Cross-domain fusion type data transmission and storage method and electronic equipment

Abstract

The embodiment of the invention discloses a cross-domain fusion type data transmission and storage method and electronic equipment. A specific embodiment of the method comprises the following steps: a server requests a dynamic transmission key pair from a trusted cipher card through a data transmission module; the client generates an asymmetric key pair; the server side responds to the received data transmission public key and the dynamic transmission public key, and verifies the dynamic transmission public key according to a local dynamic transmission key pair; in response to determining that the verification result of the dynamic transmission public key represents that verification is passed, generating data transmittable information, and encrypting the data transmittable information according to the data transmission public key; the client decrypts the encrypted data transmittable information in response to the received encrypted data transmittable information sent by the server; and the client performs encryption processing on the to-be-stored data according to a private key in the local asymmetric key pair in response to determining that the decryption transmission information represents transmissible information. According to the embodiment, the security of data transmission between the data ends is improved.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the computer field, and in particular to a cross-domain integrated data transmission and storage method and an electronic device. Background Art

[0002] At present, when sensitive data (internal confidential files) are transmitted between two data terminals, the method usually adopted is: encrypt the data before transmitting the information to improve data security. However, this data transmission method usually has the following technical problems: whether data transmission can be carried out is not authenticated, and the encryption method is relatively simple, which is easy to cause data leakage.

[0003] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the invention

[0004] The content of this disclosure is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this disclosure is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0005] Some embodiments of the present disclosure propose a cross-domain integrated data transmission and storage method, an electronic device, and a computer-readable medium to solve one or more of the technical problems mentioned in the above background technology section.

[0006] In a first aspect, some embodiments of the present disclosure provide a cross-domain converged data transmission and storage method, which is applied to a cross-domain converged data transmission and storage system. The cross-domain converged data transmission and storage system includes: a server and a client. The method includes: the client initiates a transmission channel establishment request to the server to establish a data transmission channel; the server requests a dynamic transmission key pair from a trusted password card through a data transmission module, and sends the dynamic transmission public key in the dynamic transmission key pair to the client through the data transmission channel; the client generates an asymmetric key pair according to a client identifier in response to receiving the dynamic transmission public key sent by the server, and sends the data transmission public key in the asymmetric key pair and the received dynamic transmission public key to the server; the server receives the data transmission public key and the dynamic transmission public key, and generates an asymmetric key pair according to a client identifier. The dynamic transmission public key is verified according to the local dynamic transmission key pair to obtain the dynamic transmission public key verification result; the server generates data transmittable information in response to determining that the dynamic transmission public key verification result indicates that the verification is passed, and encrypts the data transmittable information according to the data transmission public key to obtain encrypted data transmittable information, and sends the encrypted data transmittable information to the client; the client decrypts the encrypted data transmittable information according to the local asymmetric key pair to obtain decrypted transmission information in response to receiving the encrypted data transmittable information sent by the server; the client encrypts the data transmittable information according to the private key in the local asymmetric key pair to obtain decrypted transmission information in response to determining that the decrypted transmission information indicates transmittable information, and encrypts the data to be stored according to the private key in the local asymmetric key pair to obtain encrypted storage data, and sends the encrypted storage data to the server.

[0007] In a second aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner of the above-mentioned first aspect.

[0008] In a third aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation manner of the first aspect is implemented.

[0009] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: through the cross-domain integrated data transmission and storage method of some embodiments of the present disclosure, the security of data transmission between data terminals is improved. First, the client initiates a transmission channel establishment request to the above-mentioned server to establish a data transmission channel. Thus, it is convenient to establish a data communication channel to avoid data transmission failure. Secondly, the above-mentioned server requests a dynamic transmission key pair from the trusted password card through the data transmission module, and sends the dynamic transmission public key in the above-mentioned dynamic transmission key pair to the above-mentioned client through the above-mentioned data transmission channel. Thus, it is convenient to establish communication security confirmation with the client through the dynamic transmission key pair. Then, in response to receiving the dynamic transmission public key sent by the server, the above-mentioned client generates an asymmetric key pair according to the client identifier, and sends the data transmission public key in the above-mentioned asymmetric key pair and the received dynamic transmission public key to the above-mentioned server. Again, in response to receiving the data transmission public key and the dynamic transmission public key, the above-mentioned server verifies the dynamic transmission public key according to the local dynamic transmission key pair to obtain the dynamic transmission public key verification result. Thus, the interactive public key can be verified to determine whether the client receives data normally. Afterwards, the server generates data transmittable information in response to determining that the above-mentioned dynamic transmission public key verification result represents that the verification has passed, and encrypts the above-mentioned data transmittable information according to the above-mentioned data transmission public key to obtain encrypted data transmittable information, and sends the above-mentioned encrypted data transmittable information to the above-mentioned client. In this way, the client can be informed that data transmission can be performed, and data encryption is performed according to the key generated by the server. Then, in response to receiving the encrypted data transmittable information sent by the server, the client decrypts the above-mentioned encrypted data transmittable information according to the local asymmetric key pair to obtain decrypted transmission information. Finally, in response to determining that the above-mentioned decrypted transmission information represents transmittable information, the client encrypts the data to be stored according to the private key in the local asymmetric key pair to obtain encrypted storage data, and sends the encrypted storage data to the server. Here, since the key is generated by the server, the private key is on the server, and the client is not aware of it, even if the client causes data leakage during the transmission process, it is difficult to crack the leaked encrypted data without the private key. Therefore, the security of data transmission between data terminals is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0011] Figure 1 is a flowchart of some embodiments of the cross-domain integrated data transmission and storage method according to the present disclosure;

[0012] Figure 2 It is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0013] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0014] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0015] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0016] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0017] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0018] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0019] Figure 1 The present invention is a flowchart of some embodiments of the cross-domain fusion data transmission and storage method according to the present invention. The process 100 of some embodiments of the cross-domain fusion data transmission and storage method according to the present invention is shown. The cross-domain fusion data transmission and storage method is applied to a cross-domain fusion data transmission and storage system. The cross-domain fusion data transmission and storage system includes: a server and a client, including the following steps:

[0020] Step 101: The client initiates a transmission channel establishment request to the server to establish a data transmission channel.

[0021] In some embodiments, the client initiates a transmission channel establishment request to the above-mentioned server to establish a data transmission channel. That is, the client may be a VPN-C client. The server may be a VPN-S server. The transmission channel establishment request may be a request to establish a VPN channel. The data transmission channel may be a VPN channel. Here, there is no specific limitation on the method of establishing the VPN channel.

[0022] Step 102: the server requests a dynamic transmission key pair from the trusted password card through the data transmission module, and sends the dynamic transmission public key in the dynamic transmission key pair to the client through the data transmission channel.

[0023] In some embodiments, the above-mentioned server requests a dynamic transmission key pair from a trusted password card through a data transmission module, and sends the dynamic transmission public key in the above-mentioned dynamic transmission key pair to the above-mentioned client through the above-mentioned data transmission channel. The trusted password card may refer to a TCM card, which is a security chip that can effectively protect the PC and prevent illegal users from accessing the computer. That is, the trusted password card is set in the server. The data transmission module is an Internet of Things wireless data terminal set in the server, which is specially used to convert serial port data into IP data or convert IP data into serial port data, and transmit it through a wireless communication network. The dynamic transmission key pair may be a key pair generated by a trusted password card for transmitting information. The dynamic transmission key pair may include a private key and a public key.

[0024] Step 103, in response to receiving the dynamic transmission public key sent by the server, the client generates an asymmetric key pair according to the client identifier, and sends the data transmission public key in the asymmetric key pair and the received dynamic transmission public key to the server.

[0025] In some embodiments, the client generates an asymmetric key pair in response to receiving a dynamic transmission public key sent by the server according to the client identifier, and sends the data transmission public key in the asymmetric key pair and the received dynamic transmission public key to the server. The client identifier may refer to the identifier of the client. An asymmetric key pair with the client identifier as characters may be generated by a key generation algorithm (RSA, ECC). For example, the client characters may be converted into Roman numerals (encoded as Roman numerals), and then the Roman data may be keyed by a key generation algorithm. The asymmetric key pair includes: a data transmission public key and a private key.

[0026] Step 104, in response to receiving the data transmission public key and the dynamic transmission public key, the server verifies the dynamic transmission public key according to the local dynamic transmission key pair to obtain a dynamic transmission public key verification result.

[0027] In some embodiments, in response to receiving the data transmission public key and the dynamic transmission public key, the server verifies the dynamic transmission public key according to the local dynamic transmission key pair to obtain a dynamic transmission public key verification result. That is, it can be verified whether the dynamic transmission public key is the public key in the dynamic transmission key pair. If they are consistent, a dynamic transmission public key verification result indicating that the verification has passed is generated; if they are inconsistent, a dynamic transmission public key verification result indicating that the verification has not passed is generated.

[0028] Step 105, the server generates data transmittable information in response to determining that the dynamic transmission public key verification result indicates that the verification has passed, and encrypts the data transmittable information according to the data transmission public key to obtain encrypted data transmittable information, and sends the encrypted data transmittable information to the client.

[0029] In some embodiments, the server generates data transmittable information in response to determining that the dynamic transmission public key verification result indicates that the verification is passed, and encrypts the data transmittable information according to the data transmission public key to obtain encrypted data transmittable information, and sends the encrypted data transmittable information to the client. The data transmittable information indicates that the client can transmit information. The encryption method can be encryption using encryption algorithms such as DES, 3DES, and AES.

[0030] Step 106: In response to receiving the encrypted data transmittable information sent by the server, the client decrypts the encrypted data transmittable information according to a local asymmetric key pair to obtain decrypted transmission information.

[0031] In some embodiments, in response to receiving the encrypted data transmittable information sent by the server, the client decrypts the encrypted data transmittable information according to the local asymmetric key pair to obtain decrypted transmission information. That is, the encrypted data transmittable information is decrypted using the private key in the asymmetric key pair.

[0032] Step 107, in response to determining that the decrypted transmission information represents transmittable information, the client encrypts the data to be stored according to the private key in the local asymmetric key pair to obtain encrypted storage data, and sends the encrypted storage data to the server.

[0033] In some embodiments, in response to determining that the decrypted transmission information represents transmittable information, the client encrypts the data to be stored according to the private key in the local asymmetric key pair to obtain encrypted storage data, and sends the encrypted storage data to the server. For example, according to the private key in the local asymmetric key pair, the data to be stored is encrypted by the RSA encryption algorithm to obtain encrypted storage data.

[0034] Optionally, the client applies for a transmission key from a data transmission module of the server.

[0035] Optionally, the trusted cryptographic card transmits the public key to the server and the private key to the client.

[0036] Optionally, the server formats and encapsulates the transmitted data, including: encrypting each data with a public key and dynamically placing it into different data bins, updating a dynamic mapping table of the stored bins, and transmitting the encapsulated result carrier to the client.

[0037] Optionally, after receiving the data, the client performs a data integrity check. If the data is incomplete, the server is notified to resend the data. If the data is complete, the client decrypts the received data using a private key and transmits the decrypted data to the data access control module.

[0038] Optionally, when the data access control module receives the data write instruction, it reads the data storage public key stored in the data access public key interface of the trusted password card with the target identifier, encrypts the data, and writes it into the database. The target identifier may refer to the legal person ID (client identifier).

[0039] Optionally, when the data access control module receives a data read instruction, it first reads data from the database according to the read condition, reads a private key from the trusted password card with the target identifier, decrypts the data, and then provides the data to the server.

[0040] Optionally, in response to receiving the encrypted storage data sent by the client, the server decrypts the encrypted storage data according to the corresponding data transmission public key to obtain the decrypted storage data.

[0041] In some embodiments, in response to receiving the encrypted storage data sent by the client, the server decrypts the encrypted storage data according to the corresponding data transmission public key to obtain the decrypted storage data. The data transmission public key may be the data transmission public key previously sent by the client.

[0042] Optionally, the server determines whether there is a storage node corresponding to the client in the local storage node cluster, and in response to determining that there is no storage node corresponding to the client in the storage node cluster, constructs a storage node corresponding to the client as a target storage node.

[0043] In some embodiments, the server determines whether there is a storage node corresponding to the client in the local storage node cluster, and in response to determining that there is no storage node corresponding to the client in the storage node cluster, constructs a storage node corresponding to the client as a target storage node. One storage node corresponds to one client. The storage node can be a Data Node. That is, if there is no storage node corresponding to the client, the server creates a new storage node in the storage node cluster with the client identifier of the client as the identifier.

[0044] Optionally, the server constructs an encryption key according to the storage node identifier corresponding to the target storage node and the current timestamp, encrypts the decrypted storage data according to the encryption key, and stores the encrypted storage data in the target storage node.

[0045] In some embodiments, the server constructs an encryption key based on the storage node identifier and current timestamp corresponding to the target storage node, and encrypts the decrypted storage data based on the encryption key, and stores the encrypted storage data in the target storage node. That is, the storage node identifier and the current timestamp can be converted into a Roman numeral string, and then the Roman numeral string can be converted into an encryption key through a key generation algorithm. The decrypted storage data can be encrypted through an RSA encryption algorithm.

[0046] Here, after receiving the data sent by the client, the server regenerates the encryption key to encrypt and store the data. Thus, encryption is performed through multiple encryptions and continuous updating of the encryption key, which greatly improves the security of data storage.

[0047] Optionally, in response to determining that there is a storage node corresponding to the client in the storage node cluster, the server constructs an encryption key based on the node identifier and current timestamp of the storage node corresponding to the client, and encrypts the decrypted storage data based on the encryption key, and stores the encrypted storage data in the storage node.

[0048] In some embodiments, the server, in response to determining that there is a storage node corresponding to the client in the storage node cluster, constructs an encryption key based on the node identifier and current timestamp of the storage node corresponding to the client, and encrypts the decrypted storage data based on the encryption key, and stores the encrypted storage data in the storage node.

[0049] Optionally, in response to receiving a sharing instruction corresponding to the target general information, the client sends transmission mode confirmation information for the target general information to the server.

[0050] In some embodiments, the client sends transmission mode confirmation information for the target general information to the server in response to receiving a sharing instruction corresponding to the target general information. The sharing instruction may refer to an instruction for synchronizing the target general information input by a technician to the server. The target general information may be shared data of ordinary data changes (e.g., personnel table changes, address change information). The transmission mode confirmation information may refer to the confirmation information of the transmission mode of the target general information.

[0051] Optionally, the server determines a transmission state corresponding to the target general transmission mode in response to receiving transmission mode confirmation information for the target general information sent by the client.

[0052] In some embodiments, the server determines the transmission state corresponding to the target general transmission mode in response to receiving the transmission mode confirmation information for the target general information sent by the client. The transmission state may be a state indicating whether encryption is required to transmit the target general information.

[0053] Optionally, the server generates transmission mode feedback information in response to the transmission state characterizing the non-encrypted transmission, and sends the transmission mode feedback information to the client.

[0054] In some embodiments, the server generates transmission mode feedback information in response to the transmission state indicating non-encrypted transmission, and sends the transmission mode feedback information to the client, wherein the transmission mode feedback information indicates that non-encrypted transmission of target general information is supported.

[0055] Optionally, the client sends the target general information to the sending server in response to determining that the transmission mode feedback information sent by the server indicates non-encrypted transmission.

[0056] In some embodiments, the client sends the target general information to the sending server in response to determining that the transmission mode feedback information sent by the server indicates non-encrypted transmission.

[0057] Optionally, in response to receiving the data query information sent by the client, the server parses the data query information to obtain the data query field set.

[0058] In some embodiments, the server, in response to receiving the data query information sent by the client, parses the data query field set from the data query information. The data query information may represent query information for querying a certain data. The data query field may be a field corresponding to the key query data in the data query information. For example, the data query field set may include: a location data query field, a table data query field.

[0059] Optionally, the server adjusts the field format of the data query field in the data query field set according to the database field set corresponding to the target storage node to generate a data adjustment query field set.

[0060] In some embodiments, the server adjusts the field format of the data query field in the data query field set according to the database field set corresponding to the target storage node to generate a data adjustment query field set. The database field may be a field described for the target storage node. For example, the database field may be a table field of each table in the target storage node, or may be a data feature field of a key data set stored in the target storage node. The target storage node may represent the storage node corresponding to the client.

[0061] In practice, the server may adjust the field format of the data query field in the data query field set by following the steps below to generate a data adjustment query field set:

[0062] The first step is to divide the above data query field set into a non-character query field set and a character data query field set.

[0063] In the second step, for each non-character query field in the non-character query field set, perform the adjustment step:

[0064] 1. Determine whether there is a database field corresponding to the non-character query field in the database field set. Determine whether there is a database field corresponding to the non-character query field in the database field set using a keyword matching algorithm. The keyword matching algorithm may be an AC (Aho-Corasick automaton).

[0065] 2. In response to determining that there is no such field, determine the field similarity between each database field in the database field set and the non-character query field to obtain a field similarity set. For example, the field similarity between each database field in the database field set and the non-character query field can be determined by a cosine similarity or Euclidean distance similarity algorithm to obtain a field similarity set.

[0066] 3. Determine the field similarities in the field similarity set that meet the preset similarity condition as candidate field similarities. The preset similarity condition may be that the field similarity is the highest and the field similarity is greater than a predetermined similarity.

[0067] 4. Determine the database field corresponding to the candidate field similarity as the candidate database field.

[0068] 5. According to the candidate database field, the non-character query field is adjusted to obtain a non-character adjusted query field. The non-character query field can be replaced with the candidate database field to obtain a non-character adjusted query field.

[0069] In the third step, each non-character adjustment query field and the above character data query field set are determined as a data adjustment query field set.

[0070] Optionally, the server inputs the query correction field set into a pre-trained database statement conversion model to obtain a database statement.

[0071] In some embodiments, the server inputs the query correction field set into a pre-trained database statement conversion model to obtain a database statement. The database statement conversion model may be a pre-trained large neural network model that generates corresponding database statements based on the query correction field set. For example, the database statement conversion model may be a language model (Large Language Model, LLM).

[0072] Optionally, the server executes the database statement to read the query information from the target storage node, and encrypts the query information and sends it to the client.

[0073] In some embodiments, the server executes the database statement to read the query information from the target storage node, and encrypts the query information and sends it to the client, wherein the query information may be the query content corresponding to the data query information.

[0074] In practice, the server can read the query information from the target storage node through the following steps:

[0075] The first step is to execute the above database statement to generate statement execution results.

[0076] In the second step, in response to determining that the above statement execution result indicates that the statement execution failed, the processing steps are executed:

[0077] 1. Extract data query fields from the above database statements to generate a statement extraction field set.

[0078] 2. According to the database field set, the statement extraction fields in the statement extraction field set are adjusted to obtain a statement adjustment field set, wherein the statement adjustment field can be a field that is adjusted for the statement extraction field and matches the database field.

[0079] 3. Generate a database adjustment statement corresponding to the statement adjustment field set. The statement adjustment fields in the statement adjustment field set may be combined to generate a database adjustment statement.

[0080] 4. Execute the above database adjustment statement to generate an adjustment statement execution result, wherein the adjustment statement execution result can indicate whether the database adjustment statement fails to execute.

[0081] 5. In response to determining that the execution result of the adjustment statement indicates that the execution has not failed, query information corresponding to the execution result of the adjustment statement is obtained.

[0082] In the third step, in response to determining that the above adjustment statement execution result fails, the adjustment statement execution result is used as the statement execution result, and the database adjustment statement is used as the database statement, and the above processing steps are executed again.

[0083] This improves the accuracy of database statement generation and ensures the efficiency and accuracy of query information. When it is determined that the statement execution result indicates that the statement execution has failed, the database field set is used to adjust the fields of each data query to generate a more accurate query statement, further improving the accuracy of information query.

[0084] Reference below Figure 2 , which shows a schematic diagram of the structure of an electronic device 200 (e.g., a computing device) suitable for implementing some embodiments of the present disclosure. The electronic devices in some embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 2 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0085] like Figure 2 As shown, the electronic device 200 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 201, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 202 or a program loaded from a storage device 208 to a random access memory (RAM) 203. In the RAM 203, various programs and data required for the operation of the electronic device 200 are also stored. The processing device 201, the ROM 202, and the RAM 203 are connected to each other via a bus 204. An input / output (I / O) interface 205 is also connected to the bus 204.

[0086] Typically, the following devices may be connected to the I / O interface 205: an input device 206 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 207 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 208 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 209. The communication device 209 may allow the electronic device 200 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 2 The electronic device 200 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 2 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0087] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 209, or installed from the storage device 208, or installed from the ROM 202. When the computer program is executed by the processing device 201, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.

[0088] It should be noted that the computer-readable medium recorded in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In some embodiments of the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0089] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0090] The above-mentioned computer-readable medium may be included in the above-mentioned electronic device; or it may exist independently without being installed in the electronic device. The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: the client initiates a transmission channel establishment request to the above-mentioned server to establish a data transmission channel; the above-mentioned server requests a dynamic transmission key pair from the trusted password card through the data transmission module, and sends the dynamic transmission public key in the above-mentioned dynamic transmission key pair to the above-mentioned client through the above-mentioned data transmission channel; the above-mentioned client generates an asymmetric key pair according to the client identifier in response to receiving the dynamic transmission public key sent by the server, and sends the data transmission public key in the above-mentioned asymmetric key pair and the received dynamic transmission public key to the above-mentioned server; the above-mentioned server responds to receiving the data transmission public key and the dynamic transmission public key, and according to the local dynamic transmission key pair, generates an asymmetric key pair for the dynamic transmission public key. The public key is input for verification to obtain a dynamic transmission public key verification result; the server generates data transmittable information in response to determining that the dynamic transmission public key verification result indicates that the verification is passed, and encrypts the data transmittable information according to the data transmission public key to obtain encrypted data transmittable information, and sends the encrypted data transmittable information to the client; the client decrypts the encrypted data transmittable information according to the local asymmetric key pair to obtain decrypted transmission information in response to receiving the encrypted data transmittable information sent by the server; the client encrypts the data to be stored according to the private key in the local asymmetric key pair in response to determining that the decrypted transmission information indicates transmittable information, obtains encrypted storage data, and sends the encrypted storage data to the server.

[0091] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0092] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0093] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0094] The above descriptions are only some preferred embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) and the technical solutions formed.

Claims

1. A cross-domain fusion data transmission and storage method, applied to a cross-domain fusion data transmission and storage system, the cross-domain fusion data transmission and storage system comprising: The server and the client, the method comprises: The client initiates a transmission channel establishment request to the server to establish a data transmission channel; The server requests a dynamic transmission key pair from the trusted password card through the data transmission module, and sends the dynamic transmission public key in the dynamic transmission key pair to the client through the data transmission channel; In response to receiving the dynamic transmission public key sent by the server, the client generates an asymmetric key pair according to the client identifier, and sends the data transmission public key in the asymmetric key pair and the received dynamic transmission public key to the server; In response to receiving the data transmission public key and the dynamic transmission public key, the server verifies the dynamic transmission public key according to the local dynamic transmission key pair to obtain a dynamic transmission public key verification result; The server generates data transmittable information in response to determining that the dynamic transmission public key verification result indicates that the verification has passed, and encrypts the data transmittable information according to the data transmission public key to obtain encrypted data transmittable information, and sends the encrypted data transmittable information to the client; In response to receiving the encrypted data transmittable information sent by the server, the client decrypts the encrypted data transmittable information according to the local asymmetric key pair to obtain decrypted transmission information; In response to determining that the decrypted transmission information represents transmittable information, the client encrypts the data to be stored according to the private key in the local asymmetric key pair to obtain encrypted storage data, and sends the encrypted storage data to the server.

2. The method according to claim 1, wherein: The method further comprises: In response to receiving the encrypted storage data sent by the client, the server decrypts the encrypted storage data according to the corresponding data transmission public key to obtain the decrypted storage data; The server determines whether there is a storage node corresponding to the client in the local storage node cluster, and in response to determining that there is no storage node corresponding to the client in the storage node cluster, constructs a storage node corresponding to the client as a target storage node; The server constructs an encryption key according to the storage node identifier corresponding to the target storage node and the current timestamp, encrypts the decrypted storage data according to the encryption key, and stores the encrypted storage data in the target storage node.

3. The method according to claim 2, wherein: The method further comprises: In response to determining that there is a storage node corresponding to the client in the storage node cluster, the server constructs an encryption key according to the node identifier and current timestamp of the storage node corresponding to the client, encrypts the decrypted storage data according to the encryption key, and stores the encrypted storage data in the storage node.

4. The method according to claim 1, wherein: The method further comprises: The client sends transmission mode confirmation information for the target general information to the server in response to receiving the sharing instruction corresponding to the target general information; The server determines the transmission state corresponding to the target general transmission mode in response to receiving the transmission mode confirmation information for the target general information sent by the client; The server generates transmission mode feedback information in response to the transmission state indicating non-encrypted transmission, and sends the transmission mode feedback information to the client, wherein the transmission mode feedback information indicates that non-encrypted transmission of target general information is supported; In response to determining that the transmission mode feedback information sent by the server indicates non-encrypted transmission, the client sends the target general information to the sending server.

5. The method according to claim 4, wherein: The method further comprises: The server, in response to receiving the data query information sent by the client, parses the data query information to obtain a data query field set; The server adjusts the field format of the data query field in the data query field set according to the database field set corresponding to the target storage node to generate a data adjustment query field set; The server inputs the query correction field set into a pre-trained database statement conversion model to obtain a database statement; The server executes the database statement to read the query information from the target storage node, and encrypts the query information and sends it to the client.

6. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 5.

7. A computer readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images