A method, system, device and medium for realizing mobile service interaction based on an offline network environment
By generating encrypted file packages and verifying them with local secure interaction plugins, the security and efficiency issues of traditional mobile business interaction modes in confidential environments and without network coverage are resolved, achieving end-to-end secure data interaction and efficient management.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- 南京中孚信息技术有限公司
- Filing Date
- 2025-12-23
- Publication Date
- 2026-05-12
AI Technical Summary
Traditional mobile service interaction models suffer from information security risks, unusability, and complex and inefficient operation in scenarios such as confidential environments, intranet isolation, and lack of network coverage.
The server generates encrypted file packages, and uses a local secure interaction plugin for verification and ADB/FTP direct connection to mobile devices to perform permission verification and local encryption, thus achieving end-to-end secure closed-loop data interaction.
It completely eliminates the risks of public network transmission, breaks through network dependency limitations, achieves data security and reliability, supports seamless data interaction, and improves operation and maintenance efficiency.
Smart Images
Figure CN121397525B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of mobile service interaction technology, and in particular to a method, system, device and medium for realizing mobile service interaction in an offline network environment. Background Technology
[0002] With the rapid development of mobile internet technology, mobile devices are increasingly used in enterprise office, financial transactions, government services and other fields. The regulatory requirements for data security and privacy protection are becoming increasingly stringent. The demand for special application scenarios such as confidential environments, intranet isolation, and offline environments is constantly increasing. The risks of network attacks and data leaks continue to rise, which poses a huge challenge to the traditional mobile business interaction model that relies on cloud connections.
[0003] In the process of business interaction and data management of mobile devices, cloud services or remote management tools are typically used. When it is necessary to push applications, configuration files, or pull business data to mobile devices, a communication link is established between the mobile device and the cloud server or remote management platform via an internet connection. This can be achieved through MDM (Mobile Device Management) platforms, cloud storage services, or VPN-based remote access methods to upload and download data and manage devices. However, due to the increasing complexity of mobile business scenarios, the variety of device types, and the different security requirements, especially in special scenarios such as confidential environments, intranet isolation, and areas without network coverage, traditional cloud interaction methods have the following prominent problems:
[0004] 1. Serious information security risks: Data must be transmitted through the public network or relayed through a third-party cloud platform, posing risks of theft, tampering, and eavesdropping, failing to meet high security requirements; 2. Unusable in offline environments: Heavily dependent on network connectivity, it completely fails in environments such as intranet isolation, physical isolation, and areas without network access; 3. Complex and inefficient operation: Requires configuring complex network environments (such as VPN tunnels), managing multiple account permissions, and relying on the stability of third-party platforms, making troubleshooting difficult. Summary of the Invention
[0005] This application provides a method, system, device, and medium for realizing mobile service interaction in an offline network environment, in order to solve the problems of serious information security risks, inability to be used in offline environments, and complex and inefficient operation of existing solutions.
[0006] Firstly, this application provides a method for implementing mobile service interaction in an offline network environment, the method comprising:
[0007] S0. Obtain mobile service push data or pull data through the server;
[0008] S1. Generate the corresponding business file library, configure the corresponding configuration management database and push instructions based on the push data, and then package them into an encrypted file package; configure the corresponding configuration management database and pull instructions based on the push data, and then package them into an encrypted file package.
[0009] S2. Send the encrypted file package to the user's local machine and verify whether the encrypted file package has been tampered with through the user's local security interaction plugin;
[0010] S3, a local independent process launched by the secure interaction plugin, connects directly to the current user's local mobile device via ADB (Android Debug Bridge) or FTP (File Transfer Protocol) commands to read the mobile device identification information;
[0011] S4. Use the identification information to query the interaction execution report and obtain the mobile device's permission information; the permission information includes at least: authorization status, security domain level, data push range, and data pull range; terminate the operation for mobile devices whose permission information does not meet the preset requirements;
[0012] S5. Read the encrypted file package and determine the interaction type; the interaction type is divided into push type and pull type; for push type, execute S6-A, otherwise execute S6-B;
[0013] S6-A: Extract the business file library to be pushed from the encrypted file package, and use ADB or FTP commands to push the business file library to the mobile device; configure the mobile device business configuration parameters according to the configuration management database.
[0014] S6-B: Based on the configuration management database in the encrypted file package, determine the data path and file list to be pulled from the mobile device; use ADB or FTP commands to pull business data from the mobile device to the plugin's local cache; perform local encryption processing and desensitization of sensitive information on the pulled data to obtain the final encrypted and desensitized pulled data; generate an encrypted data packet and add a digital signature, and send it back to the server.
[0015] In one implementation of this application, obtaining mobile service push data or pulling data through a server specifically includes:
[0016] Data can be obtained by pushing or pulling data through a pre-defined mobile service interface.
[0017] The push data includes specific push service file libraries, mobile device service configuration parameters involved in the configuration management database, and push instructions; the pull data includes specific pull data paths and file lists involved in the configuration management database, and pull instructions.
[0018] In one implementation of this application, the user queries the interaction execution report using identification information to obtain the mobile device's permission information; the operation is terminated for mobile devices whose permission information does not meet preset requirements, specifically including:
[0019] Use the identification information to query the corresponding interaction execution report; the interaction execution report includes the device authorization status, security domain level, data push range, and data pull range of the corresponding mobile device;
[0020] Determine whether the current permission information meets the preset requirements, and terminate the operation for mobile devices whose permission information does not meet the preset requirements.
[0021] In one implementation of this application, the business file library to be pushed is extracted from the encrypted file package, and the business file library is pushed to the mobile device using ADB or FTP commands; the mobile device business configuration parameters are configured according to the configuration management database, specifically including:
[0022] The encrypted file package is decrypted and its integrity is verified locally on the user's computer; the operation ends when the integrity verification fails.
[0023] Use ADB or FTP PUT commands to push the decrypted business file library to the specified path on the mobile device. The transmission process uses an AES-256 encrypted channel.
[0024] The system updates the business configuration parameters on the mobile device using the business configuration parameters in the configuration management database, records the interaction timestamps and operation logs, and stores the preset sensitive configuration parameters in the business configuration parameters in a preset secure area on the mobile device in an encrypted form.
[0025] In one implementation of this application, the management database includes a preset program for encryption processing and desensitization of sensitive information;
[0026] Based on the configuration management database in the encrypted file package, determine the data path and file list to be pulled from the mobile device; use ADB or FTP commands to pull business data from the mobile device to the plugin's local cache; perform local encryption processing and desensitization of sensitive information on the pulled data to obtain the final encrypted and desensitized pulled data, specifically including:
[0027] Based on the fetch task configuration, determine the data path and file list that need to be fetched from the mobile device;
[0028] Use ADB commands or FTP GET commands to pull the business data corresponding to the file list from the mobile device to the plugin's local cache;
[0029] Using a pre-defined program in the configuration management database, the retrieved data is locally encrypted and sensitive information is de-identified; the encryption and de-identification are irreversible operations.
[0030] Obtain the final encrypted and de-identified data.
[0031] In one implementation of this application, after configuring the mobile device service configuration parameters according to the configuration management database, the method further includes:
[0032] Generate a data push integrity verification report, including a list of transmitted files, SHA-256 (Secure Hash Algorithm 256-bit) checksum, and operation logs;
[0033] After generating the encrypted data packet, adding a digital signature, and sending it back to the server, the method also includes:
[0034] Generate a data retrieval audit report, including a list of retrieved files, encryption algorithms, de-identification rules, timestamps, and operator information.
[0035] In one implementation of this application, the method further includes:
[0036] Add the data push integrity verification report or data pull audit report to the interaction execution report, and encrypt the interaction execution report and send it back to the server; record the access logs of preset sensitive data in the mobile device interaction data and operation logs in the configuration management database.
[0037] Secondly, this application provides a system for realizing mobile service interaction in an offline network environment, the system comprising:
[0038] The server is used to obtain or pull data from mobile services; generate corresponding configuration management databases, business file libraries, and push instructions based on the push data, and then package them into an encrypted file package; generate corresponding configuration management databases and pull instructions based on the push data, and then package them into an encrypted file package; and send the encrypted file package to the user's local machine.
[0039] On the user's local machine, the secure interactive plugin verifies whether the encrypted file package has been tampered with. The secure interactive plugin launches a local independent process that directly connects to the corresponding mobile device on the user's local machine via ADB or FTP commands. It reads the mobile device's identification information, uses this information to query the interactive execution report, and verifies the mobile device's permission information. This permission information includes at least: authorization status, security domain level, data push range, and data pull range. Operations are terminated for mobile devices whose permission information does not meet preset requirements.
[0040] After the mobile device meets the preset permission requirements, it reads the encrypted file package and determines the interaction type. The interaction type is divided into push type and pull type. Push type executes the push process, otherwise pull process is executed.
[0041] The push process includes: extracting the business file library to be pushed from the encrypted file package, using ADB or FTP commands to push the business file library to the mobile device; and configuring the mobile device's business configuration parameters according to the configuration management database.
[0042] The data retrieval process includes: determining the data path and file list to be retrieved from the mobile device based on the configuration management database in the encrypted file package; using ADB or FTP commands to retrieve business data from the mobile device to the plugin's local cache; performing local encryption processing and desensitizing of sensitive information on the retrieved data to obtain the final encrypted and desensitized retrieved data; generating an encrypted data packet and adding a digital signature, and sending it back to the server.
[0043] Thirdly, this application provides a device for realizing mobile service interaction in an offline network environment, the device comprising:
[0044] processor;
[0045] And a memory that stores executable code, which, when executed, causes the processor to execute a method for implementing mobile service interaction in an offline network environment, as described above.
[0046] Fourthly, this application provides a non-volatile computer storage medium storing computer instructions thereon, which, when executed, implement a method for mobile service interaction based on an offline network environment as described above.
[0047] As can be seen from the above technical solutions, this application has the following advantages:
[0048] By employing encrypted file packet transmission (S1-S2) and local security verification mechanisms (S3-S4), the risks of public network transmission are completely eliminated. Specifically, this includes: 1) Data encapsulation is completed when the encrypted file packet is generated on the server side (S1), avoiding third-party intermediaries; 2) A local secure interaction plugin verifies file integrity via digital signature (S2), preventing tampering; 3) Direct connection to mobile devices via ADB / FTP is used (S3), bypassing network eavesdropping; 4) Permission verification (S4) ensures that only authorized devices can operate the device. These measures directly construct an end-to-end security loop, meeting high-level confidentiality requirements.
[0049] By employing a localized processing architecture (S3-S6-B), network dependency limitations are overcome: 1) The secure interaction plugin launches an independent local process (S3), running completely independent of the cloud; 2) Data interaction is achieved offline using mobile device identification information (S3) and a local cache database (S6-B); 3) Push / pull commands are pre-configured via encrypted file packages (S1), eliminating the need for a real-time network connection. This design enables normal business operations in scenarios such as intranet isolation and offline areas, filling a gap in existing technology.
[0050] The integration of automated processes significantly simplifies operations: 1) Unified encrypted file packages carry business files, configuration databases, and commands (S1), reducing multi-platform switching; 2) Standardized ADB / FTP commands (S3-S6) replace complex network configurations such as VPNs; 3) Automatic permission verification (S4) and sensitive information anonymization (S6-B) reduce manual intervention; 4) Intelligent recognition of interaction types (S5) enables traffic routing. These improvements directly reduce failure rates and improve operational efficiency. Attached Figure Description
[0051] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0052] Figure 1 This is a flowchart of a method for implementing mobile service interaction in an offline network environment, provided by an embodiment of this application.
[0053] Figure 2 This is a schematic diagram of the internal structure of a system for realizing mobile service interaction in an offline network environment, provided by an embodiment of this application.
[0054] Figure 3 This is a schematic diagram of the internal structure of a device that enables mobile service interaction in an offline network environment, as provided in an embodiment of this application. Detailed Implementation
[0055] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0056] Those skilled in the art should understand that the embodiments described below are merely preferred embodiments of this disclosure and do not imply that this disclosure can only be implemented through these preferred embodiments. These preferred embodiments are merely used to explain the technical principles of this disclosure and are not intended to limit the scope of protection of this disclosure. Based on the preferred embodiments provided by this disclosure, all other embodiments obtained by those skilled in the art without creative effort should still fall within the scope of protection of this disclosure.
[0057] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.
[0058] The technical solutions proposed in the embodiments of this application will be described in detail below with reference to the accompanying drawings.
[0059] The embodiment provides a method for implementing mobile service interaction in an offline network environment, such as... Figure 1 As shown in the embodiments of this application, the method mainly includes the following steps:
[0060] Step S0: Obtain mobile service push data or pull data through the server.
[0061] In some embodiments, obtaining mobile service push data or pulling data through a server specifically includes:
[0062] Data can be obtained by pushing or pulling data through a pre-defined mobile service interface.
[0063] The push data includes specific push service file libraries, mobile device service configuration parameters involved in the configuration management database, and push instructions; the pull data includes specific pull data paths and file lists involved in the configuration management database, and pull instructions.
[0064] Step S1: Generate the corresponding business file library, configure the corresponding configuration management database and push instructions based on the push data, and then package them into an encrypted file package; configure the corresponding configuration management database and pull instructions based on the push data, and then package them into an encrypted file package.
[0065] It should be further explained that the configuration management database is used to maintain the identification information of various mobile devices. This device identification information includes at least the device's unique identifier (IMEI / serial number), device model, operating system version, security domain level, service configuration information, and sensitive data access permissions. Preferably, the device identification information also includes the device's security policy version, application whitelist, data encryption key, authorization validity period, network isolation status, and sensitive data anonymization rules. Service configuration information includes the device's organization, service type, data storage path, synchronization policy, offline validity period, and data retrieval whitelist. The configuration management database is also used to maintain the validity and authorization status of device information, maintain the compatibility of service files with device versions, and record all sensitive data access logs.
[0066] It should be further explained that the business file library stores the application installation packages, configuration files, business data files, encryption certificates, and business data retrieved from the mobile device required by the device. All data is stored with end-to-end encryption to ensure that sensitive information is not stored in plaintext. The business file library also sets up a mapping link between the device identification information in the configuration management database and the encrypted file package. The encrypted file package contains end-to-end encryption of the applications, configuration parameters, and business data required by the mobile device, and sends interaction execution reports to the local secure interaction plugin to update the mobile device or retrieve data from the mobile device.
[0067] Step S2: Send the encrypted file package to the user's local machine and verify whether the encrypted file package has been tampered with through the user's local security interaction plugin.
[0068] It should be further explained that the secure interaction plugin is deployed in the user's local environment, starting an independent process to communicate encryptedly with the server. It incorporates ADB (Android Debug Bridge) and FTP (File Transfer Protocol) standard command sets, establishing physical layer communication with the mobile device via USB connection or local area network, enabling completely offline bidirectional file interaction. This plugin employs process-level isolation technology to ensure that data interaction does not pass through external networks or any third-party cloud platforms. All sensitive data is stored and transmitted encrypted locally, fundamentally eliminating the risk of network attacks and data leaks. When the plugin retrieves data from the mobile device, it automatically performs local encryption, de-identifying or encrypting sensitive fields according to preset rules, ensuring that even if the data is illegally obtained, the original information cannot be recovered.
[0069] The local secure interaction plugin receives interaction execution reports and encrypted file packages. It reads the mobile device's identification information using built-in ADB / FTP commands, performs permission verification based on the configuration management database and the interaction execution report, extracts appropriate business files, and securely pushes or pulls data to the mobile device. During data retrieval, the plugin first verifies the legitimacy of the retrieval request, checks data access permissions, performs real-time encryption and integrity signing on sensitive data, generates encrypted data packets, and then sends them back to the server. No plaintext data is stored locally throughout the entire process. The interaction execution report contains operation instructions and integrity verification information for the aforementioned applications, configuration files, and business data, including data flow tracking and sensitive operation audit logs.
[0070] Step S3: The local independent process started by the security interaction plugin connects directly to the current user's local mobile device via ADB or FTP commands to read the mobile device identification information.
[0071] It should be further explained that the secure interaction plugin, deployed independently in the user's local environment, communicates with the server via an independent process, achieving physical network isolation. Data interaction never passes through external networks or any third-party platforms, fundamentally eliminating the risk of network attacks. The secure interaction plugin incorporates ADB (Android Debug Bridge) and FTP (File Transfer Protocol) standard command sets, communicating directly with mobile devices via USB connection or local area network, enabling file push and pull operations in a completely offline environment, without relying on cloud services or remote connections. It supports a two-way interactive mode where the server pushes data to and pulls data from mobile devices. Fine-grained permission whitelist management is implemented through a configuration management database, ensuring that data push and pull are performed within authorized scope, preventing unauthorized access. During data pull, the plugin automatically identifies sensitive fields (ID card number, bank card number, mobile phone number, etc.) and performs irreversible encryption or masking according to preset rules, employing AES-256 end-to-end encryption technology to ensure the security of sensitive information during transmission and storage; plaintext data is never stored locally. Data integrity is ensured through SHA-256 file verification and digital signature technology, generating complete interaction execution reports and data flow audit logs to achieve fully traceable security management and meet compliance requirements. A mapping relationship is established between device identification information and encrypted file packages, supporting differentiated configuration and batch management. Device permissions, security policies, and compatibility information are centrally maintained through a configuration management database, achieving unified and efficient mobile device management.
[0072] Step S4: Use the identification information to query the interaction execution report and obtain the mobile device's permission information; the permission information includes at least: authorization status, security domain level, data push range, and data pull range; terminate the operation for mobile devices whose permission information does not meet the preset requirements.
[0073] This includes using identification information to query the interaction execution report and obtain the mobile device's permission information; terminating the operation for mobile devices whose permission information does not meet preset requirements, specifically including:
[0074] Use the identification information to query the corresponding interaction execution report; the interaction execution report includes the device authorization status, security domain level, data push range, and data pull range of the corresponding mobile device;
[0075] Determine whether the current permission information meets the preset requirements, and terminate the operation for mobile devices whose permission information does not meet the preset requirements.
[0076] It should be noted that the interaction execution report is used to configure the interaction protocols for each mobile device, including ADB command sets, FTP transfer parameters, file path mapping rules, and sensitive data encryption algorithms (AES-256 / SM4). The interaction execution report is used to determine whether the business data interaction of the mobile device is successful and whether a retry is necessary, and to record the operation trajectory of data push and pull.
[0077] Step S5: Read the encrypted file package and determine the interaction type; the interaction type is divided into push type and pull type; for push type, execute S6-A, otherwise execute S6-B.
[0078] Step S6-A: Extract the business file library to be pushed from the encrypted file package, and use ADB or FTP commands to push the business file library to the mobile device; configure the mobile device business configuration parameters according to the configuration management database.
[0079] This step can specifically include:
[0080] Decrypt and verify the integrity of the encrypted file package on the user's local machine (to ensure the file has not been tampered with); the operation ends if the integrity verification fails.
[0081] Use ADB commands (such as adb push) or FTP PUT commands to push the decrypted business file library to the specified path on the mobile device. The transmission process uses an AES-256 encrypted channel to ensure the security of data at the physical transmission layer.
[0082] The system updates the business configuration parameters on the mobile device using the business configuration parameters in the configuration management database, records the interaction timestamps and operation logs, and stores the preset sensitive configuration parameters in the business configuration parameters in a preset secure area on the mobile device in an encrypted form.
[0083] In addition, after configuring the mobile device service configuration parameters according to the configuration management database, the method also includes:
[0084] Generate a data push integrity verification report, including a list of transmitted files, SHA-256 checksum, and operation logs.
[0085] Step S6-B: Based on the configuration management database in the encrypted file package, determine the data path and file list to be pulled from the mobile device; use ADB or FTP commands to pull business data from the mobile device to the plugin's local cache; perform local encryption processing and desensitization of sensitive information on the pulled data to obtain the final encrypted and desensitized pulled data; generate an encrypted data packet and add a digital signature, and send it back to the server.
[0086] It should be noted that the management database contains preset programs for encryption and desensitization of sensitive information;
[0087] This step S6-B specifically includes:
[0088] Based on the fetch task configuration, determine the data path and file list that need to be fetched from the mobile device;
[0089] Use ADB commands (such as adb pull) or FTP GET commands to pull business data corresponding to the file list from the mobile device to the plugin's local cache, and perform real-time identification of sensitive fields (such as ID card number, mobile phone number, bank card number, etc.) during the pulling process.
[0090] Using a pre-defined program in the configuration management database, the retrieved data is locally encrypted and sensitive information is de-identified; the encryption and de-identification are irreversible operations.
[0091] As an example, local encryption and sensitive information desensitization are performed as follows: sensitive fields (ID card number, bank card number, mobile phone number, password, etc.) are identified; irreversible encryption or masking is performed according to the desensitization rules; the entire data file is encrypted with AES-256, and encrypted data packets are generated to clear the plaintext data in the local cache to ensure that sensitive information is not stored locally.
[0092] Obtain the final encrypted and de-identified data.
[0093] The method, after generating encrypted data packets, adding digital signatures, and sending them back to the server, also includes:
[0094] Generate a data retrieval audit report, including a list of retrieved files, encryption algorithms, de-identification rules, timestamps, and operator information.
[0095] The method also includes:
[0096] Add the data push integrity verification report or data pull audit report to the interaction execution report, and encrypt the interaction execution report and send it back to the server (recording the complete data flow trajectory for easy security auditing); record the access logs of preset sensitive data in the mobile device interaction data and operation logs in the configuration management database.
[0097] As described above, this embodiment communicates directly with the mobile device through a local independent process. The data interaction does not pass through external networks or third-party cloud platforms, fundamentally eliminating the risks of network attacks, data theft, and man-in-the-middle attacks. Sensitive data is encrypted end-to-end and anonymized in real time to ensure that even if the data is illegally obtained, the original information cannot be restored, meeting the requirements of a high-security environment and regulatory compliance.
[0098] It solves the problem that traditional cloud interaction methods cannot be used in special scenarios such as intranet isolation, physical isolation, and no network coverage. It supports application push, configuration update and data retrieval in a completely offline state, ensuring business continuity. It is suitable for industries with strict network environment restrictions, such as finance, military, and government.
[0099] It not only supports pushing applications and configurations to mobile devices, but also securely pulls business data from mobile devices, enabling true two-way data flow. During the pulling process, it automatically identifies, de-identifies, and encrypts sensitive information to ensure the security and compliance of data collection.
[0100] By centrally maintaining device identification information, permission policies, and encryption keys through a configuration management database, batch device management and differentiated configurations are supported, significantly improving the efficiency of mobile device management and reducing operation and maintenance costs.
[0101] It adapts to the increasingly stringent security requirements of mobile services and the increasingly complex application scenarios, and can sustainably perform complete, fast, and secure business configuration and data management for mobile devices with ever-increasing security requirements, providing a solid security foundation for enterprise digital transformation.
[0102] In addition, this application Figure 2 This application provides a system for implementing mobile service interaction in an offline network environment. For example... Figure 2 As shown, the system provided in this application embodiment mainly includes:
[0103] Server 210 is used to obtain mobile service push data or pull data; generate corresponding configuration management database, business file library and push instructions based on push data, and then package them into an encrypted file package; generate corresponding configuration management database and pull instructions based on push data, and then package them into an encrypted file package; send the encrypted file package to the user's local machine 220;
[0104] User local device 220 is used to verify whether the encrypted file package has been tampered with through the secure interaction plugin. The local independent process started by the secure interaction plugin directly connects to the mobile device 230 corresponding to the current user local device 220 via ADB or FTP commands, reads the identification information of the mobile device 230, uses the identification information to query the interaction execution report, and verifies the permission information of the mobile device 230. The permission information includes at least: authorization status, security domain level, data push range, and data pull range. The operation is terminated for mobile devices 230 whose permission information does not meet the preset requirements.
[0105] After the mobile device 230 confirms that the permission information meets the preset requirements, it reads the encrypted file package and determines the interaction type. The interaction type is divided into push type and pull type. The push type executes the push process, otherwise the pull process is executed.
[0106] The push process includes: extracting the business file library to be pushed from the encrypted file package, using ADB or FTP commands to push the business file library to the mobile device 230; and configuring the business configuration parameters of the mobile device 230 according to the configuration management database.
[0107] The retrieval process includes: determining the data path and file list to be retrieved from the mobile device 230 based on the configuration management database in the encrypted file package; using ADB or FTP commands to retrieve business data from the mobile device 230 to the plugin's local cache; performing local encryption processing and desensitizing of sensitive information on the retrieved data to obtain the final encrypted and desensitized retrieved data; generating an encrypted data packet and adding a digital signature, and sending it back to the server 210.
[0108] The above are method embodiments of this application. Based on the same inventive concept, embodiments of this application also provide a device for realizing mobile service interaction in an offline network environment. Figure 3 As shown, the device includes: a processor; and a memory storing executable code thereon, which, when executed, causes the processor to perform a method for implementing mobile service interaction in an offline network environment as described in the above embodiment.
[0109] Specifically, the server obtains or pulls mobile service push data from the server; generates a corresponding business file library, configures a corresponding configuration management database and push instructions based on the push data, and then packages them into an encrypted file package; configures a corresponding configuration management database and pull instructions based on the push data, and then packages them into an encrypted file package; sends the encrypted file package to the user's local machine, and verifies whether the encrypted file package has been tampered with through the user's local security interaction plugin; the local independent process started by the security interaction plugin directly connects to the current user's corresponding mobile device through ADB or FTP commands to read the mobile device identification information; uses the identification information to query the interaction execution report and obtain the mobile device's permission information; the permission information includes at least: authorization status, security domain level, data push scope, and data... The process involves several steps: First, the scope of data retrieval is determined. Operations are terminated for mobile devices whose permission information does not meet preset requirements. Second, the encrypted file package is read to determine the interaction type, which is either push or pull. For push operations, the system extracts the necessary business file library from the encrypted file package and uses ADB or FTP commands to push it to the mobile device. Third, the system configures the mobile device's business configuration parameters according to the configuration management database. Otherwise, it determines the data path and file list to be pulled from the mobile device based on the configuration management database within the encrypted file package. Fourth, it uses ADB or FTP commands to pull business data from the mobile device to the plugin's local cache. Fifth, it performs local encryption and desensitization on the pulled data to obtain the final encrypted and desensitized pulled data. Finally, it generates an encrypted data packet, adds a digital signature, and sends it back to the server.
[0110] In addition, embodiments of this application also provide a non-volatile computer storage medium storing executable instructions, which, when executed, implement the method described above for realizing mobile service interaction in an offline network environment.
[0111] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A method for realizing mobile service interaction in an offline network environment, characterized in that, The method includes: S0. Obtain mobile service push data or pull data through the server; S1. Generate the corresponding business file library, configure the corresponding configuration management database and push instructions based on the pushed data, and then package them into an encrypted file package; configure the corresponding configuration management database and pull instructions based on the pulled data, and then package them into an encrypted file package. S2. Send the encrypted file package to the user's local machine and verify whether the encrypted file package has been tampered with through the user's local security interaction plugin; S3, a local independent process launched by the secure interaction plugin, directly connects to the current user's local mobile device via ADB or FTP commands to read the mobile device identification information; S4. Use the identification information to query the interaction execution report and obtain the mobile device's permission information; the permission information includes at least: authorization status, security domain level, data push range, and data pull range; terminate the operation for mobile devices whose permission information does not meet the preset requirements; S5. Read the encrypted file package and determine the interaction type; the interaction type is divided into push type and pull type; for push type, execute S6-A, otherwise execute S6-B; S6-A: Extract the business file library to be pushed from the encrypted file package, and use ADB or FTP commands to push the business file library to the mobile device; configure the mobile device's business configuration parameters according to the configuration management database; specifically including: From the encrypted file package, decryption and integrity verification are performed locally on the user's device; if the integrity verification fails, the operation ends; the decrypted business file library is pushed to the specified path on the mobile device using ADB or FTP PUT commands, and the transmission process uses an AES-256 encrypted channel; the business configuration parameters on the mobile device are updated using the business configuration parameters in the configuration management database, the interaction timestamp and operation log are recorded, and the preset sensitive configuration parameters in the business configuration parameters are stored in encrypted form in the preset security area of the mobile device; S6-B: Based on the configuration management database in the encrypted file package, determine the data path and file list to be pulled from the mobile device; use ADB or FTP commands to pull business data from the mobile device to the plugin's local cache; perform local encryption processing and desensitization of sensitive information on the pulled data to obtain the final encrypted and desensitized pulled data; generate an encrypted data packet and add a digital signature, and send it back to the server.
2. The method for realizing mobile service interaction in an offline network environment according to claim 1, characterized in that, Obtaining mobile service push data or pulling data through the server specifically includes: Data can be obtained by pushing or pulling data through a pre-defined mobile service interface. The push data includes specific push service file libraries, mobile device service configuration parameters involved in the configuration management database, and push instructions; the pull data includes specific pull data paths and file lists involved in the configuration management database, and pull instructions.
3. The method for realizing mobile service interaction in an offline network environment according to claim 1, characterized in that, Use the identification information to query the interaction execution report and obtain the mobile device's permission information; The operation is terminated for mobile devices whose permission information does not meet the preset requirements, specifically including: Use the identification information to query the corresponding interaction execution report; the interaction execution report includes the device authorization status, security domain level, data push range, and data pull range of the corresponding mobile device; Determine whether the current permission information meets the preset requirements, and terminate the operation for mobile devices whose permission information does not meet the preset requirements.
4. The method for realizing mobile service interaction in an offline network environment according to claim 1, characterized in that, The configuration management database contains preset programs for encryption and desensitization of sensitive information; Based on the configuration management database in the encrypted file package, determine the data path and file list to be pulled from the mobile device; use ADB or FTP commands to pull business data from the mobile device to the plugin's local cache. The retrieved data undergoes local encryption and sensitive information desensitization to obtain the final encrypted and desensitized retrieved data, specifically including: Based on the fetch task configuration, determine the data path and file list that need to be fetched from the mobile device; Use ADB commands or FTP GET commands to pull the business data corresponding to the file list from the mobile device to the plugin's local cache; Using a pre-defined program in the configuration management database, the retrieved data is locally encrypted and sensitive information is de-identified; the encryption and de-identification are irreversible operations. Obtain the final encrypted and de-identified data.
5. The method for realizing mobile service interaction in an offline network environment according to claim 1, characterized in that, After configuring the mobile device service configuration parameters according to the configuration management database, the method further includes: Generate a data push integrity verification report, including a list of transmitted files, SHA-256 checksum, and operation logs; After generating the encrypted data packet, adding a digital signature, and sending it back to the server, the method further includes: Generate a data retrieval audit report, including a list of retrieved files, encryption algorithms, de-identification rules, timestamps, and operator information.
6. The method for realizing mobile service interaction in an offline network environment according to claim 5, characterized in that, The method further includes: Add the data push integrity verification report or data pull audit report to the interaction execution report, and encrypt the interaction execution report and send it back to the server; record the access logs of preset sensitive data in the mobile device interaction data and operation logs in the configuration management database.
7. A system for realizing mobile service interaction in an offline network environment, characterized in that, The system includes: The server is used to obtain mobile service push data or pull data; generate corresponding configuration management database, business file library and push instructions based on push data, and then package them into an encrypted file package; generate corresponding configuration management database and pull instructions based on pull data, and then package them into an encrypted file package; and send the encrypted file package to the user's local machine. On the user's local machine, the secure interactive plugin verifies whether the encrypted file package has been tampered with. The secure interactive plugin launches a local independent process that directly connects to the corresponding mobile device on the user's local machine via ADB or FTP commands, reads the mobile device's identification information, uses this information to query the interactive execution report, and verifies the mobile device's permission information. This permission information includes at least: authorization status, security domain level, data push range, and data pull range. Operations are terminated for mobile devices whose permission information does not meet preset requirements. After the mobile device meets the preset permission requirements, it reads the encrypted file package and determines the interaction type. The interaction type is divided into push type and pull type. Push type executes the push process, otherwise pull process is executed. The push process includes: extracting the business file library to be pushed from the encrypted file package, using ADB or FTP commands to push the business file library to the mobile device; configuring the mobile device's business configuration parameters according to the configuration management database; specifically including: From the encrypted file package, decryption and integrity verification are performed locally on the user's device; if the integrity verification fails, the operation ends; the decrypted business file library is pushed to the specified path on the mobile device using ADB or FTP PUT commands, and the transmission process uses an AES-256 encrypted channel; the business configuration parameters on the mobile device are updated using the business configuration parameters in the configuration management database, the interaction timestamp and operation log are recorded, and the preset sensitive configuration parameters in the business configuration parameters are stored in encrypted form in the preset security area of the mobile device; The data retrieval process includes: determining the data path and file list to be retrieved from the mobile device based on the configuration management database in the encrypted file package; using ADB or FTP commands to retrieve business data from the mobile device to the plugin's local cache; performing local encryption processing and desensitizing of sensitive information on the retrieved data to obtain the final encrypted and desensitized retrieved data; generating an encrypted data packet and adding a digital signature, and sending it back to the server.
8. A device for realizing mobile service interaction in an offline network environment, characterized in that, The device includes: processor; And a memory having executable code stored thereon, which, when executed, causes the processor to perform a method for implementing mobile service interaction in an offline network environment as described in any one of claims 1-6.
9. A non-volatile computer storage medium, characterized in that, It stores computer instructions, which, when executed, implement a method for realizing mobile service interaction in an offline network environment as described in any one of claims 1-6.