Bill data batch transmission dynamic encryption method and system

Abstract

The application provides a bill data batch transmission dynamic encryption method and system, relates to the technical field of data processing, and the method comprises the following steps: in a bill generation link, according to a preset bill generation rule, a plurality of customer bill data sets are batch generated, a unique bill identifier is allocated to each bill data, and a batch number and a timestamp of the current batch are generated; based on the generated batch number, the timestamp and a preset key seed, a temporary encryption key of the current batch is dynamically generated; the generated temporary encryption key is used to perform overall encryption on the generated bill data set, and an encrypted bill data packet is obtained. The application solves the contradiction between the security strength and the transmission efficiency in bill batch transmission.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method and system for dynamic encryption of bulk bill data transmission. Background Technology

[0002] With stringent requirements for the protection of sensitive data such as salaries and ID numbers, bulk billing transmission in fields such as HRO and flexible employment needs to balance security and efficiency. However, existing technologies mostly rely on static key encryption or only use transport layer protection such as TLS (Transport Layer Security), which poses problems such as key reuse risks and lack of data integrity verification.

[0003] For example, when a logistics flexible worker platform transmits more than a thousand flexible worker settlement bills to a partner manpower platform each month, it uses a fixed AES key to encrypt the bill set containing flexible worker bank accounts and actual wages, and transmits it to the manpower platform for review and payment via HTTPS protocol. Only the total amount of the bill is simply verified before transmission. This solution has obvious technical flaws. The static key is stored on the system server for a long time. Once it is stolen by hackers through vulnerabilities, they can directly decrypt all historical batches of bill data. Moreover, the key is not associated with dynamic information such as batch number and timestamp. Even if the bill data packet is intercepted during transmission, attackers can use the stolen key to restore sensitive content without cracking the transmission protocol. At the same time, due to the lack of binding verification between the key and the bill data, the risk of batch data leakage after the key is leaked cannot be detected. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a dynamic encryption method and system for batch transmission of billing data, so as to resolve the contradiction between security strength and transmission efficiency in batch transmission of billing data.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0006] Firstly, a method for dynamically encrypting bulk transmission of billing data, the method comprising:

[0007] In the bill generation stage, according to the preset bill generation rules, multiple customer bill data sets are generated in batches, and a unique bill identifier is assigned to each bill data. At the same time, the batch number and timestamp of the current batch are generated.

[0008] Based on the generated batch number, timestamp, and preset key seed, a temporary encryption key for the current batch is dynamically generated.

[0009] Use the generated temporary encryption key to encrypt the entire generated bill data set, resulting in an encrypted bill data package;

[0010] The obtained encrypted bill data packet is bound to the corresponding batch metadata, which includes the batch number, encryption algorithm identifier, and key index information derived from the key generation information. The bound data is then digitally signed and transmitted to the bill reconciliation and issuance process.

[0011] Based on the bill reconciliation and disbursement process, the recipient restores the same temporary encryption key according to the key index information in the transmitted batch metadata, and decrypts and verifies the encrypted bill data packet.

[0012] After successful decryption and verification, the decrypted bill data is distributed and processed based on the bill identifier to obtain the processing results; the processing results are then written back to the batch metadata to complete the closed-loop transmission process of batch bill data.

[0013] Furthermore, in the bill generation stage, based on preset bill generation rules, multiple customer bill data sets are generated in batches, and a unique bill identifier is assigned to each bill data set. Simultaneously, a batch number and timestamp for the current batch are generated, including:

[0014] Invoke the preset bill generation rules and retrieve the original business data from the business database;

[0015] Based on the bill generation rules, the original business data is cleaned, classified, and calculated to obtain the initial bill data units;

[0016] Each initial bill data unit is assigned a globally unique bill identifier, and the bill data units carrying the bill identifiers are aggregated to form the bill data set of the current batch.

[0017] Based on the current batch of billing data, generate a batch number to identify this batch transmission task, and record the current standard time as a timestamp.

[0018] Furthermore, based on the generated batch number, timestamp, and preset key seed, a temporary encryption key for the current batch is dynamically generated, including:

[0019] Based on the obtained key seed, the batch number and timestamp are concatenated according to a predetermined format to obtain a unique dynamic variable;

[0020] The key seed and the obtained dynamic variables are used together as input parameters, and the key derivation function is called to perform the operation to obtain the result of the key derivation function.

[0021] The result of the operation based on the key derivation function is used as a temporary encryption key specifically for encrypting the current batch of bill data.

[0022] Furthermore, the generated temporary encryption key is used to encrypt the entire generated billing data set, resulting in an encrypted billing data packet, including:

[0023] Based on the obtained temporary encryption key and the resulting billing data set;

[0024] Based on the billing data set, the encryption algorithm mode is determined by a predefined encryption algorithm identifier, and the encryption algorithm is initialized using a temporary encryption key to establish an encryption computing environment;

[0025] Import the bill data set into the established encrypted computing environment to perform batch encryption operations and obtain the original ciphertext data;

[0026] Based on the obtained raw ciphertext data, the data is encapsulated according to the transmission protocol requirements, and necessary header verification information is added to obtain the final transmittable encrypted bill data packet.

[0027] Furthermore, the obtained encrypted bill data packet is bound to the corresponding batch metadata, which includes the batch number, encryption algorithm identifier, and key index information derived from the key generation information. The bound data is then digitally signed before being transmitted to the bill reconciliation and disbursement stages, including:

[0028] Based on the obtained encrypted billing data packet, and based on the generated batch number, the determined encryption algorithm identifier, and the key index information derived from the key seed and dynamic variables, batch metadata is assembled.

[0029] The encrypted billing data packet and batch metadata are bound together according to a predetermined structure to form a transmission data unit to be signed;

[0030] The sender's private key is used to perform a digital signature operation on the transmitted data unit to be signed, resulting in a signature value;

[0031] The signature value is appended to the transmitted data unit to form the final verifiable transmission packet, which is then sent to the billing reconciliation and disbursement process via a secure transmission protocol.

[0032] Furthermore, based on the bill reconciliation and disbursement process, the recipient reconstructs the same temporary encryption key using the key index information in the transmitted batch metadata, and decrypts and verifies the encrypted bill data packet, including:

[0033] The receiver obtains the verifiable transmission packet, verifies the digital signature using the sender's public key, and determines that the verifiable transmission packet is complete and authentic after confirming the signature is valid, thus obtaining the result of successful signature verification.

[0034] Based on the successful signature verification result, the verifiable transmission packet is parsed to separate the encrypted billing data packet and batch metadata contained therein;

[0035] Based on the key index information parsed from the batch metadata, combined with the key seed securely stored locally by the receiver, the temporary encryption key used for decryption is restored by performing the same calculation as the sender.

[0036] By restoring the temporary encryption key, the separated encrypted bill data packets are decrypted to recover the original bill data set, and the integrity of the decrypted data set is verified.

[0037] Furthermore, after successful decryption verification, the decrypted billing data is distributed and processed based on the billing identifier to obtain the processing result; the processing result is then written back to the batch metadata, completing the closed-loop transmission process of the batch billing data, including:

[0038] After successful decryption and integrity verification, each bill data is distributed to the corresponding reconciliation or issuance processing channel based on the bill identifier carried by each bill data in the original bill data set obtained from decryption.

[0039] Receive the processing result status of each bill data returned by each processing channel, and summarize the results according to the bill identifier to obtain the summarized processing result;

[0040] Associate the status of the aggregated processing results with the corresponding batch metadata, and record the corresponding batch metadata as completed;

[0041] The completed batch metadata is persisted and stored to obtain a complete transmission record with the final processing status, thus completing the closed-loop transmission process of batch billing data.

[0042] Secondly, a dynamic encryption system for bulk transmission of billing data includes:

[0043] The acquisition module is used in the bill generation process to generate multiple sets of bill data for customers in batches according to preset bill generation rules, and assign a unique bill identifier to each set of bill data, while generating the batch number and timestamp of the current batch.

[0044] The encryption module is used to dynamically generate a temporary encryption key for the current batch based on the generated batch number, timestamp, and preset key seed; the generated temporary encryption key is used to encrypt the entire generated bill data set to obtain an encrypted bill data package;

[0045] The calculation module is used to bind the obtained encrypted bill data packet with the corresponding batch metadata, which includes the batch number, encryption algorithm identifier, and key index information derived from the key generation information. The bound data is digitally signed and then transmitted to the bill reconciliation and issuance process.

[0046] The decryption module is used to decrypt and verify the encrypted bill data packets based on the key index information in the transmitted batch metadata during the bill reconciliation and disbursement process.

[0047] The processing module is used to distribute and process the decrypted bill data based on the bill identifier after successful decryption and verification to obtain the processing result; and write the processing result back to the batch metadata to complete the closed-loop transmission process of batch bill data.

[0048] Thirdly, a computing device, comprising:

[0049] One or more processors;

[0050] A storage device for storing one or more programs that, when executed by one or more processors, cause the one or more processors to implement the method.

[0051] Fourthly, a computer-readable storage medium storing a program that, when executed by a processor, implements the method.

[0052] The above-described solution of the present invention has at least the following beneficial effects:

[0053] This technology dynamically generates temporary encryption keys based on the batch number, timestamp, and preset key seed inevitably generated during the billing process. It combines overall encryption, batch metadata binding, and digital signatures. Then, through a closed-loop process involving key restoration, decryption verification, and write-back of processing results by the recipient, the temporary key generation logic adapts to the batch number and timestamp generation logic of the HRO system's billing process and the batch number and timestamp creation operations of the flexible payment system's settlement management. Overall encryption and digital signatures are embedded in the existing billing transmission paths of both systems. Decryption verification and closed-loop processing connect the HRO system's accounting confirmation to bill reconciliation and the flexible payment system's financial review to issuance management stages. Therefore, it overcomes the risks of historical data leakage caused by static key reuse, the lack of data integrity verification due to reliance solely on transport layer protection, and the inability to detect leakage risks due to the lack of key-bound-to-bill data binding in existing technologies. It also avoids additional modifications to the existing business operation processes of both systems. Thus, it achieves the technical effect of ensuring the security of multi-customer billing in the HRO field and batch settlement billing in the flexible payment field, adapting to existing business processes, meeting the requirements for compliant transmission of sensitive data, and achieving traceability of transmission records through persistent storage of batch metadata, thus balancing security and business efficiency. Attached Figure Description

[0054] Figure 1 This is a flowchart illustrating the dynamic encryption method for batch transmission of billing data provided in an embodiment of the present invention.

[0055] Figure 2 This is a schematic diagram of a dynamic encryption system for batch transmission of billing data provided in an embodiment of the present invention. Detailed Implementation

[0056] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0057] like Figure 1 As shown, embodiments of the present invention propose a dynamic encryption method for batch transmission of billing data, the method comprising the following steps:

[0058] Step 1: In the bill generation stage, according to the preset bill generation rules, multiple customer bill data sets are generated in batches, and a unique bill identifier is assigned to each bill data. At the same time, the batch number and timestamp of the current batch are generated.

[0059] Step 2: Based on the generated batch number, timestamp, and preset key seed, dynamically generate a temporary encryption key for the current batch;

[0060] Step 3: Use the generated temporary encryption key to encrypt the entire generated bill data set to obtain an encrypted bill data package;

[0061] Step 4: Bind the obtained encrypted bill data packet with the corresponding batch metadata. The batch metadata includes the batch number, encryption algorithm identifier, and key index information derived from the key generation information. After digitally signing the bound data, it is transmitted to the bill reconciliation and issuance process.

[0062] Step 5: Based on the bill reconciliation and disbursement process, the recipient restores the same temporary encryption key according to the key index information in the transmitted batch metadata, and decrypts and verifies the encrypted bill data packet.

[0063] Step 6: After successful decryption verification, the decrypted bill data is distributed and processed based on the bill identifier to obtain the processing result; the processing result is written back to the batch metadata to complete the closed-loop transmission process of batch bill data.

[0064] In this embodiment of the invention, based on the batch number and timestamp that are inevitably generated in the HRO system's revenue and expenditure settlement and billing generation stages and the flexible worker system's settlement management stages, a temporary encryption key specific to the current batch is dynamically generated by combining a preset key seed. This key is then used to encrypt the entire batch bill data set, bind it to batch metadata containing the batch number, encryption algorithm identifier, and key index, and transmit it with a digital signature. The recipient then decrypts and verifies the key based on the metadata. Finally, the data is distributed according to the bill identifier, and the result is written back to the batch metadata to complete the closed loop. The temporary key generation adapts to the generation logic of the HRO system's bill number and the flexible worker system's batch number, embedding encryption and signature into both systems. The unified billing transmission path, decryption, and closed-loop processing are integrated with the existing processes of HRO billing reconciliation and flexible worker issuance management. Therefore, it overcomes the technical problems in the existing transmission schemes of HRO and flexible worker systems, such as the vulnerability of static keys to theft due to long-term storage leading to the leakage of historical data, the vulnerability of keys not being associated with batch dynamic information to cracking, the lack of data integrity guarantee due to simple total amount verification, and the inability to detect leakage risks due to the lack of key binding with bills. As a result, it achieves the goal of ensuring the security of multi-customer billing in the HRO system and batch settlement billing in the flexible worker system without additional modifications to the existing business operation processes of the two systems, meeting the requirements for compliant transmission of sensitive data, and enabling traceability of transmission records through persistent storage of batch metadata.

[0065] In a preferred embodiment of the present invention, step 1 above may include:

[0066] Step 1.1: Invoke the preset bill generation rules and retrieve the original business data from the business database. Specifically, this includes: invoking the preset bill generation rules according to the current business scenario. These rules include customer fee standards in the HRO field and hourly wage calculation methods in the flexible worker field. At the same time, extract the original business data related to this bill generation from the business database, such as attendance records for flexible workers, service duration, bank accounts, or service item lists and service quantities for corporate clients, to ensure that the obtained data covers all the basic information required for bill generation.

[0067] Step 1.2 involves cleaning, classifying, and calculating the original business data based on the billing generation rules to obtain initial billing data units. Specifically, this includes: processing the extracted original business data according to the invoked billing generation rules; cleaning to remove duplicate records, data with incorrect formats, and redundant information unrelated to billing generation; classifying the cleaned data by customer dimensions such as flexible worker status or service type; and performing calculations on the classified data according to the rules, such as calculating wages payable based on flexible worker hours and hourly wages, and calculating charges payable based on the number of services and unit price for corporate clients. The final result is an initial billing data unit containing clear business information.

[0068] Step 1.3 assigns a globally unique bill identifier to each initial bill data unit, and aggregates the bill data units carrying the bill identifiers to form the bill data set for the current batch. Specifically, this involves: using the built-in unique identifier generation mechanism, assigning a globally unique bill identifier to each initial bill data unit obtained after cleaning and calculation. The bill identifier contains information such as business type code and time series to ensure that it will not be repeated in all business scenarios and time ranges. Then, all bill data units carrying the identifier are integrated together to obtain the bill data set that needs to be transmitted in batches.

[0069] Step 1.4: Based on the current batch of billing data set, generate a batch number to identify this batch transmission task and record the current standard time as a timestamp. Specifically, this includes: obtaining a batch number to uniquely identify this batch transmission task based on the business attributes of the current batch of billing data set. The batch number may include the business domain identifier generation date and the batch sequence number of the day. At the same time, the current standard UTC time is recorded by the system clock as a timestamp accurate to the second to ensure that the batch number and timestamp can uniquely correspond to this batch transmission task.

[0070] In this embodiment of the invention, raw business data is obtained from the business database by calling preset bill generation rules. After cleaning, classification and calculation, initial bill data units are formed. Each unit is assigned a globally unique bill identifier and aggregated into a bill data set. At the same time, a unique batch number and a standard timestamp are generated. This technical means overcomes the technical problems in the prior art, such as the original business data being messy and easily leading to invalid bill data, the lack of a unique identifier for a single bill making it difficult to trace accurately, and the lack of unique batch and time stamps for different batch transmission tasks, which can easily cause confusion. This achieves the technical effects of ensuring the standardization and validity of the initial bill data units, enabling accurate location and traceability of a single bill throughout the entire process, clearly distinguishing each batch transmission task to avoid batch confusion, and providing accurate data support for subsequent generation of dynamic temporary encryption keys based on batch numbers and timestamps and distribution processing based on bill identifiers.

[0071] In a preferred embodiment of the present invention, step 2 above may include:

[0072] Step 2.1: Based on the obtained key seed, the batch number and timestamp are concatenated according to a predetermined format to obtain a unique dynamic variable. Specifically, this includes: extracting a preset key seed from a secure storage area such as a hardware security device or an encrypted database through permission verification. The key seed is a fixed-length random byte sequence that is generated and stored only during initialization and will not be modified thereafter. At the same time, according to a preset concatenation format, such as arranging the batch number first and then the timestamp, separated by a specific character, the generated batch number and timestamp are combined to form a dynamic variable containing batch-specific information.

[0073] Step 2.2 involves using the key seed and the obtained dynamic variables as input parameters to call the key derivation function for computation, thereby obtaining the result of the key derivation function's operation. Specifically, this includes passing the key seed obtained from the secure storage area and the obtained dynamic variables as input parameters to the pre-set key derivation function. The function employs an algorithm that conforms to cryptographic standards. The computation process of the PBKDF2 function is divided into two parts: core iteration and final key generation, as detailed below:

[0074] Input information consists of four parts: first, the input key material, which is composed of the key seed and dynamic variables in a preset format; second, the randomly generated salt value, which is usually a random byte sequence of 16 bytes or more; third, the preset total number of hash iterations, such as 10,000 times or more; and fourth, the desired fixed length, such as 32 bytes, and the selected pseudo-random function.

[0075] Core Iterative Function Operation: Define an iterative function to generate hash blocks for each round. When the iteration round is 1, use the input key material as the key, concatenate the salt value with the number 1 converted to 4-byte big-endian, and calculate the pseudo-random function value to obtain the hash block for the first round. When the iteration round is greater than 1, first use the input key material as the key, concatenate the salt value with the number of the current round converted to 4-byte big-endian, and calculate the pseudo-random function value. Then, perform a byte-level XOR operation with the hash block obtained in the previous iteration to obtain the hash block for the current round. Repeat the above operation until the preset total number of iterations is completed to obtain the corresponding final hash block.

[0076] Generate the final key: Determine the number of hash blocks to be generated based on the expected fixed length. For example, if the expected length is 32 bytes, and each pseudo-random function outputs 32 bytes, then one block is needed. Concatenate the blocks in order. If the total length exceeds the expected length, then truncate the byte sequence up to the expected length, which is the result of the PBKDF2 function.

[0077] Step 2.3: The result of the key derivation function is used as a temporary encryption key for encrypting the current batch of bill data. Specifically, the result of the key derivation function is directly used as the temporary encryption key for the current batch of bill data. The temporary encryption key is only used to encrypt the bill data transmitted in this batch and will not be used for other batches or stored in the system for a long time. It will be destroyed after the encryption is completed, ensuring that each batch of bill data has its own encryption key.

[0078] In this embodiment of the invention, a technique is employed that obtains a preset key seed from a secure storage area, concatenates the batch number and timestamp according to a predetermined format to form a unique dynamic variable, and then uses the key seed and the dynamic variable together as input to call a key derivation function, using the calculation result as the temporary encryption key specific to the current batch. This technique overcomes the technical problems in the prior art where static keys are easily stolen due to long-term storage, can decrypt all historical batch data, and are easily cracked after being intercepted because the key is not associated with the batch's dynamic information. As a result, each batch of billing data corresponds to a unique temporary encryption key, avoiding the risk of key reuse. Even if the key seed is leaked, it is impossible to decrypt other batch data, thus improving the security of batch billing data encryption.

[0079] In a preferred embodiment of the present invention, step 3 above may include:

[0080] Step 3.1, based on the obtained temporary encryption key and the billing data set, specifically includes: calling the generated temporary encryption key and obtaining the billing data set; verifying the validity of the temporary encryption key to confirm that it has not been tampered with and is within the scope of valid use; and checking the integrity of the billing data set to ensure that all billing data units contain a globally unique billing identifier.

[0081] Step 3.2: Based on the billing data set, determine the encryption algorithm mode through a predefined encryption algorithm identifier, and initialize the encryption algorithm using a temporary encryption key to establish an encryption computing environment. This includes: analyzing the attributes of the billing data set, including data size and sensitive field types; determining the appropriate encryption algorithm mode based on the correspondence between the predefined encryption algorithm identifier and data attributes. For example, a billing set containing a large number of flexible bank accounts corresponds to the AES-GCM mode. AES-GCM, or AES Galois counter mode, combines encryption and authentication functions, ensuring both data confidentiality and integrity. The AES-GCM mode supports parallel computing, has high encryption efficiency, and is suitable for large-scale data such as billing sets containing a large number of flexible bank accounts. It can also quickly verify data integrity through built-in authentication tags, matching the dual requirements of efficiency and security for batch billing transmission. Subsequently, the obtained temporary encryption key is input into the selected encryption algorithm, configuring the required parameters such as block size and initialization vector to complete algorithm initialization and build an independent encryption computing environment.

[0082] Step 3.3 involves importing the bill data set into the established encryption computing environment to perform batch encryption operations and obtain the original ciphertext data. Specifically, this includes: importing the bill data set, which has undergone integrity verification, into the established encryption computing environment in a preset order; starting the batch encryption mechanism; performing encryption operations on each bill data unit in the set sequentially; maintaining the correlation between each unit during the encryption process to ensure that the encrypted data order is consistent with the original data; and generating the original ciphertext data in the form of a continuous byte stream after all encryption is completed.

[0083] Step 3.4: Based on the obtained original ciphertext data, encapsulate the data according to the transmission protocol requirements, add necessary header verification information, and obtain the final transmittable encrypted bill data packet. Specifically, this includes: performing structured encapsulation of the original ciphertext data according to the preset transmission protocol specifications; adding necessary verification information to the data header during the encapsulation process, including the cyclic redundancy check value calculated based on the original ciphertext, the total data length, the encryption algorithm identifier, the batch number of this transmission, and the timestamp; simultaneously setting a data format identifier for the receiver to identify the data packet structure; and finally forming an encrypted bill data packet that conforms to the transmission protocol requirements.

[0084] In this embodiment of the invention, based on the generated temporary encryption key and the billing data set, the appropriate encryption algorithm mode is determined by a predefined encryption algorithm identifier. The algorithm is initialized with the temporary encryption key to establish an encryption computing environment. The billing data set is imported into the environment to perform batch encryption to obtain the original ciphertext data. Then, the original ciphertext data is encapsulated according to the transmission protocol and packet header verification information is added. Therefore, this method overcomes the technical problems of lack of flexibility in encryption algorithm selection, low efficiency of batch billing encryption, and easy tampering during ciphertext transmission due to lack of targeted encapsulation and verification. This ensures that the encryption algorithm is accurately adapted to the current billing data scenario, improves the efficiency of batch billing data encryption processing, and ensures the integrity and tamper-proof nature of the ciphertext during transmission through packet header verification information.

[0085] In a preferred embodiment of the present invention, step 4 above may include:

[0086] Step 4.1: Based on the obtained encrypted bill data packet, and using the generated batch number, the determined encryption algorithm identifier, and the key index information derived from the key seed and dynamic variables, assemble the batch metadata. Specifically, this includes: obtaining the generated encrypted bill data packet, which already contains the encrypted content and header verification information of the batch bills; then retrieving the generated batch number used to identify this transmission task, the determined encryption algorithm identifier adapted to the current bill data, and the key index information derived from the batch number and timestamp based on the key seed and dynamic variables, using preset rules such as extracting key fields of dynamic variables and associating them with the key seed feature code. The key index information does not contain the key itself and is only used by the recipient to locate the key generation basis; finally, according to the fixed field order from batch number to encryption algorithm identifier to key index information to the identifier associated with the encrypted bill data packet, integrate the information into structured batch metadata.

[0087] Step 4.2: Bind the encrypted bill data packet and batch metadata according to a predetermined structure to form a transmission data unit to be signed. Specifically, this includes binding the obtained encrypted bill data packet and the assembled batch metadata according to a preset structured data format. The header area of ​​the data unit stores the batch metadata, and the middle area stores the encrypted bill data packet. The header and the middle area are separated by a preset special character separator, such as a specific hexadecimal character, to avoid confusion between metadata and encrypted data. After binding, an indivisible transmission data unit to be signed is obtained.

[0088] Step 4.3: Perform a digital signature operation on the transmitted data unit to be signed using the sender's private key to obtain the signature value. This includes retrieving the sender's private key from a local secure storage area. This private key is held only by the sender, not transmitted externally, and updated periodically. Then, using a cryptographically compliant digital signature algorithm, first, perform a hash operation on the transmitted data unit to be signed using a cryptographically compliant hash algorithm, such as SHA-256. The transmitted data unit to be signed, containing the encrypted billing data packet and batch metadata binding, is taken as input and processed bit by bit byte by byte. First, the input... The input data undergoes standardized preprocessing. The preprocessed data is then divided into fixed-size blocks, such as 512-bit blocks for SHA-256. Each block is subjected to multiple rounds of logical operations using the algorithm's built-in compression function, with the result of each round serving as input for the next round, forming a chained processing. Finally, after processing all blocks, a fixed-length byte sequence is output, such as a 256-bit (32-byte) message digest for SHA-256, ensuring that even minor changes in the data result in a different digest. The message digest is then encrypted using the sender's private key, ultimately yielding a unique signature value.

[0089] Step 4.4: Append the signature value to the transmission data unit to form the final verifiable transmission packet, and send it to the bill reconciliation and issuance stage through a secure transmission protocol. Specifically, this includes: appending the obtained signature value to the tail area of ​​the transmission data unit to be signed to obtain a complete verifiable transmission packet from the header batch metadata to the middle encrypted bill data packet to the tail signature value; then selecting a transmission protocol that combines transport layer and application layer security, such as adding an application layer data integrity verification mechanism on top of the HTTPS protocol, and sending the verifiable transmission packet to the bill reconciliation stage or the bill issuance stage.

[0090] In this embodiment of the invention, based on the encrypted bill data packet, batch metadata is assembled by combining the generated batch number, the determined encryption algorithm identifier, and the key index information derived from the key seed and dynamic variables. The encrypted bill data packet and the batch metadata are bound together according to a predetermined structure to form a data unit to be signed for transmission. The sender's private key is used to perform a digital signature operation on the data unit to be signed to obtain a signature value. The signature value is then appended to the data unit and sent to the target stage through a secure transmission protocol. Therefore, this method overcomes the technical problems in the prior art, such as the lack of binding verification between the key and the bill data, which makes it difficult to detect the risk of batch data leakage after key leakage, the inability to verify the authenticity of the source during data transmission, and the ease with which data can be tampered with without effective traceability. This method achieves accurate binding and association between key information and bill data, ensures the authenticity and traceability of the source of transmitted data, prevents illegal tampering of data during transmission, and provides complete metadata support for the receiver's subsequent decryption verification.

[0091] In a preferred embodiment of the present invention, step 5 above may include:

[0092] Step 5.1: The receiver obtains the verifiable transmission packet, verifies the digital signature using the sender's public key, and determines that the verifiable transmission packet is complete and authentic after confirming the signature is valid, thus obtaining a successful signature verification result. Specifically, the receiver obtains the verifiable transmission packet transmitted by the sender through a secure transmission protocol interface, retrieves the pre-stored sender's public key from the locally trusted key management area (the sender's public key is paired with the sender's private key used for signing), uses the same digital signature verification algorithm as the sender to extract the signature value at the end of the transmission packet, recalculates the message digest for the transmitted data units in the transmission packet, and then decrypts the signature value using the sender's public key. If the decrypted digest is completely consistent with the recalculated digest, the signature is confirmed to be valid, the verifiable transmission packet is determined to be tamper-proof and of authentic origin, and the successful signature verification result is recorded.

[0093] Step 5.2: Based on the successful signature verification result, the verifiable transmission packet is parsed to separate the encrypted billing data packet and batch metadata contained therein. Specifically, after the receiver receives the successful signature verification result, it starts the transmission packet parsing program. According to the structured format preset by the sender, it identifies the special delimiter between the batch metadata in the header and the encrypted billing data packet in the middle of the transmission packet. Based on the delimiter, it locates and extracts the two parts of the content. The batch metadata includes the batch number, encryption algorithm identifier, key index information, and other core parameters. The encrypted billing data packet is the original ciphertext and the header verification information.

[0094] Step 5.3: Based on the key index information parsed from the batch metadata, combined with the key seed stored securely on the receiver's local machine, the receiver performs calculations according to the same rules as the sender to reconstruct the temporary encryption key used for decryption. Specifically, the receiver extracts the key index information from the parsed batch metadata. The key index information contains key features related to the dynamic variables generated by the sender. The receiver retrieves the key seed that is pre-synchronized with the sender from its local secure storage area. Following the same rules as the sender, the receiver first reconstructs the corresponding dynamic variables based on the key index information. Then, the receiver inputs the key seed and the reconstructed dynamic variables into the same key derivation function and performs the same hash iteration calculations to generate a temporary encryption key that is completely identical to the one used by the sender for encryption.

[0095] Step 5.4: Using the restored temporary encryption key, the separated encrypted bill data packets are decrypted to recover the original bill data set. The integrity of the decrypted data set is then verified. Specifically, this includes: determining the decryption algorithm mode corresponding to the sender based on the encryption algorithm identifier in the batch metadata, initializing the decryption algorithm using the restored temporary encryption key, establishing a decryption operation environment, importing the separated encrypted bill data packets into the environment to perform the decryption operation, and recovering the original bill data set containing all bill data units. After decryption, the receiver performs an integrity verification on the data set, checking whether the globally unique identifier of each bill data unit is complete, comparing the total number of data entries with the records in the batch metadata, and verifying the matching of the data content with the original business rules to ensure that the decrypted data is complete and conforms to business specifications.

[0096] In this embodiment of the invention, after the receiver obtains the verifiable transmission packet, it verifies the digital signature using the sender's public key. After successful signature verification, the receiver parses the transmission packet to separate the encrypted bill data packet and batch metadata. Then, based on the key index information in the batch metadata and the locally securely stored key seed, it restores the temporary encryption key according to the same rules as the sender. Finally, it decrypts the data using the key and performs integrity verification on the decrypted original bill data set. Therefore, this invention overcomes the technical problems in the prior art, such as the inability to confirm the authenticity of the transmitted data source, the vulnerability to illegal cracking after data tampering or interception, the lack of an effective temporary key restoration mechanism leading to decryption failure, and the lack of guarantee for the integrity of the decrypted data. This achieves the technical effect of ensuring that the received transmission packet is authentic, complete, and of legitimate origin, that only a legitimate receiver can restore the key to achieve secure decryption, ensuring that the original bill data set is not damaged or tampered with after decryption, and constructing a full-process security protection for the receiver from signature verification to decryption to integrity verification, thereby improving the security and reliability of the batch bill data receiving process.

[0097] In a preferred embodiment of the present invention, step 6 above may include:

[0098] Step 6.1: After successful decryption and integrity verification, based on the bill identifier carried by each bill in the original bill data set obtained through decryption, distribute each bill data to the corresponding reconciliation or disbursement processing channel. Specifically, this includes: after successful decryption and integrity verification, reading the globally unique bill identifier carried by each bill in the original bill data set. The globally unique bill identifier contains characteristic information such as business type and processing channel code. Based on the processing channel code in the identifier, identify the target processing channel corresponding to each bill data. For example, the flexible worker payroll disbursement bill corresponds to the bank payment channel, and the enterprise customer service fee bill corresponds to the financial reconciliation channel.

[0099] Step 6.2: Receive the processing result status returned by each processing channel for each bill data, and summarize the results according to the bill identifier to obtain the summarized processing result. Specifically, this includes: after each processing channel performs a reconciliation or issuance operation on the received bill data, it generates a processing result status containing the reasons for success, failure, or exception, and returns the result after associating it with the identifier of the corresponding bill. Receive the results returned by all processing channels, match the processing result of each bill with the original bill data according to the bill identifier to ensure that the result corresponds one-to-one with the bill, and then count the number of successfully processed bills, the number of failed bills, and various exception reasons to form a summary result covering the processing status of all bills in this batch.

[0100] Step 6.3: Associate the status of the summarized processing results with the corresponding batch metadata and mark the corresponding batch metadata as completed. Specifically, this includes associating the obtained summarized processing results, including the overall processing success rate and the percentage of each type of exception, with the parsed batch metadata through the batch number. At the same time, add fields such as processing completion time and final status to the batch metadata and mark the processing status of the batch metadata as completed. This allows the batch metadata to fully record the entire process status from generation, encryption, transmission to processing, facilitating quick querying of batch processing progress.

[0101] Step 6.4: Persistently store the completed batch metadata to obtain a complete transmission record with the final processing status, completing the closed-loop transmission process of batch billing data. Specifically, this includes storing the batch metadata marked as processed, including the associated summary processing results, original batch information, encryption algorithm identifier, timestamp, and other complete content, in a persistent storage area with access control and encryption protection, such as an archive database. During the storage process, the metadata integrity is verified to ensure that the stored content is consistent with the associated summary results. Finally, a complete transmission record containing information from data generation to processing completion is formed, realizing closed-loop management of batch billing data from generation, encryption, transmission, decryption to processing and archiving, and meeting the needs of data traceability and compliance auditing.

[0102] In this embodiment of the invention, each bill is distributed to the corresponding reconciliation or issuance processing channel based on the bill identifier carried by each bill in the original bill data. The processing result status returned by each channel is received and summarized according to the bill identifier. The summarized result is associated with the corresponding batch metadata and marked as completed. The completed batch metadata is then persistently stored. Therefore, this method overcomes the technical problems in the prior art, such as the lack of accurate identification in bill data distribution leading to confusion, the inability to accurately match processing results with bills resulting in traceability difficulties, the lack of records of batch processing status making it difficult to confirm process progress, and the lack of complete transmission records making it impossible to achieve full process backtracking. This method ensures that bill data is accurately distributed to the corresponding processing channel, achieves a one-to-one correspondence between processing results and bill data for traceability, clarifies the batch processing status to grasp process progress, and forms a complete transmission record with the final processing status to achieve a closed loop for batch bill data transmission.

[0103] like Figure 2 As shown, embodiments of the present invention also provide a dynamic encryption system for bulk transmission of billing data, including:

[0104] The acquisition module is used in the bill generation process to generate multiple sets of bill data for customers in batches according to preset bill generation rules, and assign a unique bill identifier to each set of bill data, while generating the batch number and timestamp of the current batch.

[0105] The encryption module is used to dynamically generate a temporary encryption key for the current batch based on the generated batch number, timestamp, and preset key seed; the generated temporary encryption key is used to encrypt the entire generated bill data set to obtain an encrypted bill data package;

[0106] The calculation module is used to bind the obtained encrypted bill data packet with the corresponding batch metadata, which includes the batch number, encryption algorithm identifier, and key index information derived from the key generation information. The bound data is digitally signed and then transmitted to the bill reconciliation and issuance process.

[0107] The decryption module is used to decrypt and verify the encrypted bill data packets based on the key index information in the transmitted batch metadata during the bill reconciliation and disbursement process.

[0108] The processing module is used to distribute and process the decrypted bill data based on the bill identifier after successful decryption and verification to obtain the processing result; and write the processing result back to the batch metadata to complete the closed-loop transmission process of batch bill data.

[0109] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for dynamically encrypting bulk transmission of billing data, characterized in that, The method includes: In the bill generation stage, according to the preset bill generation rules, multiple customer bill data sets are generated in batches, and a unique bill identifier is assigned to each bill data. At the same time, the batch number and timestamp of the current batch are generated. Based on the generated batch number, timestamp, and preset key seed, a temporary encryption key for the current batch is dynamically generated, including: Based on the obtained key seed, the batch number and timestamp are concatenated according to a predetermined format to obtain a unique dynamic variable; The key seed and the obtained dynamic variables are used as input parameters to call the key derivation function to perform the operation and obtain the result of the key derivation function; the result of the key derivation function is used as a temporary encryption key for encrypting the current batch of bill data set. Use the generated temporary encryption key to encrypt the entire generated bill data set, resulting in an encrypted bill data package; The obtained encrypted billing data packet is bound to the corresponding batch metadata, which includes the batch number, encryption algorithm identifier, and key index information derived from the key generation information. The bound data is then digitally signed before being transmitted to the billing reconciliation and issuance stage. This process includes: assembling batch metadata based on the obtained encrypted billing data packet, the generated batch number, the determined encryption algorithm identifier, and the key index information derived from the key seed and dynamic variables; binding the encrypted billing data packet and batch metadata according to a predetermined structure to form a transmission data unit to be signed; performing a digital signature operation on the transmission data unit to be signed using the sender's private key to obtain a signature value; and appending the signature value to the transmission data unit to form the final verifiable transmission packet, which is then sent to the billing reconciliation and issuance stage via a secure transmission protocol. Based on the bill reconciliation and disbursement process, the recipient restores the same temporary encryption key according to the key index information in the transmitted batch metadata, and decrypts and verifies the encrypted bill data packet. After successful decryption and verification, the decrypted bill data is distributed and processed based on the bill identifier to obtain the processing result. The processing result is then written back to the batch metadata, completing the closed-loop transmission process of the batch bill data. This includes: after successful decryption and integrity verification, distributing each bill data to the corresponding reconciliation or issuance processing channel based on the bill identifier carried by each bill data in the original decrypted bill data set; receiving the processing result status of each bill data returned by each processing channel, and summarizing the results according to the bill identifier to obtain the summarized processing result; associating the summarized processing result status with the corresponding batch metadata, and recording the corresponding batch metadata as processed; and persistently storing the completed batch metadata to obtain a complete transmission record with the final processing status, thus completing the closed-loop transmission process of the batch bill data.

2. The method for dynamic encryption of batch transmission of billing data according to claim 1, characterized in that, During the bill generation process, based on preset bill generation rules, multiple customer bill data sets are generated in batches, and a unique bill identifier is assigned to each bill data set. Simultaneously, the batch number and timestamp for the current batch are generated, including: Invoke the preset bill generation rules and retrieve the original business data from the business database; Based on the bill generation rules, the original business data is cleaned, classified, and calculated to obtain the initial bill data units; Each initial bill data unit is assigned a globally unique bill identifier, and the bill data units carrying the bill identifiers are aggregated to form the bill data set of the current batch. Based on the current batch of billing data, generate a batch number to identify this batch transmission task, and record the current standard time as a timestamp.

3. The method for dynamic encryption of batch transmission of billing data according to claim 2, characterized in that, Using the generated temporary encryption key, the entire generated billing data set is encrypted to obtain an encrypted billing data package, including: Based on the billing data set, the encryption algorithm mode is determined by a predefined encryption algorithm identifier, and the encryption algorithm is initialized using a temporary encryption key to establish an encryption computing environment; Import the bill data set into the established encrypted computing environment to perform batch encryption operations and obtain the original ciphertext data; Based on the obtained raw ciphertext data, the data is encapsulated according to the transmission protocol requirements, and necessary header verification information is added to obtain the final transmittable encrypted bill data packet.

4. The method for dynamic encryption of batch transmission of billing data according to claim 3, characterized in that, Based on the bill reconciliation and disbursement process, the recipient uses the key index information in the transmitted batch metadata to reconstruct the same temporary encryption key and decrypts and verifies the encrypted bill data packet, including: The receiver obtains the verifiable transmission packet, verifies the digital signature using the sender's public key, and determines that the verifiable transmission packet is complete and authentic after confirming the signature is valid, thus obtaining the result of successful signature verification. Based on the successful signature verification result, the verifiable transmission packet is parsed to separate the encrypted billing data packet and batch metadata contained therein; Based on the key index information parsed from the batch metadata, combined with the key seed securely stored locally by the receiver, the temporary encryption key used for decryption is restored by performing the same calculation as the sender. By restoring the temporary encryption key, the separated encrypted bill data packets are decrypted to recover the original bill data set, and the integrity of the decrypted data set is verified.

5. A dynamic encryption system for batch transmission of billing data, wherein the system implements the method as described in any one of claims 1 to 4, characterized in that, include: The acquisition module is used in the bill generation process to generate multiple sets of bill data for customers in batches according to preset bill generation rules, and assign a unique bill identifier to each set of bill data, while generating the batch number and timestamp of the current batch. The encryption module is used to dynamically generate a temporary encryption key for the current batch based on the generated batch number, timestamp, and preset key seed. Use the generated temporary encryption key to encrypt the entire generated bill data set, resulting in an encrypted bill data package; The calculation module is used to bind the obtained encrypted bill data packet with the corresponding batch metadata, which includes the batch number, encryption algorithm identifier, and key index information derived from the key generation information. The bound data is digitally signed and then transmitted to the bill reconciliation and issuance process. The decryption module is used to decrypt and verify the encrypted bill data packets based on the key index information in the transmitted batch metadata during the bill reconciliation and disbursement process. The processing module is used to distribute and process the decrypted bill data based on the bill identifier after successful decryption verification in order to obtain the processing result. The processing results are written back to the batch metadata, completing the closed-loop transmission process of batch billing data.

6. A computing device, characterized in that, include: One or more processors; A storage device for storing one or more programs that, when executed by one or more processors, cause the one or more processors to implement the method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program that, when executed by a processor, implements the method as described in any one of claims 1 to 4.

Images