to obtain the second transmission key; the target type node uses the second transmission key to encrypt the first data to obtain the second data.

[0013] Optionally, the target type node encrypts the first data according to the information of the leaf nodes in the tree topology and the private key to obtain the second data, including: the target type node obtains the index of all the leaf nodes in the tree topology; the target node sums the values ​​of the indexes of all the leaf nodes to obtain the sum of the index values, and tests the length value of the data according to the sum of the values ​​to determine a fourth intermediate parameter as the value; wherein the value of the fourth intermediate parameter is y2, y2=L4modL3, L4 is the sum of the values, L3 is the length value of the first data, mod represents the modulus operation, and L3 and L4 are both positive integers; the target node uses the fourth intermediate parameter to derive the private key to obtain the second transmission key; the target node uses the second transmission key to encrypt the first data to obtain the second data.

[0014] Optionally, in the process of performing routing along the routing path, the first data or the second data is encapsulated in the payload of the corresponding message, and the header of the message contains routing information, and the routing information is the address and port number of the node in the routing path.

[0015] In the second aspect, an embodiment of the present application provides an integrated testing service platform, which includes multiple nodes. The tree topology is used to describe the topological connection relationship between multiple nodes. The routing path is a path for transmitting test data requested by users. The nodes constituting the routing path are some of the multiple nodes. The target node is any node in the routing path; the target node is configured as follows: when the target node obtains the first data, the target node determines whether there is a node of the target type among the child nodes of the target node in the tree topology; the node of the target type is a node that does not belong to the routing path and is a leaf child node of the target node; if there is a node of the target type, the target node triggers the node of the target type to securely protect the first data and obtain the second data; the target node sends the second data according to the routing path.

[0016] In a third aspect, an embodiment of the present application provides a computer-readable storage medium having program code stored thereon. When the program code is executed by the computer, the method described in the first aspect is executed.

[0017] In summary, the above method and platform have the following technical effects: For any node in the routing path used to transmit the test data requested by the user, such as recorded as the target node, when the target node obtains the test data that has been securely protected, such as recorded as the first data, the target node can determine whether there is a node of the target type in the child nodes of the target node in the tree topology. Among them, the tree topology is used to describe the topological connection relationship between multiple nodes included in the integrated testing service platform. The nodes that constitute the routing path are some of the multiple nodes, and the nodes of the target type are nodes that do not belong to the routing path and are leaf child nodes of the target node. At this time, if there is a node of the target type, the target node triggers the node of the target type to securely protect the first data and obtain the second data, so as to achieve secondary security protection through uncertain leaf child nodes. Therefore, the target node sends the second data according to the routing path, which can further improve the security of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A schematic diagram of the architecture of an integrated testing service platform provided in an embodiment of the present application; Figure 2 A flowchart of a data security protection method for an integrated testing service platform provided in an embodiment of the present application; Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0019] In the embodiment of the present invention, "indication" may include direct indication and indirect indication, and may also include explicit indication and implicit indication. The information indicated by a certain information is called information to be indicated. In the specific implementation process, there are many ways to indicate the information to be indicated, such as but not limited to, the information to be indicated can be directly indicated, such as the information to be indicated itself or the index of the information to be indicated. The information to be indicated can also be indirectly indicated by indicating other information, wherein there is an association relationship between the other information and the information to be indicated. It is also possible to indicate only a part of the information to be indicated, while the other parts of the information to be indicated are known or agreed in advance. For example, the indication of specific information can also be achieved by means of the arrangement order of each information agreed in advance (for example, specified by the protocol), thereby reducing the indication overhead to a certain extent. At the same time, the common parts of each information can also be identified and indicated uniformly to reduce the indication overhead caused by indicating the same information separately.

[0020] In addition, the specific indication method may also be various existing indication methods, such as but not limited to the above-mentioned indication methods and various combinations thereof. The specific details of the various indication methods can refer to the prior art and will not be repeated herein. As can be seen from the above, for example, when it is necessary to indicate multiple information of the same type, different indication methods may be used for different information. In the specific implementation process, the desired indication method can be selected according to specific needs. The embodiment of the present invention does not limit the selected indication method. In this way, the indication method involved in the embodiment of the present invention should be understood to cover various methods that can enable the party to be indicated to obtain the information to be indicated.

[0021] It should be understood that the information to be indicated can be sent as a whole or divided into multiple sub-information and sent separately, and the sending period and / or sending time of these sub-information can be the same or different. The specific sending method is not limited in the embodiment of the present invention. Among them, the sending period and / or sending time of these sub-information can be pre-defined, for example, pre-defined according to a protocol, or can be configured by the sending end device by sending configuration information to the receiving end device.

[0022] "Pre-definition" or "pre-configuration" can be implemented by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in the device, and the embodiments of the present invention do not limit the specific implementation method. Among them, "saving" can mean saving in one or more memories. The one or more memories can be set separately or integrated in an encoder or decoder, a processor, or an electronic device. The one or more memories can also be partially set separately and partially integrated in a decoder, a processor, or an electronic device. The type of memory can be any form of storage medium, which is not limited by the embodiments of the present invention.

[0023] The "protocol" involved in the embodiments of the present invention may refer to a protocol family in the communication field, a standard protocol with a similar protocol family frame structure, or a related protocol in a reliable access method system for future Internet of Things devices, and the embodiments of the present invention do not specifically limit this.

[0024] In the embodiments of the present invention, descriptions such as "when...", "in the case of...", "if" and "if" all mean that the device will perform corresponding processing under certain objective circumstances, but do not limit the time, nor do they require the device to perform judgment actions when implementing, nor do they mean the existence of other limitations.

[0025] In the description of the embodiments of the present invention, unless otherwise specified, " / " indicates that the objects associated before and after are in an "or" relationship, for example, A / B can represent A or B; "and / or" in the embodiments of the present invention is only a kind of association relationship describing the associated objects, indicating that there can be three relationships, for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In addition, in the description of the embodiments of the present invention, unless otherwise specified, "multiple" refers to two or more than two. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple. In addition, in order to facilitate the clear description of the technical solution of the embodiments of the present invention, in the embodiments of the present invention, the words "first" and "second" are used to distinguish the same or similar items with basically the same functions and effects. Those skilled in the art will appreciate that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference. At the same time, in the embodiments of the present invention, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete way for easy understanding.

[0026] The network architecture and business scenarios described in the embodiments of the present invention are intended to more clearly illustrate the technical solutions of the embodiments of the present invention, and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. A person of ordinary skill in the art can appreciate that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present invention are equally applicable to similar technical problems.

[0027] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0028] See also Figure 1 , an embodiment of the present application provides an integrated testing service platform, which may include multiple nodes.

[0029] Each of the multiple nodes may be a functional entity for data storage, management, and processing, such as a virtual machine, or a container that is lighter than a virtual machine, or a physical device such as a server.

[0030] Multiple nodes can be connected in a tree topology. The tree topology can be one or more without restriction. The traversal or transmission of data can be directional, such as from the root node of the tree topology downward. Correspondingly, it can also be understood that the tree topology is used to describe the topological connection relationship between multiple nodes included in the integrated testing service platform. The node types in a tree topology can be divided into leaf nodes and non-leaf nodes. Leaf nodes refer to nodes with a degree of 0, that is, nodes without child nodes. Non-leaf nodes refer to nodes with a degree of non-0, that is, nodes with child nodes. For leaf nodes, the previous node of the leaf node is the parent node of the leaf node. From the perspective of the parent node, the leaf node can be described as a leaf child node. For non-leaf nodes, if the non-leaf node has a previous node, the previous node is the parent node of the non-leaf node. From the perspective of the parent node, the non-leaf node can be described as a non-leaf child node.

[0031] For leaf nodes, since leaf nodes do not have child nodes, routing is usually not the responsibility of the leaf nodes. Leaf nodes are more responsible for performing data processing functions, such as security protection in this application, which can be encryption or integrity protection without specific restrictions.

[0032] For example, Figure 1 An exemplary architecture of an integrated testing service platform is shown in FIG. A tree topology is taken as an example. The tree topology includes 13 nodes, namely node 1 to node 13, wherein node 1 is the root node, node 7, node 9, node 10, node 11, node 12 and node 13 are leaf nodes, and node 2, node 3, node 4, node 5, node 6 and node 8 are non-leaf nodes.

[0033] In the embodiment of the present application, users can access the integrated testing service platform.

[0034] The user can be understood as a terminal. The terminal can also be called a user equipment (UE), an access terminal, a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a terminal, a wireless communication device, a user agent or a user device. The terminal device in the embodiment of the present application can be a mobile phone, a tablet computer (Pad), a computer with a wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in self driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, a vehicle-mounted terminal, etc.

[0035] The node interaction in the above system will be described in detail below in conjunction with the method.

[0036] See also Figure 2 The embodiment of the present application provides a data security protection method for an integrated test service platform. The method is applied to a target node in a routing path, where the target node is any node in the routing path, and the routing path is a path for transmitting test data requested by a user. The process of the method includes: S201: When a target node obtains first data, the target node determines whether there is a node of a target type among the child nodes of the target node in the tree topology.

[0037] The first data is the data after the test data is securely protected. In the process of executing routing along the routing path, the first data is encapsulated in the payload of the corresponding message (recorded as the first message), and the header of the first message contains routing information, which is the address and port number of the node in the routing path. For example, the routing information can include the address and port number of each node in sequence according to the order of routing in the routing path. The nodes constituting the routing path are some of the multiple nodes.

[0038] For example, Figure 1As shown, taking the routing path including node 2, node 4, node 5 and node 11 as an example, the routing information may include the address and port number of node 2, the address and port number of node 4, the address and port number of node 5 and the address and port number of node 11 in sequence. The routing information is not changed during the routing process, so that after the user receives the corresponding message, the user can determine which nodes the message is routed by through the routing information. During the routing process, the nodes in the routing path can update the source address and destination address of the message, as well as the source port number and the destination port number according to the routing information. For example, after node 4 receives the message, the source address is modified from the address of node 2 to the address of node 4, the destination address is modified from the address of node 4 to the address of node 6, and the source port number is modified from the port number of node 2 to the port number of node 4, and the destination port number is modified from the port number of node 4 to the port number of node 6 according to the routing information.

[0039] The target type node is a node that does not belong to the routing path and is a leaf child node of the target node. Continuing with the above example, Figure 1 The target type node may be node 7.

[0040] In the case where the target node is a source node in the routing path, S201 is as follows: The target node receives the request, and the request indicates that the user requests to obtain the target type of data for the group service. The request can be sent by the user to the interface gateway of the integrated test service platform. The interface network gateway is usually connected to the leaf node, and the leaf node broadcasts the request within the integrated test service platform. At this time, the request can be forwarded to the target node through the broadcast, and the target node can determine whether the target type of data corresponding to the group service is stored locally. If so, the target node obtains the test data from the target node locally according to the request, that is, the test data is the target type of data, and determines the routing path, that is, the path from the target node to the leaf node connected to the interface gateway, such as the above-mentioned nodes 2, 4, 5 and 11.

[0041] The target node performs security protection on the test data to obtain first data.

[0042] For example, when the target node is a source node in a routing path, the target node is configured with a group key for a group service, and the group key is a key shared by different users in the group service. In other words, the target node can obtain / be configured with the group key for the group service when it stores or configures the test data of the target type corresponding to the group service in advance. On this basis, in response to the user requesting to obtain data of the target type for the group service, the target node can encrypt the test data of the target node through the group key to obtain the first data. For example, the routing path includes K nodes, K is an integer greater than 1, and the target node obtains the index of each of the K nodes. The target node splices the indexes of each of the K nodes in the order of the routing or the reverse order of the routing to obtain the first intermediate parameter which is a string. For example, continuing the above example, the index of node 2 is 2, the index of node 4 is 4, the index of node 5 is 5, and the index of node 11 is 11, then the sequence is spliced ​​to 24511, and 24511 is used as the first intermediate parameter. The target node can use the first intermediate parameter to derive the group key (such as using the key derivation algorithm KDF) to obtain the first transmission key. The target node uses the first transmission key to encrypt the test data (eg, symmetric encryption, such as AES encryption) to obtain the first data.

[0043] It should be understood that, since the data is stored in a distributed manner, for the same group service, the data requested each time may be in different nodes, and the routing path each time may be different, that is, the nodes involved in the routing may be different, so the encryption key used for each transmission may be different, thereby improving the security of data transmission. In addition, since it is AES encryption, the length of the data before and after encryption can remain unchanged, that is, the length of the first data is the same as the length of the test data.

[0044] For another example, the routing path includes K nodes, K is an integer greater than 1, and the target node obtains the index of each node in the routing path except K nodes. The target node can sum the values ​​of the indexes of the K nodes to obtain the sum of the values ​​of the indexes, and determine the second intermediate parameter as the value of the length value of the test data based on the sum of the values. Among them, the value of the second intermediate parameter is y1, y1=L2modL1, L1 is the sum of the values, L2 is the length value of the test data, mod represents the modulus operation, and L1 and L2 are both positive integers. The target node uses the second intermediate parameter to derive the group key to obtain the first transmission key; the target node uses the first transmission key to encrypt the test data to obtain the first data.

[0045] It should also be understood that since the length of the data requested each time can be different, the key derived after the modulo operation of the length of the above data can also be different, that is, the key used for each transmission encryption can be different, thereby improving the security of data transmission. In addition, since it is AES encryption, the length of the data before and after encryption can remain unchanged, that is, the length of the first data is the same as the length of the test data.

[0046] It should also be understood that, since the source node is already configured with the group key of the group service, it can be known that the user making the request is a user of the group service, thereby triggering the determination in S202.

[0047] Alternatively, when the target node is a non-source node in the routing path, S201 is as follows: The target node receives the first data and indication information from the parent node of the target node in the routing path, and the indication information indicates that the user is a user of the group service. In other words, since the non-source node is not configured with the group key of the group service, it is necessary to know that the requesting user is a user of the group service through the indication information, thereby triggering the judgment of S202. The indication information can be generated by the source node and carried in the payload of the message together with the first data.

[0048] S202: If there is a node of the target type, the target node triggers the node of the target type to securely protect the first data and obtain the second data.

[0049] The target type nodes are pre-configured with the user's private key. For example, since the target type nodes (leaf nodes) are mainly responsible for data processing, the processing and storage overhead can be less restricted. When each user registers to the platform, the platform can configure the user's private key to each leaf node. Among them, the private key can be transmitted to the platform by the user through a secure connection with the platform, or configured in other ways, such as manual configuration. The private key is a key that the user does not share with other users in the group service.

[0050] Thus: the target node sends the first data to the node of the target type and indicates the user's identifier. The user's identifier may be configured to the source node when the user registers and transmitted along with the current route, such as being carried in the payload of the message.

[0051] The target type node encrypts the first data according to the information of the leaf nodes in the tree topology and the private key to obtain the second data. The private key can be obtained by the target type node from the local corresponding according to the user's identification. For example, the target type node obtains the respective indexes of all leaf nodes in the tree topology, and the target type node splices the respective indexes of all leaf nodes (such as node 7, node 9, node 10, node 11, node 12 and node 13) in the order of index from small to large or from large to small to obtain a third intermediate parameter which is a string, and uses the third intermediate parameter to derive the private key to obtain the second transmission key; the target type node uses the second transmission key to encrypt the first data to obtain the second data. For another example, the node of the target type obtains the indexes of all leaf nodes in the tree topology; the target node sums the values ​​of the indexes of all leaf nodes to obtain the sum of the index values, and tests the length value of the data based on the sum of the values ​​to determine a fourth intermediate parameter as the value; wherein the value of the fourth intermediate parameter is y2, y2=L4modL3, L4 is the sum of the values, L3 is the length value of the first data, mod represents the modulus operation, and L3 and L4 are both positive integers; the target node uses the fourth intermediate parameter to derive a private key to obtain a second transmission key; the target node uses the second transmission key to encrypt the first data to obtain second data.

[0052] The node of the target type returns the second data to the target node and marks the second data as data encrypted by the node of the target type. If the mark can be carried in the payload, when the second data is data encrypted by the node of the target type, the second data is no longer encrypted during the routing process of the routing path. In other words, subsequent nodes can ignore the above-mentioned indication information according to the mark, do not execute the judgment of S202, and directly forward it according to the route.

[0053] It should be understood that the security concept of the target type node encryption is similar to that of the target node, and can be referred to for understanding. Since the encryption of the target type node is also AES encryption, the length of the data before and after encryption can remain unchanged, that is, the length of the second data is the same as the length of the first data.

[0054] S203: The target node sends the second data according to the routing path.

[0055] For example, the target node sends the second data and the above-mentioned indication information to the child node of the target node in the routing path, and the child node of the target node in the routing path is a non-leaf child node of the target node in the tree topology. At this time, the second data is encapsulated in the payload of the corresponding message (such as the second message), and the header of the message contains routing information, and the routing information is the address and port number of the node in the routing path. Among them, the second message can be obtained by replacing the first data with the second data, and replacing the source address, destination address, source port and destination port.

[0056] Finally, the second data can be sent to the user, i.e., the terminal, through the interface gateway. Since the terminal can obtain information about each node in the tree topology, such as the index and address, when registering, after receiving the message carrying the second data through the interface gateway, the index of each node in the routing path and the index of the leaf child node can be determined according to the routing information in the message, so the inverse process of the above-mentioned secondary encryption, i.e., decryption, can be performed to obtain the test data.

[0057] In summary, for any node in the routing path used to transmit the test data requested by the user, such as recorded as the target node, when the target node obtains the test data that has been securely protected, such as recorded as the first data, the target node can determine whether there is a node of the target type in the child nodes of the target node in the tree topology. Among them, the tree topology is used to describe the topological connection relationship between multiple nodes included in the integrated testing service platform, the nodes that constitute the routing path are some of the multiple nodes, and the nodes of the target type are nodes that do not belong to the routing path and are leaf child nodes of the target node. At this time, if there is a node of the target type, the target node triggers the node of the target type to securely protect the first data and obtain the second data, so as to achieve secondary security protection through the uncertain leaf child nodes, thereby, the target node sends the second data according to the routing path to further improve the security of data transmission.

[0058] Combination of the above Figure 2 The method provided by the embodiment of the present application is described in detail. The following introduces an integrated test service platform for executing the method provided by the embodiment of the present application, which includes multiple nodes, a tree topology for describing the topological connection relationship between multiple nodes, a routing path for transmitting test data requested by a user, nodes constituting the routing path are some of the multiple nodes, and a target node is any node in the routing path; the target node is configured as follows: when the target node obtains the first data, the target node determines whether there is a node of the target type in the child nodes of the target node in the tree topology; the node of the target type is a node that does not belong to the routing path and is a leaf child node of the target node; if there is a node of the target type, the target node triggers the node of the target type to securely protect the first data and obtain the second data; the target node sends the second data according to the routing path.

[0059] The specific implementation of this platform can refer to the above method and will not be repeated here.

[0060] Combine the following Figure 3 The components of the electronic device 500 are described in detail: The processor 501 is the control center of the electronic device 500, and may be a processor or a general term for multiple processing elements. For example, the processor 501 is one or more central processing units (CPUs), or may be application specific integrated circuits (ASICs), or may be one or more integrated circuits configured to implement the embodiments of the present application, such as one or more microprocessors (digital signal processors, DSPs), or one or more field programmable gate arrays (FPGAs).

[0061] Optionally, the processor 501 can execute various functions of the electronic device 500 by running or executing the software program stored in the memory 502 and calling the data stored in the memory 502, as described above. Figure 3 Functionality in the method shown.

[0062] In a specific implementation, as an embodiment, the processor 501 may include one or more CPUs, such as Figure 3 CPU0 and CPU1 are shown in FIG.

[0063] In a specific implementation, as an embodiment, the electronic device 500 may also include multiple processors. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0064] Among them, the memory 502 is used to store the software program for executing the solution of the present application, and the execution is controlled by the processor 501. The specific implementation method can refer to the above method embodiment and will not be repeated here.

[0065] Optionally, the memory 502 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or Other types of dynamic storage devices that can store information and instructions may also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these. The memory 502 may be integrated with the processor 501, or it may exist independently and be stored in the electronic device 500. The interface circuit ( Figure 3 (not shown) is coupled to the processor 501, which is not specifically limited in this embodiment of the present application.

[0066] The transceiver 503 is used for communication with other devices. For example, if the multi-beam based positioning device is a terminal, the transceiver 503 can be used for communication with a network device or another terminal.

[0067] Optionally, the transceiver 503 may include a receiver and a transmitter ( Figure 3 The receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0068] Optionally, the transceiver 503 may be integrated with the processor 501, or may exist independently and communicate with the processor 501 through the interface circuit ( Figure 3 (not shown) is coupled to the processor 501, which is not specifically limited in this embodiment of the present application.

[0069] It should be noted that Figure 3 The structure of the electronic device 500 shown in the figure does not constitute a limitation on the device, and the actual electronic device 500 may include more or less components than those shown in the figure, or combine certain components, or arrange the components differently.

[0070] In addition, the technical effects based on the electronic device 500 can refer to the technical effects of the method in the above method embodiment, which will not be repeated here.

[0071] It should be understood that the processor in the embodiments of the present application may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0072] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0073] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When a computer instruction or computer program is loaded or executed on a computer, a process or function according to an embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0074] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0075] In this application, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0076] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0077] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0078] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0079] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some feature fields can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0080] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0081] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0082] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0083] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A data security protection method for an integrated testing service platform, characterized in that: The method is applied to a target node in a routing path, the target node is any node in the routing path, the routing path is a path for transmitting test data requested by a user, and the method includes: In the case where the target node obtains the first data, the target node determines whether there is a node of the target type in the child nodes of the target node in the tree topology; wherein the first data is the data after the test data is securely protected, the tree topology is used to describe the topological connection relationship between the multiple nodes included in the integrated testing service platform, the nodes constituting the routing path are some of the multiple nodes, and the node of the target type is a node that does not belong to the routing path and is a leaf child node of the target node; If there is a node of the target type, the target node triggers the node of the target type to securely protect the first data to obtain second data; The target node sends the second data according to the routing path.

2. The method according to claim 1, characterized in that In a case where the target node is a source node in the routing path, the target node acquires the first data, including: The target node receives a request, the request indicating that a user requests to obtain data of a target type for a group service; The target node obtains the test data from the local target node according to the request and determines the routing path, wherein the test data is data of the target type; The target node performs security protection on the test data to obtain the first data; Alternatively, when the target node is a non-source node in the routing path, the target node acquires the first data, including: The target node receives the first data and indication information from a parent node of the target node in the routing path, where the indication information indicates that the user is a user of a group service.

3. The method according to claim 2, characterized in that In the case where the target node is a source node in the routing path, the target node is configured with a group key of the group service, where the group key is a key shared by different users in the group service; On this basis, the target node performs security protection on the test data to obtain the first data, including: In response to the user requesting to obtain the target type of data for a group service, the target node encrypts the test data on the target node by using the group key to obtain the first data; Correspondingly, the target node sends the second data according to the routing path, including: The target node sends the second data and indication information to a child node of the target node in the routing path, where the child node of the target node in the routing path is a non-leaf child node of the target node in the tree topology.

4. The method according to claim 3, characterized in that The routing path includes K nodes, where K is an integer greater than 1, and the target node encrypts the test data on the target node by using the group key to obtain the first data, including: The target node obtains the index of each of the K nodes; The target node concatenates the indexes of the K nodes in the order of routing or the reverse order of routing to obtain a first intermediate parameter which is a string, and uses the first intermediate parameter to derive the group key to obtain a first transmission key; The target node uses the first transmission key to encrypt the test data to obtain the first data.

5. The method according to claim 3, characterized in that: The routing path includes K nodes, where K is an integer greater than 1, and the target node encrypts the test data on the target node by using the group key to obtain the first data, including: The target node obtains the index of each of the K nodes in the routing path; The target node sums the values ​​of the respective indexes of the K nodes to obtain the sum of the values ​​of the indexes, and determines the sum of the values ​​and the length of the test data as the second intermediate parameter of the value; The value of the second intermediate parameter is y1, y1=L2modL1, L1 is the sum of the values, L2 is the length of the test data, mod represents a modulo operation, and L1 and L2 are both positive integers; The target node uses the second intermediate parameter to derive the group key to obtain a first transmission key; The target node uses the first transmission key to encrypt the test data to obtain the first data.

6. The method according to claim 2 or 3, characterized in that: The method is also applied to the node of the target type, the node of the target type is pre-configured with the private key of the user, the private key is a key that the user does not share with other users in the group service, and the target node triggers the node of the target type to securely protect the first data to obtain second data, including: The target node sends the first data to the node of the target type; The node of the target type encrypts the first data according to the information of the leaf nodes in the tree topology and the private key to obtain the second data; The node of the target type returns the second data to the target node and marks the second data as data encrypted by the node of the target type. In the case where the second data is data encrypted by the node of the target type, the second data is no longer encrypted during the routing process of the routing path.

7. The method according to claim 6, characterized in that: The node of the target type encrypts the first data according to the information of the leaf node in the tree topology and the private key to obtain the second data, including: The node of the target type obtains the respective indexes of all leaf nodes in the tree topology; The node of the target type concatenates the indexes of all the leaf nodes in the order of small to large or large to small to obtain a third intermediate parameter which is a string, and uses the third intermediate parameter to derive the private key to obtain a second transmission key; The target type node uses the second transmission key to encrypt the first data to obtain the second data.

8. The method according to claim 6, characterized in that The node of the target type encrypts the first data according to the information of the leaf node in the tree topology and the private key to obtain the second data, including: The node of the target type obtains the respective indexes of all leaf nodes in the tree topology; The target node sums the values ​​of the respective indexes of all the leaf nodes to obtain the sum of the values ​​of the indexes, and determines the length of the test data according to the sum of the values ​​as the fourth intermediate parameter of the value; The value of the fourth intermediate parameter is y2, y2=L4modL3, L4 is the sum of the values, L3 is the length of the first data, mod represents a modulo operation, and L3 and L4 are both positive integers; The target node uses the fourth intermediate parameter to derive the private key to obtain a second transmission key; The target node uses the second transmission key to encrypt the first data to obtain the second data.

9. The method according to claim 1, characterized in that: In the process of performing routing along the routing path, the first data or the second data is encapsulated in the payload of the corresponding message, the header of the message contains routing information, and the routing information is the address and port number of the node in the routing path.

10. An integrated testing service platform, characterized in that: The integrated test service platform includes multiple nodes, the tree topology is used to describe the topological connection relationship between the multiple nodes, the routing path is a path for transmitting the test data requested by the user, the nodes constituting the routing path are some of the multiple nodes, and the target node is any node in the routing path; the target node is configured as: In the case where the target node obtains the first data, the target node determines whether there is a node of the target type in the child nodes of the target node in the tree topology; the node of the target type is a node that does not belong to the routing path and is a leaf child node of the target node; If there is a node of the target type, the target node triggers the node of the target type to securely protect the first data to obtain second data; The target node sends the second data according to the routing path.

Images