Secure exchange method and system for multi-region files

Abstract

The invention discloses a secure exchange method and system for multi-area files, and the method comprises the steps: receiving a file exchange instruction sent by a user terminal in a local area network, the file exchange instruction comprising a to-be-transmitted file, a target transmission engine node B, and a target user terminal and / or a target storage position; performing security check on the to-be-transmitted file according to a preset security policy; if the file to be transmitted passes the security check, interacting with the user terminal and the target transmission engine node B according to a preset maximum transmission thread confirmation strategy to obtain the maximum transmission data packet length; according to the maximum transmission data packet length, performing virtual blocking or virtual splicing on the to-be-transmitted file to obtain a plurality of to-be-transmitted data packets; and sending all the data packets to be transmitted to a target transmission engine node B, and enabling the target transmission engine node B to restore the received data packets and deliver the data packets to a target user terminal and / or a target storage position. According to the invention, the transmission efficiency and the transmission stability can be effectively improved, and the transmission safety can be improved.

Description

Technical Field

[0001] This invention belongs to the field of file transfer technology, specifically relating to a method and system for secure exchange of files across multiple regions. Background Technology

[0002] Traditional cross-network file exchange methods rely heavily on basic tools or manual operation. While they can meet simple transmission needs, they have significant shortcomings in security, transmission efficiency, and manageability, making them unsuitable for the complex scenarios of current businesses. To address this issue, existing transmission technologies use FTP or SFTP to achieve cross-network and cross-regional file transfer, but both have numerous drawbacks.

[0003] The disadvantages of FTP include:

[0004] 1. Extremely low safety:

[0005] Plaintext transmission: As defined in RFC 959, FTP provides no encryption. All data, including usernames, passwords, commands, and file contents, is transmitted in plaintext over the network. This is extremely dangerous in modern networks, making it highly vulnerable to eavesdropping and tampering.

[0006] Firewall / NAT unfriendly: In active mode, the server needs to actively connect to the client, which often fails or requires complex configuration in modern network environments that commonly use NAT and firewalls.

[0007] 2. Complex architecture and performance bottlenecks:

[0008] Dual connection overhead: Establishing and tearing down a separate TCP connection for each file transfer introduces additional network latency and resource overhead;

[0009] Heavy server load: In active mode, the server needs to initiate a reverse TCP connection for each data connection, which puts a lot of pressure on the server in high-concurrency scenarios.

[0010] Functional limitations: The protocol itself has weak support for the atomicity and integrity verification of file operations, as well as advanced file attributes (such as precise timestamps and permissions).

[0011] The disadvantages of SFTP include:

[0012] 1. Performance characteristics:

[0013] Connection overhead: SSH handshake and encrypted computation introduce initial connection latency;

[0014] Streaming: Supports large file streaming with controllable memory usage;

[0015] Concurrency control: Multiple requests can be processed in parallel within a single connection.

[0016] 2. Known limitations:

[0017] TCP head-of-line blocking: Because it runs on top of SSH, which guarantees packet order within a single TCP connection, it can lead to performance degradation.

[0018] Encryption overhead: Encryption and decryption operations consume CPU resources and may become a performance bottleneck;

[0019] Protocol complexity: Compared to simple FTP, it has higher implementation complexity. Summary of the Invention

[0020] To address the aforementioned problems, this invention proposes a secure method and system for exchanging files across multiple regions, which can effectively improve transmission efficiency and stability, as well as enhance transmission security.

[0021] To achieve the above-mentioned technical objectives and effects, the present invention is implemented through the following technical solution:

[0022] In a first aspect, the present invention provides a secure method for exchanging multi-region files, applied to a transmission engine node A, comprising:

[0023] The system receives a file exchange instruction sent by a user terminal within a local area network. The file exchange instruction includes the file to be transferred, the target transmission engine node B, and the target user terminal and / or the target storage location. The target transmission engine node B and the transmission engine node A are located in different local area networks.

[0024] The file to be transmitted is subjected to a security check according to a preset security policy.

[0025] If the file to be transmitted passes the security check, then the maximum transmission data packet length is obtained by interacting with the user terminal and the target transmission engine node B according to the preset maximum transmission thread confirmation strategy.

[0026] Based on the maximum transmission data packet length, the file to be transmitted is virtually divided into blocks or virtually spliced ​​to obtain several data packets to be transmitted.

[0027] All data packets to be transmitted are sent to the target transmission engine node B, which then restores the received data packets and delivers them to the target user terminal and / or the target storage location.

[0028] In conjunction with the first aspect, optionally, the method for obtaining the maximum transmission data packet length includes:

[0029] Repeat the following steps until the user terminal stops generating new UDP packets, and use the length of the last UDP packet generated by the user terminal as the maximum transmission packet length:

[0030] Receive UDP data packets sent by a user terminal, wherein the UDP data packets are defined as indivisible data packets;

[0031] The UDP data packet is sent to the UDP port of the target transmission engine node B, and the target transmission engine node B generates a response packet based on the received UDP data. The response packet includes the length of the UDP data packet and a confirmation instruction indicating whether the current UDP data packet can be transmitted on the communication link between transmission engine node A and target transmission engine node B.

[0032] The system receives the response packet sent by the target transmission engine node B and forwards it to the user terminal, enabling the user terminal to generate a new UDP packet. The method for generating the new UDP packet includes:

[0033] When the confirmation command indicates that the current UDP packet cannot be transmitted on the communication link between transport engine node A and the target transport engine node B, the length of the new UDP data is calculated according to the following formula:

[0034] ,

[0035] in, For the length of the new UDP data, The length of the current UDP packet. Indicates the length of the previous UDP packet. Indicates rounding down;

[0036] When the confirmation command indicates that the current UDP data packet can be transmitted through the communication link between transport engine node A and the target transport engine node B, the length of the new UDP data is calculated according to the following formula:

[0037] .

[0038] In conjunction with the first aspect, optionally, the step of virtually dividing or virtually concatenating the file to be transmitted into several data packets to be transmitted based on the maximum transmission data packet length specifically includes:

[0039] If the length of the file to be transmitted is greater than the maximum transmission data packet length, the file to be transmitted is logically divided into several data packets according to the maximum transmission data packet length, and each data packet is transmitted in parallel. The length of each data packet is equal to or less than the maximum transmission data packet length.

[0040] If the length of the file to be transmitted is less than the maximum transmission data packet length, then multiple files to be transmitted are logically concatenated into one data packet according to the maximum transmission data packet length, and the length of the data packet is equal to or less than the maximum transmission data packet length.

[0041] In conjunction with the first aspect, optionally, the communication link between the transmission engine node A and the target transmission engine node B supports symmetric encryption algorithms and asymmetric encryption algorithms.

[0042] Secondly, the present invention provides a secure exchange system for multi-region files, including a web platform and several transmission engine nodes that are communicatively connected to the web platform; each transmission engine node is located in a different local area network.

[0043] If transmission engine node A receives a file exchange instruction from a user terminal within the local area network, wherein the file exchange instruction includes the file to be transferred, the target transmission engine node B, and the target user terminal and / or target storage location, then it performs a security check on the file to be transferred according to a preset security policy. If the file to be transferred passes the security check, it interacts with the user terminal and the target transmission engine node B according to a preset maximum transmission thread confirmation policy to obtain the maximum transmission data packet length. Based on the maximum transmission data packet length, the file to be transferred is virtually segmented or virtually concatenated to obtain several data packets to be transferred. All data packets to be transferred are then sent to the target transmission engine node B.

[0044] The target transmission engine node B restores the received data packets and delivers them to the target user terminal and / or the target storage location.

[0045] In conjunction with the second aspect, optionally, the WEB platform includes:

[0046] The user and permission management module is used for user and permission management.

[0047] The transmission node management module is used to manage each transmission engine node;

[0048] The workspace management module is used to manage workspaces;

[0049] The security policy management module is used to manage security policies;

[0050] The approval process engine module is used to manage approval processes;

[0051] The log management and auditing modules are used to manage logs and auditing processes.

[0052] In conjunction with the second aspect, optionally, transmission engine node A repeats the following steps until the user terminal no longer generates new UDP packets, and the length of the last UDP packet generated by the user terminal is taken as the maximum transmission packet length:

[0053] The target transmission engine node B opens a UDP port and continuously listens to the UDP port;

[0054] The transmission engine node A receives the UDP data packet constructed by the user terminal and sends the UDP data packet to the UDP port of the target transmission engine node B;

[0055] The target transmission engine node B receives the UDP data packet, records the length of the UDP data packet, and then constructs a response packet. The response packet includes the length of the UDP data packet and a confirmation instruction indicating whether the current UDP data packet can be transmitted on the communication link between transmission engine node A and target transmission engine node B.

[0056] The transmission engine node A receives the response packet sent by the target transmission engine node B and forwards the response packet to the user terminal, so that the user terminal generates a new UDP data packet. The method for generating the new UDP data packet includes:

[0057] When the confirmation command indicates that the current UDP packet cannot be transmitted on the communication link between transport engine node A and the target transport engine node B, the length of the new UDP data is calculated according to the following formula:

[0058] ,

[0059] in, For the length of the new UDP data, The length of the current UDP packet. Indicates the length of the previous UDP packet. Indicates rounding down;

[0060] When the confirmation command indicates that the current UDP data packet can be transmitted through the communication link between transport engine node A and the target transport engine node B, the length of the new UDP data is calculated according to the following formula:

[0061] .

[0062] In conjunction with the second aspect, optionally, the step of virtually dividing or virtually concatenating the file to be transmitted into several data packets to be transmitted based on the maximum transmission data packet length specifically includes:

[0063] If the length of the file to be transmitted is greater than the maximum transmission data packet length, the file to be transmitted is logically divided into several data packets according to the maximum transmission data packet length, and each data packet is transmitted in parallel. The length of each data packet is equal to or less than the maximum transmission data packet length.

[0064] The file to be transmitted is virtually segmented or virtually concatenated according to the maximum transmission data packet length to obtain several data packets to be transmitted:

[0065] If the length of the file to be transmitted is greater than the maximum transmission data packet length, the file to be transmitted is logically divided into several data packets according to the maximum transmission data packet length, and each data packet is transmitted in parallel. The length of each data packet is equal to or less than the maximum transmission data packet length.

[0066] In conjunction with the second aspect, optionally, the communication link between the transmission engine node A and the target transmission engine node B supports symmetric encryption algorithms and asymmetric encryption algorithms.

[0067] Thirdly, the present invention provides a secure exchange system for multi-region files, including a storage medium and a processor;

[0068] The storage medium is used to store instructions;

[0069] The processor is configured to operate according to the instructions to perform the method according to any one of the first aspects.

[0070] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0071] This invention proposes to interact with the user terminal and the target transmission engine node B according to a preset maximum transmission thread confirmation strategy to obtain the maximum transmission data packet length. Based on this design, transmission efficiency can be maximized under various complex network conditions, and bandwidth utilization can reach more than 80%.

[0072] Furthermore, this invention proposes to virtually segment or concatenate the file to be transmitted based on the maximum transmission data packet length, resulting in several data packets to be transmitted. This enables virtual segmentation and transmission of large files, as well as virtual concatenation and transmission of small files, supporting reliable transmission of TB-level ultra-large files and millions of massive files. It also enables breakpoint resumption, multiple file verifications, and intelligent retransmission to ensure 100% accurate and complete file transmission. Attached Figure Description

[0073] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly described below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort, wherein:

[0074] Figure 1 This is a schematic diagram of a secure multi-region file exchange system according to an embodiment of the present invention;

[0075] Figure 2 This is a schematic diagram illustrating the transmission of a file to be transmitted according to an embodiment of the present invention. Detailed Implementation

[0076] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0077] Furthermore, if the embodiments of this invention involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by this invention.

[0078] Example 1

[0079] This invention provides a secure method for exchanging files across multiple regions, applied to transmission engine node A, comprising the following steps:

[0080] (1) Receive a file exchange instruction sent by a user terminal in the local area network. The file exchange instruction includes the file to be transferred, the target transmission engine node B, and the target user terminal and / or the target storage location. The target transmission engine node B and the transmission engine node A are located in different local area networks.

[0081] (2) Perform a security check on the file to be transmitted according to the preset security policy;

[0082] (3) If the file to be transmitted passes the security check, the maximum transmission thread confirmation strategy is used to interact with the user terminal and the target transmission engine node B to obtain the maximum transmission data packet length. In the specific implementation process, the security check may include anti-virus / sensitive information check / file type check, etc., which can be set according to actual needs. The security check may be a security strategy that combines automatic security check and manual review.

[0083] (4) Based on the maximum transmission data packet length, the file to be transmitted is virtually divided into blocks or virtually spliced ​​to obtain several data packets to be transmitted;

[0084] (5) Send all data packets to be transmitted to the target transmission engine node B, and make the target transmission engine node B restore the received data packets and deliver them to the target user terminal and / or the target storage location.

[0085] The above scheme proposes to interact with the user terminal and the target transmission engine node B according to the preset maximum transmission thread confirmation strategy to obtain the maximum transmission data packet length. Based on this design, the transmission efficiency can be maximized under various complex network conditions, and the bandwidth utilization rate can reach more than 80%.

[0086] In one specific embodiment of the present invention, the method for obtaining the maximum transmission data packet length includes:

[0087] Repeat the following steps until the user terminal stops generating new UDP packets, and use the length of the last UDP packet generated by the user terminal as the maximum transmission packet length:

[0088] Receive UDP data packets sent by a user terminal, wherein the UDP data packets are defined as indivisible data packets;

[0089] The UDP data packet is sent to the UDP port of the target transmission engine node B, and the target transmission engine node B generates a response packet based on the received UDP data. The response packet includes the length of the UDP data packet and a confirmation instruction indicating whether the current UDP data packet can be transmitted on the communication link between transmission engine node A and target transmission engine node B.

[0090] The system receives the response packet sent by the target transmission engine node B and forwards it to the user terminal, enabling the user terminal to generate a new UDP packet. The method for generating the new UDP packet includes:

[0091] When the confirmation command indicates that the current UDP packet cannot be transmitted on the communication link between transport engine node A and the target transport engine node B, the length of the new UDP data is calculated according to the following formula:

[0092] ,

[0093] in, For the length of the new UDP data, The length of the current UDP packet. This indicates rounding down. Indicates the length of the previous UDP packet;

[0094] When the confirmation command indicates that the current UDP data packet can be transmitted through the communication link between transport engine node A and the target transport engine node B, the length of the new UDP data is calculated according to the following formula:

[0095] .

[0096] Based on the above scheme, the maximum number of transmission threads can be confirmed, thereby improving the file transfer rate.

[0097] In one specific embodiment of the present invention, the file to be transmitted is virtually divided into blocks or virtually concatenated according to the maximum transmission data packet length to obtain several data packets to be transmitted:

[0098] If the length of the file to be transmitted is greater than the maximum transmission data packet length, the file to be transmitted is logically divided into several data packets according to the maximum transmission data packet length, and each data packet is transmitted in parallel. The length of each data packet is equal to or less than the maximum transmission data packet length.

[0099] If the length of the file to be transmitted is less than the maximum transmission data packet length, then multiple files to be transmitted are logically concatenated into one data packet according to the maximum transmission data packet length, and the length of the data packet is equal to or less than the maximum transmission data packet length.

[0100] Based on the above scheme, a single large file (such as a video, database backup, or large design file) can be logically divided into multiple smaller, fixed-size "data blocks." These data blocks can be transmitted in parallel, making full use of network bandwidth. Even if the transmission of a certain block fails, only that specific block needs to be retransmitted, rather than the entire file, greatly improving transmission efficiency and stability. Furthermore, a large number of small files (such as documents, images, and log files) can be logically "packaged" into a larger data block for transmission. Before sending, the transmission engine concatenates numerous small files into a virtual "large block," and after transmission, it automatically unpacks and restores the original small files at the target node.

[0101] In one specific embodiment of the present invention, the communication link between the transmission engine node A and the target transmission engine node B supports symmetric encryption algorithms and asymmetric encryption algorithms.

[0102] Based on this design, file transmission can be encrypted, ensuring that files are not intercepted or tampered with during transmission, thus improving security.

[0103] Based on the above analysis, the solution in the embodiments of the present invention is as follows:

[0104] Improved transmission efficiency: By using multiple transmission engine nodes to connect different areas of the network, file transfer channels can be established between different areas, enabling data files to flow quickly between areas and reducing transmission time to minutes.

[0105] File security is enhanced: the transmission engine nodes are directly connected to end users, who can directly access the nearest transmission engine node, submit file transmission requests, and realize file transmission (i.e., file upload and download) point-to-point, effectively reducing the spread of data files.

[0106] Example 2

[0107] This invention provides a secure multi-region file exchange system, such as... Figure 1 As shown, it includes a web platform and several transmission engine nodes that are communicatively connected to the web platform; each transmission engine node is located in a different local area network.

[0108] If transmission engine node A receives a file exchange instruction from a user terminal within the local area network, the file exchange instruction including the file to be transferred, the target transmission engine node B, and the target user terminal and / or target storage location, then it performs a security check on the file to be transferred according to a preset security policy. If the file to be transferred passes the security check, it interacts with the user terminal and the target transmission engine node B according to a preset maximum transmission thread confirmation policy to obtain the maximum transmission data packet length. Based on the maximum transmission data packet length, the file to be transferred is virtually segmented or virtually concatenated to obtain several data packets to be transferred. All data packets to be transferred are sent to the target transmission engine node B. Transmission engine node A and the target transmission engine node B are any one of several transmission engine nodes.

[0109] The target transmission engine node B restores the received data packets and delivers them to the target user terminal and / or the target storage location.

[0110] In one specific embodiment of the present invention, the WEB platform includes:

[0111] The user and permission management module is used for user and permission management.

[0112] The transmission node management module is used to manage each transmission engine node;

[0113] The workspace management module is used to manage workspaces;

[0114] The security policy management module is used to manage security policies;

[0115] The approval process engine module is used to manage approval processes;

[0116] The log management and auditing modules are used to manage logs and auditing processes.

[0117] In the above scheme, the WEB platform is responsible for the unified management of each transmission engine node and controls the secure file transmission between transmission engine nodes.

[0118] In one specific embodiment of the present invention, transmission engine node A repeats the following steps until the user terminal no longer generates new UDP packets, and the length of the last UDP packet generated by the user terminal is taken as the maximum transmission packet length:

[0119] The target transmission engine node B opens a UDP port and continuously listens to the UDP port;

[0120] The transmission engine node A receives the UDP data packet constructed by the user terminal and sends the UDP data packet to the UDP port of the target transmission engine node B;

[0121] The target transmission engine node B receives the UDP data packet, records the length of the UDP data packet, and then constructs a response packet. The response packet includes the length of the UDP data packet and a confirmation instruction indicating whether the current UDP data packet can be transmitted on the communication link between transmission engine node A and target transmission engine node B.

[0122] The transmission engine node A receives the response packet sent by the target transmission engine node B and forwards the response packet to the user terminal, so that the user terminal generates a new UDP data packet. The method for generating the new UDP data packet includes:

[0123] When the confirmation command indicates that the current UDP packet cannot be transmitted on the communication link between transport engine node A and the target transport engine node B, the length of the new UDP data is calculated according to the following formula:

[0124] ,

[0125] in, For the length of the new UDP data, The length of the current UDP packet. This indicates rounding down. Indicates the length of the previous UDP packet;

[0126] When the confirmation command indicates that the current UDP data packet can be transmitted through the communication link between transport engine node A and the target transport engine node B, the length of the new UDP data is calculated according to the following formula:

[0127] .

[0128] In one specific embodiment of the present invention, the file to be transmitted is virtually divided into blocks or virtually concatenated according to the maximum transmission data packet length to obtain several data packets to be transmitted:

[0129] If the length of the file to be transmitted is greater than the maximum transmission data packet length, the file to be transmitted is logically divided into several data packets according to the maximum transmission data packet length, and each data packet is transmitted in parallel. The length of each data packet is equal to or less than the maximum transmission data packet length.

[0130] The file to be transmitted is virtually segmented or virtually concatenated according to the maximum transmission data packet length to obtain several data packets to be transmitted:

[0131] If the length of the file to be transmitted is greater than the maximum transmission data packet length, the file to be transmitted is logically divided into several data packets according to the maximum transmission data packet length, and each data packet is transmitted in parallel. The length of each data packet is equal to or less than the maximum transmission data packet length.

[0132] In one specific embodiment of the present invention, the communication link between the transmission engine node A and the target transmission engine node B supports symmetric encryption algorithms and asymmetric encryption algorithms.

[0133] The following is combined Figures 1-2 The document also provides a detailed description of the operation of a secure multi-region file exchange system according to a specific embodiment of the present invention.

[0134] (1) The user terminal accesses the web interface of the transmission engine node A in the local area network and sends a file exchange instruction to the transmission engine node A (i.e., initiates a file exchange operation). The file exchange instruction includes the file to be transferred, the target transmission engine node B, and the target user terminal and / or the target storage location.

[0135] (2) After the user terminal initiates the operation, the transmission engine node A performs a security check on the transmission behavior and content of the file to be transmitted according to the preset security policy. If necessary, it will perform a manual review process according to the rules until the file to be transmitted meets the system's security requirements.

[0136] (3) After the file to be transmitted passes security check and review, transmission engine node A interacts with the user terminal and the target transmission engine node B according to the preset maximum transmission thread confirmation strategy to obtain the maximum transmission data packet length; the method for confirming the maximum transmission data packet length includes:

[0137] (3.1) The target transmission engine node B opens a UDP port and continuously listens to the UDP port (e.g., port 31885, port 31886) to wait for probe requests;

[0138] (3.2) The user terminal sends UDP packets of a specified size to the transmission engine node A in a way that the packets are indivisible, that is, DF is set at the IP layer to avoid fragmentation;

[0139] (3.3) Transmission engine node A sends the UDP data packet to the UDP port of the target transmission engine node B;

[0140] (3.4) The target transmission engine node B receives the UDP data packet, records the length of the UDP data packet, and then constructs a response packet. The response packet includes the length of the UDP data packet and a confirmation instruction indicating whether the current UDP data packet can be transmitted on the communication link between transmission engine node A and target transmission engine node B.

[0141] (3.5) The transmission engine node A receives the response packet sent by the target transmission engine node B and forwards the response packet to the user terminal, so that the user terminal generates a new UDP data packet. The method for generating the new UDP data packet includes:

[0142] The user terminal uses a binary search method to check the maximum data packet length in the communication link between transmission engine node A and target transmission engine node B within a packet length range.

[0143] Assume the maximum data packet length is 1500;

[0144] The user terminal will first send a UDP packet, assuming the size of the UDP packet is 5000, and the target transmission engine node B will reply "5000, not acceptable";

[0145] The user terminal sends 2500 again, and the target transmission engine node B replies "2500, no".

[0146] The user terminal sends 1250 again, and the target transmission engine node B replies with "1250, OK";

[0147] The user terminal sends 1875 again, and the target transmission engine node B replies "1875, not working";

[0148] The user terminal sends 1563 again, and the target transmission engine node B replies "1563, not working".

[0149] The user terminal sends 1407 again, and the target transmission engine node B replies with "1407, OK".

[0150] The user terminal sends 1485 again, and the target transmission engine node B replies with "1485, OK";

[0151] The user terminal sends 1524 again, and the target transmission engine node B replies "1524, no".

[0152] The user terminal sends 1505 again, and the target transmission engine node B replies "1505, no".

[0153] The user terminal sends 1495 again, and the target transmission engine node B replies with "1495, OK";

[0154] The user terminal sends 1500 again, and the target transmission engine node B replies with "1500, OK";

[0155] The user terminal sends 1502 again, and the target transmission engine node B replies "1502, no".

[0156] The user terminal sends 1501 again, and the target transmission engine node B replies "1501, no".

[0157] The end-user terminal determines the maximum size of the transmitted data packet to be 1500.

[0158] (4) Transmission engine node A, based on the maximum transmission data packet length, performs virtual segmentation or virtual splicing of the file to be transmitted to obtain several data packets to be transmitted; sends all data packets to be transmitted to the target transmission engine node B; specifically: during transmission, transmission engine node A automatically selects the appropriate processing method according to the size of the file to be transmitted: 1) Transmitting large files after virtual segmentation: logically cutting a single large file (such as video, database backup, large design file) into multiple smaller, fixed-size "data blocks", transmitting data blocks in parallel, making full use of network bandwidth; even if a block fails to be transmitted, only that specific block needs to be retransmitted, rather than the entire file, greatly improving the efficiency and stability of transmission; 2) Transmitting small files after virtual splicing: logically "packaging" a large number of small files (such as documents, pictures, log files) into a larger data block for transmission, before sending, the transmission engine splices many small files into a virtual "large block", and after transmission, it automatically unpacks and restores the original small files at the target node;

[0159] (5) The target transmission engine node B restores the received data packets and delivers them to the target user terminal and / or the target storage location, and notifies the recipient, who can then obtain or download the file from the transmission engine node in this region.

[0160] Example 3

[0161] This invention provides a secure multi-region file exchange system, including a storage medium and a processor;

[0162] The storage medium is used to store instructions;

[0163] The processor is configured to operate according to the instructions to execute the method according to any one of Embodiment 1.

[0164] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0165] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0166] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0167] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0168] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

[0169] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A method for secure exchange of files across multiple regions, characterized in that, Applied to transport engine node A, including: The system receives a file exchange instruction sent by a user terminal within a local area network. The file exchange instruction includes the file to be transferred, the target transmission engine node B, and the target user terminal and / or the target storage location. The target transmission engine node B and the transmission engine node A are located in different local area networks. The file to be transmitted is subjected to a security check according to a preset security policy. If the file to be transmitted passes the security check, then the maximum transmission data packet length is obtained by interacting with the user terminal and the target transmission engine node B according to the preset maximum transmission thread confirmation strategy. Based on the maximum transmission data packet length, the file to be transmitted is virtually divided into blocks or virtually spliced ​​to obtain several data packets to be transmitted. All data packets to be transmitted are sent to the target transmission engine node B, which then restores the received data packets and delivers them to the target user terminal and / or the target storage location.

2. The method for secure exchange of multi-region files according to claim 1, characterized in that: The method for obtaining the maximum transmission data packet length includes: Repeat the following steps until the user terminal stops generating new UDP packets, and use the length of the last UDP packet generated by the user terminal as the maximum transmission packet length: Receive UDP data packets sent by a user terminal, wherein the UDP data packets are defined as indivisible data packets; The UDP data packet is sent to the UDP port of the target transmission engine node B, and the target transmission engine node B generates a response packet based on the received UDP data. The response packet includes the length of the UDP data packet and a confirmation instruction indicating whether the current UDP data packet can be transmitted on the communication link between transmission engine node A and target transmission engine node B. The system receives the response packet sent by the target transmission engine node B and forwards it to the user terminal, enabling the user terminal to generate a new UDP packet. The method for generating the new UDP packet includes: When the confirmation command indicates that the current UDP packet cannot be transmitted on the communication link between transport engine node A and the target transport engine node B, the length of the new UDP data is calculated according to the following formula: ， in, For the length of the new UDP data, The length of the current UDP packet. Indicates the length of the previous UDP packet. Indicates rounding down; When the confirmation command indicates that the current UDP data packet can be transmitted through the communication link between transport engine node A and the target transport engine node B, the length of the new UDP data is calculated according to the following formula: 。 3. The method for secure exchange of multi-region files according to claim 1, characterized in that: The step of virtually dividing or concatenating the file to be transmitted into several data packets to be transmitted, based on the maximum transmission data packet length, specifically includes: If the length of the file to be transmitted is greater than the maximum transmission data packet length, the file to be transmitted is logically divided into several data packets according to the maximum transmission data packet length, and each data packet is transmitted in parallel. The length of each data packet is equal to or less than the maximum transmission data packet length. If the length of the file to be transmitted is less than the maximum transmission data packet length, then multiple files to be transmitted are logically concatenated into one data packet according to the maximum transmission data packet length, and the length of the data packet is equal to or less than the maximum transmission data packet length.

4. The method for secure exchange of multi-region files according to claim 1, characterized in that: The communication link between the transmission engine node A and the target transmission engine node B supports symmetric encryption algorithms and asymmetric encryption algorithms.

5. A secure multi-region file exchange system, characterized in that, It includes a web platform and several transmission engine nodes that are connected to the web platform for communication; each transmission engine node is located in a different local area network. If transmission engine node A receives a file exchange instruction sent by a user terminal in the local area network, and the file exchange instruction includes the file to be transferred, the target transmission engine node B, and the target user terminal and / or the target storage location, then the file to be transferred will be subject to a security check according to a preset security policy. If the file to be transmitted passes the security check, then the maximum transmission data packet length is obtained by interacting with the user terminal and the target transmission engine node B according to the preset maximum transmission thread confirmation strategy. Based on the maximum transmission data packet length, the file to be transmitted is virtually divided into blocks or virtually concatenated to obtain several data packets to be transmitted; all data packets to be transmitted are sent to the target transmission engine node B. The target transmission engine node B restores the received data packets and delivers them to the target user terminal and / or the target storage location.

6. A secure multi-region file exchange system according to claim 5, characterized in that, The WEB platform includes: The user and permission management module is used for user and permission management. The transmission node management module is used to manage each transmission engine node; The workspace management module is used to manage workspaces; The security policy management module is used to manage security policies; The approval process engine module is used to manage approval processes; The log management and auditing modules are used to manage logs and auditing processes.

7. A secure multi-region file exchange system according to claim 5, characterized in that, The transmission engine node A repeats the following steps until the user terminal stops generating new UDP packets, and the length of the last UDP packet generated by the user terminal is taken as the maximum transmission packet length: The target transmission engine node B opens a UDP port and continuously listens to the UDP port; The transmission engine node A receives the UDP data packet constructed by the user terminal and sends the UDP data packet to the UDP port of the target transmission engine node B; The target transmission engine node B receives the UDP data packet, records the length of the UDP data packet, and then constructs a response packet. The response packet includes the length of the UDP data packet and a confirmation instruction indicating whether the current UDP data packet can be transmitted on the communication link between transmission engine node A and target transmission engine node B. The transmission engine node A receives the response packet sent by the target transmission engine node B and forwards the response packet to the user terminal, so that the user terminal generates a new UDP data packet. The method for generating the new UDP data packet includes: When the confirmation command indicates that the current UDP packet cannot be transmitted on the communication link between transport engine node A and the target transport engine node B, the length of the new UDP data is calculated according to the following formula: ， in, For the length of the new UDP data, The length of the current UDP packet. Indicates the length of the previous UDP packet. Indicates rounding down; When the confirmation command indicates that the current UDP data packet can be transmitted through the communication link between transport engine node A and the target transport engine node B, the length of the new UDP data is calculated according to the following formula: 。 8. The secure multi-region file exchange system according to claim 5, characterized in that, The step of virtually dividing or concatenating the file to be transmitted into several data packets to be transmitted, based on the maximum transmission data packet length, specifically includes: If the length of the file to be transmitted is greater than the maximum transmission data packet length, the file to be transmitted is logically divided into several data packets according to the maximum transmission data packet length, and each data packet is transmitted in parallel. The length of each data packet is equal to or less than the maximum transmission data packet length. The file to be transmitted is virtually segmented or virtually concatenated according to the maximum transmission data packet length to obtain several data packets to be transmitted: If the length of the file to be transmitted is greater than the maximum transmission data packet length, the file to be transmitted is logically divided into several data packets according to the maximum transmission data packet length, and each data packet is transmitted in parallel. The length of each data packet is equal to or less than the maximum transmission data packet length.

9. The secure multi-region file exchange system according to claim 5, characterized in that, The communication link between the transmission engine node A and the target transmission engine node B supports symmetric encryption algorithms and asymmetric encryption algorithms.

10. A secure multi-region file exchange system, characterized in that, Including storage media and processor; The storage medium is used to store instructions; The processor is configured to operate according to the instructions to perform the method according to any one of claims 1-4.

Images