A network reporting method, system and storage medium based on UKEY

Abstract

A network reporting method, system and storage medium based on UKEY, relating to the field of information security technology, the method comprising: receiving a login authentication request sent by an institution end; after verification, generating authentication information including an institution number and a current timestamp; generating a session identifier, and integrating the session identifier, the institution number and the current timestamp to generate key negotiation reference data; encrypting the key negotiation reference data to obtain first encrypted data; receiving second encrypted data, and generating a symmetric encryption key based on the first encrypted data and the second encrypted data; receiving an encrypted data packet encrypted by a symmetric encryption key at the institution end, and decrypting the encrypted data packet using the symmetric encryption key to obtain reporting data; after confirming the validity of the reporting data based on the session identifier, storing the reporting data in a preset database, and returning storage confirmation information to the institution end. Implementation of this application can improve the security of network reporting.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a network reporting method, system and storage medium based on UKEY. Background Art

[0002] With the rapid development of financial technology and the continuous improvement of regulatory requirements, banking financial institutions are required to regularly report large amounts of business data and regulatory information to regulatory authorities. This data not only covers the financial institutions' operating conditions, but also contains sensitive information such as customer information and transaction records.

[0003] In related technologies, financial institutions generally use dedicated network transmission and digital certificate authentication to submit data. This involves connecting to the regulatory agency's data receiving system via a dedicated network, using digital certificates for identity authentication, and then packaging the submitted data and uploading it to the regulatory agency's server via FTP or SFTP. Once the data is received, the regulatory agency's system parses and stores the data.

[0004] However, data transmitted over the network using related technologies still faces the risk of being intercepted and tampered with, and is not secure enough. Summary of the Invention

[0005] The present application provides a UKEY-based network reporting method, system and storage medium for improving the security of network reporting.

[0006] In the first aspect, the present application provides a network reporting method based on UKEY, which is applied to a network reporting system, and the method includes: receiving a login authentication request containing an organization number and fingerprint data sent by the receiving institution based on UKEY; after verifying that the matching degree of the fingerprint data and the pre-stored fingerprint is higher than a preset matching threshold, generating authentication information containing the organization number and the current timestamp; generating a session identifier based on the authentication information and the preset private field, and integrating the session identifier, organization number and current timestamp to generate key negotiation reference data; encrypting the key negotiation reference data using the SM2 algorithm to obtain first encrypted data; receiving the second encrypted data returned by the receiving institution in response to the first encrypted data, and generating a symmetric encryption key based on the first encrypted data and the second encrypted data; receiving an encrypted data packet encrypted by the receiving institution using the symmetric encryption key, and decrypting the encrypted data packet using the symmetric encryption key to obtain reporting data; after confirming the validity of the reporting data based on the session identifier, storing the reporting data in a preset database, and returning storage confirmation information to the institution.

[0007] In the above embodiment, the network reporting system realizes the full-process security protection of identity authentication, data encryption transmission and storage during the network reporting process through multiple security mechanisms of UKEY, fingerprint verification, SM2 encryption and symmetric encryption. First, the UKEY and fingerprint are verified to ensure the user identity, and then the SM2 algorithm and symmetric encryption are used to ensure the security of data transmission. Finally, the session identification verification is used to ensure data integrity. The multi-layer protection improves the security of network reporting.

[0008] In combination with some embodiments of the first aspect, in some embodiments, before the step of receiving a login authentication request containing an institution number and fingerprint data sent by the institution based on UKEY, the method also includes: receiving registration requests from multiple registration servers and performing identity authentication to determine multiple supervisory end servers; assigning a unique identification code to each supervisory end server, and establishing a general communication link between the master control server and multiple supervisory end servers; receiving heartbeat packet information containing load data sent by multiple supervisory end servers, and calculating the comprehensive load score of the supervisory end server based on the load data; after verifying that the match degree between the fingerprint data and the pre-stored fingerprint is higher than the preset match threshold, generating authentication information containing the institution number and the current timestamp, specifically including: after verifying that the match degree between the fingerprint data and the pre-stored fingerprint is higher than the preset match threshold, screening out the target server with the lowest comprehensive load score, and assigning the target server to the institution end; generating a matching relationship table containing the correspondence between the target server and the institution end; generating authentication information containing the device identification, institution number and current timestamp of the target server.

[0009] In the above embodiment, the network reporting system uses distributed technology for complex balancing. By real-time monitoring of the load of the supervisory server, it dynamically allocates the reporting request to the server with the lowest load, and establishes a matching relationship table to achieve precise correspondence, effectively realizing balanced scheduling and optimal utilization of system resources, and improving the overall performance and stability of the system.

[0010] In combination with some embodiments of the first aspect, in some embodiments, after the step of generating a matching relationship table containing the correspondence between the target server and the target institution end, the method also includes: sending a service allocation instruction containing the access information of the target institution end to the target server; after receiving the service ready confirmation information returned by the target server, establishing a direct communication link between the target server and the target institution end; determining the reporting period of the target institution end, and counting down the binding connection of the direct communication link based on the reporting period.

[0011] In the above embodiment, the network reporting system establishes a direct communication link between the target server and the institutional end, and sets a connection countdown based on the reporting period, thereby realizing the timed management and resource release of the network connection, avoiding invalid connections occupying system resources, and improving the system operation efficiency.

[0012] In combination with some embodiments of the first aspect, in some embodiments, after the step of generating a matching relationship table containing the correspondence between the target server and the target institution end, the method also includes: receiving a file-sensitive operation request uploaded by the instruction server, determining the corresponding file to be operated and the operation type; the instruction server is one of multiple regulatory end servers; after verifying the file-sensitive operation request based on the user operation, sending the file operation instruction to the instruction server through the communication link; receiving the operation execution result returned by the instruction server, and storing the file operation record of the instruction server.

[0013] In the above embodiment, the network reporting system ensures the controllability and traceability of file operations through a unified management and verification mechanism for sensitive file operations, verifies permissions for file operations and records operation logs, effectively preventing unauthorized file access and improving data security.

[0014] In combination with some embodiments of the first aspect, in some embodiments, after confirming the validity of the reported data based on the session identifier, the reported data is stored in a preset database, and the storage confirmation information is returned to the institutional end. The steps specifically include: verifying the timeliness and authorization scope of the session identifier to obtain the session verification result; when the session verification result is the preset result, parsing the data structure of the reported data to determine the storage location of the reported data; storing the reported data in the storage location, generating a warehousing record including the storage location and storage time, and returning the storage confirmation information to the institutional end.

[0015] In the above embodiment, the network reporting system realizes the validity verification and accurate storage of the reported data through session identification verification and data structure analysis, and ensures the accuracy and traceability of data storage by verifying the session timeliness and authorization scope and determining the storage location according to the data structure.

[0016] In combination with some embodiments of the first aspect, in some embodiments, after confirming the validity of the reported data based on the session identifier, storing the reported data in a preset database, and returning the storage confirmation information to the institution end, the method also includes: receiving multiple reported data packets to be imported, establishing an initial task queue containing multiple import tasks; according to the timeliness and data volume of the reported data packets, correcting the priority of the import tasks corresponding to the reported data packets in the initial task queue to obtain an optimized task queue; executing data import based on the optimized task queue, and generating an import progress report; the import progress report includes the number of completed tasks, the number of remaining tasks and the estimated completion time.

[0017] In the above embodiment, the network reporting system realizes the intelligent scheduling and progress monitoring of the reported data import, dynamically adjusts the task priority according to the timeliness and data volume of the data, and generates progress reports in real time, thereby improving the efficiency and controllability of large-scale data import.

[0018] In combination with some embodiments of the first aspect, in some embodiments, after the steps of executing data import based on the optimized task queue and generating an import progress report, the method also includes: receiving an add request containing a newly added temporary task sent by the management terminal, determining the task type and urgency of the newly added temporary task; calculating the task priority of the newly added temporary task based on the urgency, and determining the insertion position of the newly added temporary task in the optimized task queue; inserting the newly added temporary task into the insertion position, and updating the optimized task queue; and pushing a new temporary task notification to the institution end corresponding to the optimized task queue.

[0019] In the above embodiment, the network reporting system realizes the flexible insertion and priority management of temporary tasks, dynamically adjusts the task queue according to the urgency of the task, and promptly notifies relevant agencies, ensuring the timely processing of urgent tasks and improving the system's responsiveness.

[0020] In a second aspect, an embodiment of the present application provides a network reporting system, which includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to enable the network reporting system to execute the method described in the first aspect and any possible implementation method of the first aspect.

[0021] In a third aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when the computer program product is run on a network reporting system, enables the network reporting system to execute the method described in the first aspect and any possible implementation of the first aspect.

[0022] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium comprising instructions. When the instructions are executed on a network reporting system, the network reporting system executes the method described in the first aspect and any possible implementation of the first aspect.

[0023] It is understandable that the network reporting system provided in the second aspect, the computer program product provided in the third aspect, and the computer storage medium provided in the fourth aspect are all used to execute the methods provided in the embodiments of the present application. Therefore, the beneficial effects that can be achieved can be referenced to the beneficial effects of the corresponding methods and will not be repeated here.

[0024] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0025] 1. Due to the adoption of a dual identity authentication mechanism combining UKEY physical media authentication with fingerprint biometric verification, as well as a hybrid encryption transmission mechanism based on SM2 asymmetric encryption and symmetric encryption, dual security guarantees of identity authentication and data transmission are achieved during the data reporting process. This effectively solves the security risks of existing technologies that rely solely on digital certificates that are easily copied and network transmission data that are easily intercepted and tampered with, thereby achieving a higher level of identity authentication reliability and data transmission confidentiality. At the same time, the session identification verification mechanism ensures the integrity and validity of the data, thereby improving the security performance of the entire network reporting process.

[0026] 2. Due to the adoption of a unified management mechanism and multi-level verification process for sensitive file operations, and the distribution of instructions and result feedback through the total communication link, file operations are fully controllable and traceable, effectively solving the problem of chaotic file operation permission management in existing technologies, and thus achieving standardized management and full-process monitoring of file operations, ensuring the security and compliance of sensitive file operations.

[0027] 3. Due to the adoption of a dynamic task priority adjustment mechanism based on timeliness and data volume, as well as a task queue optimization and progress monitoring mechanism, intelligent scheduling and precise management of large-scale data import processes are achieved, effectively solving the problems of low data import efficiency or difficult progress control in existing technologies, and thus achieving efficient coordination and precise control of the data import process, which not only ensures the timely processing of urgent data, but also achieves the optimal utilization of system resources, improving the system's operating efficiency and manageability. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a flowchart of the network reporting method based on UKEY in an embodiment of the present application;

[0029] Figure 2 This is another flowchart of the network reporting method based on UKEY in an embodiment of the present application;

[0030] Figure 3 It is a schematic diagram of the structure of a physical device of the network reporting system in an embodiment of the present application. DETAILED DESCRIPTION

[0031] The terms used in the following examples of the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the specification of the present application, the singular expressions "a", "an", "above", "the", and "this" are intended to include plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in the present application refers to any or all possible combinations of one or more of the listed items.

[0032] In the following, the terms "first" and "second" are used for descriptive purposes only and should not be understood to imply or suggest relative importance or implicitly indicate the number of the technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of this application, unless otherwise specified, "plurality" means two or more.

[0033] For ease of understanding, the application scenarios of the embodiments of the present application are introduced below.

[0034] A provincial regulatory agency needs to manage data reporting for more than 2,000 financial institutions within its jurisdiction. Each institution is required to submit multiple reporting tasks every month, including EAST and JRJC, and the reporting time, data volume, and business types vary among different institutions. Due to the sensitivity of the data, institutional operators need to log in to the system via USB keys for authentication, but there may be security risks such as USB keys being copied or passwords being stolen. For example, a few years ago, a rural commercial bank suffered a data leak. The investigation found that the operator's login password was stolen, allowing unauthorized personnel to gain access to the reporting system. Traditional password authentication methods cannot ensure the uniqueness of the operator's identity, nor can they guarantee the security of data during transmission, posing a significant risk to financial data reporting.

[0035] In the related art, a two-factor authentication method based on a USB key and a password is usually used for identity authentication, and a fixed key is used for data encryption transmission. The following describes an application scenario using the traditional USB key authentication method in the related art.

[0036] A city commercial bank uses a traditional USB key authentication system for data reporting. The system requires the operator to insert a USB key and enter a password for identity verification. For example, when performing monthly regulatory reporting, the operator inserts the USB key and enters a six-digit password to log into the system. The system verifies identity through a simple password match and uses a fixed encryption key for data transmission.

[0037] However, this method has multiple security vulnerabilities: the USB key may be copied and the password may be easily cracked or leaked; a single password authentication cannot ensure that the actual operator is the authorized person; and the fixed encryption key may be easily cracked, resulting in the interception and tampering of the transmitted data.

[0038] The UKEY-based network reporting method in the embodiment of this application is used to achieve the uniqueness of identity authentication and the security of data transmission through fingerprint biometric recognition, dynamic session management and multiple encryption mechanisms. The following describes the scenario using the UKEY-based network reporting method in this application.

[0039] A regional bank uses the UKEY-based online reporting system described in this application to handle data reporting tasks. When an institution operator needs to submit data, they first insert their UKEY into the terminal and perform fingerprint verification. Upon receiving a login request containing the institution number "JG20240101" and the operator's fingerprint data, the system verifies that the fingerprint match reaches 98%, exceeding the preset 95% threshold. The system then generates authentication information containing the institution number and the timestamp "202401271030." It also combines this information with the private field "SECRETKEY2024" to generate the session identifier "SESSION_JG20240101_1030." The system combines this information into key negotiation reference data, encrypts it using the SM2 algorithm, and generates the first encrypted data. Upon receiving this data, the institution returns the corresponding second encrypted data, from which the system generates an AES-256-bit symmetric encryption key. When the institution encrypts the reporting data packet using this key and sends it, the system decrypts it using the same key to obtain the original reported data. After the system verifies that the session identifier is valid, it stores the data in the Oracle database and returns a confirmation message of "data storage successful" to the institution.

[0040] Throughout the entire process, the security of the submitted data is ensured through the UKEY hardware medium and multiple encryption mechanisms. For ease of understanding, the following describes the process of the method provided by this implementation in combination with the above scenario. Figure 1 , which is a flow chart of the network reporting method based on UKEY in an embodiment of the present application.

[0041] S101. The receiving institution sends a login authentication request based on UKEY, which includes the institution number and fingerprint data.

[0042] Among them, the institutional end is the financial institution's private network server with client software installed; UKEY represents a USB security authentication medium used to store digital certificates and encryption keys, and supports fingerprint verification function; the institutional number refers to the unique identification code assigned to each financial institution; fingerprint data is the user's biometric data collected through UKEY.

[0043] This step is executed when the institution initiates a login request to the supervisory server after the institution user inserts UKEY and verifies their fingerprint. Specifically, the institution collects the user's fingerprint data through the UKEY SDK interface, packages the fingerprint data and the institution ID into a login authentication request, and sends it to the supervisory server via HTTP. Upon receiving the request, the supervisory server (network reporting system) first verifies the legitimacy of the request format and then parses the institution ID and fingerprint data for subsequent verification.

[0044] In some embodiments, login authentication requests can be received and processed in a variety of ways: Alternatively, the supervisor can initiate an independent authentication service thread, receive requests via persistent socket connections, queue the requests, and implement a timeout retry mechanism. Alternatively, requests can be received via a RESTful API, filtered and validated using Spring Security, and authentication status can be cached in Redis. It is understood that other network communication protocols and authentication mechanisms can also be used to receive and process requests, and these are not intended to be limiting.

[0045] S102: After verifying that the matching degree between the fingerprint data and the pre-stored fingerprint is higher than a preset matching threshold, generate authentication information including an organization number and a current timestamp.

[0046] Among them, the pre-stored fingerprint refers to the legal fingerprint data of institutional users stored in the regulatory database in advance; the matching degree indicates the degree of similarity between the current fingerprint data and the pre-stored fingerprint; the preset matching threshold is used to determine whether the fingerprint verification is passed; the timestamp refers to the numerical representation of the current system time.

[0047] This step performs fingerprint verification after receiving a login authentication request. Specifically, the supervisory end (online reporting system) uses a fingerprint comparison algorithm to calculate the match between the current fingerprint data and the pre-stored fingerprint. Verification is considered successful when the match exceeds a preset threshold (usually 0.8). After verification, the current system timestamp is obtained and combined with the institution number to generate authentication information containing these two fields.

[0048] S103: Generate a session identifier based on the authentication information and the preset private field, and integrate the session identifier, the organization number, and the current timestamp to generate key negotiation reference data.

[0049] Among them, the preset private field represents the key information pre-defined by the system for generating a session identifier; the session identifier refers to a unique identifier used to identify the current session; and the key negotiation reference data is a basic data packet used for subsequent generation of encryption keys.

[0050] This step, after generating authentication information, executes session identifier generation and key negotiation preparation. Specifically, the network reporting system combines the authentication information with a pre-set private field to calculate the session identifier, ensuring its uniqueness and randomness. The session identifier, organization number, and timestamp are then concatenated and integrated according to a specific format to construct the key negotiation baseline data, preparing for subsequent encrypted communications.

[0051] In some embodiments, session identifier generation and data integration can be achieved through various methods: optionally, using SHA-256 to calculate the hash value of the authentication information and private fields as the session identifier, and organizing the negotiation baseline data in JSON format; optionally, using a UUID combined with a timestamp to generate a session identifier, and encapsulating the data in a custom binary format. It is understood that other encryption algorithms and data formats can also be used to implement session management, and are not limited here.

[0052] S104: Encrypt the key negotiation reference data using the SM2 algorithm to obtain first encrypted data.

[0053] The SM2 algorithm refers to the public key cryptography algorithm issued by the State Cryptography Administration; the first encrypted data represents the ciphertext data encrypted by the SM2 algorithm.

[0054] This step performs encryption after generating the key agreement reference data. Specifically, the network reporting system calls the encryption interface of the SM2 algorithm and encrypts the key agreement reference data using the SM2 public key corresponding to the institution end, obtaining the encrypted first encrypted data to ensure the security of the data transmission process.

[0055] S105. The receiving institution receives the second encrypted data returned in response to the first encrypted data, and generates a symmetric encryption key based on the first encrypted data and the second encrypted data.

[0056] The second encrypted data represents the encrypted response data returned by the institution; the symmetric encryption key refers to the session key used for subsequent data transmission.

[0057] This step waits for and processes the institution's response after sending the first encrypted data. Specifically, the network reporting system receives the second encrypted data returned by the institution and combines it with the previously generated first encrypted data to generate a symmetric encryption key using a specific key negotiation algorithm. This key is used for subsequent data encryption transmission, providing more efficient encryption performance.

[0058] In some embodiments, symmetric key generation can be achieved through various methods: optionally, using the Diffie-Hellman key exchange algorithm in combination with the SM3 hash algorithm to generate symmetric keys; optionally, using an SM2-based key agreement scheme to generate shared keys. It is understood that other key agreement mechanisms can also be used to achieve secure key exchange, and these are not limited here.

[0059] S106. The receiving organization encrypts the encrypted data packet using the symmetric encryption key, and decrypts the encrypted data packet using the symmetric encryption key to obtain the reported data.

[0060] Among them, the encrypted data packet refers to the reporting data packet encrypted by the institution using a symmetric encryption key; the reporting data refers to the original business data after decryption.

[0061] This step executes data transmission and decryption after the symmetric encryption key is successfully generated. Specifically, the network reporting system receives the encrypted data packet sent by the institution and decrypts it using the previously generated symmetric encryption key to restore the original reporting data, ensuring the confidentiality and integrity of the data transmission.

[0062] In some embodiments, data decryption can be implemented in a variety of ways: optionally, using the SM4 algorithm for symmetric decryption and data integrity verification; optionally, using block decryption and parallel processing to improve the efficiency of decrypting large amounts of data. It is understood that other efficient decryption processing mechanisms can also be used, and are not limited here.

[0063] S107. After confirming the validity of the submitted data based on the session identifier, the submitted data is stored in a preset database, and storage confirmation information is returned to the institution end.

[0064] Among them, data validity refers to the legality and timeliness of the reported data; the preset database refers to the target database used to store the reported data; and the storage confirmation information is used to feedback the data storage status to the institution.

[0065] This step involves data storage and confirmation after the submitted data has been successfully decrypted. Specifically, the online reporting system first verifies the data's validity using the session identifier, including checking the legitimacy of the data source and the validity of the timestamp. Once verified, the submitted data is stored in a pre-defined database system and a confirmation message, including the storage status, is generated and returned to the institution.

[0066] In some embodiments, handling data storage failures must be performed while ensuring data consistency and reliability. Specifically, the network reporting system first captures storage anomalies and records detailed error logs, including the cause of the failure and data characteristics. A tiered retry mechanism is then initiated based on the type of anomaly. For temporary failures (such as network jitter), an exponential backoff algorithm is used for retrying. For fatal errors (such as disk corruption), an immediate notification message is sent to operations and maintenance personnel, who are then switched to a backup storage system. Detailed error information is also returned to the organization to guide subsequent re-reporting.

[0067] Failure handling can be implemented in a variety of ways. For example, failed data can be written to a local temporary file system and an independent retry thread can be started to periodically attempt to re-store the data. After the maximum number of retries is reached, the data can be migrated to a backup storage system, and relevant personnel can be notified in real time through a message push mechanism. At the same time, a detailed failure report can be generated for subsequent analysis.

[0068] The following is a more detailed description of the process of the method provided by this implementation. Figure 2 , which is another flow chart of the network reporting method based on UKEY in an embodiment of the present application.

[0069] S201: Receive registration requests from multiple registration servers and perform identity authentication to determine multiple supervisory end servers.

[0070] Among them, the registration server refers to the regulatory server node that can independently handle data reporting services; the registration request refers to the registration information package containing identity information and service capabilities sent by the server to the control center; identity authentication is used to confirm the legitimacy and reliability of the server; the regulatory server refers to the server node that can be put into use after passing verification.

[0071] This step is performed when the system is started or a new server node is added. Specifically, after receiving a server registration request, the network reporting system first verifies the digital certificate and encrypted signature in the request, then checks the server's hardware configuration, network connection status, and other information. If verification is successful, the server information is recorded in the server management list and an initial connection is established with the server.

[0072] In some embodiments, the authentication and management of the registration server can be achieved in a variety of ways: the system adopts an identity authentication mechanism based on a zero-trust architecture, first verifying the hardware fingerprint of the server, and then confirming the authenticity of the server identity through dynamic tokens and behavioral analysis. Multi-factor authentication technology is used in the authentication process, combined with certificate chain verification and two-way TLS authentication to ensure communication security. After the server identity is confirmed, the system will establish an encrypted communication channel and allocate resource quotas. Optionally, the system can also adopt a distributed identity authentication system based on blockchain, manage the life cycle of the server through smart contracts, and use a consensus mechanism to ensure the credibility of the authentication process. It is understandable that other identity authentication and server management mechanisms can also be used, which are not limited here.

[0073] S202: Allocate a unique identification code to each supervisory end server, and establish a general communication link between the master control server and multiple supervisory end servers.

[0074] Among them, the unique identification code represents the unique identity code of each server, which is composed of a hardware identifier and a random sequence; the total communication link refers to the encrypted communication channel established between the master control server and each supervision end server. The link status of the total communication link includes health and availability.

[0075] This step is performed after the server completes authentication. Specifically, the network reporting system generates a unique 128-bit identification code based on the server's hardware information, such as the MAC address and CPU serial number, combined with a timestamp and a random number. Each identification code is then assigned a separate communication port and encryption key, establishing a secure communication link based on the TLS 1.3 protocol. The system monitors the link status in real time through a heartbeat detection mechanism to ensure communication stability.

[0076] In some embodiments, the establishment and maintenance of communication links can be achieved in a variety of ways: the system adopts a layered encryption communication architecture, uses a national secret algorithm for encryption at the transport layer, and implements a customized handshake protocol and session management at the application layer. Communication security is ensured through dynamic key updates and session renegotiation mechanisms. Bidirectional authentication and integrity verification are used during the link establishment process to prevent man-in-the-middle attacks. Optionally, the system can also use a P2P-based network topology to achieve direct communication between server nodes, improve network transmission efficiency and enhance the system's fault tolerance. It is understandable that other communication link management mechanisms can also be used, which are not limited here.

[0077] S203: Receive heartbeat packets containing load data sent by multiple supervisory end servers, and calculate a comprehensive load score of the supervisory end servers according to the load data.

[0078] Among them, the heartbeat packet information represents the status report data sent regularly by the server; the load data includes real-time performance indicators such as CPU usage, memory occupancy, disk I / O, and network bandwidth; the comprehensive load score refers to the overall load level assessment value of the server obtained through weighted calculation.

[0079] This step is performed continuously during normal server operation. Specifically, the network reporting system sets weight coefficients {w1, w2, ..., wn} based on the importance of performance indicators. After normalizing each load indicator {x1, x2, ..., xn}, it calculates a composite load score S = Σ(wi * xi) using a weighted average algorithm. The system also considers historical load trends and uses time series analysis methods such as exponential smoothing to predict future server load changes.

[0080] In some embodiments, load assessment can be achieved in a variety of ways: the system uses machine learning methods to build a neural network model including a multi-layer perceptron and a convolutional layer, namely a load prediction model, which takes real-time load data, historical load trends and service quality indicators as input features. The load prediction model can output a more accurate load prediction score.

[0081] Specifically, the load prediction model constructs a multi-layer neural network architecture to predict server load status. The input layer receives real-time data on multi-dimensional server performance metrics, including CPU usage, memory utilization, disk I / O rate, and network bandwidth utilization. The network's hidden layer consists of a multi-layer perceptron structure, using the Reluctant Unified Unit (ReLU) activation function to perform nonlinear transformations and extract high-order features. The convolutional layer captures temporal correlations between performance metrics, with a kernel size set to 5-minute intervals. The load prediction model is trained using a stochastic gradient descent optimizer with mean squared error as the loss function. The learning rate is initially set to 0.001 and adaptively adjusted using Adam. During training, the system collects performance data every 10 minutes, accumulates it over 24 hours into training batches, and continuously optimizes model parameters through an online learning mechanism. During operation, the load prediction model outputs a load prediction score (normalized between 0 and 100) for the next 15 minutes by inputting a sequence of performance metrics from the last hour.

[0082] For example, when it is detected that the CPU usage of a server has shown an upward trend in the past 30 minutes and the memory usage exceeds 75%, the model may output a higher load prediction score (such as 85 points), prompting the system to reduce the task allocation weight of the server.

[0083] S204. The receiving institution sends a login authentication request based on UKEY, which includes the institution number and fingerprint data.

[0084] Referring to step S101 , the network reporting system receives a login authentication request.

[0085] S205. After verifying that the matching degree between the fingerprint data and the pre-stored fingerprint is higher than the preset matching threshold, the target server with the lowest comprehensive load score is screened out and the target server is allocated to the institution end.

[0086] Among them, the target server refers to the server node with low load and suitable for processing new requests; server allocation refers to assigning the reporting task of a specific agency to the selected server for processing.

[0087] This step is performed after the institution's identity verification is successful. Specifically, the network reporting system first ranks the combined load scores of all regulatory servers and selects the server with the lowest score as the target server. It also considers factors such as the server's geographic location and network latency, using a multi-objective optimization algorithm to ensure the rationality of the allocation. The system also evaluates the target server's historical service quality to avoid assigning tasks to nodes with unstable performance.

[0088] In some embodiments, the network reporting system stores all revoked certificate serial numbers and revocation reasons by maintaining a regularly updated certificate revocation database. When receiving an authentication request, the system first obtains the latest certificate revocation list from the CRL distribution point, and then uses a binary search algorithm to retrieve the serial number of the current certificate in the revocation list; the certificate revocation list (CRL) status refers to the check result of the UKEY digital certificate in the certificate revocation list. If a matching record is found, the revocation time and reason code are further checked to determine whether the certificate is within the validity period. For example, when an institution's UKEY is reported lost due to a security incident, its corresponding certificate serial number will be added to the CRL. Thereafter, all authentication requests for the UKEY will be rejected due to CRL status check failure.

[0089] S206: Generate a matching relationship table containing the corresponding relationship between the target server and the institution end.

[0090] Among them, the matching relationship table represents the corresponding binding relationship data between the target server and the institution end;.

[0091] This step is performed immediately after server allocation is complete. Specifically, the online reporting system creates a relationship record based on the allocation results, containing fields such as the institution number, server identification code, allocation timestamp, and session identifier. The system also calculates the relationship validity period and dynamically adjusts it based on the reporting cycle (such as the EAST reporting cycle). The system uses a transaction mechanism to ensure atomic updates to the relationship table and establishes indexes to accelerate query efficiency.

[0092] In some embodiments, matching relationships can be managed in a variety of ways: The system uses a distributed database to store matching relationships and a two-phase commit protocol to ensure data consistency. Concurrent access is handled through a multi-version concurrency control (MVCC) mechanism, combined with a caching mechanism to improve query performance. The system also implements an automatic mechanism for checking and clearing relationship expiration dates. Optionally, the system can also use a graph database to store matching relationships, using graph algorithms to analyze the connection characteristics of servers and organizations to optimize resource allocation strategies. It is understood that other relationship management mechanisms can also be used, and are not limited here.

[0093] In some embodiments, the network reporting system sends a service allocation instruction containing access information of the target organization to the target server; after receiving the service readiness confirmation information returned by the target server, a direct communication link is established between the target server and the target organization; the reporting period of the target organization is determined, and a countdown for binding the connection of the direct communication link is performed based on the reporting period.

[0094] Among them, the service allocation instruction represents the control command used to establish a connection between the server and the institution; the service readiness confirmation information refers to the response data of the server completing resource preparation; the communication direct link is used to represent the dedicated data channel between the institution and the server; the connection countdown refers to the link validity period set based on the reporting period.

[0095] This section is executed after server allocation is complete. Specifically, the network reporting system packages the institution's IP address, access rights, and security policy into a service allocation instruction and sends it to the target server. Upon receiving the instruction, the server reserves computing resources and storage space, configures firewall rules and access control policies, and returns a ready confirmation upon completion. The system then establishes an encrypted channel from the institution to the server and sets a link validity timer based on the reporting type (e.g., EAST monthly report, JRJC quarterly report, etc.).

[0096] In some embodiments, server connection management can be implemented in a variety of ways: the system adopts a state machine-based connection lifecycle management mechanism and establishes a secure channel through a multi-stage handshake protocol. The system first performs two-way identity authentication, then negotiates encryption parameters and session keys, and finally establishes a data transmission channel and starts heartbeat monitoring. The entire process is protected by asymmetric encryption, and a time window mechanism is used to prevent replay attacks. Optionally, the system can also implement a dynamic load balancing mechanism, which monitors server resource usage in real time and automatically switches to a backup link when necessary to ensure service continuity. It is understandable that other connection management mechanisms can also be used, which are not limited here.

[0097] In some embodiments, the network reporting system receives a file-sensitive operation request uploaded by an instruction server, determines the corresponding file to be operated and the type of operation; the instruction server is one of multiple supervisory servers; after verifying the file-sensitive operation request based on the user operation, the file operation instruction is sent to the instruction server through the communication link; the operation execution result returned by the instruction server is received, and the file operation record of the instruction server is stored.

[0098] Among them, the file sensitive operation request refers to an operation application involving the modification or deletion of important data; the file to be operated refers to the target file that requires sensitive operation; the operation type is used to indicate the specific file processing method, such as modification, deletion, etc.; the instruction server refers to the supervisory server that executes the file operation; the file operation record refers to the audit log that records the operation execution process and results.

[0099] This section is executed upon receiving a file operation request from the supervisory end. Specifically, the network reporting system parses the file identifier and operation parameters in the request to verify the operating user's permission level. The system then calls the security audit module to record the operation request information, including the operator, timestamp, and IP address. Once the user passes identity authentication and authorization verification, the system constructs an encrypted message containing detailed operation instructions and sends it to the instruction server via the main communication link. The system tracks the execution status of instructions in real time and saves the execution results and operation logs to the security audit database.

[0100] In some embodiments, sensitive operation management can be achieved in a variety of ways: the system uses a multi-level authorization mechanism to handle sensitive operations, requiring high-risk operations to be approved by multiple people. The system first conducts a risk assessment on the operation request and determines the approval process based on the importance of the file and the scope of the operation impact. The multi-level approval is then coordinated through the workflow engine, and finally the operation is performed after sufficient authorization is obtained. The entire process uses digital signatures to ensure that the operation is non-repudiable. Optionally, the system can also implement abnormal operation detection based on machine learning, identify potential violations by analyzing historical operation patterns, and automatically trigger security warnings and operation interception. It is understandable that other sensitive operation management mechanisms can also be used, which are not limited here.

[0101] S207: Generate authentication information including the device identification, organization number and current timestamp of the target server.

[0102] Among them, the device identification represents the hardware characteristics and network identification information of the target server; the authentication information refers to the credential data used to verify the identities of the communicating parties.

[0103] This step is performed after a matching relationship is established. Specifically, the network reporting system combines the target server's device ID, organization number, and millisecond-accurate timestamp, and uses a hash algorithm to generate a digest of the authentication information. The system sets a sliding time window for authentication information; authentication information outside the window automatically expires. It also maintains a record of authentication information usage to prevent replay attacks.

[0104] S208: Generate a session identifier based on the authentication information and the preset private field, and integrate the session identifier, the organization number, and the current timestamp to generate key negotiation reference data.

[0105] Referring to step S103 , the network reporting system generates key negotiation benchmark data.

[0106] S209: Encrypt the key negotiation reference data using the SM2 algorithm to obtain first encrypted data.

[0107] Referring to step S104 , the network reporting system generates first encrypted data.

[0108] S210. The receiving institution receives the second encrypted data returned in response to the first encrypted data, and generates a symmetric encryption key based on the first encrypted data and the second encrypted data.

[0109] Referring to step S105, the network reporting system generates a symmetric encryption key.

[0110] S211. The receiving organization encrypts the encrypted data packet using the symmetric encryption key, and decrypts the encrypted data packet using the symmetric encryption key to obtain the reported data.

[0111] Referring to step S106, the network reporting system will decrypt and obtain the reporting data.

[0112] S212. After confirming the validity of the submitted data based on the session identifier, the submitted data is stored in a preset database, and storage confirmation information is returned to the institution end.

[0113] Referring to step S107, the network reporting system will store the reporting data.

[0114] In some embodiments, the network reporting system verifies the timeliness and authorization scope of the session identifier to obtain a session verification result; when the session verification result is a preset result, it parses the data structure of the reported data to determine the storage location of the reported data; stores the reported data in the storage location, generates a storage record containing the storage location and storage time, and returns storage confirmation information to the institution.

[0115] Among them, the session ID represents the unique identifier of the user's current login session; timeliness refers to the validity status of the session; the authorization scope is used to represent the set of operations allowed to be performed by the session; the data structure represents the organizational form and format specifications of the reported data; the storage location refers to the storage path of the data in the file system; and the storage record is used to represent detailed information on data storage.

[0116] This section is executed upon receipt of submitted data. Specifically, the online reporting system first checks the session identifier's validity period and authorization level to verify the user's data submission permission. The system then analyzes the submitted data packet's file format and data organization, determining a storage strategy based on the data type and institution information. The system writes the data to the designated storage location and generates a record containing information such as the file path, storage timestamp, and data verification code. Finally, it returns a confirmation message with the storage status to the institution.

[0117] In some embodiments, data storage management can be implemented in a variety of ways: the system uses a distributed storage architecture to process reported data and ensures data reliability through data sharding and replication mechanisms. The system first classifies and labels the data, and then selects appropriate storage nodes based on the storage policy. It then uses a consistent hashing algorithm to calculate the data sharding scheme and evenly distribute the data to the storage cluster. Finally, data replicas are maintained through an asynchronous replication mechanism. Optionally, the system can also implement intelligent storage optimization by analyzing data access patterns, automatically adjusting the storage levels of hot and cold data, and optimizing storage resource utilization. It is understandable that other storage management mechanisms can also be used, which are not limited here.

[0118] S213: Receive multiple report data packets to be imported, and establish an initial task queue including multiple import tasks.

[0119] The submitted data packet represents a collection of data files to be processed; the initial task queue refers to a list of tasks to be processed generated by the system based on the submitted data packet.

[0120] This step is executed after receiving a data submission request from the institution. Specifically, the system parses the metadata of the submitted data packet, including data type, file size, and submission time. Based on this information, a task object is created, and its initial priority and expected execution time are set. The system uses a queue data structure to maintain the task list, ensuring orderly task processing.

[0121] In some embodiments, the construction and management of task queues can be achieved in a variety of ways: the network reporting system uses a priority queue to store tasks, and the task priority is determined by a combination of factors such as data timeliness, business importance, and resource consumption. A read-write lock mechanism is used to protect queue operations, and dynamic insertion and adjustment of tasks are achieved. The system supports breakpoint resumption and retry of tasks. Optionally, the system can also use a workflow engine to manage the task execution process, control the life cycle of tasks through a state machine, and provide flexible task scheduling capabilities. It is understandable that other task management mechanisms can also be used, which are not limited here.

[0122] S214. According to the timeliness and data volume of the reported data packets, the priority of the imported tasks corresponding to the reported data packets in the initial task queue is modified to obtain an optimized task queue.

[0123] Among them, timeliness refers to the urgency and processing period of the reported data; data volume refers to the storage capacity of the reported data packet; priority correction refers to the adjustment of the task execution order based on multi-dimensional indicators; optimized task queue refers to the task execution sequence after priority rearrangement.

[0124] This step is performed after the initial task queue is established. Specifically, the network submission system first calculates each task's base priority score: P = w1 x T + w2 x S, where T is the timeliness score, S is the data volume score, and w1 and w2 are weight coefficients. Priorities are then adjusted based on business rules (such as EAST / JRJC submission time requirements), and the task queue is reorganized using a heap sort algorithm. The system dynamically monitors the queue status and adaptively adjusts the task scheduling strategy based on system load.

[0125] For the heap sort algorithm, the system uses a max-heap data structure to prioritize tasks. First, a complete binary tree is constructed, with each node storing a task object and its priority score. The heap sorting process begins at the last non-leaf node and recursively compares the priority scores of its parent and child nodes to ensure that the parent node's priority always exceeds that of its child nodes. When the task order needs to be adjusted, the target task's priority score is updated, and then a float-up or float-down operation is performed starting at that node, maintaining the heap nature. The left child of node k has an index of 2k+1, the right child has an index of 2k+2, and the parent has an index of (k-1) / 2. This method allows the system to adjust the priority of individual tasks within O(logn) time complexity and ensures that the highest-priority task is always at the top of the heap, facilitating quick access to the next pending task. For example, when an urgent report arrives, the system assigns it the highest priority and inserts it into the heap. This task quickly reaches the top of the heap through the float-up operation, allowing it to be processed first.

[0126] In some embodiments, dynamic adjustment of task priorities can be achieved in a variety of ways: the system uses a multi-level feedback queue algorithm to dynamically adjust priorities based on the task's execution history and resource consumption. A machine learning model is used to predict task execution times and optimize the scheduling order of tasks. The system implements automatic analysis of task dependencies and a priority propagation mechanism. Optionally, the system can also use a heuristic algorithm to solve the constrained optimization problem of task scheduling, maximizing system throughput while meeting deadline constraints. It is understandable that other task scheduling algorithms can also be used, which are not limited here.

[0127] S215: Execute data import based on the optimized task queue and generate an import progress report.

[0128] Among them, data import refers to the process of writing reported data into the system database; the import progress report refers to the statistical information reflecting the execution status of the current import task. The import progress report includes the number of completed tasks, the number of remaining tasks and the estimated completion time.

[0129] This step is performed after the optimization task queue is generated. Specifically, the network reporting system processes import tasks one by one in the queue order, launching a separate worker thread for each task. The system maintains real-time statistics on the number of completed tasks and processing speed, and uses a linear regression model to predict the completion time of remaining tasks. It also monitors database performance indicators and dynamically adjusts the number of concurrent import tasks to avoid system overload.

[0130] The estimated task completion time is predicted based on a time prediction model. This model uses a linear regression algorithm and is constructed by analyzing historical task processing records. The system collects historical task data and corresponding processing times as training samples, constructing a data matrix X containing n sample points and a processing time vector y. The least squares method is used to solve the normal equation (X'X)β=X'y, resulting in the regression coefficient β=(X'X)^(-1)X'y, where β0 represents the base processing time (intercept) and β1 represents the incremental processing time per unit data volume (slope). The time prediction model evaluates its fit by calculating the coefficient of determination R²=1-∑(yi-ŷi)² / ∑(yi-ȳ)². Model retraining is triggered when R² falls below a preset threshold (e.g., 0.8). In practice, by inputting the data volume x of a new task, the time prediction model calculates the expected processing time based on the prediction equation y=β0+β1x. This calculation is then adjusted based on the current system CPU utilization. For example, when the system load reaches 80%, the predicted time will increase by 25%.

[0131] In some embodiments, the network reporting system receives an addition request containing a new temporary task sent by the management terminal, determines the task type and urgency of the new temporary task; calculates the task priority of the new temporary task based on the urgency, and determines the insertion position of the new temporary task in the optimized task queue; inserts the new temporary task into the insertion position, updates the optimized task queue; and pushes the new temporary task notification to the institution end corresponding to the optimized task queue.

[0132] Among them, temporary tasks refer to additional work items that need to be inserted into the existing task queue; add request refers to the task creation application initiated by the management terminal; urgency refers to the time requirement for task processing; new temporary task notification refers to the task arrival reminder pushed to the institution end.

[0133] This section is executed upon receiving a temporary task addition request from a management terminal. Specifically, the network reporting system parses the task description in the request, identifying the task type and time limit. The system calculates a composite priority score based on the urgency value (e.g., urgent, expedited, normal) combined with the business weight. The system traverses the current task queue, locates the position with the closest priority score using a binary search algorithm, and inserts the new task into that position. The system updates the execution time estimate for affected tasks in the queue and notifies relevant agencies in real time via a push notification mechanism.

[0134] When the network reporting system applies a binary search to its optimized task queue, it first sorts the task queue by priority score, forming an ordered array. The left pointer (left) is set to point to position 0 at the beginning of the array, and the right pointer (right) to point to position n-1 at the end. In each iteration, the midpoint (mid) is calculated as (left + right) / 2, and the priority score of the new task is compared with the priority score of the task at position mid. If the new task has a higher priority, the search range is narrowed to the left half, and right is updated to mid - 1. If the new task has a lower priority, the search range is narrowed to the right half, and left is updated to mid + 1. This process is repeated until left > right, at which point the new task is inserted at position left. For example, a temporary task with a priority score of 75 needs to be inserted into the priority sequence [90, 80, 70, 60, 50]. A binary search determines that it should be inserted at index 2, before 70. The algorithm has a time complexity of O(logn), where n is the queue length.

[0135] In some embodiments, temporary task management can be implemented in a variety of ways: The network submission system uses a dynamic task scheduling mechanism to handle temporary task insertion. The system first constructs a task dependency graph and analyzes the relationships between the new task and existing tasks. It then uses a heuristic algorithm to calculate the optimal insertion position. This algorithm comprehensively considers factors such as task urgency, resource usage, and dependency constraints, and minimizes the impact on existing tasks through iterative optimization. Finally, the system adjusts the execution plan of affected tasks in real time, triggering task queue reordering when necessary. The entire process utilizes a transaction mechanism to ensure queue state consistency.

[0136] When a new task is inserted, there is a conflict in the execution order between it and existing tasks. For example, a newly inserted task A cannot be executed until task B is completed, but task B depends on the output of task A, which creates a circular dependency. Or, a temporary task must be completed before the submission deadline, but other tasks it depends on may not be completed before the deadline.

[0137] The network reporting system handles dependency conflicts by constructing a task dependency graph and performing topological analysis. Specifically, it first uses an adjacency matrix to represent the dependencies between tasks, with matrix elements aij indicating whether task i depends on task j. When a new task is inserted, the system calculates the strength of its dependencies with existing tasks and updates the adjacency matrix. The system uses the Tarjan algorithm to detect loops in the dependency graph, indicating a circular dependency. For detected dependency conflicts, the system calculates the critical path length and time slack for each affected task and, based on task priorities and deadline constraints, uses a dynamic programming algorithm to reschedule the tasks. For example, when a temporary task that needs to be completed before the reporting deadline depends on other ongoing tasks, the system calculates whether there is a feasible scheduling solution that meets all time constraints. If no feasible solution can be found, the system triggers the task priority negotiation mechanism, notifying the management terminal to adjust task parameters or handling strategies. The time complexity of the entire conflict resolution process is O(V + E), where V is the number of tasks and E is the number of dependencies.

[0138] In the embodiment of the present application, due to the adoption of a dynamic resource scheduling strategy, it is possible to achieve precise positioning and dynamic optimization of temporary tasks. The system calculates the task priority score through a multi-dimensional priority evaluation model, combines task dependency graph analysis to ensure the rationality of the execution order, and uses a prediction model trained with historical data to evaluate resource requirements. This effectively solves the problems of inflexible temporary task processing, frequent task conflicts, and unreasonable resource allocation in traditional reporting systems, thereby realizing intelligent scheduling, optimal resource utilization, and stable and reliable operation of the reporting system, improving overall reporting efficiency and system availability.

[0139] The network reporting system in the embodiment of the present invention is described below from the perspective of hardware processing. Figure 3 , which is a schematic diagram of the physical device structure of the network reporting system in an embodiment of the present application.

[0140] It should be noted that Figure 3 The structure of the network reporting system shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0141] like Figure 3 As shown, the network reporting system includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes, such as the methods described in the above embodiments, based on programs stored in a read-only memory (ROM) 302 or programs loaded from a storage unit 308 into a random access memory (RAM) 303. RAM 303 also stores various programs and data required for system operation. CPU 301, ROM 302, and RAM 303 are interconnected via a bus 304. An input / output (I / O) interface 305 is also connected to bus 304.

[0142] The following components are connected to the I / O interface 305: an input section 306 including an audio input device, push button switches, and the like; an output section 307 including a liquid crystal display (LCD), an audio output device, indicator lights, and the like; a storage section 308 including a hard disk and the like; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card or a modem. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. Removable media 311, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 310 as needed, so that computer programs read from the removable media can be installed in the storage section 308 as needed.

[0143] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for executing the methods illustrated in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication section 309 and / or installed from removable media 311. When executed by the central processing unit (CPU) 301, the computer program performs the various functions defined in the present invention.

[0144] It should be noted that specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0145] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. Each box in the flowchart or block diagram can represent a module, program segment, or part of the code, and the above-mentioned module, program segment, or part of the code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings.

[0146] Specifically, the network reporting system of this embodiment includes a processor and a memory. The memory stores a computer program. When the computer program is executed by the processor, the UKEY-based network reporting method provided in the above embodiment is implemented.

[0147] As another aspect, the present invention further provides a computer-readable storage medium, which may be included in the network reporting system described in the above embodiments, or may exist independently without being incorporated into the network reporting system. The above storage medium carries one or more computer programs, and when the one or more computer programs are executed by a processor of the network reporting system, the network reporting system implements the UKEY-based network reporting method provided in the above embodiments.

[0148] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0149] As used in the above embodiments, the term “when” may be interpreted to mean “if” or “after” or “in response to determining that” or “in response to detecting that”, depending on the context. Similarly, the phrases “upon determining that” or “if (stated condition or event) is detected” may be interpreted to mean “if determining that” or “in response to determining that” or “upon detecting (stated condition or event)” or “in response to detecting (stated condition or event)”, depending on the context.

[0150] Those skilled in the art will appreciate that all or part of the process steps in the above-described method embodiments can be implemented by a computer program instructing the relevant hardware. The program can be stored in a computer-readable storage medium, and when executed, the program can include the process steps in the above-described method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A network reporting method based on UKEY, characterized in that: Applied to a network reporting system, the method includes: Receive the login authentication request sent by the institution based on UKEY, which includes the institution number and fingerprint data; After verifying that the fingerprint data matches the pre-stored fingerprint to a degree greater than a preset matching threshold, generating authentication information including the institution number and a current timestamp; Generate a session identifier based on the authentication information and a preset private field, and integrate the session identifier, the organization number, and the current timestamp to generate key negotiation reference data; Encrypting the key agreement reference data using the SM2 algorithm to obtain first encrypted data; The receiving institution returns the second encrypted data in response to the first encrypted data, and generates a symmetric encryption key based on the first encrypted data and the second encrypted data; receiving an encrypted data packet encrypted by the institution end using the symmetric encryption key, and decrypting the encrypted data packet using the symmetric encryption key to obtain reporting data; After confirming the validity of the reported data based on the session identifier, the reported data is stored in a preset database and storage confirmation information is returned to the institution end; the step of confirming the validity of the reported data based on the session identifier includes: verifying the legitimacy of the data source of the reported data and the validity of the timestamp based on the session identifier.

2. The method according to claim 1, characterized in that Before the step of receiving the login authentication request including the institution number and fingerprint data sent by the institution based on UKEY, the method further includes: Receive registration requests from multiple registration servers and perform identity authentication to determine multiple supervisory servers; Assigning a unique identification code to each of the supervisory end servers and establishing a general communication link between the master control server and the multiple supervisory end servers; Receiving heartbeat packet information containing load data sent by the multiple supervisory end servers, and calculating a comprehensive load score of the supervisory end server according to the load data; The step of generating authentication information including the organization number and the current timestamp after verifying that the matching degree between the fingerprint data and the pre-stored fingerprint is higher than a preset matching threshold specifically includes: After verifying that the matching degree between the fingerprint data and the pre-stored fingerprint is higher than a preset matching threshold, screening out the target server with the lowest comprehensive load score and allocating the target server to the institution end; Generate a matching relationship table containing the corresponding relationship between the target server and the institution end; Generate authentication information including the device identification of the target server, the organization number and the current timestamp.

3. The method according to claim 2, characterized in that After the step of generating a matching relationship table including the corresponding relationship between the target server and the institution end, the method further includes: Sending a service allocation instruction including the access information of the institution end to the target server; After receiving the service readiness confirmation information returned by the target server, establishing a direct communication link between the target server and the institution end; Determine the reporting period of the institution end, and count down the binding connection of the communication direct link based on the reporting period.

4. The method according to claim 2, characterized in that After the step of generating a matching relationship table including the corresponding relationship between the target server and the institution end, the method further includes: Receiving a file-sensitive operation request uploaded by an instruction server, and determining a corresponding file to be operated and an operation type; the instruction server is one of the multiple supervisory end servers; After verifying the file-sensitive operation request based on the user operation, sending the file operation instruction to the instruction server through the communication link; Receive the operation execution result returned by the instruction server, and store the file operation record of the instruction server.

5. The method according to claim 1, wherein After confirming the validity of the submitted data according to the session identifier, the step of storing the submitted data in a preset database and returning storage confirmation information to the institution side specifically includes: Verify the timeliness and authorization scope of the session identifier to obtain a session verification result; When the session verification result is a preset result, parsing the data structure of the reported data and determining the storage location of the reported data; The reported data is stored in the storage location, a storage record including the storage location and storage time is generated, and storage confirmation information is returned to the institution end.

6. The method according to claim 1, characterized in that After confirming the validity of the submitted data according to the session identifier, storing the submitted data in a preset database, and returning storage confirmation information to the institution, the method further includes: Receive multiple report data packets to be imported and establish an initial task queue containing multiple import tasks; According to the timeliness and data volume of the reported data packets, priority correction is performed on the import tasks corresponding to the reported data packets in the initial task queue to obtain an optimized task queue; Data import is performed based on the optimized task queue, and an import progress report is generated; the import progress report includes the number of completed tasks, the number of remaining tasks and the estimated completion time.

7. The method according to claim 6, characterized in that After the step of executing data import based on the optimized task queue and generating an import progress report, the method further includes: Receive an add request including a newly added temporary task from a management terminal, and determine a task type and urgency of the newly added temporary task; Calculating the task priority of the newly added temporary task based on the urgency, and determining the insertion position of the newly added temporary task in the optimized task queue; Inserting the newly added temporary task into the insertion position and updating the optimized task queue; Push a new temporary task notification to the institution end corresponding to the optimization task queue.

8. A network reporting system, characterized in that: The network reporting system includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to enable the network reporting system to execute the method as described in any one of claims 1-7.

9. A computer-readable storage medium comprising instructions, characterized in that: When the instruction is executed on the network reporting system, the network reporting system is caused to execute the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that When the computer program product is run on a network reporting system, the network reporting system is enabled to execute the method according to any one of claims 1 to 7.

Images