Method, device and equipment for data encryption transmission between isolation networks based on two-dimensional code and medium

Abstract

The invention provides a method, system and device for data encryption transmission between isolation networks based on a two-dimensional code and a medium, and belongs to the technical field of data transmission. The method comprises the steps that a form needing to be transmitted is acquired from an intranet, and key fields are extracted; converting the primary key field into a short code by using a mapping table, splicing the short code with the basic field and the service field, and adding a check code to obtain source data; after encrypting and encoding the source data, converting the source data into a two-dimensional code, and transmitting the two-dimensional code to an external network system through a physical medium; scanning the two-dimensional code by using a terminal device in an extranet, decoding and decrypting the two-dimensional code, and then splitting the two-dimensional code to obtain a short code, a basic field, a service field and a check code; and performing data verification by using the verification code, restoring the short code into the main key field by using the mapping table after the verification is passed, and restoring the original form according to the main key field, the basic field and the service field. According to the invention, a complete process from internal network data extraction to external network data restoration is realized based on the two-dimensional code.

Description

Technical Field

[0001] This application belongs to the technical field of data transmission, and particularly relates to a method, device, equipment and medium for encrypted data transmission between isolated networks based on two-dimensional codes. Background Art

[0002] With the development of information technology, enterprises with high requirements for network security usually adopt physical isolation to completely isolate the internal network from the external Internet. Although these two security measures effectively prevent external network attacks, they also bring the problem of data exchange between the internal and external networks. Currently, the common data exchange methods between the internal and external networks mainly include the following three: One is physical medium transmission, where data is manually copied through storage devices such as USB drives and optical discs. This method is cumbersome to operate, has low transmission efficiency, and there is a risk of data leakage due to loss or damage of the medium. The second is dedicated hardware devices, such as one-way transmission devices like network gates and optical gates. These devices are expensive, complex to configure, and need to be updated regularly to cope with new security threats. Moreover, the transmission bandwidth is limited and it is difficult to meet the needs of large-scale data exchange. The third is the manual input method, where staff manually input the data to be exchanged. This method has extremely low efficiency and a high error rate, and can only be applied to small-scale data exchange and cannot meet the needs of large-scale data processing.

[0003] In summary, the common data exchange methods between the internal and external networks currently have low transmission efficiency, cannot meet real-time requirements, have complex operation processes, require professional personnel to participate, have insufficient security, have a risk of data leakage, and have problems of high cost and difficult maintenance. Summary of the Invention

[0004] In a first aspect, an embodiment of this application provides a method for encrypted data transmission between isolated networks based on two-dimensional codes, including the following steps: S1. Obtain the form to be transmitted from the internal network system, and extract the data of the key fields from the form; the key fields include the primary key field, basic field, and business field; S2. Convert the data of the primary key field into a short code using a preset mapping table, splice the short code with the data of the basic field and business field in a preset fixed order, and then add a check code to the spliced data to obtain the source data; S3. After performing encryption and encoding processing on the source data, convert it into a two-dimensional code image format data source, and transmit the two-dimensional code image format data source to the external network system through a physical medium; S4. Use a terminal device in the external network system to scan the two-dimensional code image format data source, and then obtain the source data after performing decoding and decryption processing, and split the source data in a preset fixed order to obtain the data of the short code, basic field, and business field, as well as the check code; S5. Perform data verification using the check code. After the verification passes, use the preset mapping table to restore the short code to the data of the primary key field, and then restore the original form according to the data of the primary key field, basic field, and business field.

[0005] Further, the specific steps of step S1 are as follows: S11. Obtain the form to be transmitted from the intranet system, and screen out the primary key field, basic field, and business field as the key fields from the form; the data of the primary key field is UUID encoding; S12. Write and execute an SQL query statement using the primary key field, basic field, and business field, and extract the data of the primary key field, basic field, and business field in each record from the form to be transmitted.

[0006] Further, the specific steps of step S2 are as follows: S21. Pre-build a mapping table to record the short code of each UUID encoding, and transmit the mapping table to the extranet system through the secure data protocol; S22. Find the corresponding short code by looking up the mapping table according to the UUID encoding of the primary key field; S23. Concatenate in the order of the short code, basic field, and business field, and add a separator between adjacent fields to obtain a concatenated data string; S24. Generate a check code for the concatenated data string and add the check code to the end of the concatenated data string to obtain the data source.

[0007] Further, the specific steps of step S3 are as follows: S31. Encrypt the source data using the CBC mode of the AES encryption algorithm; S32. Perform Base64 encoding on the encrypted ciphertext; S33. Use the qrcode library tool to perform the pre-selected QR code configuration parameters on the encoded data to generate the source data in QR code format; the QR code configuration parameters include the error correction level, data encoding mode, minimum version number, and output resolution; S34. Transmit the source data in QR code image format to the extranet environment using a physical carrier in a form that isolates the network.

[0008] Further, the specific steps of step S31 are as follows: Generate a random initialization vector of the same size as the AES block; Use the PKCS7 padding method to pad the data source to an integer multiple of the AES block size; After performing an exclusive OR operation on the random initialization vector and the first AES block, perform AES encryption using the AES key to obtain the first ciphertext block; After performing an XOR operation on the first ciphertext block and the second AES block, perform AES encryption using the AES key to obtain the second ciphertext block; And so on, perform an XOR operation on the current AES block using the previous ciphertext block, and then perform AES encryption using the AES key to obtain the current ciphertext block until all AES blocks are encrypted; The specific steps of step S32 are as follows: After concatenating the random initialization vector with all the ciphertext blocks, obtain the data ciphertext; Perform Base64 encoding on the data ciphertext, and set to add a newline character every set number of characters during the encoding process.

[0009] Furthermore, the specific steps of step S4 are as follows: S41. Use a terminal device in the external network system to scan the data source in the form of a QR code image, and perform image preprocessing through the Zbar library; S42. Perform Base64 decoding on the data after completing the image preprocessing; S43. Decrypt the decoded data using the CBC mode of the AES encryption algorithm to obtain the source data; S44. Split the source data into a concatenated data string and a check code; The specific steps of step S5 are as follows: S51. Use the check code to verify the concatenated data string; If the verification fails, determine that the data is damaged and end; If the verification passes, proceed to step S52; S52. Use a delimiter to split the concatenated data string into a short code, a basic field, and a service field; S53. Use the mapping table sent by the internal network system through the secure data protocol to convert the short code back to the UUID code to obtain the original primary key field data; S54. Construct a JOSN format structure, and add the data of the primary key field, the basic field, and the service field to the original form.

[0010] Furthermore, the specific steps of step S42 are as follows: Perform Base decoding on the data after completing the image processing, and remove the newline character during the decoding process; Split the decoded data into a random initialization vector and all ciphertext blocks; The specific steps of step S43 are as follows: Perform AES decryption on the first ciphertext block using the same AES key as the encryption to obtain the first intermediate data block; Perform an XOR operation on the first intermediate data block and the random initialization vector to restore the first plaintext block; Perform AES decryption on the second ciphertext block using the same AES key to obtain a second intermediate data block; Perform an exclusive OR operation on the second intermediate data block and the first ciphertext block to restore the second plaintext block; And so on, for each subsequent ciphertext block: Decrypt the current ciphertext block using the AES key to obtain an intermediate data block; Perform an exclusive OR operation on the intermediate data block and the previous ciphertext block to restore the corresponding plaintext block until the last plaintext block is obtained; Perform PKCS7 padding removal operation on the last plaintext block: Read the value n of the last byte, where 0 < n ≤ 16; Verify whether the values of the last n bytes are all n; If so, remove the last n bytes.

[0011] In a second aspect, an embodiment of the present application further provides a device for encrypting and transmitting data between isolated networks based on two-dimensional codes, including: A keyword field extraction module, configured to obtain a form to be transmitted from an intranet system and extract data of keyword fields from the form; the keyword fields include a primary key field, a basic field, and a service field; A source data generation module, configured to convert the data of the primary key field into a short code using a preset mapping table, splice the short code with the data of the basic field and the service field in a preset fixed order, and then add a check code to the spliced data to obtain source data; A two-dimensional code generation and transmission module, configured to perform encryption and encoding processing on the source data, convert it into a two-dimensional code image format data source, and transmit the two-dimensional code image format data source to an extranet system through a physical medium; A data parsing module, configured to scan the two-dimensional code image format data source using a terminal device in the extranet system, perform decoding and decryption processing to obtain the source data, and split the source data in a preset fixed order to obtain the data of the short code, the basic field, the service field, and the check code; A data restoration module, configured to perform data verification using the check code, and after the verification passes, restore the short code to the data of the primary key field using a preset mapping table, and then restore the original form according to the data of the primary key field, the basic field, and the service field.

[0012] In a third aspect, an embodiment of the present application further provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, and when the processor executes the program, it implements the steps of the method for encrypting and transmitting data between isolated networks based on two-dimensional codes as described in the first aspect.

[0013] Fourthly, an embodiment of the present application further provides a storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for encrypting and transmitting data between isolated networks based on two-dimensional codes as described in the first aspect are implemented.

[0014] As can be seen from the above technical solutions, the present application has the following advantages: In the method, device, equipment and medium for encrypting and transmitting data between isolated networks based on two-dimensional codes provided by the present application, the two-dimensional code is used as the data transmission carrier, combined with automated data processing, reducing manual intervention and cumbersome operations, improving the efficiency and real-time performance of data exchange, and being able to quickly respond to the data interaction requirements between the enterprise's internal and external networks; through multiple layers of security guarantees such as data encryption, check code generation and verification, and short code mapping, the security, integrity and accuracy of data during transmission are ensured, preventing security threats such as data leakage and tampering, and meeting the requirements of high-security scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions of the present application, the drawings required for description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0016] Figure 1 It is a schematic flow chart of the method for encrypting and transmitting data between isolated networks based on two-dimensional codes of the present invention.

[0017] Figure 2 It is a schematic diagram of the device for encrypting and transmitting data between isolated networks based on two-dimensional codes of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0018] In the following, the specific steps of the method for encrypting and transmitting data between isolated networks based on two-dimensional codes will be described in detail, and various embodiments of the present disclosure will be described more comprehensively. The present disclosure can have various embodiments and adjustments and changes can be made therein. However, it should be understood that there is no intention to limit the various embodiments of the present disclosure to the specific embodiments disclosed herein, but the present disclosure should be understood to cover all adjustments, equivalents and / or alternative solutions falling within the spirit and scope of the various embodiments of the present disclosure.

[0019] Exemplarily speaking, in the current context of the continuous development of information technology, many enterprises that attach great importance to network security tend to adopt a physical isolation strategy to completely separate the internal network from the external Internet. Although physical isolation is highly effective in resisting external network attacks, at the same time, it also brings many problems to data interaction between the internal and external networks. Currently, the common data exchange methods between the internal and external networks mainly include the following three: First, physical medium transmission. This method relies on storage devices such as USB flash drives and optical discs to manually copy data. However, its operation process is cumbersome, the transmission efficiency is extremely low, and there is a potential risk of data leakage caused by the loss or damage of the medium. Second, dedicated hardware device transmission. One-way transmission devices such as air gapped gateways and optical isolators are widely used. However, these devices themselves are expensive, the configuration process is complex, and they need to be updated regularly to cope with emerging security threats. In addition, their transmission bandwidth is limited and they are often unable to handle large-scale data exchange scenarios and difficult to meet actual needs. Third, manual entry method. That is, the staff manually enters the data to be exchanged. This method is inefficient and has a high error rate, and is only suitable for small-scale data exchange and cannot handle large-scale data processing.

[0020] Generally speaking, the existing methods for data exchange between internal and external networks generally have problems such as low transmission efficiency and difficulty in meeting real-time requirements. At the operational level, the process is complex and often requires the participation of professionals. In terms of security, there is a hidden danger of data leakage. From the cost perspective, some methods are costly and difficult to maintain, and it is difficult to meet the current enterprise's requirements for efficient and secure data exchange.

[0021] In view of the above problems, this embodiment provides a method for encrypted data transmission between isolated networks based on two-dimensional codes. By using two-dimensional codes, encryption algorithms, and encoding methods, it can be applicable to different types of enterprises, organizations, and various scales and types of data exchange requirements, and is easy to integrate and apply between different systems; compared with dedicated hardware devices, it does not require high equipment investment and complex maintenance costs, and only needs to rely on electronic devices and software tools to achieve encrypted data transmission and parsing, reducing the operating costs of enterprises.

[0022] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0023] Please refer to Figure 1 The following figure shows a flowchart of a method for encrypted data transmission between isolated networks based on two-dimensional codes in a specific embodiment. The method includes the following steps: S1. Obtain the form to be transmitted from the internal network system, and extract the data of the key fields from the form; the key fields include the primary key field, the basic field, and the business field; It should be noted that by extracting key field data from the form, the necessary information in enterprise data exchange can be extracted, avoiding the processing and transmission of a large amount of irrelevant data, and improving the efficiency of data processing. The extracted key field data is the basis for subsequent data conversion, splicing, encryption and other processing operations, ensuring the integrity and accuracy of data transmission, and providing an accurate and reliable data source for realizing data interaction between the internal and external networks. S2. Use a preset mapping table to convert the data of the primary key field into a short code, splice the short code with the data of the basic field and the business field in a preset fixed order, and then add a check code to the spliced data to obtain the source data. It should be noted that converting the long UUID code of the primary key field into a short code reduces the amount of data, lowers the storage and transmission costs, and improves the efficiency of data processing and transmission. Splicing the data of the short code, the basic field and the business field in a preset fixed order forms a unified and standardized data format, which is convenient for subsequent encryption, encoding and parsing operations, and improves the consistency and accuracy of data processing. By adding a check code to the spliced data, a verification mechanism for the integrity and accuracy of the data is provided, which can timely detect whether the data has been tampered with or damaged during subsequent data transmission and processing, ensuring the reliability and credibility of the data. S3. After performing encryption and encoding processing on the source data, convert it into a data source in the form of a two-dimensional code image, and transmit the data source in the form of a two-dimensional code image to the external network system through a physical medium. It should be noted that encrypting the source data and converting the data into ciphertext effectively prevents the risk of data being stolen and cracked during transmission, ensuring the confidentiality of the data. Through encoding processing, the encrypted data is converted into a common encoding format, improving the compatibility and transportability of the data between different systems and devices, and ensuring the smooth generation and recognition of two-dimensional codes. Converting the processed data into the form of a two-dimensional code image and transmitting it through a physical medium avoids the security risks that may be brought by network connections. At the same time, relying on the portability and readability of two-dimensional codes, the safe and convenient transmission of data between networks with different security levels is realized. S4. Use a terminal device in the external network system to scan the data source in the form of a two-dimensional code image, then perform decoding and decryption processing to obtain the source data, and split the source data in a preset fixed order to obtain the data of the short code, the basic field and the business field, as well as the check code. It should be noted that by using a terminal device to scan a QR code, the data carried in the QR code can be quickly obtained, realizing the efficient conversion of data from a physical medium to an electronic device, providing a basis for subsequent data processing; through decoding and decryption operations, the encrypted QR code data is restored to the original source data, and the source data is split according to a preset order, extracting short codes, basic fields, service field data, and check codes, providing a data basis for further verification and restoration of the data, ensuring the complete recovery of the data after transmission; S5. Use the check code to perform data verification. After the verification passes, use a preset mapping table to restore the short code to the data of the primary key field, and then restore the original form according to the data of the primary key field, basic field, and service field; It should be noted that using the check code to verify the data can accurately determine whether the data has been damaged or tampered with during transmission and processing. Only the data that passes the verification can enter the subsequent restoration link, effectively ensuring the integrity and reliability of the data; by restoring the short code to the data of the primary key field and combining the data of the basic field and service field, the complete restoration of the original form is realized, meeting the enterprise's demand for using the internal network original data in the external network system, and providing accurate and complete data support for the enterprise's subsequent business processing and decision-making analysis.

[0024] Through the complete process of obtaining key field data from the internal network, converting and splicing to generate source data, encrypting and encoding into a QR code, physically transmitting to the external network, and parsing and restoring on the external network in this embodiment, the security and efficiency problems of data exchange between the internal and external networks in a physically isolated environment are solved, realizing the convenient and secure transmission of data between networks with different security levels, and providing a basis for the enterprise's data interaction.

[0025] Further, as a refinement and extension of the specific implementation manner of the above embodiment, in order to completely illustrate the specific implementation process in this embodiment, another method for encrypting and transmitting data between isolated networks based on QR codes is provided. The method includes the following steps: S1. Obtain the form to be transmitted from the internal network system, and extract the data of the key fields from the form; the key fields include the primary key field, basic field, and service field; the specific steps of step S1 are as follows: S11. Obtain the form to be transmitted from the internal network system, and screen out the primary key field, basic field, and service field that are used as key fields from the form; the data of the primary key field is a UUID code; Exemplarily, taking the internal network of a certain bank system as an example, the following key fields are uniformly extracted from the customer account information form: Primary key field: Account number For example, the account number uses a 36-bit UUID: 6ba7b810-9dad-11d1-80b4-00c04fd430c8; Basic fields: customer name, bank number For example, customer name xxx, bank number BANK001; Business fields: account balance, account type For example, account balance: 10000.00, account type: savings account; S12. Write and execute an SQL query statement using the primary key field, basic fields, and business fields to extract the primary key field, basic field, and business field data in each record from the form to be transmitted; S2. Convert the data of the primary key field into a short code using a preset mapping table, splice the short code with the data of the basic fields and business fields in a preset fixed order, and then add a check code to the spliced data to obtain the source data; The specific steps of step S2 are as follows: S21. Pre-construct a mapping table to record the short code of each UUID code, and transmit the mapping table to the external network system through a secure data protocol; Exemplarily, the mapping table is shown in Table 1 below: Table 1: Mapping table

[0026] S22. Find the corresponding short code in the mapping table according to the UUID code of the primary key field; S23. Splice in the order of short code, basic fields, and business fields, and add a delimiter between adjacent fields to obtain a spliced data string; Specifically, the splicing order is as follows: Splice in a fixed order: Short code|Bank number|Customer name|Account balance|Account type; Exemplarily, A01|BANK001|xxx|10000.00|Savings account; S24. Generate a check code for the spliced data string and add the check code to the end of the spliced data string to obtain the data source; The specific steps for generating the check code for the spliced data string in step S24 are as follows: Convert the spliced string into a byte array encoded in UTF-8, and calculate the check value using the crc32 function of the zlib library; Format the check value into an 8-bit hexadecimal string and add it to the end of the spliced data string to form the source data; After performing encryption and encoding on the source data, convert it into a data source in the form of a QR code image, and transmit the data source in the form of a QR code image to the external network system through a physical medium. The specific steps of step S3 are as follows: S31. Encrypt the source data using the CBC mode of the AES encryption algorithm; The specific steps of step S31 are as follows: Generate a random initialization vector of the same size as the AES block; Use the PKCS7 padding method to pad the data source to an integer multiple of the AES block size; After performing an exclusive OR operation on the random initialization vector and the first AES block, perform AES encryption using the AES key to obtain the first ciphertext block; After performing an exclusive OR operation on the first ciphertext block and the second AES block, perform AES encryption using the AES key to obtain the second ciphertext block; And so on, after performing an exclusive OR operation on the previous ciphertext block and the current AES block, perform AES encryption using the AES key to obtain the current ciphertext block until all AES blocks are encrypted; S32. Perform Base64 encoding on the encrypted ciphertext; The specific steps of step S32 are as follows: After concatenating the random initialization vector and all ciphertext blocks, obtain the data ciphertext; Perform Base64 encoding on the data ciphertext and set a line break every set number of characters during the encoding process; S33. Use the qrcode library tool to perform pre-selected QR code configuration parameters on the encoded data to generate source data in the form of a QR code; the QR code configuration parameters include an error correction level, a data encoding mode, a minimum version number, and an output resolution; Exemplarily, set the error correction level to H, select the Byte mode for the data encoding mode, set the minimum version number to 10, and set the output resolution to a PNG image with a resolution greater than or equal to 300 dpi; It should be noted that the error correction level is an important feature of the QR code, which determines the ability of the QR code to be correctly recognized even when partially damaged or contaminated; here, the error correction level is set to H, that is, the highest error correction level, which can correct about 30% of data errors; ensuring that the QR code can still maintain readability and accuracy when facing slight damage; The Byte mode is a general encoding mode that allows any binary data to be encoded into the QR code, and by selecting the Byte mode, it can be ensured that various types of data (such as text, numbers, special characters) can be encoded into the QR code without data format restrictions; The version number of the QR code determines the amount of data it can store; the higher the version number, the larger the capacity of the QR code; here, the minimum version number is set to 10 to ensure that the generated QR code has sufficient capacity to store the required data, avoiding problems such as the QR code being unable to accommodate or difficult to recognize due to excessive data volume; Resolution is an important indicator of image clarity; here, the resolution of the output QR code image is restricted to not less than 300 dpi and saved in PNG format, ensuring that the QR code image can maintain its clarity and readability when printed or displayed, meeting the requirements of various application scenarios; S34. Transmit the QR code image format data source to the external network environment in the form of isolating the network using a physical carrier; Exemplarily, print the QR code on paper or display it on an electronic screen, and take it out of the internal network environment with the help of a physical carrier (such as a folder, monitor, projector) and transmit it to the external network area; S4. Use a terminal device in the external network system to scan the QR code image format data source, and then perform decoding and decryption processing to obtain the source data, and perform splitting on the source data in a preset fixed order to obtain short codes, basic fields, business field data, and check codes; the specific steps of step S4 are as follows: S41. Use a terminal device in the external network system to scan the QR code image format data source and perform image preprocessing through the Zbar library; Exemplarily, the terminal device can be a smart phone, a tablet computer, or a dedicated barcode reader; Specifically, the image preprocessing includes grayscale processing, binarization processing, and positioning pattern recognition; S42. Perform Base64 decoding on the data after image preprocessing is completed; The specific steps of step S42 are as follows: Perform Base decoding on the data after image processing is completed, and remove the line break characters during the decoding process; Split the decoded data into a random initialization vector and all ciphertext blocks; S43. Decrypt the decoded data using the CBC mode of the AES encryption algorithm to obtain the source data; The specific steps of step S4 are as follows: Perform AES decryption on the first ciphertext block using the same AES key as encryption to obtain the first intermediate data block; Perform an exclusive OR operation on the first intermediate data block and the random initialization vector to restore the first plaintext block; Perform AES decryption on the second ciphertext block using the same AES key to obtain the second intermediate data block; Perform an exclusive OR operation on the second intermediate data block and the first ciphertext block to restore the second plaintext block; And so on, for each subsequent ciphertext block: Use the AES key to decrypt the current ciphertext block to obtain an intermediate data block; Perform an exclusive OR operation on the intermediate data block and the previous ciphertext block to restore the corresponding plaintext block until the last plaintext block is obtained; Perform PKCS7 padding removal operation on the last plaintext block: Read the value n of the last byte, where 0 < n ≤ 16; Verify whether the values of the last n bytes are all n If so, remove the last n bytes; S44. Split the source data into a concatenated data string and a check code; Exemplarily, splitting the source data gives: A01|BANK001|xxx|10000.00|Savings account|ABCD1234; S5. Use the check code for data verification, and after the verification passes, use a preset mapping table to restore the short code to the data of the primary key field, and then restore the original form according to the data of the primary key field, basic field, and business field; The specific steps of step S5 are as follows: S51. Use the check code to verify the concatenated data string; If the verification fails, determine that the data is damaged and end; If the verification passes, proceed to step S52; S52. Use the delimiter to split the concatenated data string into a short code, a basic field, and a business field; S53. Use the mapping table sent by the intranet system through the secure data protocol to convert the short code back to the UUID code to obtain the original primary key field data; Exemplarily, through reverse query of the mapping table, we get: Short code A01 → Original UUID 6ba7b810-9dad-11d1-80b4-00c04fd430c8 Bank code BANK001 → Head office business department Account type savings account → Business code 01; S54. Construct a JOSN format structure and add the data of the primary key field, basic field, and business field to the original form.

[0027] It should be understood that the magnitudes of the sequence numbers of the steps in the above embodiments do not mean the order of execution. The order of execution of each process should be determined by its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present invention.

[0028] Such as Figure 2As shown below, this is an embodiment of the device for encrypting and transmitting data between isolated networks based on QR codes provided by the embodiments of the present disclosure. This device and the method for encrypting and transmitting data between isolated networks based on QR codes in the above embodiments belong to the same inventive concept. For the details not described in detail in the embodiments of the device for encrypting and transmitting data between isolated networks based on QR codes, reference may be made to the embodiments of the method for encrypting and transmitting data between isolated networks based on QR codes above.

[0029] The device includes: A keyword field extraction module, configured to obtain a form to be transmitted from an intranet system and extract the data of keyword fields from the form; the keyword fields include a primary key field, a basic field, and a service field; A source data generation module, configured to convert the data of the primary key field into a short code using a preset mapping table, splice the short code with the data of the basic field and the service field in a preset fixed order, and then add a check code to the spliced data to obtain source data; A QR code generation and transmission module, configured to perform encryption and encoding processing on the source data, convert it into a QR code image format data source, and transmit the QR code image format data source to an extranet system through a physical medium; A data parsing module, configured to use a terminal device in the extranet system to scan the QR code image format data source, perform decoding and decryption processing to obtain the source data, and split the source data in a preset fixed order to obtain the data of the short code, the basic field, the service field, and the check code; A data restoration module, configured to perform data verification using the check code, and after the verification passes, restore the short code to the data of the primary key field using a preset mapping table, and then restore the original form according to the data of the primary key field, the basic field, and the service field.

[0030] Through the interaction and cooperation of the keyword field extraction module, the source data generation module, the QR code generation and transmission module, the data parsing module, and the data restoration module in this embodiment, a complete process from intranet data extraction to extranet data restoration is realized.

[0031] The method for encrypted transmission of data between isolated networks based on QR codes provided by the embodiments of the present application can be applied to electronic devices. Those skilled in the art can understand that the structure of the electronic devices involved in the embodiments of the present invention does not constitute a limitation on the electronic devices. The electronic devices may include more or fewer components than shown in the figures, or combine certain components, or have different component arrangements. In the embodiments of the present invention, the electronic devices include, but are not limited to, laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic devices may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of the present application described herein and / or claimed.

[0032] The electronic device may include a processor, an external memory interface, an internal memory, a universal serial bus (USB) interface, a charging management module, a power management module, a battery, a wireless communication module, an audio module, a speaker, a microphone, a sensor module, keys, a camera, a display screen, and a SIM card interface, etc.

[0033] It can be understood that the structure schematically shown in the embodiments of the present application does not constitute a specific limitation on the electronic device. In other embodiments of the present application, the electronic device may include more or fewer components than shown in the figures, or combine certain components, or split certain components, or have different component arrangements. The components shown in the figures may be implemented in hardware, software, or a combination of software and hardware.

[0034] The processor may include one or more processing units. For example, the processor may include a central processing unit (CPU), etc., an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Among them, different processing units may be independent devices or integrated in one or more processors.

[0035] Among them, the processor can be the nerve center and command center of the electronic device. The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of fetching and executing instructions.

[0036] A memory can also be set in the processor for storing instructions and data. In some embodiments, the memory in the processor is a cache memory. This memory can store the instructions or data that the processor has just used or recycled. If the processor needs to use the instruction or data again, it can directly call it from this memory. This avoids repeated accesses, reduces the waiting time of the processor, and thus improves the system efficiency.

[0037] The above-mentioned electronic device implements the technical solution of the method for encrypting and transmitting data between isolated networks based on two-dimensional codes in the present application, which includes obtaining the form to be transmitted from the intranet system and extracting the data of the key fields from the form; the key fields include the primary key field, the basic field, and the service field; converting the data of the primary key field into a short code using a preset mapping table, and concatenating the short code with the data of the basic field and the service field in a preset fixed order, and then adding a check code to the concatenated data to obtain the source data; performing encryption and encoding processing on the source data, converting it into a two-dimensional code image format data source, and transmitting the two-dimensional code image format data source to the extranet system through a physical medium; using a terminal device in the extranet system to scan the two-dimensional code image format data source, and then performing decoding and decryption processing to obtain the source data, and splitting the source data in a preset fixed order to obtain the data of the short code, the basic field, the service field, and the check code; using the check code for data verification, and after the verification passes, restoring the short code to the data of the primary key field using a preset mapping table, and then restoring the original form according to the data of the primary key field, the basic field, and the service field. This achieves a complete process of obtaining key field data from the intranet, converting and concatenating to generate source data, encrypting and encoding into two-dimensional codes, physically transmitting to the extranet, and parsing and restoring on the extranet, solves the security and efficiency problems of data exchange between the intranet and the extranet in a physically isolated environment, realizes the convenient and secure transmission of data between networks with different security levels, and provides a basis for the data interaction of enterprises with beneficial effects.

[0038] In the storage medium provided by the present application, there is a program product capable of implementing the method for encrypting and transmitting data between isolated networks based on two-dimensional codes.

[0039] The method for encrypted data transmission between isolated networks based on QR codes includes: obtaining the form to be transmitted from the intranet system and extracting the data of the key fields from the form; the key fields include the primary key field, the basic field, and the service field; converting the data of the primary key field into a short code using a preset mapping table, concatenating the short code with the data of the basic field and the service field in a preset fixed order, and then adding a check code to the concatenated data to obtain the source data; performing encryption and encoding processing on the source data, converting it into a QR code image format data source, and transmitting the QR code image format data source to the extranet system through a physical medium; using a terminal device in the extranet system to scan the QR code image format data source, performing decoding and decryption processing to obtain the source data, and splitting the source data in a preset fixed order to obtain the data of the short code, the basic field, the service field, and the check code; using the check code for data verification, and after the verification passes, restoring the short code to the data of the primary key field using the preset mapping table, and then restoring the original form according to the data of the primary key field, the basic field, and the service field.

[0040] In some possible implementation manners, the method for encrypted data transmission between isolated networks based on QR codes of the present disclosure may be implemented in the form of a program product, which includes program code. When the program product runs on a terminal device, the program code is used to cause the terminal device to execute the steps according to various exemplary embodiments of the present disclosure described in the "Exemplary Method" section above in this specification.

[0041] The storage medium of the present disclosure may adopt any combination of one or more readable media. The readable media may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples (non-exhaustive list) of the readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0042] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for encrypting and transmitting data between isolated networks based on two-dimensional codes, characterized in that, It includes the following steps: S1. Obtain the form to be transmitted from the intranet system, and extract the data of the key fields from the form; the key fields include the primary key field, the basic field, and the business field; S2. Convert the data of the primary key field into a short code using a preset mapping table, splice the short code with the data of the basic field and the business field in a preset fixed order, and then add a check code to the spliced data to obtain the source data; S3. After performing encryption and encoding on the source data, convert it into a data source in the format of a QR code image, and transmit the data source in the format of a QR code image to the extranet system through a physical medium; S4. Use a terminal device in the extranet system to scan the data source in the format of a QR code image, then perform decoding and decryption processing to obtain the source data, and split the source data in a preset fixed order to obtain the data of the short code, the basic field, the business field, and the check code; S5. Use the check code for data verification, and after the verification passes, use the preset mapping table to restore the short code to the data of the primary key field, and then restore the original form according to the data of the primary key field, the basic field, and the business field.

2. The method for encrypted transmission of data between isolated networks based on two-dimensional codes according to claim 1, characterized in that, The specific steps of step S1 are as follows: S11. Obtain the form to be transmitted from the intranet system, and screen out the primary key field, the basic field, and the business field that are used as key fields from the form; the data of the primary key field is in the UUID encoding; S12. Write and execute an SQL query statement using the primary key field, the basic field, and the business field, and extract the data of the primary key field, the basic field, and the business field in each record from the form to be transmitted.

3. The method for encrypting and transmitting data between isolated networks based on QR codes according to claim 2, wherein The specific steps of step S2 are as follows: S21. Pre-build a mapping table to record the short code of each UUID encoding, and transmit the mapping table to the extranet system through a secure data protocol; S22. Find the mapping table according to the UUID encoding of the primary key field to determine the corresponding short code; S23. Splice in the order of the short code, the basic field, and the business field, and add a separator between adjacent fields to obtain a spliced data string; S24. Generate a check code for the spliced data string, and add the check code to the end of the spliced data string to obtain the data source.

4. The method for encrypted transmission of data between isolated networks based on QR codes according to claim 3, wherein The specific steps of step S3 are as follows: S31. Encrypt the source data using the CBC mode of the AES encryption algorithm; S32. Perform Base64 encoding on the ciphertext obtained by encryption; S33. Use the qrcode library tool to perform pre-selected QR code configuration parameters on the encoded data to generate source data in the format of a QR code; the QR code configuration parameters include the error correction level, the data encoding mode, the minimum version number, and the output resolution; S34. Transmit the data source in the format of a QR code image to the extranet environment using a physical carrier in an isolated network form.

5. The method for encrypted transmission of data between isolated networks based on two-dimensional codes according to claim 4, characterized in that, The specific steps of step S31 are as follows: Generate a random initialization vector of the same size as the AES block; Use the PKCS7 padding method to pad the data source to an integer multiple of the AES block size; After performing an exclusive OR operation on the random initialization vector and the first AES block, perform AES encryption using the AES key to obtain the first ciphertext block; After performing an XOR operation on the first ciphertext block and the second AES block, perform AES encryption using the AES key to obtain the second ciphertext block; And so on, perform an XOR operation on the current AES block using the previous ciphertext block, and then perform AES encryption using the AES key to obtain the current ciphertext block until all AES blocks are encrypted; The specific steps of step S32 are as follows: After concatenating the random initialization vector with all ciphertext blocks, obtain the data ciphertext; Perform Base64 encoding on the data ciphertext, and set to add a newline character every set number of characters during the encoding process.

6. The method for encrypting and transmitting data between isolated networks based on two-dimensional codes according to claim 4, wherein, The specific steps of step S4 are as follows: S41. Use a terminal device in the external network system to scan the data source in the form of a QR code image, and perform image preprocessing through the Zbar library; S42. Perform Base64 decoding on the data after completing the image preprocessing; S43. Decrypt the decoded data using the CBC mode of the AES encryption algorithm to obtain the source data; S44. Split the source data into the concatenated data string and the check code; The specific steps of step S5 are as follows: S51. Use the check code to verify the concatenated data string; If the verification fails, determine that the data is damaged and end; If the verification passes, proceed to step S52; S52. Use the delimiter to split the concatenated data string into a short code, a basic field, and a service field; S53. Use the mapping table sent by the intranet system through the secure data protocol to convert the short code back to the UUID code to obtain the original primary key field data; S54. Construct a JOSN format structure and add the data of the primary key field, basic field, and service field to the original form.

7. The method for encrypting and transmitting data between isolated networks based on QR codes according to claim 6, wherein, The specific steps of step S42 are as follows: Perform Base decoding on the data after completing the image processing, and remove the newline character during the decoding process; Split the decoded data into the random initialization vector and all ciphertext blocks; The specific steps of step S43 are as follows: Perform AES decryption on the first ciphertext block using the same AES key as encryption to obtain the first intermediate data block; Perform an XOR operation on the first intermediate data block and the random initialization vector to restore the first plaintext block; Perform AES decryption on the second ciphertext block using the same AES key to obtain the second intermediate data block; Perform an XOR operation on the second intermediate data block and the first ciphertext block to restore the second plaintext block; And so on, for each subsequent ciphertext block: Decrypt the current ciphertext block using the AES key to obtain the intermediate data block; Perform an XOR operation on the intermediate data block and the previous ciphertext block to restore the corresponding plaintext block until the last plaintext block is obtained; Perform PKCS7 padding removal operation on the last plaintext block: Read the value n of the last byte, where 0 < n ≤ 16; Verify whether the values of the last n bytes are all n; If so, remove the last n bytes.

8. A device for encrypting and transmitting data between isolated networks based on two-dimensional codes, characterized in that, Including: A keyword field extraction module, which is used to obtain the form to be transmitted from the intranet system and extract the data of the keyword fields from the form; The keyword fields include a primary key field, a basic field, and a service field; A source data generation module, which is used to convert the data of the primary key field into a short code using a preset mapping table, splice the short code with the data of the basic field and the service field in a preset fixed order, and then add a check code to the spliced data to obtain the source data; A QR code generation and transmission module, which is used to perform encryption and encoding processing on the source data, convert it into a data source in the format of a QR code image, and transmit the data source in the format of a QR code image to an external network system through a physical medium; A data parsing module, which is used to scan the data source in the format of a QR code image using a terminal device in the external network system, obtain the source data after performing decoding and decryption processing, and split the source data in a preset fixed order to obtain the data of the short code, the basic field, the service field, and the check code; A data restoration module, which is used to perform data verification using the check code, and after the verification passes, restore the short code to the data of the primary key field using a preset mapping table, and then restore the original form according to the data of the primary key field, the basic field, and the service field.

9. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the steps of the method for encrypting and transmitting data between isolated networks based on QR codes according to any one of claims 1 to 7 when executing the program.

10. A storage medium, on which a computer program is stored, characterized in that, The computer program, when executed by the processor, implements the steps of the method for encrypting and transmitting data between isolated networks based on QR codes according to any one of claims 1 to 7.

Images