Document desk-in-desk system in credential and credential environment and operation method of document desk-in-desk system

Abstract

The invention provides a document transfer system in a credential environment and an operation method thereof, the system adopts a multi-storage medium unified adaptation and intelligent scheduling mechanism, can dynamically select an optimal storage rear end according to file characteristics through a storage strategy engine, and combines fragment uploading, breakpoint resuming and a second transmission technology based on mixed Hash, so that the file transfer efficiency is improved, and the file transfer efficiency is improved. And the processing efficiency of massive files, especially large files, and the utilization rate of system resources are greatly improved. A full-life-cycle data security protection system with the SM2 / SM4 cryptographic algorithm as the core is constructed, and the confidentiality, integrity and availability of data are comprehensively improved. By providing a standardized API interface and a deep association mechanism of files and service data, the integration cost of the multi-service system is greatly reduced. The integrated visual operation and maintenance monitoring system realizes real-time perception and intelligent alarm of system performance, storage states and business indexes, and obviously improves the autonomy level of operation and maintenance and the fault emergency response speed.

Description

Technical Field

[0001] This invention relates to the field of data management technology, and in particular to a document middleware system and its operation method in a domestically developed information technology environment. Background Technology

[0002] With the rapid development of the digital economy, unstructured data (such as documents, images, and videos) is growing exponentially. Industry analysis predicts that by 2025, unstructured data will account for over 90% of the total global data volume. Traditional, fragmented, and isolated file management models are no longer sufficient to meet the urgent needs for cross-system data sharing, unified governance, and efficient utilization. Against this backdrop, document middleware, as a core platform integrating file storage, management, and services, has become a key technological direction for solving the challenges of unstructured data management by providing standardized full lifecycle file management capabilities.

[0003] Meanwhile, the information technology application innovation (ITAI) industry, as a strategic measure to safeguard national network and information security and achieve independent control of core technologies, is accelerating its development in key areas such as government affairs, finance, and energy. ITAI requires comprehensive domestic substitution from underlying hardware (such as domestic CPUs and servers), basic software (such as domestic operating systems, databases, and middleware) to upper-layer applications, building a secure and reliable technical system. However, most existing mainstream document management solutions are built on foreign technology ecosystems, facing severe challenges in the ITAI environment: First, in terms of compatibility, existing solutions struggle to achieve seamless full-stack adaptation with domestic CPUs such as Phytium and Kunpeng, domestic operating systems such as Kylin and UnionTech UOS, domestic databases such as DM and Kingbase, and domestic middleware such as Eastcom. Deployment is complex, and stability and performance issues may arise during runtime. Second, in terms of storage architecture, most solutions only support a single or limited storage type (such as object storage only or distributed file systems only), resulting in a rigid architecture that cannot flexibly schedule different storage media (such as HDFS, FastDFS, OSS, and NAS) based on file characteristics (such as size and access frequency) and business scenarios, leading to insufficient elastic scalability. Furthermore, in terms of security, existing solutions generally rely on internationally accepted encryption algorithms (such as AES and RSA), lack deep integration of national commercial cryptography (SM series) algorithms, and lack systematic security protection in file storage, transmission, and access. Access control models are rudimentary, audit logs are incomplete, and it is difficult to meet the compliance requirements of the national cybersecurity level protection system (especially Level 3). In addition, regarding performance and efficiency, large file transfers lack effective fragmentation and breakpoint resumption optimizations, duplicate files cannot be quickly identified and transferred, and the system responds slowly under high concurrency. In terms of collaboration and operation and maintenance, inconsistent interface standards lead to high costs for business system integration, files are disconnected from business processes, and resource reuse is low. At the same time, the system lacks visualized autonomous operation and maintenance monitoring capabilities, fault location and handling rely on external support, resulting in low operation and maintenance efficiency.

[0004] Therefore, there is an urgent need in this field to develop an integrated document platform system that can be deeply adapted to the full-stack environment of domestic IT innovation, has intelligent scheduling capabilities for hybrid storage, incorporates a domestic cryptographic security system, and supports efficient file processing and convenient operation and maintenance monitoring, so as to solve the pain points of unstructured data management faced by the aforementioned key industries in the process of digital transformation and domestic IT innovation. Summary of the Invention

[0005] The purpose of this invention is to provide a document middleware system and its operation method under the domestic information technology innovation environment, so as to solve the problems existing in the prior art.

[0006] To achieve the above objectives, the present invention provides the following solution: This invention provides a document middleware system in a domestic IT innovation environment, comprising: The access layer is used to provide standardized file management interfaces to the outside world and to complete protocol adaptation and load balancing; The core service layer provides file metadata management, business association, and task scheduling services. A storage adaptation layer is used for unified adaptation and intelligent scheduling of various heterogeneous storage media. A data security layer is used to encrypt and control access to files throughout their entire lifecycle based on domestically developed cryptographic algorithms. The operation and maintenance monitoring layer is used to monitor, visualize, and alarm the system's operating status in real time.

[0007] Preferably, the access layer includes: The unified API gateway module is used to encapsulate and provide standard file management interfaces; A multi-protocol adapter module is used to be compatible with multiple network protocols such as HTTP / HTTPS and FTP / SFTP. The authorization module is used to authenticate access requests based on OAuth 2.0 and SM2 digital signature technology. The load balancing module is used to distribute user requests to multiple backend service instances.

[0008] Preferably, the core service layer includes: The file processing service module is used to implement large file chunked upload, breakpoint resume upload, and instant upload based on MD5 and SM3 hybrid hash. The metadata management module is used to store and index file metadata using a domestic database and to encrypt sensitive fields using SM4. The business association module is used to establish the mapping relationship between files and business entities; The task scheduling module is used to asynchronously process time-consuming operations using domestic thread pool technology; The log auditing module is used to record operation logs across the entire platform and supports multi-condition retrieval.

[0009] Preferably, the steps for implementing the instant transfer function in the file processing service module include: Calculate the MD5 and SM3 hash value of the file to be uploaded as the file fingerprint; Check if there is a record with the same fingerprint in the metadata management module; if it exists, associate the current upload request with the stored file and return success directly, completing the instant upload; if it does not exist, execute the normal chunked upload process.

[0010] Preferably, the storage adaptation layer includes: The storage adapter pool has multiple built-in adapters corresponding to HDFS, FastDFS, object storage, and network-attached storage, and provides a unified abstract interface. The distributed coordination module, based on a domestically developed distributed coordination service, enables dynamic discovery and status monitoring of storage nodes. The storage strategy engine is used to dynamically match and select the optimal storage medium based on file attributes.

[0011] Preferably, the data security layer includes: The encryption service module is used to encrypt the stored file data using the SM4 algorithm and to protect the encryption key using the SM2 algorithm. The access control module implements three-level fine-grained access management of users, roles, and permissions based on the role-based access control model; The data backup module is used to enable multiple copies of files for storage and automatic recovery of damaged copies.

[0012] Preferably, in the encryption service module, the step of encrypting the stored file data includes: Generate a random SM4 symmetric encryption key; The SM4 key is encrypted using the public key of the SM2 algorithm; Using the SM4 key, file data is encrypted in CBC mode, and a random initialization vector is generated; The encrypted SM4 key, initialization vector, and file unique identifier are associated and stored in the key management system; Write the encrypted file data to the selected storage medium.

[0013] Preferably, the operation and maintenance monitoring layer includes: The monitoring and data acquisition module is used to collect system performance, storage capacity, and interface success rate metrics. The visualization panel module is used to generate visual charts from the collected indicator data for display. The alarm module is used to trigger multi-level alarm notifications when the indicator exceeds the threshold. The log analysis module is used to aggregate and analyze system and operation logs to assist in troubleshooting.

[0014] This invention also provides a method for operating a document middleware system in a domestic IT innovation environment, comprising the following steps: S1. System Initialization: Start and initialize the domestically produced components at each layer, establish connections, and report the readiness status; S2. Access Request: Receives file management requests from business systems, performs authentication, protocol conversion, and load balancing; S3. File Processing: Based on the request type, perform file fingerprint comparison, fragmented upload, encrypted storage, metadata recording, and business-related operations; S4. Results Feedback and Monitoring: Return processing results to the business system, and collect and update system monitoring metrics. S5. Resource Maintenance: Through the interface provided by the operation and maintenance monitoring layer, perform storage node expansion, key update and log query operations.

[0015] Preferably, in step S3, for a large file upload request, the specific steps include: The file is divided into multiple fixed-size segments according to a preset strategy; Each shard is uploaded in parallel to the storage node selected by the storage adaptation layer; After all fragments have been uploaded, they will be merged into a complete file on the storage node side; The data security layer is invoked to encrypt the merged file and store it on disk.

[0016] The present invention achieves the following beneficial technical effects compared to the prior art: This invention provides a document middleware platform system and its operation method under a domestic IT innovation environment. The system, through a designed five-layer full-stack domestic IT innovation layered architecture, achieves deep compatibility with domestic CPUs, operating systems, databases, and middleware, ensuring stable deployment and efficient operation in a pure domestic IT innovation environment, and meeting the rigid requirements of independent controllability in key areas. The system innovatively adopts a unified adaptation and intelligent scheduling mechanism for multiple storage media. Through a storage strategy engine, it can dynamically select the optimal storage backend based on file characteristics, and combined with fragmented upload, breakpoint resume, and instant upload based on hybrid hashing technology, it significantly improves the processing efficiency of massive files, especially large files, and the utilization rate of system resources. In terms of security, the system constructs a full lifecycle data security protection system based on the SM2 / SM4 national cryptographic algorithms. From transmission encryption and disk storage to fine-grained permission control and complete operation auditing, it comprehensively improves the confidentiality, integrity, and availability of data, effectively supporting high-level security compliance requirements. By providing standardized API interfaces and a deep association mechanism between files and business data, the system greatly reduces the integration cost of multiple business systems and promotes cross-system sharing and reuse of file resources. Finally, the integrated visual operation and maintenance monitoring system enables real-time perception and intelligent alarms of system performance, storage status, and business indicators, significantly improving the autonomy of operation and maintenance and the speed of emergency response. Overall, this invention effectively overcomes many shortcomings of existing technologies in terms of domestic IT innovation adaptation, storage elasticity, security compliance, processing efficiency, and operation and maintenance management, providing reliable technical support for the unified, secure, and efficient management of unstructured data in various industries under the domestic IT innovation background. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a diagram of the five-layer hierarchical architecture of the system in this invention; Figure 2 This is a flowchart illustrating the overall system implementation in this invention. Figure 3 This is a flowchart of the file upload processing in this invention; Figure 4 This is a flowchart illustrating the collaborative scheduling process of the hybrid storage architecture in this invention. Figure 5 This is a flowchart of the SM4 file disk encryption process in this invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] The purpose of this invention is to provide a document middleware system and its operation method under the domestic IT innovation environment, aiming to solve the shortcomings of existing document management solutions in terms of full-stack adaptation to domestic IT innovation, hybrid storage scheduling, data security compliance, large file processing efficiency, and intelligent operation and maintenance monitoring. The core of this invention lies in building an integrated document lifecycle management platform with clear layers, decoupled functions, security and controllability, and high adaptability to domestic technology stacks.

[0021] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0022] Example 1: like Figure 1 The diagram illustrates the five-layer architecture of the system of this invention. The entire system consists of a platform infrastructure support module and a platform business processing module. The platform infrastructure support module is the technical foundation of the system, comprising, from bottom to top, a resource layer 50, a data security layer 40, a storage adaptation layer 30, a core service layer 20, and an access layer 10. The platform business processing module, based on the services provided by the infrastructure support module, implements specific business operations such as file upload, download, query, and management.

[0023] Specifically, the access layer 10 serves as the sole interface between the system and external business systems, responsible for receiving and initially processing all requests. This layer includes a unified API gateway module 11, which encapsulates standard RESTful API interfaces such as upload, download, delete, and query, and provides SDKs for mainstream development languages ​​such as Java and Python, greatly reducing the access cost for business systems. For legacy systems with different technology stacks, the multi-protocol adaptation module 12 provides compatibility with multiple network protocols such as HTTP / HTTPS and FTP / SFTP, enabling older systems to be smoothly integrated without large-scale modifications. The authentication module 13 adopts the OAuth2.0 protocol framework and deeply integrates the SM2 domestic asymmetric encryption algorithm for digital signature verification, combined with an IP whitelist mechanism, to build a robust access defense. The load balancing module 14 can be implemented based on Nginx combined with Keepalived or directly using the domestic TongWeb middleware. Through algorithms such as weighted round-robin or least connections, it intelligently distributes massive concurrent requests to multiple core service instances in the backend, ensuring high availability and horizontal scalability of the system.

[0024] Furthermore, the core service layer 20 is the system's business logic processing center, undertaking the core functions of file management. The file processing service module 21 addresses the challenge of large file transfer by designing an efficient chunked upload and breakpoint resume mechanism. When the uploaded file size exceeds a preset threshold (e.g., 100MB), the module automatically divides it into fixed-size chunks (e.g., 10MB), which can be uploaded to the storage layer in parallel, significantly improving transmission efficiency. More innovatively, this module introduces a second-transfer function based on a hybrid MD5 and SM3 hash algorithm. Figure 3As shown, at the beginning of a file upload, the system first calculates the file's hybrid hash value as its unique "fingerprint" and queries the metadata management module 22. If a record with the same fingerprint already exists in the database, it is determined to be a duplicate file. The system will directly establish an association between this upload request and the existing file storage location, returning success instantly, avoiding redundant transmission and storage overhead, and achieving true "instant upload". The metadata management module 22 uses domestic relational database clusters such as DMDMS or Kingbase to store core information such as file name, size, format, storage path, creator, and hash fingerprint. For sensitive fields such as file path and creator, the SM4 algorithm is used for encrypted storage. While ensuring data security, efficient indexing is established to achieve millisecond-level file retrieval. The business association module 23 establishes a mapping relationship between the file's unique identifier (UUID) and the business entity ID (such as order number, contract number), breaking down the barriers between file data and business data, making files no longer information silos, but traceable and analyzable business assets. The task scheduling module 24, based on domestic thread pool technologies such as Druid, asynchronously performs time-consuming operations such as file format conversion and content extraction, avoiding blocking the main request thread. It also allows users to query processing progress by returning task IDs. The log auditing module 25 meticulously records the personnel, time, IP address, parameters, and results of each file operation. All logs are persistently stored in a domestic database, supporting multi-dimensional combined queries and providing complete evidence for security auditing and accountability.

[0025] Furthermore, the storage adaptation layer 30 is key to achieving elastic management and intelligent scheduling of storage resources. For example... Figure 4As shown, this layer abstracts the differences between various underlying storage media through the storage adapter pool 31. The pool contains built-in adapters for various mainstream storage systems, including HDFS, FastDFS, object storage (such as Alibaba Cloud OSS and Huawei Cloud OBS), and Network Attached Storage (NAS). These adapters follow a unified interface specification, support hot-swapping, and adding a new storage type only requires implementing the corresponding adapter, without modifying the core business code, greatly improving the system's scalability. The distributed coordination module 32, based on domestic distributed coordination services such as ZooKeeper, implements dynamic registration, discovery, and status monitoring of all storage nodes. When a storage node fails, the coordination module can quickly detect it and remove it from the list of available nodes, ensuring service continuity. The storage policy engine 33 is the "brain" of intelligent scheduling. Its built-in policy rules can dynamically decide the optimal storage location for files based on multiple dimensions such as file type (e.g., images, videos, documents), size, expected access frequency, and the department to which the business belongs. For example, video backup files larger than 1GB can be stored in HDFS to take advantage of its high throughput, frequently accessed departmental shared documents can be stored in OSS for a low-latency access experience, and database backup files requiring high I / O performance can be stored in NAS. This hybrid storage architecture and intelligent scheduling mechanism enable the system to flexibly respond to diverse business scenarios and optimize storage costs while ensuring performance.

[0026] Furthermore, data security layer 40 provides security protection for the system throughout the entire file lifecycle. Encryption service module 41 is the cornerstone of static data security. For example... Figure 5As shown, it uses the domestically developed SM4 symmetric encryption algorithm to encrypt file data stored on disk. The specific process is as follows: First, the encryption service generates a 128-bit random SM4 key; to improve the key's security, the SM4 key is encrypted using the public key of the SM2 algorithm; then, the file data is encrypted using the original SM4 key in CBC mode, and a random initialization vector (IV) is generated and concatenated with the ciphertext; finally, the SM2-encrypted SM4 key and IV are associated with the file's UUID and securely stored in an independent domestic key management system, while the encrypted file data is written to the storage medium selected by the storage adaptation layer. During file download, the system verifies user permissions, retrieves the encryption key from the KMS, decrypts it using the corresponding SM2 private key to obtain the SM4 key, and then decrypts the file data. During transmission, the system enforces the use of the TLS 1.3 protocol based on domestic cryptographic algorithms to encrypt the network channel. The access control module 42 extends the traditional role-based access control model, realizing fine-grained control of "user-role-permission-resource". Administrators can define complex permission rules, such as "only allowing members of Department A to view, and only allowing user Zhang San to edit" files in a specific folder, and support setting temporary access permissions with time limits. The data backup module 43 ensures high data availability through a default three-replica strategy (stored on nodes in different racks), and has a background inspection process that periodically verifies the integrity of the replicas. Once a replica is found to be damaged or lost, it can automatically synchronize and repair from the healthy replica, ensuring the persistent reliability of the data.

[0027] Furthermore, the operation and maintenance monitoring layer 50 endows the system with transparent observability and autonomous operation and maintenance capabilities. The monitoring and data collection module 51 continuously collects key indicators such as CPU utilization, memory consumption, disk capacity, network traffic, and API call success rate and latency through Exporters deployed on each service node (based on the Prometheus ecosystem or domestic monitoring tools such as Baolande). The visualization panel module 52 utilizes tools such as Grafana to transform the collected time-series data into intuitive dashboards, graphs, and topology diagrams, allowing operation and maintenance personnel to have a one-stop overview of the system's real-time operating status and historical trends. The alarm module 53 allows users to set multi-level thresholds (such as warning and critical) for various indicators. When indicators are abnormal, alarm notifications are automatically triggered through various channels such as SMS, email, and internal communication tools, and different emergency response procedures are defined according to alarm levels. The log analysis module 54 aggregates system logs, business logs, and security audit logs, providing powerful search and analysis functions. When a fault occurs, it helps operation and maintenance personnel quickly locate the root cause of the problem.

[0028] like Figure 2The diagram illustrates the overall operational flow of the system from startup to request processing. System operation begins in the initialization phase, where components at each layer start according to their configurations. The resource layer 50 establishes a connection pool between its database and cache. The storage adaptation layer 30 discovers all available storage nodes through a coordination service. The data security layer 40 loads the national cryptographic algorithm library and initializes the key management service. Finally, each module reports its readiness status to the monitoring center. When a business system initiates a file upload request, the process enters the request access phase. This request is received by the API gateway module 11 of the access layer 10, passes through the authentication module 13 and the multi-protocol adaptation module 12, and is then forwarded by the load balancing module 14 to an idle instance in the core service layer 20. This is followed by the file processing phase. Figure 3 Taking the upload process shown as an example, the file processing service module 21 of the core service layer 20 first calculates the hybrid hash fingerprint of the file and queries the metadata management module 22. If it matches the instant upload, it directly associates the business ID and returns it; if a new upload is required, the storage strategy engine 33 selects the target storage medium according to the file attributes and performs fragmented upload through the corresponding storage adapter pool 31. After all fragments are uploaded, the storage end merges them, and then the encryption service module 41 intervenes to perform the following on the complete file: Figure 5 The SM4 encryption process is shown, and the encrypted file is written to disk. Simultaneously, the metadata management module 22 records file information, the business association module 23 establishes a mapping, and the log audit module 25 records the operation. During the result feedback and monitoring phase, the processing result (success or failure, and file ID) is returned to the business system via the original path, while the operation and maintenance monitoring layer 50 collects real-time metrics such as the time and resources consumed in processing this request and updates the monitoring panel 52. Finally, during the resource maintenance phase, system administrators can perform operations such as adding new storage nodes for expansion, rotating encryption keys in the key management system, or querying historical logs for audit analysis through the visual interface provided by the operation and maintenance monitoring layer 50. The entire process does not require business interruption, achieving efficient autonomous operation and maintenance.

[0029] In summary, this invention, through a five-layer full-stack domestic IT innovation architecture, deeply integrates domestic adaptation, hybrid storage scheduling, national cryptographic algorithm security, efficient file processing, and intelligent operation and maintenance monitoring, forming a complete, robust, and independently controllable unstructured data management solution. It can effectively meet the stringent requirements of document platform systems in key sectors such as government affairs, finance, and energy during the domestic IT innovation transformation process.

[0030] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0031] It should be noted that the components mentioned in the above embodiments are all general standard parts or components known to those skilled in the art. Their structures and principles can be learned by those skilled in the art through technical manuals or conventional experimental methods.

[0032] This invention has illustrated its principles and implementation methods using specific examples. The descriptions of these embodiments are merely illustrative of the method and its core ideas; furthermore, those skilled in the art will recognize that modifications may be made to the specific implementation methods and application scope based on the principles of this invention. Therefore, the content of this specification should not be construed as limiting the invention.

Claims

1. A document platform system in a Xinyi environment, characterized in that, include: The access layer is used to provide standardized file management interfaces to the outside world and to complete protocol adaptation and load balancing; The core service layer provides file metadata management, business association, and task scheduling services. A storage adaptation layer is used for unified adaptation and intelligent scheduling of various heterogeneous storage media. A data security layer is used to encrypt and control access to files throughout their entire lifecycle based on domestically developed cryptographic algorithms. The operation and maintenance monitoring layer is used to monitor, visualize, and alarm the system's operating status in real time.

2. The document platform system in the Xinyi environment according to claim 1, wherein, The access layer includes: The unified API gateway module is used to encapsulate and provide standard file management interfaces; A multi-protocol adapter module is used to be compatible with multiple network protocols such as HTTP / HTTPS and FTP / SFTP. The authorization module is used to authenticate access requests based on OAuth 2.0 and SM2 digital signature technology. The load balancing module is used to distribute user requests to multiple backend service instances.

3. The document broker system in a Xinyi environment according to claim 1, wherein, The core service layer includes: The file processing service module is used to implement large file chunked upload, breakpoint resume upload, and instant upload based on MD5 and SM3 hybrid hash. The metadata management module is used to store and index file metadata using a domestic database and to encrypt sensitive fields using SM4. The business association module is used to establish the mapping relationship between files and business entities; The task scheduling module is used to asynchronously process time-consuming operations using domestic thread pool technology; The log auditing module is used to record operation logs across the entire platform and supports multi-condition retrieval.

4. The document station system in the Xinyi environment according to claim 3, wherein, The steps for implementing the instant transfer function in the file processing service module include: Calculate the MD5 and SM3 hash value of the file to be uploaded as the file fingerprint; Check if there is a record with the same fingerprint in the metadata management module; if it exists, associate the current upload request with the stored file and return success directly, completing the instant upload; if it does not exist, execute the normal chunked upload process.

5. The system according to claim 1, wherein, The storage adaptation layer includes: The storage adapter pool has multiple built-in adapters corresponding to HDFS, FastDFS, object storage, and network-attached storage, and provides a unified abstract interface. The distributed coordination module, based on a domestically developed distributed coordination service, enables dynamic discovery and status monitoring of storage nodes. The storage strategy engine is used to dynamically match and select the optimal storage medium based on file attributes.

6. The system according to claim 1, wherein, The data security layer includes: The encryption service module is used to encrypt the stored file data using the SM4 algorithm and to protect the encryption key using the SM2 algorithm. The access control module implements three-level fine-grained access management of users, roles, and permissions based on the role-based access control model; The data backup module is used to enable multiple copies of files for storage and automatic recovery of damaged copies.

7. The document broker system in a Xinyi environment according to claim 6, wherein, The encryption service module includes the following steps for encrypting stored file data: Generate a random SM4 symmetric encryption key; The SM4 key is encrypted using the public key of the SM2 algorithm; Using the SM4 key, file data is encrypted in CBC mode, and a random initialization vector is generated; The encrypted SM4 key, initialization vector, and file unique identifier are associated and stored in the key management system; Write the encrypted file data to the selected storage medium.

8. The document broker system in a Xinyi environment according to claim 1, wherein, The operation and maintenance monitoring layer includes: The monitoring and data acquisition module is used to collect system performance, storage capacity, and interface success rate metrics. The visualization panel module is used to generate visual charts from the collected indicator data for display. The alarm module is used to trigger multi-level alarm notifications when the indicator exceeds the threshold. The log analysis module is used to aggregate and analyze system and operation logs to assist in troubleshooting.

9. A method for operating a document middleware system under the information technology innovation environment as described in any one of claims 1-8, characterized in that, Includes the following steps: S1. System Initialization: Start and initialize the domestically produced components at each layer, establish connections, and report the readiness status; S2. Access Request: Receives file management requests from business systems, performs authentication, protocol conversion, and load balancing; S3. File Processing: Based on the request type, perform file fingerprint comparison, fragmented upload, encrypted storage, metadata recording, and business-related operations; S4. Results Feedback and Monitoring: Return processing results to the business system, and collect and update system monitoring metrics. S5. Resource Maintenance: Through the interface provided by the operation and maintenance monitoring layer, perform storage node expansion, key update and log query operations.

10. The method for operating a document middleware system under a domestically developed information technology environment according to claim 9, characterized in that, Step S3, for large file upload requests, specifically includes: The file is divided into multiple fixed-size segments according to a preset strategy; Each shard is uploaded in parallel to the storage node selected by the storage adaptation layer; After all fragments have been uploaded, they will be merged into a complete file on the storage node side; The data security layer is invoked to encrypt the merged file and store it on disk.

Images