Method, device and computer-readable medium for transferring files across networks

Abstract

The embodiments of the present disclosure disclose a method, device, and computer-readable medium for transferring files across networks. A specific implementation of the method includes: in response to a file to be transferred passing a compliance check, determining the file structure information of the file to be transferred; determining whether a target file template exists based on the file structure information; separating the file content of the file to be transferred to obtain a target file; generating a chain invisible watermark based on the template identifier corresponding to the target file template, the metafile information corresponding to the file to be transferred, and the target file; embedding the chain invisible watermark into the file to be transferred to obtain a watermark-embedded file; allocating a ferry server that matches the file to be transferred through an allocation server based on the metafile information; and transmitting the watermark-embedded file across the network to an external storage space through the ferry server based on the ferry mode. This implementation achieves efficient and secure cross-network data transmission.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and more particularly to a method, device, and computer-readable medium for transmitting files across networks. Background Art

[0002] To ensure network security, hospitals often divide their internal networks into intranets to isolate them from external networks. However, common methods of cross-network data transmission, such as using storage media (e.g., USB flash drives), often lead to security issues caused by untrusted storage media (e.g., the spread of network viruses). Therefore, ensuring efficient and secure data transmission between the intranet and external networks has become a pressing issue.

[0003] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known to a person of ordinary skill in the art. Summary of the Invention

[0004] The content of this disclosure is used to briefly introduce concepts that will be described in detail in the detailed description section below. The content of this disclosure is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] Some embodiments of the present disclosure provide a method, apparatus, and computer-readable medium for transmitting files across networks to solve the technical problems mentioned in the above background technology section.

[0006] In a first aspect, some embodiments of the present disclosure provide a method for transferring files across networks, the method comprising: in response to a file to be transferred passing a compliance check, determining file structure information of the file to be transferred, wherein the file to be transferred is a file uploaded by an operation object that has passed a senseless identity authentication; determining whether a target file template exists based on the file structure information, wherein the target file template is a file template that matches the file to be transferred; in response to the existence of a target file template, separating the file content of the file to be transferred based on the target file template and a first text positioning model to obtain a target file; and determining whether a target file template exists based on the target file template and a first text positioning model to obtain a target file. A chain invisible watermark is generated based on the template identifier corresponding to the template, the metafile information corresponding to the above-mentioned file to be transmitted and the above-mentioned target file, wherein the above-mentioned chain invisible watermark is an invisible watermark of a chain structure, wherein the above-mentioned metafile information includes: file description information and ferry mode, and the ferry mode includes: immediate mode and delayed mode; the above-mentioned chain invisible watermark is embedded in the above-mentioned file to be transmitted to obtain a watermark-embedded file; according to the above-mentioned metafile information, a ferry server matching the above-mentioned file to be transmitted is allocated through an allocation server; according to the ferry mode, the above-mentioned watermark-embedded file is transmitted across the network to an external storage space through the ferry server.

[0007] In a second aspect, some embodiments of the present disclosure provide a device for transmitting files across networks, the device comprising: a first determining unit, configured to determine the file structure information of the file to be transmitted in response to the file to be transmitted passing the compliance check, wherein the file to be transmitted is a file uploaded by an operation object that has passed the senseless identity authentication; a second determining unit, configured to determine whether a target file template exists based on the file structure information, wherein the target file template is a file template that matches the file to be transmitted; a file content separation unit, configured to separate the file content of the file to be transmitted based on the target file template and a first text positioning model in response to the existence of the target file template to obtain the target file; a generating unit, configured to generate the target file based on the target file template and a first text positioning model. A chain invisible watermark is generated according to the template identifier corresponding to the above-mentioned target file template, the metafile information corresponding to the above-mentioned file to be transmitted and the above-mentioned target file, wherein the above-mentioned chain invisible watermark is an invisible watermark of a chain structure, wherein the above-mentioned metafile information includes: file description information and ferry mode, and the ferry mode includes: immediate mode and delayed mode; the embedding unit is configured to embed the above-mentioned chain invisible watermark into the above-mentioned file to be transmitted to obtain the watermark-embedded file; the allocation unit is configured to allocate a ferry server matching the above-mentioned file to be transmitted through the allocation server according to the above-mentioned metafile information; the cross-network transmission unit is configured to transmit the above-mentioned watermark-embedded file across the network to an external storage space through the ferry server according to the ferry mode.

[0008] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by one or more processors, the one or more processors implement the method described in any implementation of the first aspect above.

[0009] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation of the first aspect is implemented.

[0010] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: through the cross-network file transmission method of some embodiments of the present disclosure, efficient and secure cross-network data transmission is achieved. Specifically, first, in response to the file to be transmitted passing the compliance check, the file structure information of the above-mentioned file to be transmitted is determined, wherein the above-mentioned file to be transmitted is a file uploaded by the operation object that has passed the senseless identity authentication. Compliance checks are used to avoid cross-network transmission of sensitive data, and the file structure information is determined under the condition that the compliance check is passed. Secondly, based on the above-mentioned file structure information, it is determined whether there is a target file template, wherein the above-mentioned target file template is a file template that matches the above-mentioned file to be transmitted. Then, in response to the existence, the file content of the above-mentioned file to be transmitted is separated according to the above-mentioned target file template and the first text positioning model to obtain the target file. In practice, in the file transmission scenario of the hospital, the file to be transmitted is often obtained by filling in the template. By combining the template and the text positioning model, the separation of text content and template content can be achieved. Furthermore, a chained invisible watermark is generated based on the template identifier corresponding to the target file template, the metafile information corresponding to the file to be transferred, and the target file. The chained invisible watermark has a chained structure, and the metafile information includes file description information and a ferrying mode, with the ferrying modes including immediate and delayed modes. Next, the chained invisible watermark is embedded into the file to be transferred, resulting in a watermark-embedded file. In practice, file transfers may present a risk of tampering. Generating a chained invisible watermark provides more effective anti-tampering protection. Furthermore, the chained invisible watermark eliminates the need to verify the entire file to be transferred during subsequent tamper-proof verification. Instead, each file is verified individually in a chained manner. If a verification error occurs, verification is terminated, eliminating the need to verify subsequent unverified portions. This improves verification efficiency and reduces data processing during the verification process. Furthermore, based on the metafile information, a ferrying server matching the file to be transferred is assigned via an allocation server. By setting up a distribution server, we can automatically schedule and distribute files to be transferred, avoiding the problem of excessive load on a single distribution server in high-volume data transfer scenarios. Finally, according to the ferry mode, the ferry server transfers the watermarked files across the network to external storage space. This achieves efficient and secure cross-network data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The above and other features, advantages, and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0012] Figure 1is a flowchart of some embodiments of the method for transmitting files across networks according to the present disclosure;

[0013] Figure 2 This is a schematic diagram of the server architecture;

[0014] Figure 3 This is a schematic diagram of the process of generating relative file fingerprints;

[0015] Figure 4 It is a schematic diagram of the positional relationship between the chain invisible watermark and the file to be transmitted;

[0016] Figure 5 This is another server architecture diagram;

[0017] Figure 6 is a schematic structural diagram of some embodiments of the device for transmitting files across networks according to the present disclosure;

[0018] Figure 7 It is a structural diagram of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0019] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0020] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other.

[0021] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0022] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, they should be understood as "one or more".

[0023] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0024] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0025] refer to Figure 1 , shows a process 100 of some embodiments of the method for transferring files across networks according to the present disclosure. The method for transferring files across networks includes the following steps:

[0026] Step 101: In response to a file to be transferred passing a compliance check, file structure information of the file to be transferred is determined.

[0027] In some embodiments, the executing subject of the cross-network file transmission method (for example, a computing device) can determine the file structure information of the file to be transferred in response to the file to be transferred passing the compliance check. The file to be transferred is a file uploaded by the operating object that has passed the senseless identity authentication. Specifically, the file to be transferred can be a multimedia file (for example, an image file) or a text file (for example, a PDF file). The operating object can be a medical staff within the hospital or a person with file operation authority. The file structure information represents the text content and location distribution contained in the file to be transferred. For example, the compliance check can be a check on whether sensitive information is leaked in the text to be transferred. Specifically, by configuring a sensitive word dictionary, it can be determined by character matching whether there is leakage of sensitive information in the file to be transferred.

[0028] As an example, text content can be located and recognized using OCR (Optical Character Recognition) to obtain text structure information. For example, text structure information can be:

[0029] {text type: "text title";

[0030] Text content: "XXX";

[0031] Text position: [P1, P2, P3, P4];

[0032] Text type: "text body";

[0033] Text content: "XXXX";

[0034] Text position: [P5, P6, P7, P8];

[0035] Among them, P1, P2, P3, P4, P5, P6, P7, and P8 can represent the coordinates of the corner points where the text content is located.

[0036] It should be noted that the computing device described above can be either hardware or software. When the computing device is hardware, it can be implemented as a distributed cluster consisting of multiple servers or terminal devices, or as a single server or a single terminal device. When the computing device is software, it can be installed in the hardware devices listed above. It can be implemented as multiple software or software modules, for example, to provide distributed services, or as a single software or software module. No specific limitations are given here.

[0037] In some optional implementations of some embodiments, before determining the file structure information of the file to be transferred, the method further includes:

[0038] In the first step, in response to the operation object initiating a cross-network file transfer request through the file transfer client, the above operation object is authenticated without any sense of identity.

[0039] Among them, the identity binding between the above-mentioned file transfer client and the above-mentioned operation object. A cross-network file transfer request refers to a transfer request initiated by a file transfer client. The file transfer client can adopt a B / S architecture, a client for file transfer. In practice, seamless identity authentication refers to a method of identity authentication by combining the behavior pattern of the operation object. Specifically, by analyzing the user behavior characteristics of the operation object and the network environment characteristics of the file transfer client, a seamless identity authentication process can be achieved, which can not only ensure login security, but also reduce the number of user operations, thereby achieving a seamless login effect. User characteristics can be constructed in combination with verification time, verification location, operation habits, etc., and network environment characteristics can be constructed in combination with network environment, network type, device information, etc., and compared with historical user characteristics and historical network environment characteristics, thereby achieving seamless verification of the user (operation object) identity.

[0040] In the second step, in response to the above operation object passing the non-sensing identity authentication, it is determined whether the target isolation container exists in the isolation container pool.

[0041] The target isolated container is an isolated container in a dormant state. In practice, the isolated container can be a pre-built Docker container used to isolate different files to be transferred. Specifically, multiple isolated containers can be built on a file server to isolate and store files to be transferred uploaded by different file transfer clients. To avoid frequent reactivation of isolated containers that would affect response time, isolated containers are placed in a dormant state when not in use.

[0042] For example, see Figure 2The server architecture diagram shown in the figure shows that at least one file server, an allocation server and at least one ferry server can be set up in the intranet. The file server is used to receive files sent by the file transfer client or forward files to the file transfer client. The allocation server is used to allocate the corresponding ferry server to the files to be transferred stored in the file server, and monitor the working status and load pressure of the ferry server. The ferry server serves as an interface connected to the external network, and files are uniformly transmitted to the external network through the ferry server. In practice, the file server can be a virtual server or a hardware server. When the file server is a virtual server, multiple file servers can be configured on a single or multiple hardware servers. When the file server is a hardware server, a server cluster can be constructed in the form of a cluster. The ferry server can be a virtual server or a hardware server. When the ferry server is a virtual server, multiple ferry servers can be configured on a single or multiple hardware servers. When the ferry server is a hardware server, a server cluster can be constructed in the form of a cluster.

[0043] The third step is to load the file to be transferred into the target isolation container in response to the existence of the file.

[0044] In practice, before loading the transfer file, the target container needs to be awakened.

[0045] In the fourth step, in response to the completion of loading, the file to be transferred is scanned for viruses in the target isolation container.

[0046] In practice, a virus scanning plug-in can be integrated into the file server to scan files for viruses. For example, the OWL (Owl) virus detection engine can be used. It offers advantages such as fast scanning speed, low resource consumption, strong antivirus capabilities, strong platform compatibility, high configurability, and strong stability. It is well-suited for high-frequency file detection scenarios.

[0047] In a fifth step, in response to the file to be transferred passing the virus scan, a compliance check is performed on the file to be transferred based on the metafile information corresponding to the file to be transferred.

[0048] Among them, the metafile information represents the attribute information corresponding to the file to be transferred. In practice, the metafile information includes: file description information and ferry mode. The file description information includes: file type, file size, initiator identifier, initiator address, receiver identifier, receiver address, and file operation permission information. Among them, the file operation permission information is the operation permission for the file to be transferred, which is set by the person corresponding to the initiator identifier. In practice, first, the file type and file size included in the metafile information can be verified to identify untrusted file types or files to be transferred with abnormal file sizes. Secondly, the identity and address verification can be performed on the initiator identifier, initiator address, receiver identifier, and receiver address; then the file operation permission information can be verified to identify non-compliant permission settings such as unauthorized credit.

[0049] In the sixth step, in response to the operation object having K verification records of failing to pass the contactless identity authentication within a preset time period, the communication address corresponding to the file transfer client is blocked.

[0050] In practice, a higher frequency of identity authentication will increase the data processing pressure of the server, such as DDoS attacks. Therefore, it is necessary to block the communication addresses corresponding to the file transfer clients that have failed the non-sensory identity authentication multiple times, and update the communication addresses to the gray list. By manually checking the communication addresses, it is determined whether to remove the communication addresses from the gray list (reply to the communication address corresponding to the file transfer client to initiate a request) or move the communication addresses to the blacklist (to permanently prohibit the communication address corresponding to the file transfer client from initiating a request).

[0051] Step 102: Determine whether a target file template exists based on the file structure information.

[0052] In some embodiments, the execution subject can determine whether a target file template exists based on the file structure information. In practice, the target file template is a file template that matches the file to be transferred. Specifically, in the file transfer scenario of a hospital, the file to be transferred is often obtained by filling in a template. By determining the target file template, the subsequent separation of the template content and the text content can be facilitated. In practice, the Word2Vec model can be used to convert the file structure information into a file feature code, and the target file template can be determined by performing a similarity calculation with the file feature code corresponding to the file template in the pre-built file template library.

[0053] Optionally, the file structure information includes: a text block location information set, where the text block location information represents the location of the corresponding text block in the file to be transferred. In practice, the text block location information represents the location of the text block in the file to be transferred. Specifically, the text block location information can be represented by the coordinates of the four corner points of the text block.

[0054] In some optional implementations of some embodiments, the execution entity determines whether a target file template exists according to the file structure information, including:

[0055] In the first step, for each text block location information in the above text block location information set, perform the following processing steps:

[0056] The first sub-step is to determine the area ratio of the text block area corresponding to the text block position information to the text area area corresponding to the file to be transferred.

[0057] In practice, the text block area refers to the area enclosed by the coordinates of the four corner points included in the text block location information. The text area area refers to the area corresponding to the text content contained in the file to be transferred. Specifically, the text area area can be calculated as the sum of the areas of the text blocks corresponding to the text block location information set. Here, the area ratio = text block area / text area.

[0058] For example, see Figure 3 The schematic diagram of the relative file fingerprint generation process is shown, where the file to be transferred corresponds to 4 text block position information, and the 4 text block position information corresponds to text block A, text block B, text block C and text block D respectively.

[0059] The second sub-step is to determine a local text segment group within the text block area corresponding to the above text block position information.

[0060] The number of local text segments in the local text segment group is obtained by the above-mentioned area ratio mapping. In practice, the larger the area ratio, the more text is contained in the region representing the text block, so more local text segments need to be extracted. The smaller the area ratio, the less text is contained in the region representing the text block, so the number of local text segments to be extracted needs to be reduced. Specifically, text recognition can be performed only on the text within the local text segment through OCR recognition, so as to reduce the time consumption of text recognition.

[0061] For example, see further Figure 4 , where, since the corresponding area ratio of text block B and text block C is greater than the corresponding area ratio of text block A and text block D, text block A includes: local text segment A1. Text block B includes: local text segment B1 and local text segment B2. Text block C includes: local text segment C1 and local text segment C2. Text block D includes: local text segment D1. Therefore, only local text segment A1, local text segment B1, local text segment B2, local text segment C1, local text segment C2, and local text segment D1 need to be OCR-recognized.

[0062] The third step is to generate a relative file fingerprint corresponding to the above-mentioned file to be transferred based on the obtained set of local text segment groups.

[0063] In practice, a relative file fingerprint is a file signature code for the file to be transferred, constructed by combining a set of local text segments. Specifically, a relative file fingerprint includes a local text segment position encoding and a local text segment content encoding. For local text segments, the Word2Vec model can be used to encode the text contained in the local text segment. The local text segment position encoding is constructed using the center coordinates of the corresponding position in the local text segment.

[0064] The fourth step is to perform file template matching in a pre-built file template library based on the relative file fingerprint to determine whether the target file template exists.

[0065] In practice, the first to third steps above can be used to construct the file template fingerprint corresponding to the file template library, and determine whether the target file template exists by calculating the feature similarity between the relative file fingerprint and the file template fingerprint.

[0066] Specifically, when the amount of text in a file is large, the conventional word-by-word matching method requires a very large amount of data to be matched. Therefore, the present invention optimizes the corresponding algorithm, that is, first locating the text block according to the file structure, and then determining the number of local texts that need to be identified based on the relative ratio of the area of ​​the text block to the entire file, thereby reducing the amount of data processing in the process of identifying and matching text. In particular, considering the relative position relationship between local text segments in the text block and the relative position relationship between text blocks, it is possible to combine conventional text matching with the local text segment position coding to match file templates from both semantic and structural perspectives.

[0067] Step 103 : In response to the existence of the target file, the file to be transferred is separated into file contents according to the target file template and the first text positioning model to obtain the target file.

[0068] In some embodiments, the execution subject may, in response to the existence, separate the file content of the file to be transferred according to the target file template and the first text positioning model to obtain the target file. The first text positioning model may be a model for identifying non-template content in the file to be transferred. In practice, under the premise of ensuring positioning accuracy, in order to improve positioning speed, a one-stage lightweight text positioning model may be adopted. The target file is a file containing non-template content in the file to be transferred. For example, the target file may include: indicator values, handwritten characters, etc.

[0069] Optionally, the first text localization model includes: a low receptive field feature extraction module, a high receptive field feature extraction module, and a text localization module. In practice, the low receptive field feature extraction model can be composed of three layers of serially connected convolutional layers. In particular, the convolutional layers in the low receptive field feature extraction module use smaller convolution kernels (for example, 1×1 or 3×3 convolution kernels) to achieve feature extraction from a global perspective from the perspective of the entire file to be transmitted. The high receptive field feature extraction model can be composed of five layers of serially connected convolutional layers. In particular, the high receptive field feature extraction module uses larger convolution kernels (for example, 5×5) to achieve feature extraction from a local perspective from the perspective of the region of interest. The text localization module consists of: one convolutional layer, one maximum pooling layer (Max-Pooling layer), and one Softmax layer. The lightweight first text localization model can quickly perform text localization with low data processing overhead.

[0070] In some optional implementations of some embodiments, the execution subject separates the file content of the file to be transferred according to the target file template and the first text positioning model to obtain the target file, including:

[0071] In the first step, the region of interest is determined based on the text filling bits in the target file template.

[0072] In practice, the present disclosure quickly locates areas that may contain non-template content by combining text filling positions. Compared with the method of using neural networks for feature extraction and positioning, it can achieve rapid and rough positioning of the area of ​​interest and effectively reduce the amount of data processing.

[0073] In the second step, text features of the file to be transmitted are extracted using the low receptive field feature extraction module to generate a first feature map.

[0074] In practice, three layers of serially connected convolutional layers are used to extract features of the files to be transmitted from a global perspective.

[0075] In the third step, the feature values ​​of the corresponding positions of the non-interested regions in the first feature map are initialized using the above-mentioned regions of interest to obtain a second feature map.

[0076] In practice, the execution entity can set the features in the first feature map outside the region of interest to 0. This prevents the feature values ​​outside the region of interest from participating in subsequent feature value calculations, which not only greatly improves the calculation speed but also allows for rapid focus on features corresponding to locations that may contain non-template content.

[0077] In the fourth step, a third feature map is generated based on the low receptive field feature extraction module and the second feature map.

[0078] Step 5: Generate the target file based on the text positioning module and the third feature map.

[0079] Step 104 : Generate a chain invisible watermark according to the template identifier corresponding to the target file template, the metafile information corresponding to the file to be transferred, and the target file.

[0080] In some embodiments, the execution entity may generate a chain invisible watermark in various ways based on the template identifier corresponding to the target file template, the metafile information corresponding to the file to be transferred, and the target file. A chain invisible watermark refers to a watermark that stores invisible watermark information in a chain.

[0081] In some optional implementations of some embodiments, the execution entity generates a chain invisible watermark according to the template identifier corresponding to the target file template, the metafile information corresponding to the file to be transferred, and the target file, including:

[0082] The first step is to perform MD5 hashing on the file signature code corresponding to the target file to obtain a first hash identifier.

[0083] In practice, text signatures are often high-dimensional, one-dimensional feature vectors. However, invisible watermark embedding is limited by file size; that is, the number of embedded characters is related to the file size. To ensure robustness of the embedding process, the invisible watermark character count needs to be compressed as much as possible. Therefore, the character length of the text signature is compressed using MD5 hashing.

[0084] The second step is to generate a first verification code corresponding to the first hash identifier.

[0085] In practice, the first hash identifier can be converted into a decimal string. Then, the decimal string can be converted into a byte string. Then, the CRC (Cyclic Redundancy Check) value corresponding to the byte string is calculated using the crcmod module as the first checksum.

[0086] As an example, see the following pseudocode:

[0087] import hashlib

[0088] import crcmod

[0089] FileCharCode= File Character Code

[0090] hasher = hashlib.md5()

[0091] hasher.update(FileCharCode.encode('utf-8'))

[0092] FirstHashTag (first hash tag) = hasher.hexdigest()

[0093] crc32_func = crcmod.mkCrcFun(0x104C11DB7, initCrc=0, xorOut=0xFFFFFFFF)

[0094] CrcCode (first check code) = crc32_func(FirstHashTag.encode('utf-8'))

[0095] The third step is to perform MD5 hash processing on the above metafile information to obtain a second hash identifier.

[0096] In practice, since the original file information also contains a lot of characters, it is also necessary to compress the characters by MD5 hashing. Specifically, the method for generating the second hash identifier can refer to the method for generating the first hash identifier, and will not be repeated here.

[0097] The fourth step is to generate a second verification code corresponding to the second hash identifier.

[0098] In practice, the second verification code may be generated by referring to the method for generating the first verification code, which will not be described in detail here.

[0099] Step 5: Perform MD5 hashing on the template identifier to obtain a third hash identifier.

[0100] In practice, the third hash identifier may be generated by referring to the method for generating the first hash identifier, which will not be described in detail here.

[0101] Step 6: Generate a third verification code corresponding to the third hash identifier.

[0102] In practice, the third verification code may be generated by referring to the generation method of the first verification code, which will not be described in detail here.

[0103] Step 7: Determine the first filling area, the second filling area, and the third filling area.

[0104] The first filling area is used to embed a first check code, the second filling area is used to embed a second check code, and the third filling area is used to embed a third check code.

[0105] In practice, two non-intersecting regions in the file to be transmitted can be randomly selected as the first filling region and the second filling region, respectively. The third filling region is a fixed position in the file to be transmitted (such as the upper left corner).

[0106] In the eighth step, the position of the area corresponding to the first filling area is encrypted to obtain first position information.

[0107] In practice, a position offset method may be used to encrypt the position of the area corresponding to the first filling area to obtain the first position information.

[0108] In the ninth step, the position of the area corresponding to the second filling area is encrypted to obtain second position information.

[0109] In practice, a position offset method may be used to encrypt the position of the area corresponding to the second filling area to obtain the second position information.

[0110] In the tenth step, the chain invisible watermark is constructed according to the first check code, the second check code, the third check code, the first position information and the second position information.

[0111] The chain invisible watermark includes: binary A, binary B and binary C, wherein binary A is used to store the third check code and the second position information, binary B is used to store the second check code and the first position information, and binary C is used to store the first check code, wherein the position information of binary C is empty, and binary A, binary B and binary C are chain-linked through the included position information.

[0112] For example, see Figure 4The diagram shows the positional relationship between a chained invisible watermark and a file to be transmitted. The file to be transmitted includes a first padding area, a second padding area, and a third padding area. The first padding area is used to fill binary A in the chained invisible watermark. The second padding area is used to fill binary B in the chained invisible watermark. The third padding area is used to fill binary C in the chained invisible watermark. Binary A is linked to binary B via the included second position information. Binary B is linked to binary C via the included first position information. In particular, during the subsequent anti-tampering verification process, since the first padding area is fixed, the third check code is first used to verify whether the file template has been tampered with. If tampering has occurred, subsequent verification is not performed, and the file is directly deemed to have been tampered with after the watermark is embedded. If the third check code indicates no tampering, the position is de-shifted using the second position information to determine the position of the second padding area. The second check code included in binary B embedded in the second padding area is then used to verify whether the meta-file information has been tampered with. If tampering has occurred, subsequent verification is not performed, and the file is directly deemed to have been tampered with after the watermark is embedded. When the second check code indicates that there is no tampering, the position is reversed through the first position information to obtain the position of the third filling area, and the first check code included in the tuple C filled in the third filling area is used to verify whether the target file has been tampered with. When tampering exists, it is determined that the file has been tampered with after the watermark is embedded.

[0113] Step 105: embed the chain invisible watermark into the file to be transmitted to obtain the watermark-embedded file.

[0114] In some embodiments, the execution entity may embed the chain invisible watermark into the file to be transmitted to obtain the watermark-embedded file. In practice, the content overlay method may be used to embed the chain invisible watermark into the file to be transmitted to obtain the watermark-embedded file.

[0115] In some optional implementations of some embodiments, the execution entity embeds the chain invisible watermark into the file to be transmitted to obtain the watermark-embedded file, including:

[0116] In the first step, two-dimensional Fourier transform is performed on the first filling area, the second filling area and the third filling area respectively to obtain the transformed first filling area, the transformed second filling area and the transformed third filling area.

[0117] In the second step, the above-mentioned binary group A is superimposed on the first filling area after the above-mentioned transformation, the above-mentioned binary group B is superimposed on the second filling area after the above-mentioned transformation, and the above-mentioned binary group C is superimposed on the third filling area after the above-mentioned transformation to obtain the first filling area after superposition, the second filling area after superposition, and the third filling area after superposition.

[0118] The third step is to perform a two-dimensional inverse Fourier transform on the first filling area after addition, the second filling area after superposition, and the third filling area after superposition to obtain the watermark-embedded file.

[0119] Step 106: Allocate a ferry server that matches the file to be transferred through the allocation server according to the metafile information.

[0120] In some embodiments, the above-mentioned execution entity can allocate a ferry server that matches the file to be transferred through an allocation server based on the metafile information. The metafile information includes: file description information and ferry mode, and the ferry mode includes: immediate mode and delayed mode. The immediate mode represents real-time cross-network transmission of the file to be transferred. The delayed mode represents delayed cross-network transmission of the file to be transferred. In particular, the allocation server can capture events such as creation and modification of files on the disk by continuously and actively monitoring changes in the disk used to store the files to be transferred in the file server, thereby automatically performing file ferrying.

[0121] For example, see Figure 5 Another server architecture diagram is shown, in which the ferry server may include: ferry server A and ferry server B. Ferry server A is used to perform cross-network transmission of watermarked files in immediate mode. Ferry server B is used to perform cross-network transmission of watermarked files in delayed mode. Specifically, the allocation server determines the ferry server that matches the file to be transferred based on the ferry mode included in the metafile information, and feeds back a transmission instruction to the file server, causing the file server to transfer the watermarked file to the ferry server (ferry server A or ferry server B). When there are multiple ferry servers, for example, multiple ferry servers for immediate mode and multiple ferry servers for delayed mode, the allocation server communicates with the ferry server to confirm the current status of the ferry server, thereby determining the ferry server that matches the file to be transferred from the multiple ferry servers for the same ferry mode. To reduce communication overhead, the ferry server periodically synchronizes the server status with the allocation server to update the current status.

[0122] Step 107: According to the ferry mode, the watermark-embedded file is transmitted across the network to the external storage space through the ferry server.

[0123] In some embodiments, the execution subject can transmit the watermark-embedded file across the network to an external storage space through a ferry server according to the ferry mode. In practice, when the ferry mode is the immediate mode, the watermark-embedded file is directly transmitted across the network to the external storage space through the ferry server. When the ferry mode is the delayed mode, by controlling the delay timer, when the transmission time point is reached, the watermark-embedded file is transmitted across the network to the external storage space through the ferry server. By uniformly storing the files in the external storage space, users with external network access can directly access the external storage space to read the files.

[0124] Optionally, to further ensure the robustness of cross-network file transfers, a manual approval trigger rule can be set before cross-network transfer to automatically trigger manual approval. After qualified manual approval, cross-network transfer can then be performed through the ferry server. In addition, starting from the receipt of the cross-network file transfer request, each automated operation in steps 101 to 107 will generate an operation record and store it in the log system to achieve the purpose of leaving a trace of file exchange and facilitate subsequent problem tracking. In particular, corresponding message encryption is performed during the file transfer process (for example, through asymmetric encryption) to avoid information leakage problems that exist in plaintext transmission.

[0125] Optionally, for the process of transferring data from the external network to the internal network, the data can be transferred from the external network to the internal network in reverse through the ferry server by setting file permissions and recipient information (for example, recipient name, department name, internal network account, etc.).

[0126] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: through the cross-network file transmission method of some embodiments of the present disclosure, efficient and secure cross-network data transmission is achieved. Specifically, first, in response to the file to be transmitted passing the compliance check, the file structure information of the above-mentioned file to be transmitted is determined, wherein the above-mentioned file to be transmitted is a file uploaded by the operation object that has passed the senseless identity authentication. Compliance checks are used to avoid cross-network transmission of sensitive data, and the file structure information is determined under the condition that the compliance check is passed. Secondly, based on the above-mentioned file structure information, it is determined whether there is a target file template, wherein the above-mentioned target file template is a file template that matches the above-mentioned file to be transmitted. Then, in response to the existence, the file content of the above-mentioned file to be transmitted is separated according to the above-mentioned target file template and the first text positioning model to obtain the target file. In practice, in the file transmission scenario of the hospital, the file to be transmitted is often obtained by filling in the template. By combining the template and the text positioning model, the separation of text content and template content can be achieved. Furthermore, a chained invisible watermark is generated based on the template identifier corresponding to the target file template, the metafile information corresponding to the file to be transferred, and the target file. The chained invisible watermark has a chained structure, and the metafile information includes file description information and a ferrying mode, with the ferrying modes including immediate and delayed modes. Next, the chained invisible watermark is embedded into the file to be transferred, resulting in a watermark-embedded file. In practice, file transfers may present a risk of tampering. Generating a chained invisible watermark provides more effective anti-tampering protection. Furthermore, the chained invisible watermark eliminates the need to verify the entire file to be transferred during subsequent tamper-proof verification. Instead, each file is verified individually in a chained manner. If a verification error occurs, verification is terminated, eliminating the need to verify subsequent unverified portions. This improves verification efficiency and reduces data processing during the verification process. Furthermore, based on the metafile information, a ferrying server matching the file to be transferred is assigned via an allocation server. By setting up a distribution server, we can automatically schedule and distribute files to be transferred, avoiding the problem of excessive load on a single distribution server in high-volume data transfer scenarios. Finally, according to the ferry mode, the ferry server transfers the watermarked files across the network to external storage space. This achieves efficient and secure cross-network data transmission.

[0127] Further references Figure 6 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a device for transmitting files across networks. These device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the device for transmitting files across networks can be specifically applied to various electronic devices.

[0128] like Figure 6As shown, some embodiments of the cross-network file transmission device 600 include: a first determination unit 601, a second determination unit 602, a file content separation unit 603, a generation unit 604, an embedding unit 605, an allocation unit 606 and a cross-network transmission unit 607. The first determination unit 601 is configured to determine the file structure information of the file to be transmitted in response to the file to be transmitted passing the compliance check, wherein the file to be transmitted is a file uploaded by the operation object that has passed the senseless identity authentication; the second determination unit 602 is configured to determine whether there is a target file template based on the file structure information, wherein the target file template is a file template that matches the file to be transmitted; the file content separation unit 603 is configured to perform file content separation on the file to be transmitted according to the target file template and the first text positioning model in response to the existence of the target file template to obtain the target file; the generation unit 604 is configured to determine the target file template based on the template corresponding to the target file template. The board identification, the metafile information corresponding to the above-mentioned file to be transmitted and the above-mentioned target file are used to generate a chain invisible watermark, wherein the above-mentioned chain invisible watermark is an invisible watermark of a chain structure, wherein the above-mentioned metafile information includes: file description information and ferry mode, and the ferry mode includes: immediate mode and delayed mode; the embedding unit 605 is configured to embed the above-mentioned chain invisible watermark into the above-mentioned file to be transmitted to obtain the watermark-embedded file; the allocation unit 606 is configured to allocate a ferry server matching the above-mentioned file to be transmitted through the allocation server according to the above-mentioned metafile information; the cross-network transmission unit 607 is configured to transmit the above-mentioned watermark-embedded file across the network to the external storage space through the ferry server according to the ferry mode.

[0129] It is understandable that the units recorded in the file cross-network transmission device 600 and the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the cross-network file transmission device 600 and the units included therein, and will not be repeated here.

[0130] Reference below Figure 7 , which shows a structural schematic diagram of an electronic device (eg, a computing device) suitable for implementing some embodiments of the present disclosure. Figure 7 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure. Figure 7As shown, the computer device includes a processor, a memory and a network interface connected via a system bus, wherein the memory may include a non-volatile storage medium and an internal memory. The non-volatile storage medium may store an operating system and a computer program. The computer program includes program instructions, which, when executed, may enable the processor to execute any of the above methods. The processor is used to provide computing and control capabilities to support the operation of the entire computer device. The internal memory provides an environment for the operation of the computer program in the non-volatile storage medium, which, when executed by the processor, may enable the processor to execute any of the above methods. The network interface is used for network communication, such as sending assigned tasks, etc. Those skilled in the art will understand that Figure 7 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present disclosure, and does not constitute a limitation on the computer device to which the solution of the present disclosure is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0131] It should be understood that the processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0132] In one embodiment, the processor is configured to run a computer program stored in a memory to implement the following steps: in response to a file to be transferred passing a compliance check, determining file structure information of the file to be transferred, wherein the file to be transferred is a file uploaded by an operation object that has passed a senseless identity verification; determining whether a target file template exists based on the file structure information, wherein the target file template is a file template that matches the file to be transferred; in response to the existence of a target file template, separating the file content of the file to be transferred based on the target file template and a first text positioning model to obtain a target file; and determining whether a target file template exists based on the target file template and a first text positioning model to obtain a target file. A chain invisible watermark is generated by using the template identifier corresponding to the target file template, the metafile information corresponding to the above-mentioned file to be transmitted and the above-mentioned target file, wherein the above-mentioned chain invisible watermark is an invisible watermark of a chain structure, wherein the above-mentioned metafile information includes: file description information and ferry mode, and the ferry mode includes: immediate mode and delayed mode; the above-mentioned chain invisible watermark is embedded in the above-mentioned file to be transmitted to obtain a watermark-embedded file; according to the above-mentioned metafile information, a ferry server matching the above-mentioned file to be transmitted is allocated through an allocation server; according to the ferry mode, the above-mentioned watermark-embedded file is transmitted across the network to an external storage space through the ferry server.

[0133] An embodiment of the present disclosure also provides a computer-readable storage medium, on which a computer program is stored. The computer program includes program instructions. The method implemented when the program instructions are executed can refer to the various embodiments of the cross-network transmission method of the present disclosure.

[0134] The computer-readable storage medium may be an internal storage unit of the computer device described in the aforementioned embodiment, such as a hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a SmartMedia Card (SMC), a Secure Digital (SD) card, a flash memory card, etc., provided on the computer device.

[0135] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0136] The above descriptions are merely some preferred embodiments of the present disclosure and illustrate the underlying technical principles. Those skilled in the art should understand that the scope of the invention encompassed by the embodiments of the present disclosure is not limited to technical solutions formed by specific combinations of the aforementioned technical features. It also encompasses other technical solutions formed by any combination of the aforementioned technical features or their equivalents, without departing from the aforementioned inventive concept. For example, a technical solution formed by replacing the aforementioned features with (but not limited to) technical features with similar functions disclosed in the embodiments of the present disclosure.

Claims

1. A method for transmitting files across networks, characterized in that: include: In response to the file to be transferred passing the compliance check, determining file structure information of the file to be transferred, wherein the file to be transferred is a file uploaded by the operation object that has passed the non-sensing identity authentication; Determining whether a target file template exists according to the file structure information, wherein the target file template is a file template that matches the file to be transferred; In response to the existence of the target file, separating the file content of the file to be transferred according to the target file template and the first text positioning model to obtain the target file; Generate a chain invisible watermark according to the template identifier corresponding to the target file template, the metafile information corresponding to the file to be transferred, and the target file, wherein the chain invisible watermark is an invisible watermark with a chain structure, wherein the metafile information includes: file description information and ferry mode, and the ferry mode includes: immediate mode and delayed mode; Embedding the chain invisible watermark into the file to be transmitted to obtain a watermark-embedded file; Allocating a ferry server matching the file to be transferred through an allocation server according to the metafile information; According to the ferry mode, the watermark-embedded file is transmitted across the network to an external storage space through a ferry server.

2. The method according to claim 1, characterized in that Before determining the file structure information of the file to be transferred, the method further includes: In response to an operation object initiating a cross-network file transfer request through a file transfer client, performing a senseless identity verification on the operation object, wherein the file transfer client and the operation object are bound to each other; In response to the operation object passing the senseless identity authentication, determining whether a target isolation container exists in the isolation container pool, wherein the target isolation container is an isolation container in a dormant state; In response to existence, loading the file to be transferred into the target isolation container; In response to the completion of loading, performing a virus scan on the file to be transferred in the target isolation container; In response to the file to be transferred passing the virus scan, performing a compliance check on the file to be transferred based on metafile information corresponding to the file to be transferred; In response to the operation object having K verification records of failing to pass the contactless identity authentication within a preset time period, the communication address corresponding to the file transfer client is blocked.

3. The method according to claim 2, characterized in that The file structure information includes: a text block position information set, the text block position information representing the position of the corresponding text block in the file to be transmitted; and The determining whether a target file template exists according to the file structure information includes: For each piece of text block position information in the text block position information set, perform the following processing steps: Determining an area ratio of the text block area corresponding to the text block position information to the text area area corresponding to the file to be transferred; Determining a local text segment group within the text block area corresponding to the text block position information, wherein the number of local text segments in the local text segment group is obtained by mapping the area ratio; Generating a relative file fingerprint corresponding to the file to be transferred according to the obtained set of local text segment groups; According to the relative file fingerprint, file template matching is performed in a pre-built file template library to determine whether the target file template exists.

4. The method according to claim 3, characterized in that The first text localization model includes: a low receptive field feature extraction module, a high receptive field feature extraction module and a text localization module; and The step of separating the file content of the file to be transferred according to the target file template and the first text positioning model to obtain the target file includes: Determining a region of interest based on text fill bits in the target file template; Performing text feature extraction on the file to be transmitted by the low receptive field feature extraction module to generate a first feature map; Initializing the feature values ​​of the positions corresponding to the non-interested regions in the first feature map using the region of interest to obtain a second feature map; generating a third feature map according to the low receptive field feature extraction module and the second feature map; The target file is generated according to the text positioning module and the third feature map.

5. The method according to claim 4, characterized in that Generating a chain invisible watermark according to the template identifier corresponding to the target file template, the metafile information corresponding to the file to be transmitted, and the target file includes: Performing MD5 hashing on the file signature code corresponding to the target file to obtain a first hash identifier; Generating a first verification code corresponding to the first hash identifier; Performing MD5 hash processing on the metafile information to obtain a second hash identifier; Generating a second verification code corresponding to the second hash identifier; Performing MD5 hashing on the template identifier to obtain a third hash identifier; Generating a third verification code corresponding to the third hash identifier; Determine a first padding area, a second padding area, and a third padding area, wherein the first padding area is used to embed a first check code, the second padding area is used to embed a second check code, and the third padding area is used to embed a third check code; Encrypting the area position corresponding to the first filling area to obtain first position information; Encrypting the area position corresponding to the second filling area to obtain second position information; The chain invisible watermark is constructed according to the first check code, the second check code, the third check code, the first position information and the second position information, wherein the chain invisible watermark includes: binary group A, binary group B and binary group C, wherein binary group A is used to store the third check code and the second position information, binary group B is used to store the second check code and the first position information, and binary group C is used to store the first check code, wherein the position information of binary group C is empty, and binary group A, binary group B and binary group C are chain-linked through the included position information.

6. The method according to claim 5, characterized in that The step of embedding the chain invisible watermark into the file to be transmitted to obtain the watermark-embedded file includes: Performing a two-dimensional Fourier transform on the first filling area, the second filling area, and the third filling area respectively to obtain a transformed first filling area, a transformed second filling area, and a transformed third filling area; Respectively superimposing the binary group A onto the transformed first filling region, superimposing the binary group B onto the transformed second filling region, and superimposing the binary group C onto the transformed third filling region to obtain a superimposed first filling region, a superimposed second filling region, and a superimposed third filling region; Performing a two-dimensional inverse Fourier transform on the first filling area after addition, the second filling area after superposition, and the third filling area after superposition to obtain the watermark-embedded file.

7. A device for transmitting files across networks, characterized in that: include: A first determining unit is configured to determine file structure information of the file to be transferred in response to the file to be transferred passing the compliance check, wherein the file to be transferred is a file uploaded by the operation object that has passed the non-sensing identity authentication; a second determining unit configured to determine whether a target file template exists according to the file structure information, wherein the target file template is a file template that matches the file to be transferred; A file content separation unit is configured to, in response to the existence, separate the file content of the file to be transferred according to the target file template and the first text positioning model to obtain a target file; a generating unit configured to generate a chain invisible watermark according to a template identifier corresponding to the target file template, metafile information corresponding to the file to be transferred, and the target file, wherein the chain invisible watermark is an invisible watermark with a chain structure, wherein the metafile information includes: file description information and a ferry mode, and the ferry mode includes: an immediate mode and a delayed mode; an embedding unit configured to embed the chain invisible watermark into the file to be transmitted to obtain a watermark-embedded file; an allocating unit configured to allocate, through an allocating server, a ferry server matching the file to be transferred based on the metafile information; The cross-network transmission unit is configured to transmit the watermark-embedded file across the network to an external storage space through a ferry server according to a ferry mode.

8. An electronic device, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

9. A computer-readable medium, characterized in that A computer program is stored thereon, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images