Data docking method for confidential application system and non-confidential application system based on highly configurable component

Abstract

The invention provides a confidential application system and non-confidential application system data docking method based on a high configurable component, which can meet the requirements of three-member decentration, data transmission security, access control and whole process traceability (security audit) of data docking of a confidential application system and a non-confidential application system in a confidential network environment. The data interface development efficiency, flexibility, expansibility, safety and reliability are improved, and the method comprises the following steps that firstly, a data docking unified service configuration assembly is built; 2, a system administrator of the secret-related application system configures data docking technical parameters; 3, configuring a data docking security policy by a security administrator of the secret-related application system; 4, defining a data extraction service and a data pushing service by a system administrator of the secret-related application system; 5, a system administrator of the secret-related application system newly builds data extraction and data push service test cases and tests the test cases one by one; sixthly, the confidential application system and the non-confidential application system call data extraction and pushing services respectively; 7, carrying out sensitive information cleaning conversion on the data from the secret-related application system; 8, data encryption transmission; 9, receiving the data and carrying out decryption and integrity verification; 10, checking the butt joint data; and 11, auditing the operation of the system administrator in the steps 2, 4 and 5 and the operation log of the security administrator in the step 3 by the security auditor of the secret-related application system.

Description

Technical Field

[0001] This invention relates to the field of data interoperability technology for application systems of different security levels in a classified network environment, and is applicable to data interoperability between classified and unclassified applications. Specifically, it relates to a data interoperability method between classified and unclassified application systems based on highly configurable components. Background Technology

[0002] In a classified network environment, there exist both classified application systems that process classified business data and non-classified application systems that process non-classified business data. When classified and non-classified application systems need to integrate, higher requirements are placed on the security and reliability of the data connection mode. Technical measures are needed to prevent classified data from flowing from classified application systems to non-classified application systems. Configuration operations or traceability processes should be performed separately according to the permission division of the three personnel (system administrator, security administrator, and security auditor) of the classified application system. At the same time, the requirements for interface development efficiency, flexibility, scalability, security, and reliability when connecting data from multiple heterogeneous systems must be met.

[0003] Existing application system data integration technologies include database sharing, microservice architecture, message middleware, enterprise service bus, and API calls. Among these, database sharing cannot meet the granularity requirements of access control for confidential data, while microservice architecture, message middleware, and enterprise service bus are costly to build and have specific requirements for the application system architecture, making them unsuitable for widespread application. API calls, on the other hand, have no requirements for the application system architecture, offer good cross-platform compatibility, and are relatively inexpensive. Furthermore, RESTful APIs offer better security, are simpler and more flexible, and are easier to understand and apply than SOAP APIs, thus becoming the mainstream application system integration method.

[0004] While RESTful API technology is widely used for application system integration, differences in understanding and implementation among developers lead to inconsistent interface styles across application systems. This creates difficulties for client-side calls, integration development, and troubleshooting, ultimately failing to meet business needs for flexible and scalable data integration. Furthermore, classified network environments impose high standards on controlled data access, secure transmission, and security auditing, for which no product currently meets these requirements. Therefore, implementing data integration between classified and unclassified application systems necessitates improvements to existing technologies to address these specific needs. Summary of the Invention

[0005] To ensure the security and reliability of data interoperability between classified and unclassified application systems, further improve the flexibility and scalability of application systems, and enhance the efficiency of data interoperability development and troubleshooting, this invention proposes a data interoperability method between classified and unclassified application systems based on highly configurable components.

[0006] The technical implementation of this invention is as follows: First, a unified data interface service configuration component is built in the classified application system based on RESTful API technology. Various parameters are configured, and data extraction and push services are defined (the data extraction service specifically refers to data transmission from a non-classified application system to a classified application system, and the data push service specifically refers to data transmission from a classified application system to a non-classified application system). The interacting data is cleaned and encrypted before transmission. The application system requiring data interface calls the data extraction and push services and verifies the data integrity upon receiving the data. This unified data interface service configuration component uses the classified application system administrator for login authentication and logs the administrator's configuration operations, service calls, and data interactions.

[0007] A method for data interoperability between a classified application system and a non-classified application system based on highly configurable components is implemented through the following steps:

[0008] Step 1: Build a unified data integration service configuration component: In the classified application system, build a unified data integration service configuration component based on RESTful API technology. This component includes interfaces for configuring various system sites, system service interface sets, service interface functions, transmission keys, data push and extraction strategies, data scope, data cleaning rules, as well as interfaces for viewing service interface logs and testing client call test cases.

[0009] Step 2: System administrators of classified application systems configure data interface technical parameters: System administrators of classified application systems use the components built in Step 1 to configure data interface technical parameters, such as: system site, system service interface set, and system automatic recording of system administrator configuration operation logs.

[0010] Step 3: The security administrator of the classified application system configures the data connection security policy: The security administrator of the classified application system uses the components built in Step 1 to configure the data connection security policy, such as: defining the transmission key, data push and extraction policy, data range, and data cleaning rules. The system automatically records the security administrator's configuration operation log.

[0011] Step 4: The system administrator of the classified application system defines the data extraction service and the data push service. The system administrator uses the components built in Step 1 to define the data extraction service and the data push service. The system automatically records the system administrator's configuration operation log.

[0012] Step 5.1 The system administrator of the classified application system creates new test cases for the data extraction service and tests them one by one: The system administrator of the classified application system uses the components built in Step 1 to create new test cases for the data extraction service and tests them one by one. The system automatically records the administrator's configuration operation log. If the test fails, the problem is located by checking the log, the relevant parameters are adjusted, and then Step 5.1 is repeated. If the test is successful, proceed to Steps 6.1 and 6.2.

[0013] Step 5.2 The system administrator of the classified application system creates new data push service test cases and tests them one by one: The system administrator of the classified application system uses the components built in Step 1 to create new data push service test cases and tests them one by one. If the test fails, the problem is located by checking the logs, the relevant parameters are adjusted, and then Step 5.2 is repeated; if the test is successful, proceed to Steps 6.3 and 6.4.

[0014] Step 6.1 Classified application system calls data extraction service: The business process of the classified application system calls the data extraction service defined in step 4. If the result is successful, proceed to step 8.1; if the result fails, the system administrator of the classified application system locates the problem by checking the logs, adjusts the relevant parameters, and then repeats step 5.1.

[0015] Step 6.2 Non-classified application system calls data extraction service: The business process of non-classified application system calls the data extraction service defined in step 4. If the result is successful, proceed to step 8.1; if the result fails, the system administrator of the classified application system locates the problem by checking the logs, adjusts the relevant parameters, and then repeats step 5.1.

[0016] Step 6.3 Classified application system calls data push service: The business process of the classified application system calls the data push service defined in step 4. If the result is successful, proceed to step 7; if the result fails, the system administrator of the classified application system locates the problem by checking the logs, adjusts the relevant parameters, and then repeats step 5.2.

[0017] Step 6.4 Non-classified application system calls data push service: The business process of non-classified application system calls the data push service defined in step 4. If the result is successful, proceed to step 7; if the result fails, the system administrator of the classified application system will locate the problem by checking the logs, adjust the relevant parameters, and then repeat step 5.2.

[0018] Step 7 Cleaning and Transforming Data from Classified Application Systems: The components built in Step 1 clean and transform the sensitive information of the data from classified application systems obtained in Steps 6.3 and 6.4 according to the data cleaning rules defined in Step 3, and then proceed to Step 8.2.

[0019] Step 8.1 Encrypted data transmission to classified application system: The component built in Step 1 encrypts the data obtained from the non-classified application system in Steps 6.1 and 6.2 according to the transmission key defined in Step 3 and transmits it to the classified application system, then proceeds to Step 9.1.

[0020] Step 8.2 Encrypted data transmission to non-encrypted application system: The component built in Step 1 encrypts the data obtained in Step 7 according to the transmission key defined in Step 3 and transmits it to the non-encrypted application system, then proceeds to Step 9.2.

[0021] Step 9.1 The classified application system receives data and performs decryption and integrity verification: The classified application system decrypts and verifies the integrity of the data received in step 8.1 according to the transmission key defined in step 3. If the integrity verification fails, it proceeds to step 8.1; if the integrity verification passes, it proceeds to step 10.1.

[0022] Step 9.2 The non-classified application system receives data and performs decryption and integrity verification: The non-classified application system decrypts and verifies the integrity of the data received in step 8.2 according to the transmission key defined in step 3. If the integrity verification fails, it proceeds to step 8.2; if the integrity verification passes, it proceeds to step 10.2.

[0023] Step 10.1 Verify the data connection of the classified application system: The user of the classified application system verifies whether the data obtained in step 9.1 meets the expectations. If it does not meet the expectations, the system administrator of the classified application system locates the problem by checking the logs, adjusts the relevant parameters, and repeats step 5.1. If it meets the expectations, the data connection is successful.

[0024] Step 10.2 Verify the data connection for non-classified application systems: Users of non-classified application systems verify whether the data obtained in step 9.2 meets expectations. If it does not, the system administrator of the classified application system locates the problem by checking the logs, adjusts the relevant parameters, and then repeats step 5.2. If it meets the expectations, the data connection is successful.

[0025] Step 11: Audit administrator operations: The security auditor for classified application systems audits the system administrator's operations in steps 2, 4, and 5, as well as the operation logs made by the security administrator in step 3.

[0026] The beneficial effects of this invention are:

[0027] This invention proposes a unified data interface configuration component based on RESTful API technology. After a single deployment and parameter configuration, it can be invoked by multiple application systems, enabling data integration between multiple non-classified and classified application systems, regardless of the application system platform's technical architecture. The component includes interfaces for configuring each application system's site, system service interface set, service interface functions, transmission keys, data push and extraction strategies, data range, and data cleaning rules, as well as interfaces for viewing service interface logs and testing client call test cases. This eliminates the need for writing code when developing data interfaces for heterogeneous application systems, as the configuration interface is simple and easy to use. Compared to the previous approach of deploying multiple interfaces with different styles for each application system, this invention significantly reduces the development workload and difficulty of data integration between non-classified and classified application systems, improves the efficiency of data interface development, and enhances the flexibility and scalability of application systems.

[0028] This component allows for the configuration of data ranges and provides data cleaning and encrypted transmission functions. When it is necessary to extract data from classified application systems, by defining the data range and keyword replacement rules (data cleaning rules), it is possible to extract and clean up sensitive information from specified non-classified data in classified application systems. This can effectively solve the risk problem of classified data flowing from classified application systems to non-classified application systems during data exchange and can meet the controlled data access requirements for the exchange between classified and non-classified application systems in a classified network environment.

[0029] This invention proposes a unified data interface configuration component based on RESTful API technology, separating the interface interface configuration parameters, security policy configuration interface, and administrator log interface. System administrators can operate the data interface configuration and service execution log interface, security administrators can operate the security policy definition interface, and security auditors can view the logs of both system administrators and security administrators, thus meeting the requirements of separation of permissions and mutual checks and balances among these three personnel in a classified network environment.

[0030] This invention proposes a unified service configuration component for data integration based on RESTful API technology. The configuration operations of administrators and the system execution logs enable full traceability of the data interface configuration, service calls, and data interaction process. This can effectively prevent harm that may be caused by intentional violations and can meet the data security audit requirements for the integration of classified and unclassified application systems in a classified network environment.

[0031] This invention proposes a unified service configuration component for data integration based on RESTful API technology. This component encrypts and verifies the integrity of data transmitted from heterogeneous application systems, preventing the data from being illegally obtained or tampered with. It can meet the data security transmission requirements for the integration of classified and unclassified application systems in a classified network environment.

[0032] This invention proposes a unified data integration service configuration component based on RESTful API technology. It can configure test cases for data integration services, which can help developers quickly locate data integration problems during the data integration process and greatly improve the efficiency of system fault diagnosis. Attached Figure Description

[0034] Figure 1 This is a schematic diagram of the data interface process between a classified application system and a non-classified application system based on highly configurable components, as proposed in this invention.

[0035] Figure 2 This is a schematic diagram of the functional structure of the unified data docking service configuration component proposed in this invention. Detailed Implementation

[0037] This invention discloses a data interface method for classified and unclassified application systems based on highly configurable components. Taking the data interface between an operational control system (classified application system) and a comprehensive management system (unclassified application system) as an example, the comprehensive management system needs to access the basic project information and project budget data of the operational control system, while the operational control system needs to access the project materials and contract data of the comprehensive management system. Therefore, a data interface is established between the operational control system (classified application system) and the comprehensive management system (unclassified application system) (see process details). Figure 1 The specific steps are as follows:

[0038] Step 1: Build a unified configuration component: In the operation and management system (classified application system), build a unified service configuration component for data integration based on RESTful API technology (see functional structure). Figure 2 ).

[0039] Step 2: Configure data integration technical parameters: The system administrator of the operation and management system (classified application system) uses the unified service configuration component for data integration to configure data integration technical parameters, specifically including: system site, system service interface set, and the system automatically records the system administrator's configuration operation log.

[0040] Step 3 Configure data connection security policy: The security administrator of the operation and management system (classified application system) uses the unified service configuration component for data connection to configure the data connection security policy, such as: defining the transmission key, data push and extraction policy, data range, and data cleaning rules. The system automatically records the security administrator's configuration operation log.

[0041] Step 4: Define data extraction and data push services: The system administrator of the operation and control system (classified application system) uses the unified service configuration component for data interface to define the service for extracting material and contract data from the comprehensive management system (non-classified application system) and the service for pushing basic project information and project budget data from the operation and control system (classified application system). The system automatically records the system administrator's configuration operation log.

[0042] Step 5.1 Create new test cases for data extraction services and test them one by one: The system administrator of the operation and management system (classified application system) applies the unified service configuration component for data integration, creates test cases for material data extraction services and contract data extraction services, and tests them one by one. The system automatically records the administrator's configuration operation log. If the test fails, locate the problem by checking the log, adjust the relevant parameters, and repeat step 5.1. If the test is successful, proceed to steps 6.1 and 6.2.

[0043] Step 5.2 Create new data push service test cases and test them one by one: The system administrator of the business management system (classified application system) applies the unified service configuration component for data docking, creates new test cases for project basic information and project budget data push services and tests them one by one. If the test fails, locate the problem by checking the logs, adjust the relevant parameters, and repeat step 5.2; if the test is successful, proceed to steps 6.3 and 6.4.

[0044] Step 6.1 Data extraction service called by classified application system: The operation of querying project funding execution status in the business management system (classified application system) triggers the call to the corresponding project material and contract data extraction service. If the result is successful, proceed to step 8.1; if the result fails, the system administrator of the business management system (classified application system) locates the problem by checking the logs, adjusts the relevant parameters, and then repeats step 5.1.

[0045] Step 6.2 Non-classified application system calls data extraction service: After the contract and material application process of the integrated management system (non-classified application system) is completed, the corresponding material and contract data extraction service is called. If the result is successful, proceed to step 8.1; if the result fails, the system administrator of the operation control system (classified application system) will locate the problem by checking the logs, adjust the relevant parameters, and then repeat step 5.1.

[0046] Step 6.3 Data Push Service Called by Classified Application System: After the project initiation process of the Business Management System (Classified Application System) is completed, the basic information data push service of the project is called. If the result is successful, proceed to step 7; if the result fails, the system administrator of the Business Management System (Classified Application System) will locate the problem by checking the logs, adjust the relevant parameters, and then repeat step 5.2.

[0047] Step 6.4 Non-classified application system calls data push service: The material application and contract application process of the integrated management system (non-classified application system) triggers the call to the project budget data push service. If the result is successful, proceed to step 7; if the result fails, the administrator of the operation control system (classified application system) will locate the problem by checking the logs, adjust the relevant parameters, and then repeat step 5.2.

[0048] Step 7 Cleaning and Transformation of Data from Classified Application Systems: The unified service configuration component for data docking cleans and transforms the data from the business control system (classified application system) according to the defined data cleaning rules, and then proceeds to step 8.2.

[0049] Step 8.1 Data encryption and transmission to classified application system: The unified service configuration component for data docking encrypts the material and contract data obtained from the integrated management system (non-classified application system) in steps 6.1 and 6.2 according to the defined transmission key and transmits it to the classified application system, and then proceeds to step 9.1.

[0050] Step 8.2 Data encryption transmission to non-classified application system: The unified service configuration component for data docking encrypts the basic project information and project budget data obtained from the business management system (classified application system) in Step 7 according to the defined transmission key and transmits them to the integrated management system (non-classified application system), and then proceeds to Step 9.2.

[0051] Step 9.1 The classified application system receives data and performs decryption and integrity verification: The operation and control system (classified application system) decrypts and verifies the integrity of the material and contract data obtained from the integrated management system (non-classified application system) in step 8.1 according to the transmission key. If the integrity verification fails, proceed to step 8.1; if the integrity verification passes, proceed to step 10.1.

[0052] Step 9.2 The non-classified application system receives data and performs decryption and integrity verification: The integrated management system (non-classified application system) decrypts and verifies the integrity of the data obtained from the operation and control system (classified application system) in step 8.2 according to the transmission key. If the integrity verification fails, proceed to step 8.2; if the integrity verification passes, proceed to step 10.2.

[0053] Step 10.1 Data verification for classified application systems: Users of the Operation and Control System (classified application system) verify whether the contract and material data they receive are consistent with the corresponding data in the Integrated Management System (non-classified application system). If they are inconsistent, the system administrator of the Operation and Control System (classified application system) locates the problem by checking the logs, adjusts the relevant parameters, and then repeats step 5.1. If the data is consistent, the data connection is successful.

[0054] Step 10.2 Verify Data Integration in Non-Classified Application Systems: Users of the Integrated Management System (Non-Classified Application System) verify whether the received basic project information and project budget data are consistent with the corresponding data in the Business Management System (Classified Application System). If they are inconsistent, the system administrator of the Business Management System (Classified Application System) locates the problem by checking the logs, adjusts the relevant parameters, and then repeats Step 5.2. If the data integration is successful, the data integration is complete.

[0055] Step 11 Audit administrator operations: The audit administrator of the business control system (classified application system) reviews the operation logs of the system administrator in steps 2, 4, and 5 and the operation logs of the security administrator in step 3, checks the standardization of operations, and promptly identifies and reports potential risks for rectification.

Claims

1. A method for data docking between a classified application system and a non-classified application system based on a high-configurable component, characterized in that, The method comprises the following steps: Step 1: building a data connection unified service configuration component; Step 2: a system administrator of a classified application system configuring data connection technical parameters; Step 3: a security administrator of the classified application system configuring data connection security strategies; Step 4: the system administrator of the classified application system defining data extraction services and data push services; Step 5: the system administrator of the classified application system newly creating data extraction and data push service test cases and testing them one by one; Step 6: the classified application system and a non-classified application system respectively calling the data extraction and push services; Step 7: sensitive information cleaning and conversion of data taken from the classified application system; Step 8: data encryption transmission; Step 9: receiving data and performing decryption and integrity check; Step 10: checking the connected data; Step 11: a security auditor of the classified application system auditing the operation logs of the system administrator in steps 2, 4 and 5 and the operation of the security administrator in step 3.

2. The method according to claim 1, wherein, According to the permission division of the three members (the system administrator, the security administrator and the security auditor) of the classified application system, the operation in the data connection unified service configuration component built in step 1 of claim 1 is respectively performed, so that the three-member permission division and mutual restraint in the data connection implementation process of the classified application system and the non-classified application system in the classified network environment are met.

3. The method of claim 1, wherein the method further comprises: receiving the data from the non-classified application system; and transmitting the data to the classified application system. The data connection unified service configuration component built in step 1 of claim 1 comprises interfaces for configuring each application system site, system service interface set, service interface function, transmission key, data push and extraction strategy, extraction data range, data cleaning rule and viewing service interface log and test calling client case, so that when each heterogeneous application system develops a data interface by using the component, no code needs to be written and the configuration interface is simple and easy to operate.

4. The data interoperability method between a classified application system and a non-classified application system based on highly configurable components as described in claim 1, characterized in that, The data connection unified service configuration component built in step 1 of claim 1 can configure the extraction data range and provide data cleaning and encryption transmission functions, when the data of the classified application system needs to be extracted, the specified non-classified data in the classified application system can be extracted and cleaned by defining the extraction data range and the keyword replacement rule (data cleaning rule), the risk problem of the classified data flowing from the classified application system to the non-classified application system in the data connection can be effectively solved, and the data access controlled requirement of the connection between the classified application system and the non-classified application system in the classified network environment can be met.

5. The data interoperability method between a classified application system and a non-classified application system based on highly configurable components as described in claim 1, characterized in that, The configuration operation and system execution log of the data connection unified service configuration component built in step 1 of claim 1 can make the configuration of the data interface and the service calling and data interaction process traceable throughout, can effectively prevent the harm caused by the intentional illegal operation of human beings, and can meet the data security auditing requirement of the connection between the classified application system and the non-classified application system in the classified network environment.

6. The method of claim 1, wherein the method further comprises: The data connection unified service configuration component built in step 1 of claim 1 encrypts and checks the integrity of the data transmitted by the heterogeneous application system, prevents the connected data from being illegally acquired or illegally tampered, and can meet the data security transmission requirement of the connection between the classified application system and the non-classified application system in the classified network environment.

7. The data interoperability method between a classified application system and a non-classified application system based on highly configurable components as described in claim 1, characterized in that, The data docking unified service configuration component built in step 1 of claim 1 can configure data docking service test cases, and can help developers quickly locate data docking problems in the data docking process, and greatly improve system troubleshooting efficiency.

Images