Data transmission method for distributed file system and device thereof, and electronic device

Abstract

This application discloses a data transmission method, apparatus, and electronic device for a distributed file system, relating to the field of privacy computing technology or other related fields. The method includes: selecting N relay nodes from the current network; establishing anonymous communication links sequentially between the target client and a guard node, between the guard node and an intermediate node, between the intermediate node and an exit node, and between the exit node and the target server; encrypting the data to be transmitted using N layers of public keys from the N relay nodes to obtain encrypted data packets, with each layer of encryption corresponding to one relay node; transmitting the encrypted data packets through the anonymous communication links; and decrypting the encrypted data packets N times using N private keys, with each decryption corresponding to one relay node. This application solves the technical problem in related technologies where distributed file systems use non-anonymous data transmission methods, resulting in a lack of security for both data and data transmitters, easily leading to information leakage.

Description

Technical Field

[0001] This invention relates to the field of privacy computing technology or other related fields. Specifically, it relates to a data transmission method, apparatus, and electronic device for a distributed file system. Background Technology

[0002] As the cornerstone of file sharing on heterogeneous platforms, network file systems allow users to seamlessly access file resources on the network as if they were operating local files. However, distributed file systems, especially NFS (Network File System), are facing severe challenges due to the evolving nature of internet privacy protection.

[0003] In a typical NFS architecture, file providers must publicly disclose their network information, including IP addresses and possible authentication credentials, in plaintext so that clients can establish connections and retrieve files. This non-anonymous, information-exposed sharing method makes file providers vulnerable to attacks on the internet, significantly weakening data security and privacy protection. Even more problematic is that while HTTPS and other encrypted communication methods can protect data content from being spied on, the connection between the client and server can still be monitored by third parties, posing a risk of identity leakage for both communicating parties.

[0004] Distributed file systems, by their initial design, did not adequately consider the security of data interaction, leaving both file security and the security of file transmitters unsecured. This has become a major bottleneck restricting their widespread application in modern networks. With the increasing frequency of cyberattacks and privacy violations, users urgently need to ensure their network location cannot be easily tracked while sharing files, making the need for anonymity for file providers increasingly prominent. Existing technologies fall short in meeting the privacy and security requirements of anonymous file access and sharing, particularly in failing to establish a truly secure anonymous communication environment between file providers and visitors. This results in the security of both data and data transmitters being compromised, making information leakage highly likely.

[0005] There is currently no effective solution to the above problems. Summary of the Invention

[0006] The main objective of this application is to provide a data transmission method, apparatus, and electronic device for a distributed file system, so as to at least solve the technical problem in the related art where the use of non-anonymous data transmission in distributed file systems leads to the lack of security for both data and data transmitters, and is prone to information leakage.

[0007] To achieve the above objectives, according to one aspect of this application, a data transmission method for a distributed file system is provided. The method includes: selecting N relay nodes from a current network, where N is an integer greater than or equal to 3; each relay node includes a guard node, at least one intermediate node, and an exit node; establishing encrypted communication links sequentially between a target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and a target server to obtain anonymous communication links; when the target client obtains data to be transmitted, encrypting the data using N public keys of the N relay nodes to obtain an encrypted data packet, where each encryption layer corresponds to one of the relay nodes; anonymously transmitting the encrypted data packet through the anonymous communication link, wherein during transmission, the encrypted data packet is decrypted N times using N private keys, and the resulting target data is transmitted to the target server, with each decryption corresponding to one of the relay nodes.

[0008] Further, the step of selecting N relay nodes from the current network includes: requesting a relay server list from a directory server, wherein the relay server list is used to record all the relay servers that are currently active in the current network; filtering N relay servers from the relay server list based on the target transmission requirements, and determining the network node corresponding to each relay server to obtain N relay nodes; determining the node identity of each relay node to obtain a guard node, at least one intermediate node, and an exit node.

[0009] Further, the step of establishing encrypted communication links sequentially between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server to obtain an anonymous communication link includes: controlling the target client to send a handshake request to the guard node, wherein the handshake request includes at least a preset encryption algorithm; generating a first communication key in the guard node based on the preset encryption algorithm, wherein the first communication key includes a first public key and a first private key; performing a session key exchange between the target client and the guard node using the first public key and the first private key, and obtaining a first sub-link in the anonymous communication link after the exchange is completed.

[0010] Furthermore, the step of exchanging session keys between the target client and the guard node using the first public key and the first private key includes: controlling the guard node to return the first public key to the target client, whereby the target client uses the first public key to encrypt a pre-generated session key to obtain an encrypted session key; controlling the target client to send the encrypted session key to the guard node, whereby the guard node uses the first private key to decrypt the encrypted session key, and storing the decrypted session key in the guard node.

[0011] Furthermore, after obtaining the first sub-link in the anonymous communication link, the method further includes: controlling the guard node to send the handshake request to the intermediate node; generating a second communication key in the intermediate node based on the preset encryption algorithm, wherein the second communication key includes: a second public key and a second private key; returning the second public key to the target client through the first sub-link, whereby the target client saves it, and after saving, obtaining the second sub-link in the anonymous communication link.

[0012] Furthermore, after obtaining the second sub-link in the anonymous communication link, the method further includes: controlling the intermediate node to send the handshake request to the exit node; generating a third communication key in the exit node based on the preset encryption algorithm, wherein the third communication key includes a third public key and a third private key; returning the third public key to the target client through the second sub-link and the first sub-link, whereby the target client saves it, and after saving, obtaining the third sub-link in the anonymous communication link.

[0013] Furthermore, after obtaining the third sub-link in the anonymous communication link, the method further includes: controlling the target client to sequentially encrypt the target server address using the third public key, the second public key, and the first public key to obtain an encrypted address; transmitting the encrypted address through the first sub-link, the second sub-link, and the third sub-link, and during the transmission process, sequentially decrypting the encrypted address using the first private key, the second private key, and the third private key to obtain the target server address in the exit node; and establishing a fourth sub-link in the anonymous communication link between the exit node and the target server based on the target server address.

[0014] Further, the step of establishing the fourth sub-link in the anonymous communication link between the egress node and the target server based on the target server address includes: controlling the egress node to send the handshake request to the target server based on the target server address; generating a fourth communication key in the target server based on the preset encryption algorithm, wherein the fourth communication key includes a fourth public key and a fourth private key; returning the fourth public key to the target client through the third sub-link, the second sub-link, and the first sub-link, whereby the target client saves it, and after saving, the fourth sub-link in the anonymous communication link is obtained.

[0015] To achieve the above objectives, according to another aspect of this application, a data transmission apparatus for a distributed file system is also provided. The apparatus includes: a selection unit for selecting N relay nodes from a current network, where N is an integer greater than or equal to 3, and the relay nodes include: a guard node, at least one intermediate node, and an exit node; an establishment unit for sequentially establishing encrypted communication links between a target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server, thereby obtaining an anonymous communication link; an encryption unit for, when the target client obtains the data to be transmitted, using N public keys of the N relay nodes to perform N layers of encryption on the data to obtain an encrypted data packet, wherein each layer of encryption corresponds to one of the relay nodes; and a transmission unit for anonymously transmitting the encrypted data packet through the anonymous communication link, wherein during transmission, the encrypted data packet is decrypted N times using N private keys, and the resulting target data is transmitted to the target server, with each decryption corresponding to one of the relay nodes.

[0016] Further, the selection unit includes: a request module, configured to request a list of relay servers from the directory server, wherein the list of relay servers is used to record all the relay servers currently active in the network; a filtering module, configured to filter N relay servers from the list of relay servers based on the target transmission requirements, and determine the network node corresponding to each relay server to obtain N relay nodes; and a determination module, configured to determine the node identity of each relay node to obtain a guard node, at least one intermediate node, and an exit node.

[0017] Further, the establishment unit includes: a first control module, configured to control the target client to send a handshake request to the guard node, wherein the handshake request includes at least a preset encryption algorithm; a first generation module, configured to generate a first communication key in the guard node based on the preset encryption algorithm, wherein the first communication key includes a first public key and a first private key; and an exchange module, configured to perform a session key exchange between the target client and the guard node using the first public key and the first private key, and obtain a first sub-link in the anonymous communication link after the exchange is completed.

[0018] Furthermore, the exchange module includes: a first control submodule, used to control the guard node to return the first public key to the target client, whereby the target client uses the first public key to encrypt a pre-generated session key to obtain an encrypted session key; and a second control submodule, used to control the target client to send the encrypted session key to the guard node, whereby the guard node uses the first private key to decrypt the encrypted session key and stores the decrypted session key in the guard node.

[0019] Furthermore, the establishment unit further includes: a second control module, used to control the guard node to send the handshake request to the intermediate node after obtaining the first sub-link in the anonymous communication link; a second generation module, used to generate a second communication key in the intermediate node based on the preset encryption algorithm, wherein the second communication key includes: a second public key and a second private key; and a first return module, used to return the second public key to the target client through the first sub-link, for the target client to save, and after saving, obtain the second sub-link in the anonymous communication link.

[0020] Furthermore, the establishment unit further includes: a third control module, used to control the intermediate node to send the handshake request to the exit node after obtaining the second sub-link in the anonymous communication link; a third generation module, used to generate a third communication key in the exit node based on the preset encryption algorithm, wherein the third communication key includes: a third public key and a third private key; and a second return module, used to return the third public key to the target client through the second sub-link and the first sub-link, for the target client to save, and after saving, obtain the third sub-link in the anonymous communication link.

[0021] Furthermore, the establishment unit further includes: a fourth control module, configured to, after obtaining the third sub-link in the anonymous communication link, control the target client to sequentially encrypt the target server address using the third public key, the second public key, and the first public key to obtain an encrypted address; a transmission module, configured to transmit the encrypted address through the first sub-link, the second sub-link, and the third sub-link, and during the transmission process, sequentially decrypt the encrypted address using the first private key, the second private key, and the third private key to obtain the target server address in the exit node; and an establishment module, configured to establish the fourth sub-link in the anonymous communication link between the exit node and the target server based on the target server address.

[0022] Furthermore, the establishment module includes: controlling the exit node to send the handshake request to the target server based on the target server address; a generation submodule, used to generate a fourth communication key in the target server based on the preset encryption algorithm, wherein the fourth communication key includes a fourth public key and a fourth private key; and a return submodule, used to return the fourth public key to the target client through the third sub-link, the second sub-link, and the first sub-link, for the target client to save, and after saving, to obtain the fourth sub-link in the anonymous communication link.

[0023] To achieve the above objectives, according to another aspect of this application, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the data transmission method for a distributed file system as described above.

[0024] To achieve the above objectives, according to another aspect of this application, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the data transfer method for a distributed file system as described in any of the preceding claims.

[0025] This invention proposes a data transmission method for a distributed file system. First, N relay nodes are selected from the current network, where N is an integer greater than or equal to 3. Each relay node includes a guard node, at least one intermediate node, and an exit node. Then, encrypted communication links are established sequentially between the target client and the guard node, between the guard node and the intermediate node, between the intermediate node and the exit node, and between the exit node and the target server, resulting in anonymous communication links. Next, when the target client obtains the data to be transmitted, the data is encrypted using N layers of encryption using the N public keys of the N relay nodes, resulting in an encrypted data packet. Each layer of encryption corresponds to one relay node. Finally, the encrypted data packet is transmitted anonymously through the anonymous communication links. During transmission, the encrypted data packet is decrypted N times using N private keys, and the resulting target data is transmitted to the target server. Each decryption corresponds to one relay node.

[0026] In this invention, an anonymous communication link is constructed in the data transmission network of a distributed file system. By selecting N relay nodes and establishing encrypted communication links sequentially, the anonymity of the file provider during data transmission is protected, thereby enhancing data transmission security and user identity security. Specifically, by establishing encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server, an anonymous network composed of relay nodes is formed, ensuring the anonymity and security of the data transmission path of the distributed file system. When constructing the anonymous communication link, a guard node, at least one intermediate node, and an exit node are selected to act as "relay stations" in the data transmission process. Before data transmission, the public key of the relay node is used to encrypt the data in multiple layers to ensure the security of the data during transmission and prevent interception and decryption. During data transmission, the private key is used to decrypt the encrypted data packets layer by layer to ensure that the data can be received by the correct target server. At the same time, the privacy and integrity of data transmission are maintained, and the complexity and security of data transmission are further enhanced. This solves the technical problem in related technologies where distributed file systems use non-anonymous data transmission, resulting in the lack of security for both data and data transmitters, and easily leading to information leakage. Attached Figure Description

[0027] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0028] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for a data transfer method in a distributed file system is shown.

[0029] Figure 2 This is a flowchart of an optional data transmission method for a distributed file system according to an embodiment of the present invention;

[0030] Figure 3 This is a schematic diagram of an optional data transmission device for a distributed file system according to an embodiment of the present invention;

[0031] Figure 4 This is a structural block diagram of an electronic device that performs a data transmission method for a distributed file system according to an embodiment of the present invention. Detailed Implementation

[0032] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0034] To facilitate understanding of the present invention by those skilled in the art, some terms or nouns involved in the various embodiments of the present invention are explained below:

[0035] Anonymous networks are network architectures designed to protect user communication privacy. Through multiple layers of encryption and routing technologies, users' network behavior and identity information remain anonymous to other participants in the network. Typical anonymity network technologies include Tor routing and I2P.

[0036] Onion Router is a network that enables anonymous communication. User data is encrypted multiple times during transmission and routed through randomly selected multi-layer relay nodes. Each relay only knows the information of the node above and below it, ultimately achieving the goal of protecting user identity and the privacy of communication content.

[0037] It should be noted that the data transmission method and apparatus for distributed file systems in this application can be used in the field of privacy computing technology for the secure transmission and processing of distributed file system data, and can also be used in any field other than privacy computing technology for the secure transmission and processing of distributed file system data. This application does not limit the application field of the data transmission method and apparatus for distributed file systems.

[0038] It should be noted that all relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) involved in this application are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, processing, transmission, provision, disclosure, use, and handling of such data comply with the laws, regulations, and standards of the relevant regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse access. For example, this system has interfaces with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface, and the relevant information is obtained only after receiving consent from the aforementioned user or organization.

[0039] The information collection (e.g., user voice, video, and text collection) and analysis operations involved in this application have provided users with corresponding operation entry points during execution, allowing users to choose to agree to or reject the automated decision results; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0040] The following embodiments of the present invention can be applied to various systems / applications / devices that require data transmission and data privacy protection, enabling secure and anonymous data transmission. The present invention uses public-private key pairs for multi-layered encrypted communication, and then sequentially decrypts the guardian nodes, intermediate nodes, and exit nodes of the anonymous network system through a distributed file system. This better protects the anonymity and security of file providers and the data transmission process, preventing information leakage and malicious attacks.

[0041] The present invention will now be described in detail with reference to various embodiments.

[0042] Example 1

[0043] According to an embodiment of the present invention, an embodiment of a data transmission method for a distributed file system is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0044] The data transmission method for a distributed file system provided in Embodiment 1 of the present invention can be executed in a mobile terminal, a computer terminal, or a similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for a data transfer method in a distributed file system is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0045] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0046] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the data transmission method for a distributed file system in this embodiment of the application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned data transmission method for a distributed file system. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0047] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0048] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0049] Under the above operating environment, the present invention provides, as follows: Figure 2 The data transmission method shown is for a distributed file system. The main body of this method is the distributed file system and the anonymous network system it interfaces with. It combines public and private key encryption technology and is used in network file sharing scenarios. In particular, it solves the problem of non-anonymity of file providers on the network. It achieves the purpose of protecting the anonymity of file providers and the security of data transmission in the distributed file system by establishing a multi-layered encrypted communication link. Specifically, it establishes encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server in sequence.

[0050] The embodiments of the present invention will now be described in detail with reference to each specific step.

[0051] Figure 2 This is a flowchart of an optional data transmission method for a distributed file system according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0052] Step S201: Select N relay nodes from the current network, where N is an integer greater than or equal to 3. The relay nodes include: a guard node, at least one intermediate node, and an exit node.

[0053] Specifically, the current network refers to a network environment that allows anonymous data transmission. It can be any network that supports anonymous communication, such as the Onion Routing Network, which uses multi-layered encryption and random routing nodes to achieve anonymous data transmission.

[0054] Relay nodes are a core component of anonymous networks, responsible for receiving, decrypting, re-encrypting, and forwarding data packets to achieve anonymity and security in data transmission. Based on their location and function within the network, relay nodes can be categorized as guard nodes, intermediate nodes, and exit nodes.

[0055] The guard node is the first station in the data transmission process. It is responsible for receiving data from the target client, decrypting the data using its own private key, and forwarding it to the next intermediate node. The primary task of the guard node is to ensure the anonymity of the client and prevent any tracking or identification. The intermediate node is located between the guard node and the exit node. It is used to forward data to the next node and further decrypt the data using its own private key, but it does not decrypt the final content of the data packet, thus maintaining the anonymity and encryption state during the data transmission process.

[0056] The exit node is the last stop in the anonymous data transmission link. It is responsible for receiving data from intermediate nodes, decrypting the data using its own private key to obtain the original data before encryption, and then sending the original data to the target server. The exit node is used to transmit data to the destination accurately.

[0057] Optionally, step S201 includes: requesting a list of relay servers from the directory server, wherein the list of relay servers is used to record all active relay servers in the current network; filtering N relay servers from the list of relay servers based on the target transmission requirements, and determining the network node corresponding to each relay server to obtain N relay nodes; determining the node identity of each relay node to obtain a guard node, at least one intermediate node and an exit node.

[0058] It's important to note that a directory server is a repository within an anonymous network, storing information about all currently active relay servers in the network, such as server addresses and public keys. Target clients request a list of relay servers from the directory server to obtain available relay node information, thereby establishing an anonymous communication link.

[0059] A relay server is an anonymous network node recorded in the directory server list. It can act as a guard node, intermediate node, or exit node, and participate in the anonymous data transmission process by performing specific encryption and decryption tasks.

[0060] Alternatively, in carrying out the present invention, the actual operation may involve the following steps:

[0061] Requesting a list of relay servers from the directory server: The target client device sends a request to the directory server to obtain a list of all active relay servers in the current network. The directory server responds to the request and returns a list containing information such as relay server addresses and public keys.

[0062] Relay server selection based on target transmission requirements: Based on the data transmission target (such as speed, latency, geographical location, etc.), the target client selects multiple relay servers from the obtained relay server list to ensure the anonymity of data transmission.

[0063] The network node corresponding to each relay server is determined: the selected relay servers are assigned a specific identity, namely, a guard node, an intermediate node, or an exit node. The target client, based on an algorithm or strategy, determines the role of each relay server in the network link, thereby constructing a complete anonymous communication link.

[0064] Determining the identity of each relay node: The identity of each relay node (guard, intermediate, exit) is determined based on its position and function in the network link. Guard nodes are the entry point of the link, exit nodes are the end point of the link, and intermediate nodes are located in between, responsible for forwarding data packets.

[0065] Through the above steps, the present invention can effectively construct a data transmission link in an anonymous network, ensuring that data in the distributed file system will not be intercepted or tracked by third parties during transmission, while protecting the privacy and security of file providers and data receivers, thus meeting the needs of privacy computing and data transmission fields for data anonymity and security.

[0066] Step S202: Establish encrypted communication links sequentially between the target client and the guard node, between the guard node and the intermediate node, between the intermediate node and the exit node, and between the exit node and the target server to obtain anonymous communication links.

[0067] It should be noted that an encrypted communication link refers to a communication channel established between two communication entities that uses encryption technology to protect the security of data transmission. In the scenario of this invention embodiment, the encrypted communication link is a component of the anonymous communication link, and the security and privacy of data during transmission are ensured through encryption and decryption using public and private keys.

[0068] Optionally, step S202 includes: controlling the target client to send a handshake request to the guard node, wherein the handshake request includes at least a preset encryption algorithm; generating a first communication key in the guard node based on the preset encryption algorithm, wherein the first communication key includes a first public key and a first private key; performing a session key exchange between the target client and the guard node using the first public key and the first private key, and obtaining a first sub-link in the anonymous communication link after the exchange is completed.

[0069] It should be noted that a handshake request is a signal in a communication protocol used to establish a trust relationship and an encrypted session at the beginning of communication. In this invention, the target client first sends a handshake request to the guard node. The handshake request contains at least preset encryption algorithm information, indicating which encryption algorithm the client wishes to use for subsequent session key exchange. Here, the encryption algorithm is a mathematical method used for data encryption and decryption, and the preset encryption algorithm is a data encryption standard that is pre-determined and supported in the anonymous network system.

[0070] A communication key is a key used for data encryption and decryption in an encrypted communication link, and includes a public key or a private key. The first communication key is a key pair generated when an encrypted communication link is established between the target client and the guard node, including a first public key and a first private key, where the first public key is used for encryption and the first private key is used for decryption.

[0071] A session key is a key used by two communicating entities in a communication session to encrypt and decrypt data transmitted during the session. The generation and exchange of session keys ensure that the security of session data is not compromised even if the communication key is leaked. In this invention, the exchange of session keys is involved in each establishment of an encrypted communication link to enhance the dynamic security and anonymity of data transmission.

[0072] In one optional embodiment, the detailed steps for establishing an anonymous communication link include: after selecting a guard node, the target client device (such as a PC or smartphone) sends a handshake request to it. This request contains information about a preset encryption algorithm proposed by the client. The purpose of the handshake request is to initiate a secure communication session with the guard node. After receiving the handshake request, the guard node generates a first communication key pair, namely a first public key and a first private key, according to the preset encryption algorithm. The generated first public key is sent back to the target client, while the first private key is retained for subsequent decryption operations. The target client uses the received first public key to perform a session key exchange with the guard node. The session key exchange process is bidirectional, ensuring the secure generation and transmission of the session key. After the session key exchange is completed, the encrypted communication link between the target client and the guard node is successfully established, forming the first sub-link in the anonymous communication link.

[0073] Through a similar process, the guard node establishes encrypted communication links with intermediate nodes, intermediate nodes with exit nodes, and exit nodes with the target server, ultimately constructing the entire anonymous communication link. During the establishment of these encrypted communication links, each link follows the aforementioned handshake request, communication key generation, and session key exchange steps, ensuring that every part of the entire anonymous communication link is securely encrypted. This guarantees the anonymity and security of data transmission, meeting the objectives and requirements of this invention.

[0074] By establishing the aforementioned encrypted communication link, data can be securely transmitted between the target client and the target server, while protecting the identity information and data privacy of all parties.

[0075] Optionally, the step of exchanging session keys between the target client and the guard node using the first public key and the first private key includes: controlling the guard node to return the first public key to the target client, the target client using the first public key to encrypt the pre-generated session key to obtain an encrypted session key; controlling the target client to send the encrypted session key to the guard node, the guard node using the first private key to decrypt the encrypted session key, and storing the decrypted session key in the guard node.

[0076] In this embodiment of the invention, a key step in establishing an encrypted communication link is to perform a session key exchange between the target client and the guard node using a first public key and a first private key. This ensures the security of data during transmission while maintaining the anonymity of communication.

[0077] After the guardian node generates the first communication key pair (first public key and first private key), it sends the first public key to the target client to encrypt the session key, ensuring the security of the session key during transmission. Upon receiving the guardian node's first public key, the target client pre-generates a session key, a temporary key used for subsequent data transmission. This session key typically has a higher security level than the communication key, providing a higher level of data protection. The target client uses the first public key to encrypt the session key, generating an encrypted session key. The target client sends the encrypted session key to the guardian node. Since the data is encrypted using the first public key, only the guardian node, holding the first private key, can successfully decrypt it. Upon receiving the encrypted session key from the target client, the guardian node uses its own first private key to decrypt the data, recovering the plaintext form of the session key. The first private key is part of the key pair generated by the guardian node and is stored only locally, never disclosed to any third party. The decrypted session key is stored by the guardian node for subsequent data encryption and decryption operations with the target client. Session keys are generated temporarily and are only valid during the current session. Once the session ends, the session key is destroyed, thereby enhancing the overall security of data transmission.

[0078] In practice, the session key exchange process can be further refined, including: after the guardian node generates the first communication key pair (first public key and first private key), it sends the first public key to the target client in the handshake response. After receiving the handshake response, the target client verifies the validity of the first public key and uses it to encrypt the pre-generated session key.

[0079] After encryption is complete, the target client packages the encryption session key and necessary handshake protocol information into a data packet and sends it to the guard node. Only the guard node can decrypt the encryption session key in the data packet because only the guard node holds the corresponding first private key.

[0080] After receiving the data packet, the guard node uses its first private key to decrypt the encrypted session key in the data packet. After successful decryption, the guard node saves the obtained session key in local secure storage. The guard node and the target client now each hold the same session key, but this key is kept secret from other network nodes (such as intermediate nodes and exit nodes).

[0081] The guard node and the target client encrypt and decrypt data using symmetric encryption algorithms (such as AES, 3DES, etc.) based on the session key. The data is encrypted multiple times during transmission, with each encryption using a different session key, thus ensuring that even if the session key of one node is cracked, it cannot affect the data security of other nodes.

[0082] Through the aforementioned session key exchange process, this invention ensures the secure and reliable communication link between the target client and the guard node, while also providing a robust security guarantee for subsequent data transmission. This process avoids the security risks that may arise from directly encrypting data using the communication key, because the communication key is public throughout the entire anonymous communication link (at least to intermediate and exit nodes), while the session key is generated temporarily for each session and shared only between the target client and the guard node, thereby greatly enhancing the anonymity and security of data transmission.

[0083] Optionally, after obtaining the first sub-link in the anonymous communication link, the method further includes: controlling the guard node to send a handshake request to the intermediate node; generating a second communication key in the intermediate node based on a preset encryption algorithm, wherein the second communication key includes: a second public key and a second private key; returning the second public key to the target client through the first sub-link, whereby the target client saves it, and obtaining the second sub-link in the anonymous communication link after saving.

[0084] After successfully establishing the first sub-link between the target client and the guard node, the present invention further extends the anonymous communication link to include intermediate nodes.

[0085] Specifically, after the encrypted communication link with the target client is established, the guard node selects an intermediate node from the previously acquired list of relay servers and sends a handshake request to the intermediate node. The handshake request also contains preset encryption algorithm information. After receiving the handshake request from the guard node, the intermediate node generates a second communication key pair, namely a second public key and a second private key, according to the preset encryption algorithm. The second communication key will be used for data encryption and decryption between the guard node and the intermediate node. The intermediate node sends the generated second public key to the guard node. The guard node uses the first sub-link with the target client to forward the second public key to the target client. The target client saves the second public key for subsequent data encryption. After the target client saves the second public key, the encrypted communication link between the guard node and the intermediate node is successfully established, forming the second sub-link of the anonymous communication link. This sub-link also follows the secure handshake protocol and session key exchange process to ensure the secure transmission of data between the guard node and the intermediate node.

[0086] It should be noted that the guard node selects an intermediate node according to a specific algorithm and sends a handshake request through the first sub-link. The information contained in the handshake request is sufficient for the intermediate node to identify the communication intent and the preset encryption algorithm. After receiving the handshake request, the intermediate node generates a second communication key pair (a second public key and a second private key), sends the second public key to the guard node, and waits for subsequent instructions.

[0087] After receiving the second public key, the guard node does not directly decrypt or use this key. Instead, it encapsulates it and forwards it to the target client through the first sub-link. The target client saves the second public key in preparation for the encryption process of subsequent data transmission.

[0088] The guard node and the intermediate node exchange session keys using a preset encryption algorithm, similar to the exchange between the target client and the guard node, but using a second communication key pair. Once the session key exchange is completed, the encrypted communication link between the guard node and the intermediate node is successfully established, forming the second sub-link of the anonymous communication link.

[0089] Similarly, after establishing the second sub-link, the guard node and intermediate node use a session key to encrypt and decrypt the data. The data packet is encrypted once when it passes through the first sub-link, and it is encrypted again when it reaches the intermediate node, this time using the session key between the guard node and the intermediate node. This "onion"-like multi-layer encryption technology ensures that the data is encrypted at each layer during transmission, and is only decrypted and sent to the target server when it reaches the exit node.

[0090] After establishing the link with the intermediate node, the subsequent steps of this invention will involve selecting the exit node and establishing the link, as well as finally establishing the communication link with the target server to form the entire anonymous communication link.

[0091] Through the above process, the present invention can ensure that every part of the anonymous communication link follows strict security and privacy standards, providing layers of encryption protection for data transmission and enhancing the application potential of the entire system in the field of privacy computing.

[0092] Optionally, after obtaining the second sub-link in the anonymous communication link, the method further includes: controlling the intermediate node to send a handshake request to the exit node; generating a third communication key in the exit node based on a preset encryption algorithm, wherein the third communication key includes a third public key and a third private key; returning the third public key to the target client through the second sub-link and the first sub-link, whereby the target client saves the key, and after saving, obtaining the third sub-link in the anonymous communication link.

[0093] After the first sub-link (target client and guard node) and the second sub-link (guard node and intermediate node) are successfully established, the next step is to extend the anonymous communication link to include the egress node.

[0094] Specifically, after the encrypted communication link with the guard node is established, the intermediate node selects an exit node from the previously acquired list of relay servers and sends a handshake request to the exit node. This handshake request also contains preset encryption algorithm information, indicating the desired encryption method for establishing the link. Upon receiving the handshake request from the intermediate node, the exit node generates a third communication key pair—a third public key and a third private key—based on the preset encryption algorithm. This third communication key pair is used for data encryption and decryption between the intermediate node and the exit node, ensuring the secure transmission of data over this segment of the link.

[0095] The exit node sends the generated third public key to the intermediate node. The intermediate node then forwards the third public key to the target client via the second sub-link with the guard node and the first sub-link with the target client. The target client stores the third public key for encryption of subsequent data transmission. After the intermediate node stores the third private key and completes the session key exchange with the exit node, the encrypted communication link between the intermediate node and the exit node is successfully established, forming the third sub-link of the anonymous communication link. This sub-link also follows the secure handshake protocol and session key exchange process to ensure the secure transmission of data between the intermediate node and the exit node.

[0096] It should be noted that after the intermediate node establishes the second sub-link with the guard node, it selects an exit node according to a preset algorithm and sends a handshake request to it. The request contains encryption algorithm information. After receiving the handshake request, the exit node generates a third communication key pair (a third public key and a third private key). The exit node saves the third private key and sends the third public key to the intermediate node through the second sub-link.

[0097] After receiving the third public key from the exit node, the intermediate node does not use this public key directly. Instead, it forwards it to the target client again through the second sub-link with the guard node. After receiving the third public key, the target client saves this public key for subsequent data encryption.

[0098] The intermediate node and the exit node exchange session keys, similar to the previous exchange process between the target client and the guard node, and between the guard node and the intermediate node. Once the session key exchange is complete, the encrypted communication link between the intermediate node and the exit node is successfully established, forming the third sub-link of the anonymous communication link.

[0099] When data packets pass through an anonymous communication link, they are encrypted three times: first, at the target client using the session key of the first sub-link; second, at the guard node using the session key of the second sub-link; and third, at the intermediate node using the session key of the third sub-link. This multi-layered encryption technology ensures that the data is encrypted at each level during transmission, until it is decrypted and sent to the target server at the exit node.

[0100] Through a three-way handshake and session key exchange, the anonymous communication link between the target client and the exit node has been fully established, including three sub-links: the first sub-link between the target client and the guard node, the second sub-link between the guard node and the intermediate node, and the third sub-link between the intermediate node and the exit node. The construction of the entire anonymous communication link ensures the anonymity and security of data transmission, meeting the needs of privacy computing and data transmission fields.

[0101] Through the above steps, the present invention can successfully construct a multi-node anonymous communication link, ensuring that the data is encrypted at each layer during the transmission process until the data is securely transmitted to the final destination. This not only improves the security of the data, but also protects the identity information of each node participating in the communication, enhancing the application value of the entire system in the field of network privacy and security.

[0102] Optionally, after obtaining the third sub-link in the anonymous communication link, the method further includes: controlling the target client to encrypt the target server address sequentially using the third public key, the second public key, and the first public key to obtain an encrypted address; transmitting the encrypted address through the first sub-link, the second sub-link, and the third sub-link, and during the transmission process, decrypting the encrypted address sequentially using the first private key, the second private key, and the third private key to obtain the target server address in the exit node; and establishing a fourth sub-link in the anonymous communication link between the exit node and the target server based on the target server address.

[0103] After the first three sub-links of the anonymous communication link (target client and guard node, guard node and intermediate node, intermediate node and exit node) are established, address encryption technology is used to ensure that the destination address of data transmission, i.e. the target server address, is not disclosed.

[0104] Specifically, during the establishment of the anonymous link, the target client has obtained the public keys (i.e., the first public key, the second public key, and the third public key) of the guard node, intermediate node, and exit node. The target client is controlled to use the third public key (the public key of the exit node) to encrypt the address of the target server for the first time, then use the second public key to encrypt the encrypted address for the second time, and finally use the first public key to encrypt it for the third time to form an encrypted address. This ensures that even if the data is intercepted during transmission, the address information of the target server cannot be directly obtained.

[0105] The encrypted address is transmitted through three sub-links of the anonymous link. Starting from the target client, it passes through the guard node, intermediate node, and finally reaches the exit node. During the transmission of data in each link, the corresponding session key is used for additional encryption and decryption to enhance the security of data transmission.

[0106] When the encrypted address reaches the guard node, the guard node decrypts the data using its first private key, then re-encrypts the decrypted data using its second public key and forwards it to the intermediate node. The intermediate node decrypts the data using its second private key, then encrypts it again using its third public key before sending it to the exit node. Finally, the exit node decrypts the data using its third private key to obtain the address of the target server.

[0107] After the egress node decrypts and obtains the target server's address, it sends a handshake request to the target server. The target server responds to the handshake request, and both parties exchange session keys to establish an encrypted communication link, which is the fourth sub-link of the anonymous communication link. This sub-link also follows a secure handshake protocol and session key exchange process to ensure the secure transmission of data between the egress node and the target server.

[0108] It should be noted that after the target client completes the establishment of the first three sub-links of the anonymous link, it uses the third public key (the public key of the exit node) to encrypt the target server address for the first time, obtaining encrypted address 1; then, the target client uses the second public key to encrypt encrypted address 1 for the second time, obtaining encrypted address 2; finally, it uses the first public key to encrypt encrypted address 2 for the third time, generating the final encrypted address.

[0109] The process of transmitting an encrypted address through three sub-links of an anonymous link is as follows: First, the encrypted address is sent from the target client to the guard node through the first sub-link; after the guard node decrypts the data using the first private key, it re-encrypts it using the second public key and sends it to the intermediate node through the second sub-link; after the intermediate node decrypts it using the second private key, it re-encrypts it using the third public key and sends it to the exit node through the third sub-link.

[0110] At the exit node, the encrypted address is finally decrypted using a third private key to recover the target server's address information. This ensures that the target server's address is only decrypted at the exit node and is not leaked to other nodes in the anonymous link. The exit node uses the recovered target server address to send a handshake request to the target server. The target server responds to the handshake request, and both parties exchange session keys using a preset encryption algorithm, establishing an encrypted communication link. At this point, the fourth sub-link of the anonymous communication link is complete, forming a complete anonymous communication path from the target client to the target server.

[0111] Through the above process, this invention not only establishes a secure anonymous communication link, protecting the security and anonymity of data transmission, but also further enhances the security of the link endpoint by encrypting the target server address, preventing the leakage of address information. This design has significant application value in the fields of privacy computing and secure communication.

[0112] Optionally, the step of establishing a fourth sub-link in the anonymous communication link between the egress node and the target server based on the target server address includes: controlling the egress node to send a handshake request to the target server based on the target server address; generating a fourth communication key in the target server based on a preset encryption algorithm, wherein the fourth communication key includes a fourth public key and a fourth private key; returning the fourth public key to the target client through the third sub-link, the second sub-link, and the first sub-link, whereby the target client saves it, and after saving, the fourth sub-link in the anonymous communication link is obtained.

[0113] After successfully constructing the first three sub-links of the anonymous communication link (the first sub-link between the target client and the guard node, the second sub-link between the guard node and the intermediate node, and the third sub-link between the intermediate node and the exit node), this invention continues to construct the fourth sub-link, namely the link between the exit node and the target server.

[0114] Specifically, after decrypting the address, the exit node obtains the target server's location information. At this point, the exit node initiates a handshake request to the target server, which includes information about a preset encryption algorithm, indicating a desire to establish secure encrypted communication with the target server. Upon receiving the handshake request from the exit node, the target server generates a fourth communication key pair—a fourth public key and a fourth private key—based on the preset encryption algorithm. The fourth public key is used to encrypt data packets, while the fourth private key is stored on the target server and used to decrypt data packets received from the exit node.

[0115] The target server sends the fourth public key to the exit node. The exit node then forwards this public key to the target client sequentially through the third, second, and first sub-links. Upon receiving the fourth public key, the target client saves it for subsequent data encryption. Once the target client successfully saves the fourth public key, the encrypted communication link between the exit node and the target server is established, forming the fourth sub-link in the anonymous communication link. This sub-link also relies on the exchange of session keys between the two parties, ensuring the secure transmission of data between the exit node and the target server.

[0116] It should be noted that after decrypting to obtain the target server address, the exit node sends a handshake request to the target server based on this address information. The handshake request contains a preset encryption algorithm proposed by the exit node, such as TLS or SSL. After receiving the handshake request from the exit node, the target server generates a fourth communication key pair (a fourth public key and a fourth private key) according to the preset algorithm, and then sends the fourth public key to the exit node.

[0117] After receiving the fourth public key, the exit node does not use it directly. Instead, it encapsulates it into a data packet and sends it to the intermediate node through the third sub-link (the link between the exit node and the intermediate node). The intermediate node then forwards the data packet to the guard node through the second sub-link (the link between the intermediate node and the guard node). Finally, the guard node sends the fourth public key to the target client through the first sub-link (the link between the guard node and the target client).

[0118] After receiving the fourth public key, the target client stores it in its local encrypted communication information repository. At this point, the target client has mastered the public key information of all participating nodes in the entire anonymous communication link, including the first public key of the guard node, the second public key of the intermediate node, the third public key of the exit node, and the fourth public key of the target server.

[0119] Once the fourth public key is stored by the target client, the anonymous communication link between the target client, the guard node, the intermediate node, the exit node, and the target server is fully established. The target client can use the public keys of all nodes to encrypt the data, and then send it through the three sub-links in sequence. Each node uses its own private key to decrypt and re-encrypt the data. Finally, after decryption at the exit node, the fourth private key (the target server's private key) is used to decrypt the data one last time, and the original data is sent to the target server.

[0120] Through the above steps, the anonymous communication link of the present invention is fully constructed, including four sub-links from the target client to the target server. Each sub-link ensures encryption security and identity anonymity during data transmission. It has important application value in the fields of big data, cloud computing and privacy protection, and can effectively protect the integrity of data and communication privacy, preventing data from being eavesdropped or tampered with during transmission.

[0121] In the anonymous communication system of this invention, secure data transmission is the core element. To ensure the security and anonymity of data during transmission, this invention employs multi-layered encryption and decryption technologies.

[0122] In the data encryption process, in step S203, when the target client obtains the data to be transmitted, the data is encrypted in N layers using the N public keys of N relay nodes to obtain an encrypted data packet, where each layer of encryption corresponds to one relay node.

[0123] The target client first obtains the data that needs to be transmitted to the target server, which can be files, documents, or any other form of digital information.

[0124] Based on the previously established anonymous link information, the target client obtains the public keys of the exit node, intermediate nodes, and guard nodes. For each sub-link, the target client uses the public key of the corresponding relay node to encrypt the data, forming the input for the next layer of encrypted data. Specifically, the data is first encrypted using the public key of the exit node to obtain encryption layer 1; then, encryption layer 1 is encrypted using the public key of the intermediate node to obtain encryption layer 2; finally, encryption layer 2 is encrypted using the public key of the guard node to obtain the final encrypted data packet.

[0125] After N layers of encryption, the target client receives a fully encrypted data packet. This data packet will be transmitted through an anonymous communication link to ensure that even if it is intercepted during transmission, the data content cannot be directly obtained.

[0126] In the process of anonymous data transmission and decryption, step S204 involves anonymously transmitting encrypted data packets through an anonymous communication link. During the transmission, N private keys are used to decrypt the encrypted data packets N times, and the resulting target data is transmitted to the target server. Each decryption corresponds to a relay node.

[0127] The encrypted data packet is first sent via the first sub-link (the link between the target client and the guard node). Upon receiving the encrypted data packet, the guard node uses its private key to decrypt the outermost layer, obtaining the next layer of encrypted data. Then, the guard node sends the next layer of encrypted data to the intermediate node via the second sub-link (the link between the guard node and the intermediate node). The intermediate node uses its private key to decrypt the next layer of encrypted data, obtaining the next layer of encrypted data, and then sends the data to the exit node via the third sub-link (the link between the intermediate node and the exit node). The exit node repeats the above process until it decrypts the data using the Nth private key (here, the session key between the exit node and the target server), and then sends the resulting plaintext data to the target server.

[0128] During data transmission, each relay node uses its private key to decrypt the data packet, extract the next layer of encrypted data, re-encrypts this data, and sends it to the next node via the next sub-link of the anonymous link. This process is repeated at each node until the encrypted data packet finally reaches the target server.

[0129] At the exit node, the session key (i.e., the fourth private key) with the target server is used to finally decrypt the data packet to obtain the plaintext data, and then the data is transmitted to the target server.

[0130] In one optional embodiment, assuming the target client needs to transmit data to the target server, and the anonymous link consists of the following nodes: a guard node (N=1), an intermediate node (N=2), and an exit node (N=3), the data encryption transmission process is as follows:

[0131] A. The target client encrypts the data. The target client first encrypts the data using the public key of the exit node, forming encryption layer 1; then it uses the public key of the intermediate node to encrypt the data in encryption layer 1, forming encryption layer 2; finally, it uses the public key of the guard node to encrypt the data in encryption layer 2, forming the final encrypted data packet.

[0132] B. Anonymous data transmission. Encrypted data packets are sent to the guard node via the first sub-link. The guard node uses its private key to decrypt the outermost layer, obtaining the data in encryption layer 2, and then sends it to the intermediate node via the second sub-link. The intermediate node uses its private key to decrypt, obtaining the data in encryption layer 1, and then sends it to the exit node via the third sub-link. The exit node uses its private key to decrypt, obtaining the plaintext data, and then uses the session key with the target server (i.e., the fourth private key) to decrypt it again, sending the data to the target server.

[0133] Through the above steps, this invention ensures the security and anonymity of data during transmission, protects user data privacy, and prevents potential eavesdropping and tampering during data transmission. This multi-layered encryption-based anonymous data transmission technology has broad application prospects in fields such as cloud storage, network communication, and big data processing.

[0134] Through steps S201 to S204 above, N relay nodes can be selected from the current network, where N is an integer greater than or equal to 3. The relay nodes include: a guard node, at least one intermediate node, and an exit node. Then, encrypted communication links are established sequentially between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server to obtain an anonymous communication link. Then, when the target client obtains the data to be transmitted, the data is encrypted with N layers using the N public keys of the N relay nodes to obtain an encrypted data packet. Each layer of encryption corresponds to one relay node. Finally, the encrypted data packet is transmitted anonymously through the anonymous communication link. During the transmission process, the encrypted data packet is decrypted N times using N private keys, and the obtained target data is transmitted to the target server. Each decryption corresponds to one relay node.

[0135] In this embodiment of the invention, an anonymous communication link is constructed in the data transmission network of the distributed file system. By selecting N relay nodes and establishing encrypted communication links sequentially, the anonymity of the file provider during data transmission is protected, thereby enhancing the security of data transmission and user identity. Specifically, by establishing encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server, an anonymous network composed of relay nodes is formed, ensuring the anonymity and security of the data transmission path of the distributed file system. When constructing the anonymous communication link, a guard node, at least one intermediate node, and an exit node are selected to act as "relay stations" in the data transmission process. Before data transmission, the public key of the relay node is used to encrypt the data in multiple layers to ensure the security of the data during transmission and prevent interception and decryption. During data transmission, the private key is used to decrypt the encrypted data packets layer by layer to ensure that the data can be received by the correct target server. At the same time, the privacy and integrity of data transmission are maintained, and the complexity and security of data transmission are further enhanced. This solves the technical problem in related technologies where the distributed file system uses a non-anonymous data transmission form, resulting in the lack of security for both data and data transmitters, and easily leading to information leakage.

[0136] The invention will now be described in conjunction with another alternative embodiment.

[0137] Example 2

[0138] This invention also provides a data transmission device for a distributed file system. It should be noted that the data transmission device for a distributed file system in this invention includes multiple implementation units, which can be used to execute the data transmission method for a distributed file system provided in Embodiment 1 above. Each implementation unit corresponds to each implementation step in Embodiment 1 above.

[0139] Figure 3 This is a schematic diagram of an optional data transmission apparatus for a distributed file system according to an embodiment of the present invention, such as... Figure 3 As shown, the device may include: a selection unit 31, an establishment unit 32, an encryption unit 33, and a transmission unit 34.

[0140] The selection unit 31 is used to select N relay nodes from the current network, where N is an integer greater than or equal to 3, and the relay nodes include: a guard node, at least one intermediate node and an exit node.

[0141] Establishment unit 32 is used to sequentially establish encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server to obtain anonymous communication links.

[0142] The encryption unit 33 is used to encrypt the data in N layers using the N public keys of N relay nodes when the target client obtains the data to be transmitted, so as to obtain an encrypted data packet, wherein each layer of encryption corresponds to one relay node.

[0143] The transmission unit 34 is used to anonymously transmit encrypted data packets through an anonymous communication link. During the transmission process, N private keys are used to decrypt the encrypted data packets N times, and the resulting target data is transmitted to the target server. Each decryption corresponds to a relay node.

[0144] The aforementioned data transmission device for a distributed file system can first select N relay nodes from the current network through the selection unit 31, where N is an integer greater than or equal to 3. The relay nodes include: a guard node, at least one intermediate node, and an exit node. Then, the establishment unit 32 sequentially establishes encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server to obtain anonymous communication links. Then, the encryption unit 33, when the target client obtains the data to be transmitted, uses the N public keys of the N relay nodes to encrypt the data in N layers to obtain encrypted data packets. Each layer of encryption corresponds to one relay node. Finally, the transmission unit 34 transmits the encrypted data packets anonymously through the anonymous communication links. During the transmission process, the encrypted data packets are decrypted N times using N private keys, and the resulting target data is transmitted to the target server. Each decryption corresponds to one relay node.

[0145] In this embodiment of the invention, an anonymous communication link is constructed in the data transmission network of the distributed file system. By selecting N relay nodes and establishing encrypted communication links sequentially, the anonymity of the file provider during data transmission is protected, thereby enhancing the security of data transmission and user identity. Specifically, by establishing encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server, an anonymous network composed of relay nodes is formed, ensuring the anonymity and security of the data transmission path. When constructing the anonymous communication link, a guard node, at least one intermediate node, and an exit node are selected to act as "relay stations" in the data transmission process. Before data transmission, the public key of the relay node is used to perform multi-layer encryption on the data, ensuring the security of the distributed file system data during transmission and preventing interception and decryption. During data transmission, the private key is used to decrypt the encrypted data packets layer by layer, ensuring that the data can be received by the correct target server. At the same time, the privacy and integrity of data transmission are maintained, and the complexity and security of data transmission are further enhanced. This solves the technical problem in related technologies where the distributed file system uses a non-anonymous data transmission method, resulting in the lack of security for both data and data transmitters, and easily leading to information leakage.

[0146] Optionally, the selection unit includes: a request module for requesting a list of relay servers from the directory server, wherein the list of relay servers records all active relay servers in the current network; a filtering module for filtering N relay servers from the list of relay servers based on the target transmission requirements, and determining the network node corresponding to each relay server to obtain N relay nodes; and a determination module for determining the node identity of each relay node to obtain a guard node, at least one intermediate node, and an exit node.

[0147] Optionally, the establishment unit includes: a first control module, used to control the target client to send a handshake request to the guard node, wherein the handshake request includes at least a preset encryption algorithm; a first generation module, used to generate a first communication key in the guard node based on the preset encryption algorithm, wherein the first communication key includes: a first public key and a first private key; and an exchange module, used to perform a session key exchange between the target client and the guard node using the first public key and the first private key, and obtain a first sub-link in the anonymous communication link after the exchange is completed.

[0148] Optionally, the exchange module includes: a first control submodule, used to control the guard node to return the first public key to the target client, and the target client to use the first public key to encrypt the pre-generated session key to obtain the encrypted session key; and a second control submodule, used to control the target client to send the encrypted session key to the guard node, and the guard node to use the first private key to decrypt the encrypted session key and store the decrypted session key in the guard node.

[0149] Optionally, the establishment unit further includes: a second control module, used to control the guard node to send a handshake request to the intermediate node after obtaining the first sub-link in the anonymous communication link; a second generation module, used to generate a second communication key in the intermediate node based on a preset encryption algorithm, wherein the second communication key includes: a second public key and a second private key; and a first return module, used to return the second public key to the target client through the first sub-link, for the target client to save, and after saving, obtain the second sub-link in the anonymous communication link.

[0150] Optionally, the establishment unit further includes: a third control module, used to control the intermediate node to send a handshake request to the exit node after obtaining the second sub-link in the anonymous communication link; a third generation module, used to generate a third communication key in the exit node based on a preset encryption algorithm, wherein the third communication key includes: a third public key and a third private key; and a second return module, used to return the third public key to the target client through the second sub-link and the first sub-link, for the target client to save, and after saving, obtain the third sub-link in the anonymous communication link.

[0151] Optionally, the establishment unit further includes: a fourth control module, used to control the target client to encrypt the target server address sequentially using the third public key, the second public key, and the first public key after obtaining the third sub-link in the anonymous communication link, to obtain an encrypted address; a transmission module, used to transmit the encrypted address through the first sub-link, the second sub-link, and the third sub-link, and during the transmission process, to decrypt the encrypted address sequentially using the first private key, the second private key, and the third private key, to obtain the target server address in the exit node; and an establishment module, used to establish the fourth sub-link in the anonymous communication link between the exit node and the target server based on the target server address.

[0152] Optionally, the establishment module includes: controlling the exit node to send a handshake request to the target server based on the target server address; a generation submodule, used to generate a fourth communication key in the target server based on a preset encryption algorithm, wherein the fourth communication key includes a fourth public key and a fourth private key; and a return submodule, used to return the fourth public key to the target client through the third sub-link, the second sub-link, and the first sub-link, for the target client to save, and after saving, the fourth sub-link in the anonymous communication link is obtained.

[0153] It should be noted that the selection unit 31, establishment unit 32, encryption unit 33, and transmission unit 34 mentioned above correspond to steps S201 to S204 in Embodiment 1. The instances and application scenarios implemented by the above units and corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules or units can also run as part of the device in the computer terminal 10 provided in Embodiment 1.

[0154] The invention will now be described in conjunction with another alternative embodiment.

[0155] Example 3

[0156] The present invention can also provide an electronic device. Figure 4 This is a structural block diagram of an electronic device that performs a data transmission method for a distributed file system according to an embodiment of the present invention, such as... Figure 4 As shown, the electronic device may include: one or more ( Figure 4 Only one of the following is shown: processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0157] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the data transmission method and apparatus for a distributed file system in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned data transmission method for a distributed file system. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0158] The processor can access information and applications stored in memory via the transmission device to execute the following steps: Select N relay nodes from the current network, where N is an integer greater than or equal to 3. Each relay node includes a guard node, at least one intermediate node, and an exit node. Establish encrypted communication links sequentially between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server to obtain anonymous communication links. When the target client obtains the data to be transmitted, encrypt the data using N public keys from the N relay nodes to obtain an encrypted data packet, where each encryption layer corresponds to one relay node. Transmit the encrypted data packet anonymously through the anonymous communication link, where the encrypted data packet is decrypted N times using N private keys during transmission, and the resulting target data is transmitted to the target server, with each decryption corresponding to one relay node.

[0159] The processor can also access information and applications stored in memory via the transmission device to perform the following steps: request a list of relay servers from the directory server, wherein the list of relay servers records all active relay servers in the current network; filter N relay servers from the list of relay servers based on the target transmission requirements, and determine the network node corresponding to each relay server to obtain N relay nodes; determine the node identity of each relay node to obtain a guard node, at least one intermediate node, and an exit node.

[0160] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: control the target client to send a handshake request to the guard node, wherein the handshake request contains at least a preset encryption algorithm; generate a first communication key in the guard node based on the preset encryption algorithm, wherein the first communication key contains a first public key and a first private key; perform a session key exchange between the target client and the guard node using the first public key and the first private key, and obtain the first sub-link in the anonymous communication link after the exchange is completed.

[0161] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: control the guard node to return the first public key to the target client, the target client uses the first public key to encrypt the pre-generated session key to obtain the encrypted session key; control the target client to send the encrypted session key to the guard node, the guard node uses the first private key to decrypt the encrypted session key, and saves the decrypted session key in the guard node.

[0162] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: control the guard node to send a handshake request to the intermediate node; generate a second communication key in the intermediate node based on a preset encryption algorithm, wherein the second communication key includes: a second public key and a second private key; return the second public key to the target client through the first sub-link, whereby the target client saves it, and after saving, obtains the second sub-link in the anonymous communication link.

[0163] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: control the intermediate node to send a handshake request to the exit node; generate a third communication key in the exit node based on a preset encryption algorithm, wherein the third communication key includes a third public key and a third private key; return the third public key to the target client through the second sub-link and the first sub-link, whereby the target client saves it, and after saving, obtains the third sub-link in the anonymous communication link.

[0164] The processor can also invoke information and applications stored in the memory via the transmission device to perform the following steps: control the target client to encrypt the target server address sequentially using the third public key, the second public key, and the first public key to obtain an encrypted address; transmit the encrypted address through the first sub-link, the second sub-link, and the third sub-link, and during the transmission process, decrypt the encrypted address sequentially using the first private key, the second private key, and the third private key to obtain the target server address in the exit node; establish the fourth sub-link in the anonymous communication link between the exit node and the target server based on the target server address.

[0165] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: control the exit node to send a handshake request to the target server based on the target server address; generate a fourth communication key in the target server based on a preset encryption algorithm, wherein the fourth communication key includes a fourth public key and a fourth private key; return the fourth public key to the target client through the third sub-link, the second sub-link and the first sub-link, and the target client saves it, and after saving, the fourth sub-link in the anonymous communication link is obtained.

[0166] The present invention provides a data transmission scheme for a distributed file system. In the data transmission network of a distributed file system, anonymous communication links are constructed by selecting N relay nodes and establishing encrypted communication links sequentially. This achieves the goal of protecting the anonymity of file providers during data transmission, thereby enhancing data transmission security and user identity security. Specifically, by establishing encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server, an anonymous network composed of relay nodes is formed. This ensures the anonymity and security of the data transmission path of the distributed file system. When constructing anonymous communication links, a guard node, at least one intermediate node, and an exit node are selected to act as "relay stations" in the data transmission process. Before data transmission, the public keys of the relay nodes are used to perform multi-layer encryption on the data to ensure data security during transmission and prevent interception and decryption. During data transmission, the private keys are used to decrypt the encrypted data packets layer by layer to ensure that the data can be received by the correct target server. This maintains the privacy and integrity of data transmission and further enhances the complexity and security of data transmission. This solves the technical problem in related technologies where distributed file systems use non-anonymous data transmission methods, resulting in the lack of security for both data and data transmitters, and the potential for information leakage.

[0167] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0168] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0169] The invention will now be described in conjunction with another alternative embodiment.

[0170] Example 4

[0171] This invention also provides a computer-readable storage medium. Optionally, in this invention, the computer-readable storage medium can be used to store the program code executed by the data transmission method for a distributed file system provided in Embodiment 1.

[0172] Optionally, in this embodiment of the invention, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0173] This invention also provides a computer program product, which, when executed on a data processing device, is suitable for executing the steps of a data transmission method for a distributed file system: selecting N relay nodes from the current network, where N is an integer greater than or equal to 3, and the relay nodes include: a guard node, at least one intermediate node, and an exit node; establishing encrypted communication links sequentially between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server to obtain anonymous communication links; when the target client obtains the data to be transmitted, using the N public keys of the N relay nodes to encrypt the data in N layers to obtain an encrypted data packet, where each layer of encryption corresponds to one relay node; anonymously transmitting the encrypted data packet through the anonymous communication link, wherein during the transmission process, the encrypted data packet is decrypted N times using N private keys, and the obtained target data is transmitted to the target server, where each decryption corresponds to one relay node.

[0174] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0175] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0176] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection of units or modules may be electrical or other forms.

[0177] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0178] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0179] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0180] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A data transmission method for a distributed file system, characterized in that, include: Select N relay nodes from the current network, where N is an integer greater than or equal to 3. The relay nodes include: a guard node, at least one intermediate node, and an exit node. The steps of establishing encrypted communication links sequentially between the target client and the guard node, between the guard node and the intermediate node, between the intermediate node and the exit node, and between the exit node and the target server to obtain anonymous communication links include: The system controls the upper-level node to send a handshake request carrying a preset encryption algorithm to the lower-level node, generates a communication key based on the preset encryption algorithm in the lower-level node, and performs a session key exchange between the upper-level node and the lower-level node based on the communication key. After the exchange is completed, the anonymous communication link is obtained. When the target client obtains the data to be transmitted, the data is encrypted with N layers using N public keys of N relay nodes to obtain an encrypted data packet, wherein each layer of encryption corresponds to one relay node; The encrypted data packet is transmitted anonymously through the anonymous communication link. During the transmission, the encrypted data packet is decrypted N times using N private keys, and the resulting target data is transmitted to the target server. Each decryption corresponds to one relay node.

2. The data transmission method according to claim 1, characterized in that, The steps for selecting N relay nodes from the current network include: Request a list of relay servers from the directory server, wherein the list of relay servers is used to record all the relay servers currently active in the network; Based on the target transmission requirements, N relay servers are selected from the list of relay servers, and the network node corresponding to each relay server is determined to obtain N relay nodes; The node identity of each relay node is determined to obtain the guard node, the at least one intermediate node, and the exit node.

3. The data transmission method according to claim 1, characterized in that, The steps of establishing encrypted communication links sequentially between the target client and the guard node, between the guard node and the intermediate node, between the intermediate node and the exit node, and between the exit node and the target server to obtain anonymous communication links include: The target client is controlled to send a handshake request to the guard node, wherein the handshake request contains at least a preset encryption algorithm; A first communication key is generated in the guard node based on the preset encryption algorithm, wherein the first communication key includes: a first public key and a first private key; The first public key and the first private key are used to perform a session key exchange between the target client and the guard node, and the first sub-link in the anonymous communication link is obtained after the exchange is completed.

4. The data transmission method according to claim 3, characterized in that, The steps of performing session key exchange between the target client and the guard node using the first public key and the first private key include: The guard node is controlled to return the first public key to the target client, and the target client uses the first public key to encrypt the pre-generated session key to obtain the encrypted session key; The target client is controlled to send the encrypted session key to the guard node, which then uses the first private key to decrypt the encrypted session key and stores the decrypted session key in the guard node.

5. The data transmission method according to claim 3, characterized in that, After obtaining the first sub-link in the anonymous communication link, the process further includes: The guard node is controlled to send the handshake request to the intermediate node; A second communication key is generated in the intermediate node based on the preset encryption algorithm, wherein the second communication key includes: a second public key and a second private key; The second public key is returned to the target client through the first sub-link, where it is saved. After the saving is completed, the second sub-link in the anonymous communication link is obtained.

6. The data transmission method according to claim 5, characterized in that, After obtaining the second sub-link in the anonymous communication link, the process further includes: The intermediate node is controlled to send the handshake request to the exit node; A third communication key is generated at the exit node based on the preset encryption algorithm, wherein the third communication key includes: a third public key and a third private key; The third public key is returned to the target client through the second sub-link and the first sub-link, where it is saved. After saving, the third sub-link in the anonymous communication link is obtained.

7. The data transmission method according to claim 6, characterized in that, After obtaining the third sub-link in the anonymous communication link, the process also includes: The target client is controlled to encrypt the target server address sequentially using the third public key, the second public key, and the first public key to obtain an encrypted address; The encrypted address is transmitted through the first sub-link, the second sub-link, and the third sub-link. During the transmission, the encrypted address is decrypted sequentially using the first private key, the second private key, and the third private key to obtain the target server address in the exit node. Based on the target server address, a fourth sub-link is established between the exit node and the target server in the anonymous communication link.

8. The data transmission method according to claim 7, characterized in that, The step of establishing the fourth sub-link in the anonymous communication link between the egress node and the target server based on the target server address includes: Based on the target server address, the exit node is controlled to send the handshake request to the target server; A fourth communication key is generated on the target server based on the preset encryption algorithm, wherein the fourth communication key includes: a fourth public key and a fourth private key; The fourth public key is returned to the target client through the third sub-link, the second sub-link, and the first sub-link, and is saved by the target client. After saving, the fourth sub-link in the anonymous communication link is obtained.

9. A data transmission device for a distributed file system, characterized in that, include: The selection unit is used to select N relay nodes from the current network, where N is an integer greater than or equal to 3, and the relay nodes include: a guard node, at least one intermediate node and an exit node; The establishment unit, used to sequentially establish encrypted communication links between the target client and the guard node, the guard node and the intermediate node, the intermediate node and the exit node, and the exit node and the target server to obtain anonymous communication links, includes the following steps: The system controls the upper-level node to send a handshake request carrying a preset encryption algorithm to the lower-level node, generates a communication key based on the preset encryption algorithm in the lower-level node, and performs a session key exchange between the upper-level node and the lower-level node based on the communication key. After the exchange is completed, the anonymous communication link is obtained. An encryption unit is used to encrypt the data to be transmitted using N public keys of N relay nodes to obtain an encrypted data packet when the target client obtains the data to be transmitted. Each layer of encryption corresponds to one of the relay nodes. The transmission unit is used to anonymously transmit the encrypted data packet through the anonymous communication link, wherein during the transmission process, the encrypted data packet is decrypted N times using N private keys, and the resulting target data is transmitted to the target server, with each decryption corresponding to one relay node.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the data transmission method for a distributed file system as described in any one of claims 1 to 8.

11. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the data transfer method for a distributed file system as described in any one of claims 1 to 8.

12. A computer program product, characterized in that, It includes computer instructions, wherein when executed by a processor, the computer instructions implement the steps of the data transfer method for a distributed file system as described in any one of claims 1 to 8.

Images