Data transmission method and device for distributed file system and electronic equipment

Abstract

The invention discloses a data transmission method and device for a distributed file system and electronic equipment, and relates to the technical field of privacy computing or other related fields, and the method comprises the following steps: selecting N relay nodes from a current network; anonymous communication links are established between the target client and the guard node, between the guard node and the intermediate node, between the intermediate node and the exit node, and between the exit node and the target server in sequence; n public keys of N relay nodes are used to carry out N-layer encryption on data to be transmitted to obtain an encrypted data packet, and each layer of encryption corresponds to one relay node; and the encrypted data packet is transmitted through the anonymous communication link, N private keys are used to decrypt the encrypted data packet for N times, and each decryption corresponds to one relay node. Through the data transmission method and device, the technical problem that information leakage is easily caused due to the fact that the distributed file system adopts a non-anonymous data transmission form in the prior art, the safety of data and data transmitters cannot be guaranteed is solved.

Description

Technical Field

[0001] The present invention relates to the field of privacy computing technology or other related fields, and in particular to a data transmission method and device and electronic device for a distributed file system. Background Art

[0002] The current network file system, as the cornerstone of file sharing on heterogeneous platforms, allows users to access file resources on the network seamlessly as if they were operating local files. However, the inherent working mode of distributed file systems, especially NFS (Network File System), is facing severe challenges from the upgrade of Internet privacy protection.

[0003] In the typical NFS architecture, file providers must disclose their network information in plain text, including IP addresses and possible authentication credentials, so that clients can establish connections and obtain files. This non-anonymous, information-exposed sharing method makes file providers easy targets for attack on the Internet, greatly weakening data security and privacy protection. What's more difficult is that even if encrypted communication methods such as HTTPS are adopted, although data content can be protected from being spied on, the connection between the client and the server may still be monitored by a third party, and the identity information of both parties in communication may be leaked.

[0004] Distributed file systems were not designed with full consideration of the security of data interaction, which made it impossible to effectively guarantee the security of files and file transferors. This has become a major bottleneck restricting their widespread application in modern networks. With the frequent occurrence of network attacks and privacy violations, users are eager to ensure that their network locations cannot be easily tracked while seeking to share files, and the need for anonymity of file providers has become increasingly prominent. Existing technologies are insufficient in meeting the privacy and security requirements of anonymous file access and sharing, especially in failing to establish a truly secure anonymous communication environment between file providers and visitors, resulting in the inability to guarantee the security of both data and data transferors, which can easily lead to information leakage.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The main purpose of the present application is to provide a data transmission method and device and electronic device for a distributed file system, so as to at least solve the technical problem in the related art that the distributed file system adopts a non-anonymous data transmission form, resulting in the security of both data and data transmitters not being guaranteed, which is easy to cause information leakage.

[0007] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a data transmission method for a distributed file system is provided, the method comprising: selecting N relay nodes from the current network, wherein N is an integer greater than or equal to 3, and the relay nodes include: a guard node, at least one intermediate node and an exit node; establishing encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server in sequence to obtain an anonymous communication link; when the target client obtains the data to be transmitted, using N public keys of N relay nodes to perform N layers of encryption on the data to obtain an encrypted data packet, wherein each layer of encryption corresponds to one relay node; anonymously transmitting the encrypted data packet through the anonymous communication link, wherein during the transmission process, N private keys are used to decrypt the encrypted data packet N times, and the obtained target data is transmitted to the target server, and each decryption corresponds to one relay node.

[0008] Furthermore, the step of selecting N relay nodes from the current network includes: requesting a relay server list from a directory server, wherein the relay server list is used to record all the relay servers surviving in the current network; screening N relay servers in the relay server list based on target transmission requirements, and determining the network node corresponding to each of the relay servers to obtain N relay nodes; determining the node identity of each of the relay nodes to obtain the one guard node, the at least one intermediate node and the one exit node.

[0009] Furthermore, the steps of establishing encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server in sequence to obtain an anonymous communication link include: controlling the target client to send a handshake request to the guard node, wherein the handshake request at least includes a preset encryption algorithm; generating a first communication key in the guard node based on the preset encryption algorithm, wherein the first communication key includes: a first public key and a first private key; performing a session key exchange between the target client and the guard node through the first public key and the first private key, and obtaining a first sub-link in the anonymous communication link after the exchange is completed.

[0010] Furthermore, the step of executing the session key exchange between the target client and the guard node through the first public key and the first private key includes: controlling the guard node to return the first public key to the target client, and the target client uses the first public key to encrypt the pre-generated session key to obtain an encrypted session key; controlling the target client to send the encrypted session key to the guard node, and the guard node uses the first private key to decrypt the encrypted session key, and saves the decrypted session key in the guard node.

[0011] Furthermore, after obtaining the first sub-link in the anonymous communication link, it also includes: controlling the guard node to send the handshake request to the intermediate node; generating a second communication key in the intermediate node based on the preset encryption algorithm, wherein the second communication key includes: a second public key and a second private key; returning the second public key to the target client through the first sub-link, and the target client saves it, and after the saving is completed, obtaining the second sub-link in the anonymous communication link.

[0012] Furthermore, after obtaining the second sub-link in the anonymous communication link, it also includes: controlling the intermediate node to send the handshake request to the exit node; generating a third communication key in the exit node based on the preset encryption algorithm, wherein the third communication key includes: a third public key and a third private key; returning the third public key to the target client through the second sub-link and the first sub-link, and the target client saves it, and after the saving is completed, the third sub-link in the anonymous communication link is obtained.

[0013] Furthermore, after obtaining the third sub-link in the anonymous communication link, it also includes: controlling the target client to use the third public key, the second public key and the first public key in sequence to encrypt the target server address to obtain an encrypted address; transmitting the encrypted address through the first sub-link, the second sub-link and the third sub-link, and during the transmission process, decrypting the encrypted address in sequence using the first private key, the second private key and the third private key to obtain the target server address in the exit node; and establishing a fourth sub-link in the anonymous communication link between the exit node and the target server based on the target server address.

[0014] Furthermore, the step of establishing a fourth sub-link in the anonymous communication link between the exit node and the target server based on the target server address includes: controlling the exit node to send the handshake request to the target server based on the target server address; generating a fourth communication key in the target server based on the preset encryption algorithm, wherein the fourth communication key includes: a fourth public key and a fourth private key; returning the fourth public key to the target client through the third sub-link, the second sub-link and the first sub-link, and the target client saves the key, and after the saving is completed, obtaining the fourth sub-link in the anonymous communication link.

[0015] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a data transmission device for a distributed file system is also provided, the device comprising: a selection unit, used to select N relay nodes from the current network, wherein N is an integer greater than or equal to 3, and the relay nodes include: a guard node, at least one intermediate node and an exit node; an establishment unit, used to establish encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server in sequence to obtain an anonymous communication link; an encryption unit, used to use N public keys of N relay nodes to perform N layers of encryption on the data to obtain an encrypted data packet when the target client obtains the data to be transmitted, wherein each layer of encryption corresponds to one relay node; a transmission unit, used to anonymously transmit the encrypted data packet through the anonymous communication link, wherein N private keys are used to decrypt the encrypted data packet N times during the transmission process, and the obtained target data is transmitted to the target server, and each decryption corresponds to one relay node.

[0016] Furthermore, the selection unit includes: a request module, used to request a relay server list from a directory server, wherein the relay server list is used to record all the relay servers surviving in the current network; a screening module, used to screen N relay servers in the relay server list based on target transmission requirements, and determine the network node corresponding to each of the relay servers to obtain N relay nodes; a determination module, used to determine the node identity of each of the relay nodes to obtain the one guard node, the at least one intermediate node and the one exit node.

[0017] Furthermore, the establishment unit includes: a first control module, used to control the target client to send a handshake request to the guard node, wherein the handshake request at least includes a preset encryption algorithm; a first generation module, used to generate a first communication key in the guard node based on the preset encryption algorithm, wherein the first communication key includes: a first public key and a first private key; an exchange module, used to perform a session key exchange between the target client and the guard node through the first public key and the first private key, and obtain the first sub-link in the anonymous communication link after the exchange is completed.

[0018] Furthermore, the exchange module includes: a first control submodule, used to control the guard node to return the first public key to the target client, and the target client uses the first public key to encrypt the pre-generated session key to obtain an encrypted session key; a second control submodule, used to control the target client to send the encrypted session key to the guard node, and the guard node uses the first private key to decrypt the encrypted session key, and saves the decrypted session key in the guard node.

[0019] Furthermore, the establishment unit also includes: a second control module, used to control the guard node to send the handshake request to the intermediate node after obtaining the first sub-link in the anonymous communication link; a second generation module, used to generate a second communication key in the intermediate node based on the preset encryption algorithm, wherein the second communication key includes: a second public key and a second private key; a first return module, used to return the second public key to the target client through the first sub-link, which is saved by the target client, and after the saving is completed, the second sub-link in the anonymous communication link is obtained.

[0020] Furthermore, the establishment unit also includes: a third control module, used to control the intermediate node to send the handshake request to the exit node after obtaining the second sub-link in the anonymous communication link; a third generation module, used to generate a third communication key in the exit node based on the preset encryption algorithm, wherein the third communication key includes: a third public key and a third private key; a second return module, used to return the third public key to the target client through the second sub-link and the first sub-link, and the target client saves it, and after the saving is completed, the third sub-link in the anonymous communication link is obtained.

[0021] Furthermore, the establishment unit also includes: a fourth control module, which is used to control the target client to use the third public key, the second public key and the first public key in sequence to encrypt the target server address after obtaining the third sub-link in the anonymous communication link to obtain an encrypted address; a transmission module, which is used to transmit the encrypted address through the first sub-link, the second sub-link and the third sub-link, and during the transmission process, decrypt the encrypted address in sequence using the first private key, the second private key and the third private key to obtain the target server address in the exit node; an establishment module, which is used to establish the fourth sub-link in the anonymous communication link between the exit node and the target server based on the target server address.

[0022] Furthermore, the establishment module includes: controlling the exit node to send the handshake request to the target server based on the target server address; a generation submodule, used to generate a fourth communication key in the target server based on the preset encryption algorithm, wherein the fourth communication key includes: a fourth public key and a fourth private key; a return submodule, used to return the fourth public key to the target client through the third sub-link, the second sub-link and the first sub-link, and the target client saves it, and after the saving is completed, the fourth sub-link in the anonymous communication link is obtained.

[0023] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer-readable storage medium is also provided, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned data transmission methods for a distributed file system.

[0024] In order to achieve the above-mentioned purpose, according to another aspect of the present application, there is also provided an electronic device, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-mentioned data transmission methods for a distributed file system.

[0025] The present invention proposes a data transmission method for a distributed file system. First, N relay nodes are selected from the current network, wherein N is an integer greater than or equal to 3, and the relay nodes include: a guard node, at least one intermediate node and an exit node. Then, encrypted communication links are established in sequence between a target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server to obtain an anonymous communication link. Then, when the target client obtains the data to be transmitted, the N public keys of the N relay nodes are used to perform N layers of encryption on the data to obtain an encrypted data packet, wherein each layer of encryption corresponds to a relay node. Finally, the encrypted data packet is anonymously transmitted through the anonymous communication link. During the transmission process, the encrypted data packet is decrypted N times using N private keys, and the obtained target data is transmitted to the target server, and each decryption corresponds to a relay node.

[0026] In the present invention, an anonymous communication link is constructed in the data transmission network of the distributed file system. By selecting N relay nodes and sequentially establishing encrypted communication links, the purpose of protecting the anonymity of the file provider in the data transmission process is achieved, thereby achieving the technical effect of enhancing the security of data transmission and enhancing the security of user identity. Specifically, an anonymous network composed of relay nodes is formed by establishing encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server, thereby ensuring the anonymity and security of the data transmission path of the distributed file system. When constructing the anonymous communication link, a guard node, at least one intermediate node and an exit node are selected to serve as a "transfer station" in the data transmission process. Before data transmission, the public key of the relay node is used to perform multi-layer encryption on the data to ensure the security of the data in the transmission process and prevent it from being intercepted and decrypted in the middle. During the data transmission process, the private key is used to decrypt the encrypted data packet layer by layer to ensure that the data can be received by the correct target server. At the same time, the privacy and integrity of the data transmission are maintained, and the complexity and security of the data transmission are further enhanced, thereby solving the technical problem that the distributed file system adopts a non-anonymous data transmission form in the related art, resulting in the security of both the data and the data transmitter being not guaranteed, which is easy to cause information leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0028] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for a data transmission method of a distributed file system is shown;

[0029] Figure 2 is a flow chart of an optional data transmission method for a distributed file system according to an embodiment of the present invention;

[0030] Figure 3 is a schematic diagram of an optional data transmission device for a distributed file system according to an embodiment of the present invention;

[0031] Figure 4 The invention is a structural block diagram of an electronic device for executing a data transmission method for a distributed file system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0034] To facilitate those skilled in the art to understand the present invention, some terms or nouns involved in the embodiments of the present invention are explained below:

[0035] Anonymous network is a network architecture designed to protect the privacy of user communications. Through multi-layer encryption and routing technology, the user's network behavior and identity information remain anonymous to other participants in the network. Typical anonymous network technologies include Tor, I2P, etc.

[0036] Onion routing is a network that realizes anonymous communication. User data will be encrypted multiple times during transmission and routed through randomly selected multi-layer relay nodes. Each layer of relay only knows the information of the nodes on its previous and next layers, ultimately achieving the purpose of protecting user identity and the privacy of communication content.

[0037] It should be noted that the data transmission method and apparatus for distributed file systems in the present application can be used in the field of privacy computing technology when the distributed file system data is securely transmitted and processed, and can also be used in any field outside the field of privacy computing technology when the distributed file system data is securely transmitted and processed. The present application does not limit the application field of the data transmission method and apparatus for distributed file systems.

[0038] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, processing, transmission, provision, disclosure, use and processing of the relevant data comply with the laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good customs, and provide corresponding operation entrances for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0039] The information collection (for example, user voice, video, and text collection) and analysis operations involved in this application have provided users with corresponding operation entrances when they are executed, allowing users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0040] The following embodiments of the present invention can be applied to various systems / applications / devices that need to transmit data and protect data privacy, and can realize secure and anonymous data transmission. The present invention uses public and private key pairs for multi-layer encryption communication, and then decrypts the guard nodes, intermediate nodes and exit nodes of the anonymous network system in sequence through a distributed file system, which can better protect the anonymity and security of the file provider and the data transmission process, and prevent information leakage and malicious attacks.

[0041] The present invention is described in detail below in conjunction with various embodiments.

[0042] Embodiment 1

[0043] According to an embodiment of the present invention, an embodiment of a data transmission method for a distributed file system is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0044] The data transmission method embodiment for a distributed file system provided in the first embodiment of the present invention can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for a data transmission method of a distributed file system is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0045] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0046] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the data transmission method for a distributed file system in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned data transmission method for a distributed file system is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0047] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0048] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0049] Under the above operating environment, the present invention provides Figure 2 The data transmission method for a distributed file system shown in the figure is implemented by a distributed file system and an anonymous network system connected thereto. The method is combined with public-private key encryption technology and is used in network file sharing scenarios, especially to solve the problem of non-anonymity of file providers on the network. By establishing a multi-layer encrypted communication link, specifically, the steps of sequentially establishing encrypted communication links between a target client and a guard node, a guard node and an intermediate node, an intermediate node and an exit node, and an exit node and a target server are performed to achieve the purpose of protecting the anonymity of file providers and the security of data transmission in a distributed file system.

[0050] The embodiment of the present invention is described in detail below in conjunction with various specific steps.

[0051] Figure 2 is a flow chart of an optional data transmission method for a distributed file system according to an embodiment of the present invention, such as Figure 2 As shown, the method comprises the following steps:

[0052] Step S201, selecting N relay nodes from the current network, where N is an integer greater than or equal to 3, and the relay nodes include: a guard node, at least one intermediate node and an exit node.

[0053] Specifically, the current network refers to a network environment that can be used for anonymous data transmission, which can be any network that supports anonymous communication, such as the onion routing network, which uses multi-layer encryption and random routing nodes to achieve anonymous data transmission.

[0054] Relay nodes are the core components of an anonymous network, responsible for receiving, decrypting, re-encrypting and forwarding data packets, thereby achieving anonymity and security of data transmission. The role of relay nodes can be divided into guard nodes, intermediate nodes and exit nodes according to their position and function in the network.

[0055] Among them, the guard node is the first stop in the data transmission process. It is responsible for receiving data from the target client, decrypting the data with its own private key, and forwarding it to the next intermediate node. The primary task of the guard node is to ensure the anonymity of the client and prevent any tracking or identification; the intermediate node is located between the guard node and the exit node, and is used to forward data to the next node. It uses its own private key to further decrypt the data, but will not decrypt the final content of the data packet, maintaining the anonymity and encryption status during data transmission.

[0056] The exit node is the last stop of the anonymous data transmission link. It is responsible for receiving data from the intermediate node, using its own private key to further decrypt the data to obtain the original data before encryption, and then sending the original data to the target server. The exit node is used to transmit data to the destination accurately.

[0057] Optionally, step S201 includes: requesting a relay server list from a directory server, wherein the relay server list is used to record all relay servers surviving in the current network; screening N relay servers in the relay server list based on target transmission requirements, and determining the network node corresponding to each relay server to obtain N relay nodes; determining the node identity of each relay node to obtain a guard node, at least one intermediate node and an exit node.

[0058] It should be noted that the directory server is an information library in the anonymous network, which is used to store the information of all relay servers currently alive in the network, such as server addresses, public keys, etc. The target client obtains the available relay node information by requesting the relay server list from the directory server, thereby building an anonymous communication link.

[0059] A relay server is an anonymous network node recorded in the directory server list. It can act as a guard node, intermediate node, or exit node, and participate in the anonymous transmission process of data by performing specific encryption and decryption tasks.

[0060] Optionally, in the process of implementing the present invention, the actual operation may involve the following steps:

[0061] Request a relay server list from the directory server: The target client device sends a request to the directory server to obtain a list of all surviving relay servers in the current network. The directory server responds to the request and returns a list containing relay server addresses, public keys, and other information.

[0062] Filter relay servers based on target transmission requirements: According to the target of data transmission (such as speed, latency, geographic location, etc.), the target client filters out multiple relay servers from the obtained relay server list to ensure the anonymity of data transmission.

[0063] Determine the network node corresponding to each relay server: The selected relay servers will be assigned a specific identity, namely a guard node, intermediate node or exit node. The target client determines the role of each relay server in the network link based on the algorithm or strategy, thereby building a complete anonymous communication link.

[0064] Determine the node identity of each relay node: The node identity (guard, intermediate, exit) of each relay node is determined according to its position and function in the network link. The guard node is the entrance of the link, the exit node is the end of the link, and the intermediate node is located between the two and is responsible for forwarding data packets.

[0065] Through the above steps, the present invention can effectively build a data transmission link in an anonymous network, ensuring that the data in the distributed file system will not be intercepted or tracked by a third party during the transmission process, while protecting the privacy security of file providers and data recipients, and meeting the needs of privacy computing and data transmission fields for data anonymity and security.

[0066] Step S202, establish encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server in sequence to obtain an anonymous communication link.

[0067] It should be noted that an encrypted communication link refers to a communication channel established between two communication entities that uses encryption technology to protect the security of data transmission. In the scenario of the embodiment of the present invention, the encrypted communication link is a component of the anonymous communication link, and the security and privacy of data during transmission are ensured through encryption and decryption of public and private keys.

[0068] Optionally, step S202 includes: controlling the target client to send a handshake request to the guard node, wherein the handshake request includes at least a preset encryption algorithm; generating a first communication key in the guard node based on the preset encryption algorithm, wherein the first communication key includes: a first public key and a first private key; performing a session key exchange between the target client and the guard node through the first public key and the first private key, and obtaining a first sub-link in the anonymous communication link after the exchange is completed.

[0069] It should be noted that a handshake request is a signal in a communication protocol, which is used to establish a trust relationship and an encrypted session at the beginning of communication. In the present invention, the target client first sends a handshake request to the guard node, and the handshake request contains at least preset encryption algorithm information, indicating which encryption algorithm the client wants to use for subsequent session key exchange. Among them, the encryption algorithm is a mathematical method for data encryption and decryption, and the preset encryption algorithm is a data encryption standard pre-determined and supported in the anonymous network system.

[0070] The communication key is a key used for data encryption and decryption in an encrypted communication link, including a public key or a private key. The first communication key is a key pair generated when an encrypted communication link is established between the target client and the guard node, including a first public key and a first private key, where the first public key is used for encryption and the first private key is used for decryption.

[0071] The session key is a key used by two communicating entities in a communication session to encrypt and decrypt data transmitted during the session. The generation and exchange of session keys ensure that even if the communication key is leaked, the security of the session data will not be affected. In the present invention, each establishment of an encrypted communication link involves the exchange of session keys to enhance the dynamic security and anonymity of data transmission.

[0072] In an optional embodiment, the detailed steps of establishing an anonymous communication link include: after selecting a guard node, the target client device (such as a PC, a smart phone) sends a handshake request to the guard node, wherein the request includes information about a preset encryption algorithm proposed by the client, and the purpose of the handshake request is to initiate a secure communication session with the guard node; after receiving the handshake request, the guard node generates a first communication key pair, i.e., a first public key and a first private key, according to the preset encryption algorithm, and sends the generated first public key back to the target client, while retaining the first private key for subsequent decryption operations; the target client uses the received first public key to perform a session key exchange with the guard node, and the session key exchange process is bidirectional, thereby ensuring the secure generation and transmission of the session key; after the session key exchange is completed, the encrypted communication link between the target client and the guard node is successfully established, forming the first sub-link in the anonymous communication link.

[0073] Through a similar process, the guard node will establish an encrypted communication link with the intermediate node, the intermediate node with the exit node, and the exit node with the target server, and finally build the entire anonymous communication link. In the process of establishing the encrypted communication link, the establishment of each link follows the steps of handshake request, communication key generation and session key exchange, ensuring that each part of the entire anonymous communication link is securely encrypted, thereby ensuring the anonymity and security of data transmission, which meets the goals and requirements of the present invention.

[0074] By establishing the above-mentioned encrypted communication link, data can be securely transmitted between the target client and the target server, while protecting the identity information and data privacy of all parties.

[0075] Optionally, the step of executing the session key exchange between the target client and the guard node through the first public key and the first private key includes: controlling the guard node to return the first public key to the target client, and the target client uses the first public key to encrypt the pre-generated session key to obtain an encrypted session key; controlling the target client to send the encrypted session key to the guard node, and the guard node uses the first private key to decrypt the encrypted session key, and saves the decrypted session key in the guard node.

[0076] In the embodiment of the present invention, a key step in establishing an encrypted communication link is to perform a session key exchange between the target client and the guard node using the first public key and the first private key, thereby ensuring the security of data during transmission while also maintaining the anonymity of communication.

[0077] After the guard node generates the first communication key pair (the first public key and the first private key), it sends the first public key to the target client for encrypting the session key to ensure the security of the session key during transmission; after receiving the first public key of the guard node, the target client will pre-generate a session key, which is a temporary key for subsequent data transmission. The security level is usually higher than the communication key and can provide a higher level of data protection. The target client uses the first public key to encrypt the session key to generate an encrypted session key; the target client sends the encrypted session key to the guard node. Since the data is encrypted using the first public key, only the guard node holding the first private key can successfully decrypt it; after receiving the encrypted session key sent by the target client, the guard node uses its own first private key to decrypt the data, thereby restoring the plaintext form of the session key. The first private key is part of the key pair generated by the guard node, which is only stored locally at the guard node and will not be disclosed to any third party; the decrypted session key is saved by the guard node for subsequent data encryption and decryption operations between the guard node and the target client. The session key is generated temporarily and is valid only during the current session. Once the session ends, the session key will be destroyed, thereby enhancing the overall security of data transmission.

[0078] In actual operation, the process of session key exchange can be further refined, including: after the guard node generates the first communication key pair (first public key and first private key), it includes the first public key in the handshake response and sends it to the target client. After receiving the handshake response, the target client verifies the validity of the first public key and uses the public key to encrypt the pre-generated session key.

[0079] After encryption is completed, the target client packages the encrypted session key and necessary handshake protocol information into a data packet and sends it to the guard node. Only the guard node can decrypt the encrypted session key in the data packet because only the guard node holds the corresponding first private key.

[0080] After receiving the data packet, the guard node uses the first private key to decrypt the encrypted session key in the data packet. After successful decryption, the guard node saves the obtained session key in the local secure storage. The guard node and the target client now each hold the same session key, but this key is kept confidential from other network nodes (such as intermediate nodes and exit nodes).

[0081] The guard node and the target client use a symmetric encryption algorithm (such as AES, 3DES, etc.) to encrypt and decrypt data based on the session key. The data will be encrypted multiple times during transmission, and each encryption uses a different session key to ensure that even if the session key of a node is cracked, it will not affect the data security of other nodes.

[0082] Through the above-mentioned session key exchange process, the present invention can ensure that the communication link between the target client and the guard node is safe and reliable, and also provide a solid security guarantee for subsequent data transmission. This process avoids the security risks that may be caused by directly using the communication key to encrypt data, because the communication key is public during the entire anonymous communication link (at least to the intermediate node and the exit node), while the session key is temporarily generated for each session and is only shared between the target client and the guard node, thereby greatly enhancing the anonymity and security of data transmission.

[0083] Optionally, after obtaining the first sub-link in the anonymous communication link, it also includes: controlling the guard node to send a handshake request to the intermediate node; generating a second communication key in the intermediate node based on a preset encryption algorithm, wherein the second communication key includes: a second public key and a second private key; returning the second public key to the target client through the first sub-link, which is saved by the target client, and after the saving is completed, obtaining the second sub-link in the anonymous communication link.

[0084] After successfully establishing the first sub-link between the target client and the guard node, the present invention further expands the anonymous communication link to include intermediate nodes.

[0085] Specifically, after the encrypted communication link with the target client is established, the guard node selects an intermediate node from the previously obtained relay server list and sends a handshake request to the intermediate node. The handshake request also contains preset encryption algorithm information. After receiving the handshake request from the guard node, the intermediate node generates a second communication key pair according to the preset encryption algorithm, namely, a second public key and a second private key. The second communication key will be used for data encryption and decryption between the guard node and the intermediate node. The intermediate node sends the generated second public key to the guard node. The guard node uses the first sub-link between the target client to forward the second public key to the target client. The target client saves the second public key for subsequent data encryption. After the target client saves the second public key, the encrypted communication link between the guard node and the intermediate node is successfully established, forming the second sub-link of the anonymous communication link. This sub-link also follows the secure handshake protocol and session key exchange process to ensure the security of data transmission between the guard node and the intermediate node.

[0086] It should be noted that the guard node selects an intermediate node according to a specific algorithm and sends a handshake request through the first sub-link. The information contained in the handshake request is sufficient for the intermediate node to identify the communication intention and the preset encryption algorithm. After receiving the handshake request, the intermediate node generates a second communication key pair (a second public key and a second private key), sends the second public key to the guard node, and waits for subsequent instructions.

[0087] After receiving the second public key, the guard node does not directly decrypt or use the key, but encapsulates it and forwards it to the target client through the first sub-link. The target client saves the second public key and prepares it for the encryption process of subsequent data transmission.

[0088] The guard node and the intermediate node exchange session keys through a preset encryption algorithm, which is similar to the exchange between the target client and the guard node, but uses a second communication key pair. Once the session key exchange is completed, the encrypted communication link between the guard node and the intermediate node is successfully established, forming the second sub-link of the anonymous communication link.

[0089] Similarly, after establishing the second sub-link, the guard node and the intermediate node will use the session key to encrypt and decrypt the data. The data packet has been encrypted once when passing through the first sub-link. When the data packet reaches the intermediate node, it will be encrypted again, this time using the session key between the guard node and the intermediate node. This "onion" multi-layer encryption technology ensures that the data is encrypted at each layer during the transmission process until the data reaches the exit node, where it will be decrypted and sent to the target server.

[0090] After completing the link establishment with the intermediate node, the subsequent steps of the present invention will involve the selection of the exit node and the link establishment, and finally the establishment of the communication link with the target server to form the entire anonymous communication link.

[0091] Through the above process, the present invention can ensure that each part of the anonymous communication link complies with strict security and privacy standards, provides layer upon layer of encryption protection for data transmission, and enhances the application potential of the entire system in the field of privacy computing.

[0092] Optionally, after obtaining the second sub-link in the anonymous communication link, it also includes: controlling the intermediate node to send a handshake request to the exit node; generating a third communication key in the exit node based on a preset encryption algorithm, wherein the third communication key includes: a third public key and a third private key; returning the third public key to the target client through the second sub-link and the first sub-link, and the target client saves the third sub-link, and after the saving is completed, the third sub-link in the anonymous communication link is obtained.

[0093] After the first sub-link (target client and guard node) and the second sub-link (guard node and intermediate node) are successfully established, the next step is to expand the anonymous communication link to include the exit node.

[0094] Specifically, after the encrypted communication link with the guard node is established, the intermediate node selects an exit node from the previously obtained relay server list and sends a handshake request to the exit node. The handshake request also contains the preset encryption algorithm information, indicating which encryption method is expected to be used to establish the link; after receiving the handshake request from the intermediate node, the exit node generates a third communication key pair, i.e., a third public key and a third private key, according to the preset encryption algorithm. The third communication key pair is used for data encryption and decryption between the intermediate node and the exit node to ensure the security of data transmission on this link.

[0095] The exit node sends the generated third public key to the intermediate node, and the intermediate node forwards the third public key to the target client through the second sub-link between the guard node and the first sub-link between the target client and the target client. The target client saves the third public key for encryption of subsequent data transmission; after the intermediate node saves the third private key and completes the session key exchange with the exit node, the encrypted communication link between the intermediate node and the exit node is successfully established, forming the third sub-link of the anonymous communication link. This sub-link also follows the secure handshake protocol and session key exchange process to ensure the security of data transmission between the intermediate node and the exit node.

[0096] It should be noted that after the intermediate node completes the establishment of the second sub-link with the guard node, it selects an exit node according to a preset algorithm and sends a handshake request to it. The request contains encryption algorithm information. After receiving the handshake request, the exit node generates a third communication key pair (a third public key and a third private key). The exit node saves the third private key and sends the third public key to the intermediate node through the second sub-link.

[0097] After receiving the third public key of the exit node, the intermediate node does not use this public key directly, but forwards it to the target client again through the second sub-link with the guard node. After receiving the third public key, the target client saves this public key for subsequent data encryption.

[0098] The session key exchange between the intermediate node and the exit node is similar to the previous exchange process between the target client and the guard node, and the guard node and the intermediate node. Once the session key exchange is completed, the encrypted communication link between the intermediate node and the exit node is successfully established, forming the third sub-link of the anonymous communication link.

[0099] When the data packet passes through the anonymous communication link, it will be encrypted three times: the first time at the target client using the session key of the first sub-link; the second time at the guard node using the session key of the second sub-link; the third time at the intermediate node using the session key of the third sub-link. This multi-layer encryption technology ensures that the data is encrypted at each layer during the transmission process until the exit node, where the data is decrypted and sent to the target server.

[0100] Through three-way handshake and session key exchange, the anonymous communication link between the target client and the exit node has been fully established, including three sub-links: the first sub-link between the target client and the guard node, the second sub-link between the guard node and the intermediate node, and the third sub-link between the intermediate node and the exit node. The construction of the entire anonymous communication link ensures the anonymity and security of data transmission, and meets the needs of privacy computing and data transmission.

[0101] Through the above steps, the present invention can successfully build a multi-node anonymous communication link, ensuring that each layer of the data is encrypted during the transmission process until the data is securely transmitted to the final destination, which not only improves the security of the data, but also protects the identity information of each node involved in the communication, thereby enhancing the application value of the entire system in the field of network privacy and security.

[0102] Optionally, after obtaining the third sub-link in the anonymous communication link, it also includes: controlling the target client to encrypt the target server address using the third public key, the second public key and the first public key in sequence to obtain an encrypted address; transmitting the encrypted address through the first sub-link, the second sub-link and the third sub-link, and during the transmission process, decrypting the encrypted address using the first private key, the second private key and the third private key in sequence to obtain the target server address in the exit node; and establishing a fourth sub-link in the anonymous communication link between the exit node and the target server based on the target server address.

[0103] After the first three sub-links of the anonymous communication link (target client and guard node, guard node and intermediate node, intermediate node and exit node) are established, address encryption technology is used to ensure that the destination of data transmission, namely the address of the target server, is not leaked.

[0104] Specifically, during the anonymous link establishment process, the target client has obtained the public keys of the guard node, intermediate node and exit node (i.e., the first public key, the second public key and the third public key), and controls the target client to use the third public key (the public key of the exit node) to encrypt the address of the target server for the first time, and then use the second public key to encrypt the encrypted address for the second time, and finally use the first public key to encrypt it for the third time to form an encrypted address, ensuring that even if the data is intercepted during transmission, the address information of the target server cannot be directly obtained.

[0105] The encrypted address is transmitted through the three sub-links of the anonymous link, starting from the target client, passing through the guard node, the intermediate node, and finally reaching the exit node. During the transmission process of each link, the data is additionally encrypted and decrypted using the corresponding session key to enhance the security of data transmission.

[0106] When the encrypted address reaches the guard node, the guard node decrypts the data using the first private key, then re-encrypts the decrypted data, encrypts it using the second public key and forwards it to the intermediate node, which decrypts the data using the second private key, encrypts it using the third public key and forwards it to the exit node. Finally, the exit node decrypts the data using the third private key and obtains the address of the target server.

[0107] After the exit node decrypts and obtains the address of the target server, it sends a handshake request to the target server. The target server responds to the handshake request, and the two parties perform session key exchange to establish an encrypted communication link, which is the fourth sub-link of the anonymous communication link. This sub-link also follows the secure handshake protocol and session key exchange process to ensure the security of data transmission between the exit node and the target server.

[0108] It should be noted that after the target client completes the establishment of the first three sub-links of the anonymous link, it uses the third public key (the public key of the exit node) to encrypt the target server address for the first time to obtain encrypted address 1; then, the target client uses the second public key to encrypt encrypted address 1 for the second time to obtain encrypted address 2; finally, the first public key is used to encrypt encrypted address 2 for the third time to generate the final encrypted address.

[0109] The encrypted address is transmitted through the three sub-links of the anonymous link. First, the encrypted address is sent from the target client to the guard node through the first sub-link; after the guard node decrypts the data using the first private key, it re-encrypts it using the second public key and sends it to the intermediate node through the second sub-link; after the intermediate node decrypts the data using the second private key, it re-encrypts it using the third public key and sends it to the exit node through the third sub-link.

[0110] At the exit node, the encrypted address is finally decrypted using the third private key to recover the address information of the target server, ensuring that the target server address is only decrypted at the exit node and will not be leaked in other nodes of the anonymous link. The exit node uses the recovered target server address to send a handshake request to the target server, and the target server responds to the handshake request. The two parties perform session key exchange through a preset encryption algorithm to establish an encrypted communication link. At this point, the fourth sub-link of the anonymous communication link is established, forming a complete anonymous communication path from the target client to the target server.

[0111] Through the above process, the present invention not only builds a secure anonymous communication link and protects the security and anonymity of the data transmission process, but also further enhances the security of the link endpoint by encrypting the target server address and prevents the leakage of address information. This design has important application value in the fields of privacy computing and secure communication.

[0112] Optionally, the step of establishing a fourth sub-link in the anonymous communication link between the exit node and the target server based on the target server address includes: controlling the exit node to send a handshake request to the target server based on the target server address; generating a fourth communication key in the target server based on a preset encryption algorithm, wherein the fourth communication key includes: a fourth public key and a fourth private key; returning the fourth public key to the target client through the third sub-link, the second sub-link and the first sub-link, and the target client saves the key, and after the saving is completed, the fourth sub-link in the anonymous communication link is obtained.

[0113] After successfully constructing the first three sub-links of the anonymous communication link (the first sub-link between the target client and the guard node, the second sub-link between the guard node and the intermediate node, and the third sub-link between the intermediate node and the exit node), the present invention proceeds to construct the fourth sub-link, i.e., the link between the exit node and the target server.

[0114] Specifically, after decrypting the address, the exit node obtains the specific location information of the target server. At this time, the exit node initiates a handshake request to the target server. The request contains information about the preset encryption algorithm, indicating that it hopes to establish secure encrypted communication with the target server. After receiving the handshake request from the exit node, the target server generates a fourth communication key pair, namely a fourth public key and a fourth private key, according to the preset encryption algorithm. The fourth public key will be used to encrypt the data packet, while the fourth private key is stored in the target server for decrypting the data packet received from the exit node.

[0115] The target server sends the fourth public key to the exit node, which then forwards the public key to the target client through the third sub-link, the second sub-link, and the first sub-link in sequence. After receiving the fourth public key, the target client saves it for subsequent data encryption. When the target client successfully saves the fourth public key, the encrypted communication link between the exit node and the target server is established, forming the fourth sub-link in the anonymous communication link. This sub-link is also based on the exchange of session keys between the two parties, ensuring the security of data transmission between the exit node and the target server.

[0116] It should be noted that after the exit node obtains the target server address through decryption, it sends a handshake request to the target server according to the address information, and the handshake request includes the preset encryption algorithm proposed by the exit node, such as TLS, SSL, etc. After receiving the handshake request from the exit node, the target server generates a fourth communication key pair (a fourth public key and a fourth private key) according to the preset algorithm, and then the target server sends the fourth public key to the exit node.

[0117] After receiving the fourth public key, the exit node does not use it directly, but encapsulates it into a data packet and sends it to the intermediate node through the third sub-link (the link between the exit node and the intermediate node). The intermediate node then forwards the data packet to the guard node through the second sub-link (the link between the intermediate node and the guard node). The guard node finally sends the fourth public key to the target client through the first sub-link (the link between the guard node and the target client).

[0118] After receiving the fourth public key, the target client saves it in the local encrypted communication information library. At this time, the target client has mastered the public key information of all participating nodes in the entire anonymous communication link, including the first public key of the guard node, the second public key of the intermediate node, the third public key of the exit node and the fourth public key of the target server.

[0119] Once the fourth public key is saved by the target client, the anonymous communication link between the target client, guard node, intermediate node, exit node and target server is completely established. The target client can use the public keys of all nodes to encrypt the data, and then send it through three sub-links in sequence. Each node decrypts and re-encrypts it using its own private key. Finally, after decryption at the exit node, the fourth private key (the private key of the target server) is used to decrypt the data for the last time, and the original data is sent to the target server.

[0120] Through the above steps, the anonymous communication link of the present invention is completely constructed, including four sub-links from the target client to the target server. Each sub-link ensures the encryption security and identity anonymity during data transmission. It has important application value in the fields of big data, cloud computing and privacy protection, and can effectively protect data integrity and communication privacy, and prevent data from being eavesdropped or tampered with during transmission.

[0121] In the anonymous communication system of the present invention, the secure transmission of data is the core link. To ensure the security and anonymity of data during transmission, the present invention adopts multi-layer encryption and decryption technology.

[0122] During the data encryption process, in step S203, when the target client obtains the data to be transmitted, the data is encrypted in N layers using N public keys of N relay nodes to obtain an encrypted data packet, wherein each layer of encryption corresponds to one relay node.

[0123] The target client first obtains the data that needs to be transmitted to the target server, which can be files, documents or any other form of digital information.

[0124] The target client obtains the public keys of the exit node, intermediate node, and guard node based on the anonymous link information established previously. For each sub-link, the target client will use the public key of the corresponding relay node to encrypt the data to form the input of the next layer of encrypted data. Specifically, the data is first encrypted using the public key of the exit node to obtain encryption layer 1; then encryption layer 1 is encrypted using the public key of the intermediate node to obtain encryption layer 2; finally, encryption layer 2 is encrypted using the public key of the guard node to obtain the final encrypted data packet.

[0125] After N layers of encryption, the target client receives a fully encrypted data packet, which will be transmitted through an anonymous communication link to ensure that even if it is intercepted during transmission, the data content cannot be directly obtained.

[0126] During the anonymous data transmission and decryption process, in step S204, the encrypted data packet is anonymously transmitted through an anonymous communication link, wherein the encrypted data packet is decrypted N times using N private keys during the transmission process, and the obtained target data is transmitted to the target server, and each decryption corresponds to a relay node.

[0127] The encrypted data packet is first sent through the first sub-link (the link between the target client and the guard node). After receiving the encrypted data packet, the guard node uses its private key to decrypt the outermost layer to obtain the next layer of encrypted data. Then, the guard node sends the next layer of encrypted data packet to the intermediate node through the second sub-link (the link between the guard node and the intermediate node); the intermediate node uses its private key to decrypt the next layer of encrypted data to obtain the next layer of encrypted data, and then sends the data to the exit node through the third sub-link (the link between the intermediate node and the exit node); the exit node repeats the above process until it uses the Nth private key (here, the session key between the exit node and the target server) to decrypt and then sends the obtained plaintext data to the target server.

[0128] During data transmission, each relay node uses its own private key to decrypt the data packet, extract the next layer of encrypted data, and then re-encrypt this part of the data and send it to the next node through the next sub-link of the anonymous link. This process is repeated on each node until the encrypted data packet finally reaches the target server.

[0129] At the exit node, the data packet is finally decrypted using the session key (i.e., the fourth private key) with the target server to obtain the plaintext data, which is then transmitted to the target server.

[0130] In an optional embodiment, assuming that the target client needs to transmit data to the target server, and the anonymous link consists of the following nodes: guard node (N=1), intermediate node (N=2), exit node (N=3), the data encryption transmission process is as follows:

[0131] A, the target client encrypts the data. The target client first encrypts the data using the public key of the exit node to form encryption layer 1; then uses the public key of the intermediate node to encrypt the data of encryption layer 1 to form encryption layer 2; finally, uses the public key of the guard node to encrypt the data of encryption layer 2 to form the final encrypted data packet.

[0132] B, anonymous data transmission. The encrypted data packet is sent to the guard node through the first sub-link. The guard node uses its own private key to decrypt the outermost layer, obtains the data of encryption layer 2, and then sends it to the intermediate node through the second sub-link. The intermediate node uses the private key to decrypt, obtains the data of encryption layer 1, and then sends it to the exit node through the third sub-link. The exit node uses the private key to decrypt, obtains the plaintext data, and then uses the session key with the target server (i.e., the fourth private key) to decrypt and send the data to the target server.

[0133] Through the above steps, the present invention can ensure the security and anonymity of data during transmission, protect the privacy of user data, and prevent possible eavesdropping and tampering of data during transmission. This anonymous data transmission technology based on multi-layer encryption has broad application prospects in cloud storage, network communication, and big data processing.

[0134] Through the above steps S201 to S204, N relay nodes can be selected from the current network first, where N is an integer greater than or equal to 3, and the relay nodes include: a guard node, at least one intermediate node and an exit node, and then encrypted communication links are established between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server in turn to obtain an anonymous communication link, and then when the target client obtains the data to be transmitted, the N public keys of the N relay nodes are used to perform N layers of encryption on the data to obtain an encrypted data packet, where each layer of encryption corresponds to a relay node, and finally the encrypted data packet is anonymously transmitted through the anonymous communication link, where N private keys are used to decrypt the encrypted data packet N times during the transmission process, and the obtained target data is transmitted to the target server, and each decryption corresponds to a relay node.

[0135] In the embodiment of the present invention, an anonymous communication link is constructed in the data transmission network of the distributed file system. By selecting N relay nodes and sequentially establishing encrypted communication links, the purpose of protecting the anonymity of the file provider during the data transmission process is achieved, thereby achieving the technical effect of enhancing the security of data transmission and enhancing the security of user identity. Specifically, an anonymous network composed of relay nodes is formed by establishing encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server, thereby ensuring the anonymity and security of the data transmission path of the distributed file system. When constructing the anonymous communication link, a guard node, at least one intermediate node and an exit node are selected to serve as a "transfer station" in the data transmission process. Before data transmission, the public key of the relay node is used to perform multi-layer encryption on the data to ensure the security of the data during the transmission process and prevent it from being intercepted and decrypted in the middle. During the data transmission process, the private key is used to decrypt the encrypted data packet layer by layer to ensure that the data can be received by the correct target server. At the same time, the privacy and integrity of the data transmission are maintained, and the complexity and security of the data transmission are further enhanced, thereby solving the technical problem that the distributed file system adopts a non-anonymous data transmission form in the related art, resulting in the security of both the data and the data transmitter being not guaranteed, which is easy to cause information leakage.

[0136] The present invention is described below in conjunction with another optional embodiment.

[0137] Embodiment 2

[0138] An embodiment of the present invention further provides a data transmission device for a distributed file system. It should be noted that the data transmission device for a distributed file system in the embodiment of the present invention includes multiple implementation units, which can be used to execute the data transmission method for a distributed file system provided in the above-mentioned embodiment one, and each implementation unit corresponds to each implementation step in the above-mentioned embodiment one.

[0139] Figure 3 is a schematic diagram of an optional data transmission device for a distributed file system according to an embodiment of the present invention, such as Figure 3 As shown, the device may include: a selection unit 31, an establishment unit 32, an encryption unit 33, and a transmission unit 34.

[0140] The selection unit 31 is used to select N relay nodes from the current network, where N is an integer greater than or equal to 3, and the relay nodes include: a guard node, at least one intermediate node and an exit node.

[0141] The establishing unit 32 is used to sequentially establish encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server to obtain an anonymous communication link.

[0142] The encryption unit 33 is used to encrypt the data in N layers using N public keys of N relay nodes when the target client obtains the data to be transmitted, so as to obtain an encrypted data packet, wherein each encryption layer corresponds to one relay node.

[0143] The transmission unit 34 is used to anonymously transmit the encrypted data packet through the anonymous communication link, wherein the encrypted data packet is decrypted N times using N private keys during the transmission process, and the obtained target data is transmitted to the target server, and each decryption corresponds to a relay node.

[0144] The above-mentioned data transmission device for a distributed file system can first select N relay nodes from the current network through a selection unit 31, wherein N is an integer greater than or equal to 3, and the relay nodes include: a guard node, at least one intermediate node and an exit node, and then establish an encrypted communication link between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server in sequence through an establishment unit 32 to obtain an anonymous communication link, and then through the encryption unit 33, when the target client obtains the data to be transmitted, the N public keys of the N relay nodes are used to perform N layers of encryption on the data to obtain an encrypted data packet, wherein each layer of encryption corresponds to a relay node, and finally the encrypted data packet is anonymously transmitted through the anonymous communication link through the transmission unit 34, wherein the encrypted data packet is decrypted N times using N private keys during the transmission process, and the obtained target data is transmitted to the target server, and each decryption corresponds to a relay node.

[0145] In an embodiment of the present invention, an anonymous communication link is constructed in the data transmission network of the distributed file system. By selecting N relay nodes and sequentially establishing encrypted communication links, the purpose of protecting the anonymity of the file provider during the data transmission process is achieved, thereby achieving the technical effect of enhancing the security of data transmission and enhancing the security of user identity. Specifically, an anonymous network composed of relay nodes is formed by establishing encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server, thereby ensuring the anonymity and security of the data transmission path. When constructing the anonymous communication link, a guard node, at least one intermediate node and an exit node are selected to act as a "transfer station" in the data transmission process. Before data transmission, the public key of the relay node is used to perform multi-layer encryption on the data to ensure the security of the data of the distributed file system during the transmission process and prevent it from being intercepted and decrypted in the middle. During the data transmission process, the private key is used to decrypt the encrypted data packet layer by layer to ensure that the data can be received by the correct target server. At the same time, the privacy and integrity of the data transmission are maintained, and the complexity and security of the data transmission are further enhanced, thereby solving the technical problem that the distributed file system adopts a non-anonymous data transmission form in the related art, resulting in the security of both the data and the data transmitter being not guaranteed, which is easy to cause information leakage.

[0146] Optionally, the selection unit includes: a request module, used to request a relay server list from a directory server, wherein the relay server list is used to record all relay servers surviving in the current network; a screening module, used to screen N relay servers in the relay server list based on target transmission requirements, and determine the network node corresponding to each relay server to obtain N relay nodes; a determination module, used to determine the node identity of each relay node to obtain a guard node, at least one intermediate node and an exit node.

[0147] Optionally, the establishment unit includes: a first control module, used to control the target client to send a handshake request to the guard node, wherein the handshake request includes at least a preset encryption algorithm; a first generation module, used to generate a first communication key in the guard node based on the preset encryption algorithm, wherein the first communication key includes: a first public key and a first private key; an exchange module, used to execute a session key exchange between the target client and the guard node through the first public key and the first private key, and obtain the first sub-link in the anonymous communication link after the exchange is completed.

[0148] Optionally, the exchange module includes: a first control submodule, used to control the guard node to return the first public key to the target client, and the target client uses the first public key to encrypt the pre-generated session key to obtain an encrypted session key; a second control submodule, used to control the target client to send the encrypted session key to the guard node, and the guard node uses the first private key to decrypt the encrypted session key, and saves the decrypted session key in the guard node.

[0149] Optionally, the establishment unit also includes: a second control module, used to control the guard node to send a handshake request to the intermediate node after obtaining the first sub-link in the anonymous communication link; a second generation module, used to generate a second communication key in the intermediate node based on a preset encryption algorithm, wherein the second communication key includes: a second public key and a second private key; a first return module, used to return the second public key to the target client through the first sub-link, which is saved by the target client, and after the saving is completed, the second sub-link in the anonymous communication link is obtained.

[0150] Optionally, the establishment unit also includes: a third control module, used to control the intermediate node to send a handshake request to the exit node after obtaining the second sub-link in the anonymous communication link; a third generation module, used to generate a third communication key in the exit node based on a preset encryption algorithm, wherein the third communication key includes: a third public key and a third private key; a second return module, used to return the third public key to the target client through the second sub-link and the first sub-link, which is saved by the target client, and after the saving is completed, the third sub-link in the anonymous communication link is obtained.

[0151] Optionally, the establishment unit also includes: a fourth control module, which is used to control the target client to use the third public key, the second public key and the first public key in sequence to encrypt the target server address after obtaining the third sub-link in the anonymous communication link to obtain an encrypted address; a transmission module, which is used to transmit the encrypted address through the first sub-link, the second sub-link and the third sub-link, and during the transmission process, decrypt the encrypted address in sequence using the first private key, the second private key and the third private key to obtain the target server address in the exit node; and an establishment module, which is used to establish the fourth sub-link in the anonymous communication link between the exit node and the target server based on the target server address.

[0152] Optionally, the establishment module includes: controlling the exit node to send a handshake request to the target server based on the target server address; generating a sub-module, used to generate a fourth communication key in the target server based on a preset encryption algorithm, wherein the fourth communication key includes: a fourth public key and a fourth private key; and returning a sub-module, used to return the fourth public key to the target client through the third sub-link, the second sub-link and the first sub-link, which is saved by the target client, and after the saving is completed, the fourth sub-link in the anonymous communication link is obtained.

[0153] It should be noted that the above-mentioned selection unit 31, establishment unit 32, encryption unit 33, and transmission unit 34 correspond to steps S201 to S204 in the first embodiment, and the above-mentioned units and corresponding steps implement the same examples and application scenarios, but are not limited to the contents disclosed in the first embodiment. It should be noted that the above-mentioned modules or units may be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n), and the above-mentioned modules or units may also be part of a device and may be run in the computer terminal 10 provided in the first embodiment.

[0154] The present invention is described below in conjunction with another optional embodiment.

[0155] Embodiment 3

[0156] An embodiment of the present invention may also provide an electronic device, Figure 4 is a structural block diagram of an electronic device for executing a data transmission method for a distributed file system according to an embodiment of the present invention. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 (only one is shown) processor 402, memory 404, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0157] Among them, the memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the data transmission method and device for distributed file systems in the embodiments of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned data transmission method for distributed file systems. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0158] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: select N relay nodes from the current network, where N is an integer greater than or equal to 3, and the relay nodes include: a guard node, at least one intermediate node and an exit node; establish encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server in sequence to obtain an anonymous communication link; when the target client obtains the data to be transmitted, use the N public keys of the N relay nodes to perform N layers of encryption on the data to obtain an encrypted data packet, where each layer of encryption corresponds to a relay node; anonymously transmit the encrypted data packet through the anonymous communication link, where N private keys are used to decrypt the encrypted data packet N times during the transmission process, and transmit the obtained target data to the target server, and each decryption corresponds to a relay node.

[0159] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: request a relay server list from the directory server, wherein the relay server list is used to record all relay servers surviving in the current network; based on the target transmission requirements, screen N relay servers in the relay server list, and determine the network node corresponding to each relay server to obtain N relay nodes; determine the node identity of each relay node to obtain a guard node, at least one intermediate node and an exit node.

[0160] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: control the target client to send a handshake request to the guard node, wherein the handshake request at least includes a preset encryption algorithm; generate a first communication key in the guard node based on the preset encryption algorithm, wherein the first communication key includes: a first public key and a first private key; execute a session key exchange between the target client and the guard node through the first public key and the first private key, and obtain the first sub-link in the anonymous communication link after the exchange is completed.

[0161] The processor can also call the information and applications stored in the memory through the transmission device to perform the following steps: control the guard node to return the first public key to the target client, and the target client uses the first public key to encrypt the pre-generated session key to obtain an encrypted session key; control the target client to send the encrypted session key to the guard node, and the guard node uses the first private key to decrypt the encrypted session key, and save the decrypted session key in the guard node.

[0162] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: control the guard node to send a handshake request to the intermediate node; generate a second communication key in the intermediate node based on a preset encryption algorithm, wherein the second communication key includes: a second public key and a second private key; return the second public key to the target client through the first sub-link, and the target client saves it, and after the saving is completed, obtain the second sub-link in the anonymous communication link.

[0163] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: control the intermediate node to send a handshake request to the exit node; generate a third communication key in the exit node based on a preset encryption algorithm, wherein the third communication key includes: a third public key and a third private key; return the third public key to the target client through the second sub-link and the first sub-link, and the target client saves it, and after the saving is completed, obtain the third sub-link in the anonymous communication link.

[0164] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: control the target client to use the third public key, the second public key and the first public key in sequence to encrypt the target server address to obtain an encrypted address; transmit the encrypted address through the first sub-link, the second sub-link and the third sub-link, and during the transmission process, use the first private key, the second private key and the third private key in sequence to decrypt the encrypted address to obtain the target server address in the exit node; establish a fourth sub-link in the anonymous communication link between the exit node and the target server based on the target server address.

[0165] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: control the exit node to send a handshake request to the target server based on the target server address; generate a fourth communication key in the target server based on a preset encryption algorithm, wherein the fourth communication key includes: a fourth public key and a fourth private key; return the fourth public key to the target client through the third sub-link, the second sub-link and the first sub-link, and the target client saves it, and after the saving is completed, obtain the fourth sub-link in the anonymous communication link.

[0166] According to an embodiment of the present invention, a data transmission solution for a distributed file system is provided. In the data transmission network of the distributed file system, by constructing an anonymous communication link, by selecting N relay nodes and sequentially establishing encrypted communication links, the purpose of protecting the anonymity of the file provider during the data transmission process is achieved, thereby achieving the technical effect of enhancing the security of data transmission and enhancing the security of user identity. Specifically, by establishing encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server, an anonymous network composed of relay nodes is formed to ensure the anonymity and security of the data transmission path of the distributed file system. When constructing the anonymous communication link, a guard node, at least one intermediate node and an exit node are selected to act as a "transit station" in the data transmission process. Before data transmission, the public key of the relay node is used to perform multi-layer encryption on the data to ensure the security of the data during transmission and prevent it from being intercepted and decrypted in the middle. During the data transmission process, the private key is used to decrypt the encrypted data packet layer by layer to ensure that the data can be received by the correct target server. At the same time, the privacy and integrity of data transmission are maintained, and the complexity and security of data transmission are further enhanced, thereby solving the technical problem that the distributed file system adopts a non-anonymous data transmission form in the related technology, resulting in the security of both data and data transmitters not being guaranteed, which is easy to cause information leakage.

[0167] It can be understood by those skilled in the art that Figure 4 The structure shown is for illustration only, and the electronic device may also be a smart phone, a tablet computer, a PDA, a mobile Internet device (MID), a PAD or other terminal device. Figure 4 The structure of the electronic device is not limited. Figure 4 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 4 Different configurations shown.

[0168] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0169] The present invention is described below in conjunction with another optional embodiment.

[0170] Embodiment 4

[0171] The embodiment of the present invention further provides a computer-readable storage medium. Optionally, in the embodiment of the present invention, the computer-readable storage medium can be used to store the program code executed by the data transmission method for a distributed file system provided in the first embodiment.

[0172] Optionally, in an embodiment of the present invention, the above-mentioned storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0173] An embodiment of the present invention also provides a computer program product, which, when executed on a data processing device, is suitable for executing the steps of a data transmission method for a distributed file system: selecting N relay nodes from the current network, wherein N is an integer greater than or equal to 3, and the relay nodes include: a guard node, at least one intermediate node and an exit node; establishing encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server in sequence to obtain an anonymous communication link; when the target client obtains the data to be transmitted, using N public keys of N relay nodes to perform N layers of encryption on the data to obtain an encrypted data packet, wherein each layer of encryption corresponds to a relay node; anonymously transmitting the encrypted data packet through the anonymous communication link, wherein during the transmission process, using N private keys to decrypt the encrypted data packet N times, and transmitting the obtained target data to the target server, each decryption corresponding to a relay node.

[0174] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0175] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0176] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and there may be other division methods in actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0177] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0178] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0179] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0180] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data transmission method for a distributed file system, characterized in that: include: Select N relay nodes from the current network, where N is an integer greater than or equal to 3, and the relay nodes include: a guard node, at least one intermediate node and an exit node; Establishing encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server in sequence to obtain an anonymous communication link; When the target client obtains the data to be transmitted, N layers of encryption are performed on the data using N public keys of the N relay nodes to obtain an encrypted data packet, wherein each layer of encryption corresponds to one relay node; The encrypted data packet is anonymously transmitted through the anonymous communication link, wherein the encrypted data packet is decrypted N times using N private keys during the transmission process, and the obtained target data is transmitted to the target server, and each decryption corresponds to one of the relay nodes.

2. The data transmission method according to claim 1, characterized in that: The steps of selecting N relay nodes from the current network include: Requesting a relay server list from a directory server, wherein the relay server list is used to record all the relay servers surviving in the current network; Based on the target transmission requirement, N relay servers are screened in the relay server list, and a network node corresponding to each relay server is determined to obtain N relay nodes; The node identity of each of the relay nodes is determined to obtain the one guard node, the at least one intermediate node and the one exit node.

3. The data transmission method according to claim 1, characterized in that: The step of sequentially establishing encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server to obtain an anonymous communication link includes: Controlling the target client to send a handshake request to the guard node, wherein the handshake request at least includes a preset encryption algorithm; Generating a first communication key in the guard node based on the preset encryption algorithm, wherein the first communication key includes: a first public key and a first private key; The session key exchange between the target client and the guard node is performed through the first public key and the first private key, and the first sub-link in the anonymous communication link is obtained after the exchange is completed.

4. The data transmission method according to claim 3, characterized in that: The step of performing session key exchange between the target client and the guard node by using the first public key and the first private key comprises: Controlling the guard node to return the first public key to the target client, and the target client encrypts the pre-generated session key using the first public key to obtain an encrypted session key; The target client is controlled to send the encrypted session key to the guard node, and the guard node uses the first private key to decrypt the encrypted session key, and stores the decrypted session key in the guard node.

5. The data transmission method according to claim 3, characterized in that: After obtaining the first sub-link in the anonymous communication link, the method further includes: Controlling the guard node to send the handshake request to the intermediate node; Generating a second communication key in the intermediate node based on the preset encryption algorithm, wherein the second communication key includes: a second public key and a second private key; The second public key is returned to the target client through the first sub-link, and is saved by the target client. After the saving is completed, the second sub-link in the anonymous communication link is obtained.

6. The data transmission method according to claim 5, characterized in that: After obtaining the second sub-link in the anonymous communication link, the method further includes: Controlling the intermediate node to send the handshake request to the egress node; Generating a third communication key in the egress node based on the preset encryption algorithm, wherein the third communication key includes: a third public key and a third private key; The third public key is returned to the target client through the second sub-link and the first sub-link, and is saved by the target client. After the saving is completed, the third sub-link in the anonymous communication link is obtained.

7. The data transmission method according to claim 6, characterized in that: After obtaining the third sub-link in the anonymous communication link, the method further includes: Controlling the target client to encrypt the target server address using the third public key, the second public key and the first public key in sequence to obtain an encrypted address; The encrypted address is transmitted through the first sub-link, the second sub-link and the third sub-link, and during the transmission process, the encrypted address is decrypted using the first private key, the second private key and the third private key in sequence to obtain the target server address in the exit node; A fourth sub-link in the anonymous communication link is established between the exit node and the target server based on the target server address.

8. The data transmission method according to claim 7, characterized in that: The step of establishing a fourth sub-link in the anonymous communication link between the exit node and the target server based on the target server address comprises: Controlling the exit node to send the handshake request to the target server based on the target server address; Generating a fourth communication key in the target server based on the preset encryption algorithm, wherein the fourth communication key includes: a fourth public key and a fourth private key; The fourth public key is returned to the target client through the third sub-link, the second sub-link and the first sub-link, and is saved by the target client. After the saving is completed, the fourth sub-link in the anonymous communication link is obtained.

9. A data transmission device for a distributed file system, characterized in that: include: A selection unit, configured to select N relay nodes from the current network, wherein N is an integer greater than or equal to 3, and the relay nodes include: a guard node, at least one intermediate node and an exit node; An establishing unit is used to sequentially establish encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server to obtain an anonymous communication link; an encryption unit, configured to, when the target client obtains the data to be transmitted, use the N public keys of the N relay nodes to perform N layers of encryption on the data to obtain an encrypted data packet, wherein each layer of encryption corresponds to one of the relay nodes; A transmission unit is used to anonymously transmit the encrypted data packet through the anonymous communication link, wherein the encrypted data packet is decrypted N times using N private keys during the transmission process, and the obtained target data is transmitted to the target server, and each decryption corresponds to one of the relay nodes.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the data transmission method for a distributed file system according to any one of claims 1 to 8.

11. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the data transmission method for a distributed file system as described in any one of claims 1 to 8.

12. A computer program product, characterized in that The method comprises computer instructions, wherein when the computer instructions are executed by a processor, the steps of the data transmission method for a distributed file system described in any one of claims 1 to 8 are implemented.

Images