One-way cross-network file transmission method, terminal equipment and storage medium

Abstract

The invention relates to the technical field of network data transmission, in particular to a one-way cross-network file transmission method, terminal equipment and a storage medium. The one-way cross-network file transmission method is applied to a sending end, and comprises the following steps: after receiving a transmission request of a user, generating a global unique identifier for a to-be-transmitted file, and then performing fragmentation processing operation on the to-be-transmitted file; generating a disposable symmetric encryption session key, and performing encryption processing on each file fragment by adopting an encryption algorithm to generate binary encryption data; the binary encrypted data is converted into a character string format through coding, and the coded encrypted fragmented data is sent to a receiving end piece by piece through a RESTful API one-way transmission channel; and safely transmitting the symmetric encryption session key to an auditing end through an independent high-security transmission channel, and submitting plaintext data of the file to the auditing end through a secure transmission channel. According to the invention, the security and reliability of cross-network data exchange can be remarkably improved.

Description

Technical Field

[0001] This application relates to the field of network data transmission technology, and in particular to a one-way cross-network file transfer method, terminal device and storage medium. Background Technology

[0002] With the rapid development of information technology in my country, digital transformation has become an inevitable trend for enterprise development. The widespread application of emerging technologies such as cloud computing, big data, and artificial intelligence has led to an explosive growth in enterprise data, particularly in the volume and importance of core business secrets such as product design drawings, source code, customer information, and financial statements. At the same time, the cybersecurity threat situation is becoming increasingly severe, with frequent security incidents such as advanced persistent threats, ransomware, and insider leaks, posing unprecedented challenges to enterprises' core data assets. The state has successively promulgated laws and regulations such as the Cybersecurity Law, the Data Security Law, and the Personal Information Protection Law, which have placed higher demands on the protection of enterprise data security.

[0003] In critical information infrastructure sectors such as military, finance, energy, and telecommunications, physically or logically isolated network architectures are commonly used to ensure network security, forming network zones with different security levels, including production networks, office networks, equipment networks, testing networks, and extranets. Traditional cross-network data transmission methods, such as manual copying, CD burning, and USB flash drive transfer, suffer from numerous problems, including low efficiency, difficulty in ensuring data integrity, challenges in auditing and tracing, and high risks associated with human error. These methods can no longer meet the needs of modern enterprises for efficient, secure, and controllable data exchange.

[0004] Therefore, how to achieve fast, reliable, and traceable one-way transmission of files between different security zones while ensuring network security has become a critical technical challenge that urgently needs to be addressed in the field of network security. Summary of the Invention

[0005] This application addresses the need for unidirectional file transfer between network areas with different security levels, whether physically or logically isolated. It proposes a unidirectional cross-network file transfer method, terminal device, and storage medium. Through techniques such as chunked transmission, transmission data encoding and decoding, data integrity verification, digital signature, and audit logs, it achieves efficient, controllable, and traceable unidirectional file transfer while ensuring network security, significantly improving the security and reliability of cross-network data exchange.

[0006] This application provides a one-way cross-network file transfer method, applied at the sending end, including: After receiving the user's transmission request, a globally unique identifier is generated for the file to be transmitted, and then the file to be transmitted is processed by fragmentation. Generate a one-time symmetric encryption session key, and use an encryption algorithm to encrypt each file fragment to generate binary encrypted data; The binary encrypted data is converted into a string format through encoding, and then the encoded encrypted fragmented data is sent to the receiving end piece by piece through the RESTful API one-way transmission channel; The symmetric encryption session key is securely transmitted to the auditing end through an independent, high-security transmission channel, and the plaintext data of the file is submitted to the auditing end through the secure transmission channel.

[0007] Furthermore, before generating a globally unique identifier for the file to be transmitted after receiving the user's transmission request, and before performing fragmentation processing on the file to be transmitted, the process further includes: It receives the file to be transferred selected by the user through the application, as well as the transfer request initiated by calling the file submission RESTful API interface.

[0008] Furthermore, after receiving the user's transmission request, generating a globally unique identifier for the file to be transmitted, and then performing a fragmentation operation on the file to be transmitted, the process further includes: Generate a globally unique identifier and sequence number for each fragment, and calculate the hash value of each fragment and the total hash value of the entire file.

[0009] This application also provides a one-way cross-network file transfer method, applied to an auditing end, including: The preset content auditing module is invoked to perform multi-dimensional security checks on plaintext data, including virus scanning, malicious code detection, sensitive information identification, and file type verification. When plaintext data passes all content audit items, the file is marked as safe and processable. After confirming the file's security, the symmetric encryption session key is securely forwarded to the receiving end via a RESTful API one-way transmission channel.

[0010] Furthermore, after the preset content auditing module performs multi-dimensional security checks on the plaintext data, the process also includes: If the plaintext data fails any content audit, the file transfer request is rejected, an audit failure report is generated, and the audit failure result is returned to the sender via the RESTful API interface.

[0011] Furthermore, after generating the audit failure report and returning the audit failure result to the sender via the RESTful API interface, the process also includes: Depending on the severity of the audit failure, send the user a risk alert notification of the appropriate level to alert them to the security risks present in the file content; Based on the user's confirmation instruction, the task cancellation interface of the receiving end is called to notify the receiving end to terminate the current transmission task and trigger the cleanup mechanism for received file fragments.

[0012] This application also provides a one-way cross-network file transfer method, applied at the receiving end, including: The received encrypted string data is restored to binary encrypted data using a decoding algorithm, and the received encrypted file fragments are decrypted using a symmetric encryption session key. The original file data is recovered, and data integrity is ensured by jointly verifying the total hash value of the entire file, the hash value of each fragment, and the sequence number.

[0013] Furthermore, it also includes: After completing the entire file processing flow, the final transmission result is fed back to the user in real time through the transmission status query interface.

[0014] This application also provides a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the one-way cross-network file transfer method described above.

[0015] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the one-way cross-network file transfer method described above.

[0016] The above-mentioned technical solution of this application has the following advantages: The one-way cross-network file transfer method provided in this application reduces the amount of data transmitted in a single transmission by using file fragmentation, thereby improving transmission stability and speed and effectively meeting the needs of one-way cross-network file transfer. Simultaneously, hash value verification ensures the integrity of file transmission. A content auditing module is introduced to perform virus scanning and sensitive information detection on each file fragment, preventing malicious files and sensitive information from entering the receiving network and improving the security and compliance of transmitted content. Through techniques such as chunked transmission, data encoding and decoding, data integrity verification, digital signatures, and audit logs, efficient, controllable, and traceable one-way file transmission is achieved while ensuring network security, significantly improving the security and reliability of cross-network data exchange. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1 This is an application scenario diagram of the one-way cross-network file transfer method provided in the embodiments of this application; Figure 2 This is a flowchart illustrating a one-way cross-network file transfer method provided in an embodiment of this application. Detailed Implementation

[0019] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of this application with unnecessary detail.

[0020] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0021] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0022] References to "one embodiment" or "some embodiments" in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized. "A plurality" means "two or more."

[0023] This application provides a one-way cross-network file transfer method based on a RESTful API that supports content auditing. This method is primarily applied to scenarios requiring one-way file transfer between different security domain networks (such as intranet and extranet, production network and office network, etc.) and where there are strict auditing requirements for the security and compliance of the transferred content. Examples include sensitive data exchange scenarios involving government agencies, financial institutions, and large enterprises. The goal is to achieve efficient one-way file transfer, comprehensive auditing of the transferred content, improved interface compatibility, and real-time monitoring of the transfer status.

[0024] The specific embodiments of this application will be described in further detail below with reference to the accompanying drawings and examples. The following examples are used to illustrate this application, but are not intended to limit the scope of this application.

[0025] This application provides a one-way cross-network file transfer method, such as... Figure 1 As shown, this method involves four participants: the user, the sender, the receiver, and the auditor. In a typical deployment scenario, the sender and receiver are located in network domains with different security levels (such as intranet and extranet, production network and office network). They only support one-way communication via unencrypted RESTful APIs and are only allowed to transmit data in string format. To ensure auditing efficiency and reduce security risks, the auditor is typically deployed in the same network security domain as the sender, and a dedicated plaintext secure audit transmission channel is established between the sender and auditor to perform content security checks.

[0026] Based on the network architecture of the above typical scenarios, the complete implementation process of this method is as follows: Figure 2 As shown. The specific implementation steps are as follows: S1. File Submission: On the sending network, the user selects the file to be transferred through the application and calls the file submission RESTful API interface provided by the sending end to initiate a transfer request. The request includes basic file metadata (such as filename, size, and type) and transfer parameter configuration.

[0027] S2. Data Preparation: After receiving the transmission request, the sending end immediately generates a globally unique identifier (fileId) for the current file. Then, it performs a file splitting operation on the target file, specifically dividing the file into multiple independent file fragments according to a preset fragment size. A globally unique identifier (chunkId) and a sequence number (chunkSeq) are generated for each fragment. At the same time, the hash value (chuckHash) of each fragment and the total hash value (fileHash) of the entire file are calculated for subsequent data integrity verification.

[0028] S3. Sending Encrypted Data: The sending end generates a one-time symmetric encryption session key (sessionKey). Using a common encryption algorithm such as AES, this session key is combined to encrypt each file fragment, generating binary encrypted data (binaryData). The binary encrypted data (binaryData) is then converted to a string format using BASE64 encoding, denoted as string encrypted data (stringData). The encoded encrypted fragments are then sent piece by piece to the receiving end via a RESTful API one-way transmission channel, ensuring data confidentiality during transmission.

[0029] S4. Send Session Key: The sending end securely transmits the encrypted session key (sessionKey) to the auditing end through an independent, high-security transmission channel, preparing for subsequent file decryption operations and effectively preventing the key from being stolen during transmission.

[0030] S5. Submitted Content Audit: The sending end submits plaintext data (plainData) of the file to the auditing end through a secure transmission channel. The auditing end calls the preset content auditing module to perform multi-dimensional security checks on the plaintext data (plainData), including virus scanning, malicious code detection, sensitive information identification, file type verification, and other comprehensive security checks.

[0031] S6. Audit Passed: When the plaintext data (plainData) passes all content audit items, the auditing end marks the file as safe and processable, awaiting further processing. S6-1, Submit Session Key: After confirming the file security, the auditing end securely forwards the session key (sessionKey) to the receiving end through the RESTful API one-way transmission channel; S6-2, Data Decryption: The receiving end first uses the BASE64 decoding algorithm to restore the received encrypted string data (stringData) to binary encrypted data (binaryData). Then, it uses the session key (sessionKey) to decrypt each received encrypted file fragment, ultimately recovering the original file data. This is then verified using fileHash and...<chuckHash,chunkSeq> Joint verification ensures data integrity.

[0032] S7. Audit Failure: If plaintext data fails any audit item, the auditing end will immediately reject the file transmission request, generate a detailed audit failure report, and return the audit failure result to the sender via the RESTful API interface, including the reason for failure, the type of violation, and the specific location of the problem. S7-1, Risk Alert: The auditing end promptly sends risk alert notifications of the corresponding level to users based on the severity of the audit failure, clearly alerting users to the security risks existing in the file content; S7-2, Cancel Reception: Based on the user's confirmation instruction, the audit end calls the task cancellation interface of the receiving end to notify the receiving end to terminate the current transmission task and trigger the cleanup mechanism for received file fragments.

[0033] S8. Notify the user of the result: After completing the entire file processing flow, the receiving end provides real-time feedback on the final transmission result to the user through the transmission status query interface. The user can query complete transmission status information, audit result details, and file metadata through the receiving end application.

[0034] The following is a description through specific embodiments.

[0035] Example The system architecture of this embodiment mainly includes four core components: a sending end, a one-way transmission device, an auditing end, and a receiving end. Each component provides a one-way cross-network file transfer method based on a RESTful API that supports content auditing. The specific implementation method will be described in detail below with reference to the technical solution.

[0036] The sending end is responsible for file fragmentation, encrypted transmission, and state management, specifically including: The file reading and preprocessing module is responsible for reading the file to be transferred from the local file system and performing initial verification. The file fragmentation module implements functions such as file fragmentation strategy formulation, fragmentation identifier generation, and fragmentation hash calculation. Encrypted transmission module: Generates a random session key for each transmission task, encrypts the fragmented data, and transmits it over the network; Status Management Module: Maintains the status information of transmission tasks, including fragment upload status and overall transmission progress.

[0037] Unidirectional transmission devices are used to establish physically isolated unidirectional data channels between different security domains, ensuring that data can only flow from the source network to the destination network. Specifically, this includes: One-way data transmission module: Implements a one-way data transmission mechanism based on optical signals or other physical isolation technologies; Flow control module: Limits transmission rate and data volume to prevent resource abuse; Security filtering module: Performs preliminary security filtering on transmitted data, blocking obvious malicious data.

[0038] The auditing department is responsible for auditing the content of transmitted files to ensure the security and compliance of the transmitted content, specifically including: Data receiving module: Receives fragmented data from the sending end and temporarily stores it; Multi-engine auditing module: integrates a virus scanning engine, a sensitive information identification engine, a file type verification engine, and a content compliance checking engine; Audit Result Generation Module: Generates a comprehensive audit report based on the detection results of each audit engine.

[0039] The receiving end is responsible for receiving, merging, verifying the integrity of file fragments, and finally storing them, specifically including: Fragment receiving module: Receives and verifies fragmented data from the audit end; File merging module: Merges all fragments into a complete file according to the fragment sequence number; Integrity verification module: performs hash value calculation and comparison on the merged files to ensure data integrity; Storage management module: Stores verified files to a specified location and manages storage space.

[0040] (1) File fragmentation processing method File fragmentation is one of the core technologies of this method, and the specific implementation strategy is as follows: 1. Fragmentation Strategy The system uses a fixed-size fragmentation strategy by default, with a default fragment size of 4MB, which can be dynamically adjusted based on network bandwidth and file type. For very large files (>1GB), the fragment size can be automatically adjusted to 8MB-16MB to reduce the number of fragments; for small files (<1MB), you can choose to transmit them directly without fragmentation to improve transmission efficiency.

[0041] 2. Fragment identifier generation File unique identifier (fileId): generated using the UUID v4 algorithm to ensure global uniqueness.

[0042] ChunkId: Generated using a combination of fileId and chunkSeq.

[0043] Chunk Sequence Number (chunkSeq): An incrementing integer starting from 0, used to identify the sequential position of the chunk in the original file.

[0044] 3. Sharded hash calculation The SHA-256 algorithm is used to calculate the hash value (chunkHash) of each chunk for chunk-level integrity verification; simultaneously, the total hash value (fileHash) of the entire file is calculated for integrity verification after the files are merged. The hash values ​​are transmitted and stored in BASE64 encoded form.

[0045] 4. Fragmented metadata management The sending end maintains fragment metadata information, including fragment size, quantity, chunkId, chunkSeq, and chunkHash for each fragment. Fragment metadata is stored in both memory cache and a local database to ensure data reliability; a fragment upload status tracking mechanism is also implemented to support breakpoint resume functionality.

[0046] (2) Fragmented transmission and content auditing methods The fragmented transmission process is closely integrated with the content auditing process to ensure transmission efficiency and content security. The specific implementation is as follows: 1. Fragmented transmission mechanism A strategy combining sequential and parallel transmission is adopted: sequential transmission is enabled by default, while parallel transmission can be enabled when network conditions permit; adaptive transmission rate control is implemented, and the transmission rate is dynamically adjusted according to network conditions; each fragment is acknowledged immediately after transmission to ensure transmission reliability; for fragments that fail to be transmitted, automatic retry is performed, with a maximum of 3 retries.

[0047] 2. Encrypted transmission implementation The sending end generates a random 256-bit AES session key for each transmission task; uses the session key to encrypt the fragmented data in AES-256-CBC mode; the encrypted data is converted into a string format using BASE64 encoding for transmission; the session key is transmitted to the auditing end through an independent secure channel to ensure key security.

[0048] 3. Content Audit Process The sending end transmits plaintext fragmented data to the auditing end in real time for auditing; the auditing end adopts a multi-engine parallel auditing strategy, specifically including: Virus detection engine: Uses commercial-grade antivirus software to scan for malicious code.

[0049] Sensitive Information Recognition Engine: Uses regular expressions and machine learning models to identify sensitive information (such as ID card numbers, bank card numbers, passwords, etc.).

[0050] File type verification engine: Detects the true file type by identifying file header features, preventing file type spoofing.

[0051] Content compliance check engine: Checks content compliance based on predefined rules.

[0052] The audit results are fed back to the sending end in real time, and a detailed audit log is recorded.

[0053] 4. Security Control Strategy Implement rate limiting control based on transmission rate and file size to prevent resource abuse; monitor and block abnormal transmission behavior in real time; support transmission control policies based on blacklists and whitelists; digitally sign all transmitted data and audit results to ensure data integrity and non-repudiation.

[0054] (3) File merging and integrity verification methods After receiving all fragments and passing the audit, the receiving end performs file merging and integrity verification operations, specifically as follows: 1. File merging process The receiving end writes all fragment data to the temporary storage area according to the fragment sequence number chunkSeq; it implements a fragment arrival order adjustment mechanism, supporting out-of-order reception and sequential merging; it performs real-time verification of the written data during the merging process to ensure data accuracy; it provides a merging progress monitoring function and supports breakpoint continuation of large file merging.

[0055] 2. Integrity verification mechanism Fragment-level verification: Upon receiving each fragment, it is immediately verified using chunkHash to ensure the integrity of the fragment data; File-level verification: After the files are merged, the hash value of the entire file is calculated and compared with fileHash; A dual verification mechanism is adopted to ensure the integrity of data during transmission and merging; If verification fails, a retransmission mechanism is automatically triggered.

[0056] 3. Storage Management Strategy The receiving end adopts a two-tier storage architecture of temporary storage + final storage; temporary storage is used to store fragmented data that has not been merged and uses high-performance storage media; final storage is used to store merged and verified files and supports multiple storage types (local file system, object storage, etc.); it implements storage capacity monitoring and automatic cleanup mechanisms to periodically clean up expired or failed transmission task data.

[0057] 4. Exception handling mechanism In case of abnormal situations such as missing or corrupted fragments, a retransmission request is automatically sent to the sender; for files that fail to be merged, a cleanup mechanism is automatically triggered to release storage space; all abnormal situations are logged in detail and an alarm notification function is provided.

[0058] (4) Method for feedback of transmission status and audit results The system provides a comprehensive feedback mechanism for transmission status and audit results, ensuring that users are promptly informed of transmission progress and results. The specific implementation is as follows: 1. Transmission State Definition Initialization (INIT): The task has been created but transmission has not yet started.

[0059] PROCESSING: The file is being transferred.

[0060] COMPLETED: File transfer completed and merged successfully.

[0061] FAILED: An error occurred during file transfer.

[0062] Auditing: The document is currently undergoing a content audit.

[0063] Audit passed (AUDIT_PASS): The document content audit passed.

[0064] Audit rejected (AUDIT_REJECT): The audit of the document content failed.

[0065] 2. Real-time status feedback Both the sending and receiving ends maintain detailed transmission status information; a WebSocket real-time push interface is provided to support real-time push of transmission progress and status; a transmission status polling interface is implemented to support clients to actively query the transmission status; the status update frequency can be dynamically adjusted according to the transmission progress (10 seconds / time in the early stage of transmission, and 1 second / time when it is close to completion).

[0066] 3. Audit Results Feedback Upon completion of the audit, the audit results are immediately fed back to the sender and the user; for documents that pass the audit, a detailed audit report summary is provided; for documents that are rejected by the audit, detailed information such as the specific reasons for rejection, the type of violation, and the location of the problem is provided; the audit results can be exported to PDF, Excel and other formats.

[0067] 4. User notification mechanism It supports multiple notification methods, including in-system messages, emails, and SMS; it adopts different levels of notification strategies based on the priority of the transmission task and the severity of the audit results; it enables the customization of notification templates to meet the notification needs of different scenarios; and it provides notification status tracking to ensure that notifications are delivered.

[0068] 5. Log recording and auditing Record complete transmission logs, including information on the entire process from task creation, fragmented transmission, merging and verification, to audit results; log information adopts a hierarchical storage strategy, with critical logs stored in encrypted form; provide log query and analysis functions, supporting retrieval by time, task ID, file name, and other conditions; log data retention time is configurable to meet different compliance requirements.

[0069] The one-way cross-network file transfer method provided in this application has the following beneficial effects: High transmission efficiency: By using file fragmentation for transmission, the amount of data transmitted in a single transmission is reduced, improving transmission stability and speed, and effectively meeting the needs of one-way cross-network file transmission; at the same time, hash value verification ensures the integrity of file transmission.

[0070] Content security and controllability: The introduction of a content auditing module performs auditing operations such as virus scanning and sensitive information detection on each file segment to prevent malicious files and sensitive information from entering the receiving network, thereby improving the security and compliance of transmitted content.

[0071] Good interface compatibility: The interface is designed based on RESTful API and follows the HTTP standard, which has good cross-platform and cross-system compatibility, reducing the customized development work for system integration and lowering maintenance costs.

[0072] The transmission status can be monitored: It provides a transmission status query interface and an audit result query interface, which enables real-time monitoring and querying of the file transmission process and audit results, making it easier for operation and maintenance personnel to discover and handle transmission anomalies in a timely manner.

[0073] This application also provides a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the one-way cross-network file transfer method provided in the first aspect.

[0074] In applications, terminal devices may include, but are not limited to, processors and memory. These are merely examples of terminal devices and do not constitute a limitation on them. They may include more or fewer components, combinations of certain components, or different components, such as input / output devices and network access devices. Input / output devices may include cameras, audio capture / playback devices, displays, etc. Network access devices may include network modules for wireless network communication with external devices.

[0075] In applications, the processor can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0076] In applications, the memory may be an internal storage unit of the terminal device in some embodiments, such as the hard drive or RAM of the terminal device. In other embodiments, the memory may be an external storage device of the terminal device, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card. The memory may also include both internal and external storage units of the terminal device. The memory is used to store the operating system, applications, bootloader, data, and other programs, such as the program code of computer programs. The memory can also be used to temporarily store data that has been output or will be output.

[0077] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can implement the steps in the above-described method embodiments.

[0078] This application implements all or part of the processes in the methods of the above embodiments, which can be accomplished by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium can include at least: any entity or device capable of carrying the computer program code to a terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, such as a USB flash drive, a portable hard drive, a magnetic disk, or an optical disk.

[0079] Those skilled in the art will recognize that the device and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0080] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interface, or the device may be indirectly coupled or communicated, and may be electrical, mechanical, or other forms.

[0081] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A one-way cross-network file transfer method, characterized in that, Applied to the sending end, including: After receiving the user's transmission request, a globally unique identifier is generated for the file to be transmitted, and then the file to be transmitted is processed by fragmentation. Generate a one-time symmetric encryption session key, and use an encryption algorithm to encrypt each file fragment to generate binary encrypted data; The binary encrypted data is converted into a string format through encoding, and then the encoded encrypted fragmented data is sent to the receiving end piece by piece through the RESTful API one-way transmission channel; The symmetric encryption session key is securely transmitted to the auditing end through an independent, high-security transmission channel, and the plaintext data of the file is submitted to the auditing end through the secure transmission channel.

2. The one-way cross-network file transfer method as described in claim 1, characterized in that, After receiving the user's transmission request, before generating a globally unique identifier for the file to be transmitted and then performing fragmentation processing on the file to be transmitted, the process further includes: It receives the file to be transferred selected by the user through the application, as well as the transfer request initiated by calling the file submission RESTful API interface.

3. The one-way cross-network file transfer method as described in claim 1, characterized in that, After receiving the user's transmission request, generating a globally unique identifier for the file to be transmitted, and then performing a fragmentation operation on the file to be transmitted, the process further includes: Generate a globally unique identifier and sequence number for each fragment, and calculate the hash value of each fragment and the total hash value of the entire file.

4. A one-way cross-network file transfer method, characterized in that, Applications in the auditing field include: The preset content auditing module is invoked to perform multi-dimensional security checks on plaintext data, including virus scanning, malicious code detection, sensitive information identification, and file type verification. When plaintext data passes all content audit items, the file is marked as safe and processable. After confirming the file's security, the symmetric encryption session key is securely forwarded to the receiving end via a RESTful API one-way transmission channel.

5. The one-way cross-network file transfer method as described in claim 4, characterized in that, After the preset content auditing module performs multi-dimensional security checks on the plaintext data, the method further includes: If the plaintext data fails any content audit, the file transfer request is rejected, an audit failure report is generated, and the audit failure result is returned to the sender via the RESTful API interface.

6. The one-way cross-network file transfer method as described in claim 5, characterized in that, After generating the audit failure report and returning the audit failure result to the sender via the RESTful API interface, the process also includes: Depending on the severity of the audit failure, send the user a risk alert notification of the appropriate level to alert them to the security risks present in the file content; Based on the user's confirmation instruction, the task cancellation interface of the receiving end is called to notify the receiving end to terminate the current transmission task and trigger the cleanup mechanism for received file fragments.

7. A one-way cross-network file transfer method, characterized in that, Applied to the receiving end, including: The received encrypted string data is restored to binary encrypted data using a decoding algorithm, and the received encrypted file fragments are decrypted using a symmetric encryption session key. The original file data is recovered, and data integrity is ensured by jointly verifying the total hash value of the entire file, the hash value of each fragment, and the sequence number.

8. The one-way cross-network file transfer method as described in claim 7, characterized in that, Also includes: After completing the entire file processing flow, the final transmission result is fed back to the user in real time through the transmission status query interface.

9. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the one-way cross-network file transfer method as described in any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the one-way cross-network file transfer method as described in any one of claims 1 to 8.

Images