Intelligent network big data security transmission method and system based on cloud computing

Abstract

This invention discloses a cloud-based intelligent network big data secure transmission method and system, relating to the field of big data transmission technology. The method includes the following steps: a cloud platform parses the data to be transmitted and generates a sensitive association table; based on the sensitive association table, content fragments, relationship fragments, and reassembly permission fragments are separated; a phased transmission queue is generated based on the fragment restoration relationship; content fragments are sent according to the queue and arrival certificates are generated; after successful verification, relationship fragments and reassembly permission fragments are released level by level and reassembly is completed; if verification fails, release is stopped and invalid fragments are marked. This invention, based on a complementary fragment separation and release mechanism, achieves phased secure transmission of big data in the cloud, possessing advantages such as resistance to interception, resistance to restoration, and prevention of leakage due to anomalies.

Description

Technical Field

[0001] This invention relates to the field of big data transmission technology, and in particular to a method and system for secure transmission of big data in intelligent networks based on cloud computing. Background Technology

[0002] With the development of cloud computing platforms and intelligent network services, large amounts of network data, such as government and enterprise data, user behavior data, device operation logs, and file objects, are increasingly being transmitted across systems and regions via cloud nodes. Existing technologies typically improve security by employing methods such as data fragmentation, link encryption, authentication, hash verification, multi-path transmission, and transmission log auditing. This involves first dividing the data into segments according to fixed sizes or file boundaries, then encrypting and sending the segments, and finally performing integrity verification and merging at the receiving end. While this approach can reduce the risk of plaintext leakage and transmission tampering, its fragmentation is primarily based on data size, link status, or transmission efficiency, without fully considering the risks of restoring complete business objects or transmission behaviors formed by combining different fields, log fragments, and file blocks.

[0003] To further enhance security, the industry has implemented solutions such as distributing data across different links, separating metadata from data content storage, desensitizing sensitive fields, or blocking abnormal transmissions through retransmission. However, these solutions typically aim for the eventual continuous recovery of complete data. If relationship information, reconstructed information, or metadata are aggregated with business content in the same transmission stage, along the same path, or in the same cache region, a recoverable data link may still be formed. Based on the aforementioned claims, the shortcomings of existing technologies lie in the failure to separate the source of business content from the source of the reconstruction relationship, the lack of a phased release mechanism for content fragments, relationship fragments, and reconstructed permission fragments, and the absence of arrival proof control for subsequent fragment release. This results in the possibility that sent fragments may continue to participate in reconstruction and recovery when transmission anomalies occur, making it difficult to fundamentally prevent the risk of complete data recovery from the transmission structure.

[0004] Therefore, how to provide a secure transmission method and system for intelligent network big data based on cloud computing is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a method and system for secure transmission of intelligent network big data based on cloud computing. This invention is based on a complementary fragment separation and release mechanism to achieve secure transmission of big data in stages in the cloud, and has the advantages of anti-interception, anti-reproduction, and anomaly prevention of leakage.

[0006] The cloud computing-based intelligent network big data secure transmission method according to embodiments of the present invention includes the following steps: The cloud platform acquires network big data transmission tasks, performs field parsing, business object identification, and combination relationship identification on the data set to be transmitted, and generates a sensitive association table. Based on the sensitive association table, the data set to be transmitted is separated into content fragments, relationship fragments, and reassembly permission fragments, generating a complementary fragment set; Based on the restoration relationship between content fragments, relational fragments, and recombination permission fragments in the complementary fragment set, isolation transmission constraints are established, and a phased transmission queue is generated. Content fragments are sent according to a phased transmission queue, and the receiving end generates an arrival certificate based on the actual arrival path of the content fragment, the reception time, the reception buffer, and the fragment digest. The cloud platform performs consistency verification on the proof of arrival. After the content fragment verification passes, the corresponding relation fragment is released. After both the content fragment and the relation fragment verification pass, the corresponding reassembly permit fragment is released. The receiving end performs reassembly verification on the content fragment and the relation fragment based on the reassembly permit fragment. After the verification passes, the data set to be transmitted is restored. When the arrival proof verification fails, or the content fragment or relation fragment is inconsistent with the corresponding arrival proof, the release of subsequent fragments is stopped, and fragments that have been sent and have not met the reassembly conditions are marked as invalid fragments.

[0007] Optionally, the generation of the sensitive association table specifically includes: The cloud platform extracts the data set to be transmitted from the network big data transmission task, parses the field boundaries, the source of field values ​​and the original position of the fields, and generates field parsing results; Based on the field parsing results, identify the field affiliation under the same business event, the same user session, the same device status, or the same file object, and generate business object identification results; Based on the field parsing results and business object identification results, the co-occurrence, sequential occurrence, and mutual pointing between fields within the same business object are identified, and the combination relationship identification results are generated. Based on the results of the combination relationship identification, identify fragment combinations that simultaneously contain both the source of business content and the source of restoration relationship within the same business object, and write them into the sensitive association table.

[0008] Optionally, the generation of the complementary fragment set specifically includes: Based on the data locations corresponding to the source of business content and the source of restoration relationship in the sensitive association table, locate the corresponding fields, log fragments and file blocks in the data set to be transmitted; Extract field values, log text, or file block content from the data location corresponding to the source of business content, remove the content related to field attribution, order of appearance, field correspondence, or file block connection, and generate content fragments. Extract field attribution, order of appearance, field correspondence, or file block connection content from the data location corresponding to the source of the relationship, and hide field values, log text, or file block content to generate relationship fragments; Generate a reorganization permission fragment based on the corresponding content fragments and relationship fragments under the same sensitive association table item; Content fragments, relationship fragments, and reorganization permission fragments are merged according to their corresponding content under the same sensitive association table item to generate a complementary fragment set.

[0009] Optionally, the generation of the phased transmission queue specifically includes: Based on the content fragments, relational fragments, and reorganization permission fragments under the same sensitive association table item in the complementary fragment set, determine the restoration relationship among the three; Content fragments, relation fragments, and reassembly license fragments with restoration relationships are allocated to different transmission paths, different intermediate buffers, and different release stages to form isolated transmission constraints. Based on the isolation transmission constraints, content fragments are arranged in the early release phase, relation fragments are arranged after the arrival proof verification of the corresponding content fragments, and reassembly permission fragments are arranged after both the corresponding content fragments and relation fragments are verified, thus generating a phased transmission queue. When different sensitive related entries share the same content segment, the same relationship segment, or the same reorganization license segment, the cloud platform rearranges the corresponding release phases and updates the phased transmission queue.

[0010] Optionally, the generation of the arrival proof specifically includes: The cloud platform reads content segments in the pre-release phase according to the phased transmission queue and sends them according to the transmission path. When sending, it writes the content segment identifier, the sensitive association table entry to which it belongs, and the sending phase identifier. After receiving a content segment, the receiving end obtains the actual arrival path, reception time, and reception buffer of the content segment, and generates a segment digest. The content fragment identifier, actual arrival path, reception time, reception buffer, and fragment digest are bound together to generate an arrival certificate and return it to the cloud platform.

[0011] Optionally, the implementation of the consistency check specifically includes: The cloud platform reads the arrival certificate, performs consistency verification between the content fragment identifier, actual arrival path, reception time, reception buffer, and fragment digest and the phased transmission queue, and generates the content fragment verification result. When the content fragment verification result is passed, the cloud platform releases the relationship fragment corresponding to the content fragment according to the phased transmission queue, and the receiving end generates the arrival proof of the relationship fragment; The cloud platform performs consistency verification on the arrival proof of the relation fragment, and matches the relation fragment with the arrival proof of the corresponding content fragment to generate the relation fragment verification result; When both the content fragment verification result and the relationship fragment verification result are passed, the cloud platform releases the corresponding reassembly license fragment according to the phased transmission queue. The receiving end performs reassembly verification on the content fragment and relationship fragment based on the license content carried by the reassembly license fragment. After the verification is successful, the set of data to be transmitted is restored.

[0012] Optionally, the generation of the failure fragment specifically includes: The cloud platform reads the content fragment verification results and relationship fragment verification results to locate the content fragments or relationship fragments that failed the arrival proof verification or were inconsistent with the corresponding arrival proof. Based on the content or relational fragments that fail the arrival proof verification or are inconsistent with the corresponding arrival proof, the release of subsequent fragments with a restoration relationship with them is stopped in the phased transmission queue; Content or relational segments that have been sent but do not meet the reassembly conditions are marked as invalid segments, and invalid segments are prohibited from participating in the reassembly verification. The receiving end disconnects the executable correspondence between the failed fragment and the reconstructed license fragment based on the failed fragment marker, and returns a failure confirmation to the cloud platform. Based on the failure confirmation, the cloud platform rearranges the release phases of unreleased segments under the same sensitive association table entry and updates the phased transmission queue.

[0013] According to an embodiment of the present invention, a cloud computing-based intelligent network big data secure transmission system includes: The sensitive association generation module is used to enable the cloud platform to obtain network big data transmission tasks, perform field parsing, business object identification, and combination relationship identification on the data set to be transmitted, and generate a sensitive association table. The complementary fragment generation module is used to separate the data set to be transmitted into content fragments, relation fragments, and reassembly permission fragments based on the sensitive association table, and generate a complementary fragment set. The phased queue generation module is used to establish isolation transmission constraints and generate phased transmission queues based on the restoration relationship between content fragments, relation fragments and recombination permission fragments in the complementary fragment set. The arrival proof generation module is used to send content fragments according to the phased transmission queue and generate arrival proofs; The tiered release and reassembly module enables the cloud platform to perform consistency verification on the arrival certificate, and restores the set of data to be transmitted after the verification is successful. The abnormal failure handling module is used to stop releasing subsequent fragments when the arrival proof verification fails, or when the content fragment or relationship fragment is inconsistent with the corresponding arrival proof, and to mark the sent fragments that do not meet the reassembly conditions as failed fragments.

[0014] The beneficial effects of this invention are: This invention, after acquiring a network big data transmission task from a cloud platform, first performs field parsing, business object identification, and combination relationship identification on the data set to be transmitted, generating a sensitive association table. Then, based on this table, the data set to be transmitted is separated into content fragments, relationship fragments, and reassembly permission fragments, ensuring that the source of business content and the source of the reconstruction relationship are separated before transmission. Therefore, when a content fragment is captured alone, only field values, log text, or file block content can be obtained, making it difficult to determine field attribution, order of appearance, field correspondence, or file block continuation. When a relationship fragment is captured alone, only the reconstruction method between fragments can be obtained, and the complete business content cannot be directly obtained. The reassembly permission fragment is not released until the pre-processing verification is passed, thereby reducing the risk of complete data being restored in a single path, single buffer, or single transmission stage.

[0015] This invention establishes isolation transmission constraints based on the restoration relationships between content fragments, relational fragments, and reassembly permission fragments in a complementary fragment set, and generates a phased transmission queue to prevent fragments with restoration relationships from clustering on the same transmission path, in the same intermediate buffer, or in the same release phase. Compared to schemes that rely solely on encryption, hash verification, or ordinary multipath transmission, this invention moves security control forward to the fragment generation and release order level. Even if a transmission path is monitored or an intermediate buffer malfunctions, it is difficult to simultaneously obtain the business content, restoration relationships, and reassembly permission, thereby improving the anti-interception and anti-restoration capabilities of cross-node transmission of network big data in a cloud computing environment.

[0016] This invention also performs consistency checks on the actual arrival path, reception time, reception buffer, and fragment digest of content fragments using arrival proofs. After the content fragment verification passes, the corresponding relation fragment is released; after both the content fragment and relation fragment verifications pass, the corresponding reassembly permit fragment is released. If the arrival proof verification fails, or the content fragment, relation fragment, and corresponding arrival proof are inconsistent, subsequent fragment release is stopped, and sent fragments that do not meet the reassembly conditions are marked as invalid fragments. Therefore, sent fragments after an anomaly cannot continue to participate in reassembly verification, avoiding the problem in existing technologies where abnormal fragments can continue to form a complete data link through retransmission, resending, or erroneous reassembly, thus improving data leakage prevention and secure recovery capabilities in transmission anomaly scenarios. Attached Figure Description

[0017] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of the cloud computing-based intelligent network big data secure transmission method proposed in this invention; Figure 2 This is a flowchart illustrating the complementary segment separation process of the cloud computing-based intelligent network big data secure transmission method proposed in this invention. Figure 3 This is a flowchart illustrating the proof and release of failure for the cloud computing-based intelligent network big data secure transmission method proposed in this invention. Detailed Implementation

[0018] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0019] refer to Figures 1-3 A cloud-based intelligent network big data secure transmission method includes the following steps: The cloud platform acquires network big data transmission tasks, performs field parsing, business object identification, and combination relationship identification on the data set to be transmitted, and generates a sensitive association table. Based on the sensitive association table, the data set to be transmitted is separated into content fragments, relationship fragments, and reassembly permission fragments, generating a complementary fragment set; Based on the restoration relationship between content fragments, relational fragments, and recombination permission fragments in the complementary fragment set, isolation transmission constraints are established, and a phased transmission queue is generated. Content fragments are sent according to a phased transmission queue, and the receiving end generates an arrival certificate based on the actual arrival path of the content fragment, the reception time, the reception buffer, and the fragment digest. The cloud platform performs consistency verification on the proof of arrival. After the content fragment verification passes, the corresponding relation fragment is released. After both the content fragment and the relation fragment verification pass, the corresponding reassembly permit fragment is released. The receiving end performs reassembly verification on the content fragment and the relation fragment based on the reassembly permit fragment. After the verification passes, the data set to be transmitted is restored. When the arrival proof verification fails, or the content fragment or relation fragment is inconsistent with the corresponding arrival proof, the release of subsequent fragments is stopped, and fragments that have been sent and have not met the reassembly conditions are marked as invalid fragments.

[0020] In this embodiment, the generation of the sensitive association table specifically includes: The cloud platform extracts the data set to be transmitted from the network big data transmission task, parses the field boundaries, the source of field values ​​and the original position of the fields, and generates field parsing results; Based on the field parsing results, identify the field affiliation under the same business event, the same user session, the same device status, or the same file object, and generate business object identification results; Based on the field parsing results and business object identification results, the co-occurrence, sequential occurrence, and mutual pointing between fields within the same business object are identified, and the combination relationship identification results are generated. The combined relationship identification result is generated by combining the original position and value source of the field in the field parsing result with the field attribution in the business object identification result. The cloud platform first determines the data block source of the field in the data set to be transmitted according to the original position of the field, and then determines whether the field comes from the same business event, the same user session, the same device status, or the same file object in the same network big data transmission task according to the value source. When two or more fields, log fragments, or file blocks can jointly point to a complete business object, complete transmission behavior, or complete business status within the same business object, the cloud platform uses the joint pointing result as the combined relationship identification result. Based on the results of the combination relationship identification, identify the combination of fragments that simultaneously contain the source of business content and the source of restoration relationship within the same business object, and write them into the sensitive association table; The source of the business content is the data location in the data set to be transmitted that carries field values, log text, or file block content. The source of the restoration relationship is the data location in the data set to be transmitted that carries field attribution, order of appearance, field correspondence, or file block connection content. The cloud platform arranges fields, log fragments, and file blocks according to their original positions within the same business object. When the arrangement result contains both a source of business content and a source of restoration relationship, and both can jointly determine the field attribution, log sequence, or file block connection under the same business object, the corresponding source of business content is marked as the source of subsequent content fragments, and the corresponding source of restoration relationship is marked as the source of subsequent relationship fragments. The corresponding content between the two is written into the sensitive association table.

[0021] In this embodiment, the generation of the complementary fragment set specifically includes: Based on the data locations corresponding to the source of business content and the source of restoration relationship in the sensitive association table, locate the corresponding fields, log fragments and file blocks in the data set to be transmitted; Extract field values, log text, or file block content from the data location corresponding to the source of business content, remove the content related to field attribution, order of appearance, field correspondence, or file block connection, and generate content fragments. The content fragment generation process is as follows: The cloud platform extracts the data portion carrying the actual business content from the data set to be transmitted according to the data location corresponding to the source of business content in the sensitive association table, and deletes the content that can point to the field affiliation, log sequence, or file block connection under the same business object in the extraction result; when the data location of the field value also carries the field name, field affiliation, or object number, the cloud platform only retains the data content corresponding to the field value and transfers the field name, field affiliation, or object number to the subsequent relationship fragment generation process; when the data location of the log text also carries the log sequence, the cloud platform only retains the log text and transfers the log sequence to the subsequent relationship fragment generation process; when the data location of the file block content also carries file block connection content, the cloud platform only retains the file block content and transfers the file block connection content to the subsequent relationship fragment generation process. Extract field attribution, order of appearance, field correspondence, or file block connection content from the data location corresponding to the source of the relationship, and hide field values, log text, or file block content to generate relationship fragments; The process of generating the relationship fragment is as follows: The cloud platform restores the data location corresponding to the relationship source in the sensitive association table, extracts the content used to restore the correspondence between content fragments from the data set to be transmitted, and masks field values, log text, or file block content that can directly represent business content in the extraction results; when restoring the field attribution corresponding to the relationship source, the relationship fragment retains the business object to which the field belongs and its corresponding content with the content fragment; when restoring the order of occurrence of the relationship source, the relationship fragment retains the sequential content between content fragments; when restoring the field correspondence corresponding to the relationship source, the relationship fragment retains the corresponding content between the fields; when restoring the file block connection content corresponding to the relationship source, the relationship fragment retains the connection content between the file blocks. Generate a reorganization permission fragment based on the corresponding content fragments and relationship fragments under the same sensitive association table item; The process of generating the reassembly license fragment is as follows: The cloud platform reads the generation source of the content fragment and the generation source of the relationship fragment under the same sensitive association table entry, as well as the corresponding content between them, and generates license content for the receiving end to recover the data set to be transmitted. The license content includes a content fragment identifier, a relationship fragment identifier, a reassembly order start identifier, a verification result reference, and a receiving end reassembly action identifier. It does not carry field values, log text, or file block content, nor does it carry complete field attribution, complete log sequence, or complete file block connection content. Instead, it carries license content that the receiving end can only perform reassembly verification after both the content fragment and the relationship fragment have passed the arrival proof verification. Before the reassembly license fragment is released, the receiving end cannot recover the data set to be transmitted based on the received content fragment and relationship fragment. Content fragments, relationship fragments, and reorganization permission fragments are merged according to their corresponding content under the same sensitive association table item to generate a complementary fragment set.

[0022] In this embodiment, the generation of the phased transmission queue specifically includes: Based on the content fragments, relational fragments, and reorganization permission fragments under the same sensitive association table item in the complementary fragment set, determine the restoration relationship among the three; The restoration relationship is determined by the source of the content fragment's generation, the source of the relationship fragment's generation, and the corresponding content between them. The release order is marked by the license content carried by the reassembled license fragment. The cloud platform reads the business content source corresponding to the content fragment and the restoration relationship source corresponding to the relationship fragment under the same sensitive association table entry. It then matches the retained field values, log text, or file block content in the content fragment with the retained field attribution, appearance order, field correspondence, or file block connection content in the relationship fragment. When the two can restore the field attribution, log sequence, or file block connection under the same business object after the reassembled license fragment is released, the corresponding content fragment, relationship fragment, and reassembled license fragment are determined to have a restoration relationship. Content fragments, relation fragments, and reassembly license fragments with restoration relationships are allocated to different transmission paths, different intermediate buffers, and different release stages to form isolated transmission constraints. The isolation transmission constraints include: the cloud platform performs separate processing of the path, cache, and release phase for each group of content fragments, relationship fragments, and reassembly license fragments with a restoration relationship; the cloud platform determines available transmission paths and available intermediate caches from the cloud transmission resources corresponding to the network big data transmission task, takes the available transmission path used by the content fragment as the first transmission path, takes the available intermediate cache traversed by the content fragment as the first intermediate cache, and relationship fragments with a restoration relationship with it must not use the first transmission path and the first intermediate cache, and reassembly license fragments must not use the intermediate caches already used by the content fragments or relationship fragments; the content fragments are placed in the pre-release phase, the relationship fragments are placed in the release phase after the arrival proof verification, and the reassembly license fragments are placed in the release phase after both the content fragments and relationship fragments have completed verification, so that fragments that can jointly restore the data set to be transmitted do not cluster in the same transmission path, the same intermediate cache, or the same release phase. Based on the isolation transmission constraints, content fragments are arranged in the early release phase, relation fragments are arranged after the arrival proof verification of the corresponding content fragments, and reassembly permission fragments are arranged after both the corresponding content fragments and relation fragments are verified, thus generating a phased transmission queue. The generation process of the phased transmission queue is as follows: The cloud platform first arranges the content fragments according to the sensitive association table entries to which the content fragments belong in the complementary fragment set, and reserves the release position of the corresponding relation fragment for each content fragment; when there are multiple content fragments under the same sensitive association table entry, the cloud platform makes the release position of the corresponding relation fragment later than the release position of all corresponding content fragments; the release position of the reassembly permission fragment is later than the release positions of all content fragments and all relation fragments under the same sensitive association table entry; each relation fragment in the phased transmission queue is associated with the arrival proof of the corresponding content fragment, and each reassembly permission fragment is associated with the verification result of the corresponding content fragment and relation fragment; When different sensitive related entries share the same content segment, the same relationship segment, or the same reorganization license segment, the cloud platform rearranges the corresponding release phases and updates the phased transmission queue. The update process of the phased transmission queue is as follows: the cloud platform checks whether there are shared content fragments, relationship fragments or reorganization license fragments under different sensitive association table entries; when a shared fragment participates in multiple restoration relationships, the cloud platform arranges the fragment according to the latest release stage that can restore the data set to be transmitted, and keeps other fragments with restoration relationships with the fragment on different transmission paths, different intermediate buffers and different release stages.

[0023] In this embodiment, the generation of the arrival proof specifically includes: The cloud platform reads content segments in the pre-release phase according to the phased transmission queue and sends them according to the transmission path. When sending, it writes the content segment identifier, the sensitive association table entry to which it belongs, and the sending phase identifier. After receiving a content segment, the receiving end obtains the actual arrival path, reception time, and reception buffer of the content segment, and generates a segment digest. Bind the content fragment identifier, actual arrival path, reception time, reception buffer, and fragment digest to generate an arrival certificate and return it to the cloud platform; The process of generating the arrival proof is as follows: After the content fragment enters the receive buffer, the receiving end first reads the content fragment identifier and the sending stage identifier. The content fragment identifier is used to confirm the position of the content fragment in the phased transmission queue, and the sending stage identifier is used to confirm whether the content fragment belongs to the early release stage. The receiving end determines the actual arrival path based on the path node identifier or the receiving gateway forwarding identifier carried by the content fragment, reads the position where the content fragment is written into the receiving end's buffer space as the receive buffer, and generates a fragment digest according to the actual received data of the content fragment. The receiving end binds the actual arrival path, the receiving time, the receive buffer, and the fragment digest together with the content fragment identifier.

[0024] In this embodiment, the implementation of the consistency check specifically includes: The cloud platform reads the arrival certificate, performs consistency verification between the content fragment identifier, actual arrival path, reception time, reception buffer, and fragment digest and the phased transmission queue, and generates the content fragment verification result. The process of generating the content fragment verification result is as follows: The cloud platform first locates the position of the content fragment in the phased transmission queue based on the content fragment identifier to confirm whether it belongs to the pre-release phase; then, it compares the actual arrival path with the corresponding transmission path of the content fragment in the phased transmission queue, compares the receiving buffer with the intermediate buffer corresponding to the content fragment, and confirms whether the actual data received by the receiving end is consistent with the content fragment sent by the cloud platform based on the fragment digest; when the content fragment identifier, actual arrival path, receiving buffer, and fragment digest are all consistent with the corresponding content in the phased transmission queue, a content fragment verification pass result is generated. When the content fragment verification result is passed, the cloud platform releases the relationship fragment corresponding to the content fragment according to the phased transmission queue, and the receiving end generates the arrival proof of the relationship fragment; The release process of the relationship fragment is as follows: the cloud platform reads the release position of the relationship fragment associated with the arrival proof of the content fragment in the phased transmission queue, and after the corresponding content fragment verification result is generated, the corresponding relationship fragment is sent to the receiving end; after receiving the relationship fragment, the receiving end binds the relationship fragment identifier, actual arrival path, receiving time, receiving buffer and fragment digest to generate the arrival proof of the relationship fragment. The cloud platform performs consistency verification on the arrival proof of the relation fragment, and matches the relation fragment with the arrival proof of the corresponding content fragment to generate the relation fragment verification result; The process of generating the relationship fragment verification result is as follows: The cloud platform finds the release position of the relationship fragment in the phased transmission queue based on the relationship fragment identifier, and confirms whether the release position is later than the arrival proof verification result of the corresponding content fragment; then, the actual arrival path and receiving buffer of the relationship fragment are compared with the first transmission path and the first intermediate buffer that the relationship fragment cannot use in the isolation transmission constraint; when the relationship fragment does not use the first transmission path and the first intermediate buffer, and the fragment digest of the relationship fragment is consistent with the relationship fragment sent by the cloud platform, a relationship fragment verification result is generated. When both the content fragment verification result and the relationship fragment verification result are passed, the cloud platform releases the corresponding reassembly license fragment according to the phased transmission queue. The release process of the reassembled license fragment is as follows: The cloud platform reads the verification results of the content fragments and the relationship fragments under the same sensitive association table, and finds the release position of the corresponding reassembled license fragment in the phased transmission queue; when all content fragments and all relationship fragments corresponding to the release position have generated verification results, the cloud platform sends the reassembled license fragment to the receiving end; when any content fragment or any relationship fragment has not generated a verification result, the cloud platform keeps the corresponding reassembled license fragment unreleased. The receiving end performs reassembly verification on the content fragment and relationship fragment based on the license content carried by the reassembly license fragment. After the verification is successful, the set of data to be transmitted is restored. The reassembly verification process involves the receiving end reading the content fragment identifier, relationship fragment identifier, reassembly order start identifier, verification result reference content, and receiving end reassembly action identifier from the reassembly license fragment. Based on the content fragment identifier, the receiving end reads the received content fragments, and based on the relationship fragment identifier, it reads the received relationship fragments. The receiving end first confirms that both the content fragments and relationship fragments have corresponding verification pass results. Then, it initiates the reassembly verification according to the reassembly order start identifier, matching the field values, log text, or file block content in the content fragments with the field attribution, order of appearance, field correspondence, or file block connection content in the relationship fragments. When the matching result matches the verification result reference content in the reassembly license fragment, the receiving end executes the reassembly action corresponding to the receiving end reassembly action identifier, restoring the data set to be transmitted.

[0025] In this embodiment, the generation of the failure fragment specifically includes: The cloud platform reads the content fragment verification results and relationship fragment verification results to locate the content fragments or relationship fragments that failed the arrival proof verification or were inconsistent with the corresponding arrival proof. The positioning process is as follows: The cloud platform reads the verification status of the content segment identifier, actual arrival path, receiving buffer, and segment digest from the content segment verification result. When the actual arrival path is inconsistent with the transmission path in the phased transmission queue, the receiving buffer is inconsistent with the intermediate buffer in the phased transmission queue, or the segment digest is inconsistent with the content segment sent by the cloud platform, the corresponding content segment is determined to be unsuccessful in arrival proof verification. The cloud platform reads the verification status of the relationship segment identifier, actual arrival path, receiving buffer, and segment digest from the relationship segment verification result. When the relationship segment uses the first transmission path or the first intermediate buffer that is not allowed to be used in the isolation transmission constraint, or the segment digest of the relationship segment is inconsistent with the relationship segment sent by the cloud platform, the corresponding relationship segment is determined to be inconsistent with the corresponding arrival proof. Based on the content or relational fragments that fail the arrival proof verification or are inconsistent with the corresponding arrival proof, the release of subsequent fragments with a restoration relationship with them is stopped in the phased transmission queue; The release cessation process involves the cloud platform locating the sensitive association entry to which a content fragment or relationship fragment belongs based on its identifier, and identifying the unreleased relationship fragments and reassembly license fragments under the same sensitive association entry in the phased transmission queue. When the object that fails the arrival proof verification is a content fragment, the cloud platform stops releasing the relationship fragments and reassembly license fragments that have a restoration relationship with that content fragment. When the object that does not match the corresponding arrival proof is a relationship fragment, the cloud platform stops releasing the reassembly license fragments that have a restoration relationship with that relationship fragment, preventing the fragments that fail the verification from obtaining subsequent fragments for restoring the data set to be transmitted. Content or relational segments that have been sent but do not meet the reassembly conditions are marked as invalid segments, and invalid segments are prohibited from participating in the reassembly verification. The faulty segment is marked by searching the sent content segments and relationship segments through the cloud platform for segments that have not yet obtained the corresponding reassembly permission, as well as segments that have obtained the relationship segment but have not completed the reassembly verification. The faulty segment is marked and bound to the content segment identifier or relationship segment identifier. Before performing the reassembly verification, the receiving end reads the content segment identifier and relationship segment identifier. When any content segment or relationship segment has a faulty segment mark, the receiving end stops reading the content segment or relationship segment and refuses to include the faulty segment in the reassembly verification. The receiving end disconnects the executable correspondence between the failed fragment and the reconstructed license fragment based on the failed fragment marker, and returns a failure confirmation to the cloud platform. The executable correspondence includes: the receiving end reads the content fragment identifier, relationship fragment identifier, reassembly sequence start identifier, verification result reference content, and receiving end reassembly action identifier from the reassembly license fragment; when any of the content fragment identifiers or relationship fragment identifiers corresponds to a failed fragment, the receiving end cancels the correspondence between the failed fragment and the reassembly sequence start identifier, cancels the correspondence between the failed fragment and the verification result reference content, and stops executing the reassembly action corresponding to the receiving end reassembly action identifier; the receiving end returns the content fragment identifier or relationship fragment identifier corresponding to the failed fragment to the cloud platform, forming a failure confirmation; Based on the failure confirmation, the cloud platform rearranges the release phases of unreleased segments under the same sensitive association table entry and updates the phased transmission queue; The update process of the phased transmission queue is as follows: the cloud platform determines the sensitive association table entry to which the failed segment belongs based on the failure confirmation, and reads the relationship segments and reassembly permission segments that have not yet been released under the same sensitive association table entry; the unreleased segments that have a restoration relationship with the failed segment are removed from the original release stage, and their transmission path, intermediate buffer and release stage are re-determined based on the isolation transmission constraints.

[0026] A cloud-based intelligent network big data secure transmission system includes: The sensitive association generation module is used to enable the cloud platform to obtain network big data transmission tasks, perform field parsing, business object identification, and combination relationship identification on the data set to be transmitted, and generate a sensitive association table. The complementary fragment generation module is used to separate the data set to be transmitted into content fragments, relation fragments, and reassembly permission fragments based on the sensitive association table, and generate a complementary fragment set. The phased queue generation module is used to establish isolation transmission constraints and generate phased transmission queues based on the restoration relationship between content fragments, relation fragments and recombination permission fragments in the complementary fragment set. The arrival proof generation module is used to send content fragments according to the phased transmission queue and generate arrival proofs; The tiered release and reassembly module enables the cloud platform to perform consistency verification on the arrival certificate, and restores the set of data to be transmitted after the verification is successful. The abnormal failure handling module is used to stop releasing subsequent fragments when the arrival proof verification fails, or when the content fragment or relationship fragment is inconsistent with the corresponding arrival proof, and to mark the sent fragments that do not meet the reassembly conditions as failed fragments.

[0027] Example 1: To verify the feasibility of this invention in practice, it was applied to a network big data security transmission scenario between a provincial government cloud data center and a disaster recovery data center in the same city. In this scenario, business processing logs, user session records, device operating status, and electronic file fragments need to be transmitted periodically. While a single data entry may not necessarily contain complete sensitive information, once field values, business object numbers, log order, and file block connections are clustered within the same transmission path or buffer, a complete business object and transmission behavior can be reconstructed. The original system used fixed-size fragmentation, link encryption, and hash verification for transmission. In tests conducted during the same period, the implementer, after extracting consecutive transmission fragments from a certain intermediate buffer, was able to recover part of the user session link based on field names, object numbers, and log order. To address this problem, this example uses the method of this invention. The cloud platform first parses the data set to be transmitted, analyzing field boundaries, field value sources, and original field locations. Then, it identifies the field affiliation under the same business event, the same user session, the same device status, or the same file object. Furthermore, it identifies the combination relationships between fields based on their co-occurrence, sequential occurrence, and mutual pointing, generating a sensitive association table.

[0028] In this specific application, the transmission link between two cloud data nodes in the same location is selected as the verification environment. The data set to be transmitted includes 1.86 million business processing logs, 420,000 user session fragments, 310,000 device status fragments, and 126,000 electronic file blocks, with an original data volume of 86.4 GB. The cloud platform identifies a total of 87,000 fragment combinations that can jointly point to a complete business object, a complete transmission behavior, or a complete business status based on the sensitive association table. The data location of the field values, log text, or file block content is used as the source of business content, and the data location of the field attribution, order of appearance, field correspondence, or file block connection content is used as the source of the reconstruction relationship. Subsequently, the cloud platform extracts field values, log text, and file block content from the business content source, removing field attribution, order of appearance, field correspondence, and file block connection content to generate content fragments; it also extracts field attribution, order of appearance, field correspondence, and file block connection content from the relationship source, masking field values, log text, and file block content to generate relationship fragments; and finally, based on the corresponding content between content fragments and relationship fragments under the same sensitive association table item, it generates reorganization permission fragments. After processing, the test data is separated into 129,000 content fragments, 87,000 relationship fragments, and 87,000 reorganization permission fragments, which are then merged into a complementary fragment set.

[0029] The cloud platform establishes isolation transmission constraints based on the restoration relationships between content fragments, relationship fragments, and reassembly license fragments in the complementary fragment set. This ensures that fragments with restoration relationships within the same set do not traverse the same transmission path, the same intermediate buffer, or enter the same release phase. Implementers configure three transmission paths and four intermediate buffers in the verification environment, with content fragments entering the early release phase first. After receiving a content fragment, the receiving end generates an arrival certificate based on the actual arrival path, reception time, receiving buffer, and fragment digest, and returns it to the cloud platform. The cloud platform performs consistency verification on the arrival certificate; only after the content fragment verification passes is the corresponding relationship fragment released, and only after both the content fragment and relationship fragment verification pass is the corresponding reassembly license fragment released. The receiving end performs reassembly verification based on the content fragment identifier, relationship fragment identifier, reassembly order initiation identifier, verification result reference content, and receiving end reassembly action identifier in the reassembly license fragment. After successful verification, the data set to be transmitted is restored. Verification results show that the method of the present invention takes an average of 18.9 minutes to complete 86.4GB of data transmission, which increases the time overhead by 4.1% compared with the original fixed fragmentation encryption transmission method. However, the number of complete business objects that can be directly recovered in the intermediate buffer area is reduced from 1542 in the original method to 27, the complete transmission behavior link restoration ratio is reduced from 18.6% to 1.9%, and the number of subsequent fragment releases in fragment digest inconsistency and path deviation scenarios is reduced from 312 in the original method to 11.

[0030] In the anomaly verification, the implementer simulated four scenarios: path deviation, receive buffer mismatch, fragment digest inconsistency, and duplicate arrival, generating a total of 438 abnormal fragments. The original system primarily relied on retransmission and re-verification after anomalies occurred. Existing fragments might still participate in recovery along with subsequently retransmitted fragments, resulting in the reassembly of relationship information and business content in 12 sets of anomaly samples. The method of this invention, when arrival proof verification fails, or when content fragments, relationship fragments, and their corresponding arrival proofs are inconsistent, stops the release of subsequent fragments by the cloud platform and marks sent fragments that do not meet the reassembly conditions as invalid fragments. Before reassembly verification, the receiving end reads the content fragment identifier and relationship fragment identifier. Upon discovering an invalid fragment marker, it stops reading that fragment and refuses to include it in the reassembly verification. After verifying 438 abnormal fragments, the average time for marking invalid fragments was 0.37 seconds, the proportion of subsequent reassembly permitted fragments being intercepted and released reached 96.8%, and the proportion of abnormal fragments continuing to participate in reassembly verification decreased from 14.3% in the original method to 1.4%. Therefore, this invention can not only reduce the possibility of clustering of business content and restoration relationships during normal transmission, but also block the link for restoring complete data after a transmission anomaly occurs, thereby improving the anti-interception, anti-restoration, and anomaly prevention capabilities of secure big data transmission in a cloud computing environment.

[0031] Table 1 Comparison of the Staged Secure Transmission Effects of Big Data in the Cloud

[0032] The above experiments were conducted at the same location, with the same transmission link configuration and the same data scale. The transmitted data volume was 86.4GB, and the data content included business processing logs, user session fragments, device status fragments, and electronic file blocks. The fixed-size fragmented AES-GCM transmission method uses fixed-size fragments, AES-GCM encryption, and SHA-256 digest verification to complete the transmission. The multi-path hash verification fragmented transmission method introduces multi-link transmission and hash integrity verification on the basis of fixed-size fragmentation. The method of this invention separates the data set to be transmitted into content fragments, relation fragments, and reassembly permission fragments according to a sensitive association table before transmission, establishes isolation transmission constraints according to the restoration relationship, and then controls the release of subsequent fragments through arrival proofs. The data in the table does not show an arithmetic progression, but rather shows different degrees of improvement on different indicators, which can reflect the actual impact of fragment aggregation, path anomalies, buffer anomalies, and reassembly verification anomalies on transmission security.

[0033] In terms of transmission efficiency, the method of this invention completes 86.4GB of data transmission in an average of 18.9 minutes, which is lower than the 18.1 minutes of the fixed-size fragmented AES-GCM transmission method and the 18.5 minutes of the multi-path hash check fragmented transmission method. The average throughput also decreased from 4.77GB / min to 4.57GB / min, indicating that this invention introduces certain transmission overhead due to the addition of sensitive association table generation, complementary fragment separation, isolation transmission constraint establishment, arrival proof verification, and phased release processes. However, the reassembly success rate of the legitimate receiving end remains at 97.8%, and no significant unavailability issues are caused by fragment separation and phased release. This shows that the method can still meet the requirements of continuous big data transmission in the cloud and receiver recovery while sacrificing a small amount of transmission speed.

[0034] From the perspective of data recovery effectiveness, the fixed-size fragmented AES-GCM transmission method can directly restore 1542 complete business objects in the intermediate buffer, the multi-path hash verification fragmented transmission method reduces this to 638, and the method of this invention reduces it to 27. The complete transmission behavior link recovery rate also decreased from 18.6% and 8.4% to 1.9%. This result shows that simply encrypting data fragments or distributing fragments across multiple paths cannot fully solve the problem of field values, log order, object ownership, and file block connection content clustering in the buffer. The method of this invention first identifies the source of business content and the source of recovery relationship based on the sensitive association table, and then generates content fragments and relationship fragments respectively, so that a single fragment cannot carry both business content and recovery relationship at the same time. At the same time, the reassembly permission fragment is not released until both the content fragment and the relationship fragment pass verification. Therefore, even if fragments remain in the intermediate buffer, it is difficult to recover the complete business object or the complete transmission behavior.

[0035] From the perspective of abnormal transmission handling, all three methods encountered 438 abnormal arrival proof segments. The fixed-size fragmented AES-GCM transmission method experienced 312 instances of subsequent segment erroneous release, the multi-path hash check fragmented transmission method experienced 147 instances, while the method of this invention only experienced 11 instances. The proportion of abnormal segments continuing to participate in reassembly verification decreased from 14.3% and 7.8% to 1.4%; the average time for blocking abnormal segments decreased from 1.24s and 1.09s to 0.37s. This result indicates that this invention does not simply rely on retransmission or re-verification after an anomaly occurs. Instead, when the arrival proof verification fails, the content segment is inconsistent with the arrival proof, or the relation segment is inconsistent with the arrival proof, it directly stops releasing subsequent segments and marks the sent segments that do not meet the reassembly conditions as invalid segments, preventing them from continuing to participate in reassembly verification. Since the anomaly handling action is directly related to the phased transmission queue, arrival proof, and reassembly permission segment release mechanism, abnormal segments can be blocked more quickly after being discovered, reducing erroneous retransmission, erroneous release, and erroneous recovery.

[0036] In summary, the method of this invention identifies the source of business content and the source of reconstruction relationships through a sensitive association table, reduces the reproducibility of single fragments through complementary separation of content fragments, relationship fragments, and reassembly permission fragments, reduces the aggregation of fragments with reconstruction relationships in the same transmission path and the same intermediate buffer through isolated transmission constraints, controls the step-by-step release of relationship fragments and reassembly permission fragments through arrival proofs, and blocks abnormal fragments from continuing to participate in reassembly verification through invalid fragment marking. Although the transmission time increases by 0.8 minutes compared to the fixed-size fragmented AES-GCM transmission method, the number of complete business objects that can be directly restored in the intermediate buffer, the complete transmission behavior link restoration ratio, the number of erroneous releases of subsequent abnormal fragments, and the proportion of abnormal fragments continuing to participate in reassembly verification are all significantly reduced. This indicates that the method can improve the anti-interception capability, anti-reconstruction capability, and anomaly prevention capability during network big data transmission in a cloud computing environment while maintaining the recovery capability of the legitimate receiving end.

[0037] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A cloud computing-based intelligent network big data secure transmission method, characterized in that, Includes the following steps: The cloud platform acquires network big data transmission tasks, performs field parsing, business object identification, and combination relationship identification on the data set to be transmitted, and generates a sensitive association table. Based on the sensitive association table, the data set to be transmitted is separated into content fragments, relationship fragments, and reassembly permission fragments, generating a complementary fragment set; Based on the restoration relationship between content fragments, relational fragments, and reassembly permission fragments in the complementary fragment set, isolation transmission constraints are established, and a phased transmission queue is generated; Content fragments are sent according to a phased transmission queue, and the receiving end generates an arrival certificate based on the actual arrival path of the content fragment, the reception time, the reception buffer, and the fragment digest. The cloud platform performs consistency verification on the proof of arrival. After the content fragment verification passes, the corresponding relation fragment is released. After both the content fragment and the relation fragment verification pass, the corresponding reassembly permit fragment is released. The receiving end performs reassembly verification on the content fragment and the relation fragment based on the reassembly permit fragment. After the verification passes, the data set to be transmitted is restored. When the arrival proof verification fails, or the content fragment or relation fragment is inconsistent with the corresponding arrival proof, the release of subsequent fragments is stopped, and fragments that have been sent and have not met the reassembly conditions are marked as invalid fragments.

2. The cloud computing-based intelligent network big data secure transmission method according to claim 1, characterized in that, The generation of the sensitive association table specifically includes: The cloud platform extracts the data set to be transmitted from the network big data transmission task, parses the field boundaries, the source of field values ​​and the original position of the fields, and generates field parsing results; Based on the field parsing results, identify the field affiliation under the same business event, the same user session, the same device status, or the same file object, and generate business object identification results; Based on the field parsing results and business object identification results, the co-occurrence, sequential occurrence, and mutual pointing between fields within the same business object are identified, and the combination relationship identification results are generated. Based on the results of the combination relationship identification, identify fragment combinations that simultaneously contain both the source of business content and the source of restoration relationship within the same business object, and write them into the sensitive association table.

3. The cloud computing-based intelligent network big data secure transmission method according to claim 1, characterized in that, The generation of the complementary fragment set specifically includes: Based on the data locations corresponding to the source of business content and the source of restoration relationship in the sensitive association table, locate the corresponding fields, log fragments and file blocks in the data set to be transmitted; Extract field values, log text, or file block content from the data location corresponding to the source of business content, remove the content related to field attribution, order of appearance, field correspondence, or file block connection, and generate content fragments. Extract field attribution, order of appearance, field correspondence, or file block connection content from the data location corresponding to the source of the relationship, and hide field values, log text, or file block content to generate relationship fragments; Generate a reorganization permission fragment based on the corresponding content fragments and relationship fragments under the same sensitive association table item; Content fragments, relationship fragments, and reorganization permission fragments are merged according to their corresponding content under the same sensitive association table item to generate a complementary fragment set.

4. The cloud computing-based intelligent network big data secure transmission method according to claim 1, characterized in that, The generation of the phased transmission queue specifically includes: Based on the content fragments, relational fragments, and reorganization permission fragments under the same sensitive association table item in the complementary fragment set, determine the restoration relationship among the three; Content fragments, relation fragments, and reassembly license fragments with restoration relationships are allocated to different transmission paths, different intermediate buffers, and different release stages to form isolated transmission constraints. Based on the isolation transmission constraints, content fragments are arranged in the early release phase, relation fragments are arranged after the arrival proof verification of the corresponding content fragments, and reassembly permission fragments are arranged after both the corresponding content fragments and relation fragments are verified, thus generating a phased transmission queue. When different sensitive related entries share the same content segment, the same relationship segment, or the same reorganization license segment, the cloud platform rearranges the corresponding release phases and updates the phased transmission queue.

5. The cloud computing-based intelligent network big data secure transmission method according to claim 1, characterized in that, The generation of the arrival proof specifically includes: The cloud platform reads content segments in the pre-release phase according to the phased transmission queue and sends them according to the transmission path. When sending, it writes the content segment identifier, the sensitive association table entry to which it belongs, and the sending phase identifier. After receiving a content segment, the receiving end obtains the actual arrival path, reception time, and reception buffer of the content segment, and generates a segment digest. The content fragment identifier, actual arrival path, reception time, reception buffer, and fragment digest are bound together to generate an arrival certificate and return it to the cloud platform.

6. The cloud computing-based intelligent network big data secure transmission method according to claim 1, characterized in that, The implementation of the consistency check specifically includes: The cloud platform reads the arrival certificate, performs consistency verification between the content fragment identifier, actual arrival path, reception time, reception buffer, and fragment digest and the phased transmission queue, and generates the content fragment verification result. When the content fragment verification result is passed, the cloud platform releases the relationship fragment corresponding to the content fragment according to the phased transmission queue, and the receiving end generates the arrival proof of the relationship fragment; The cloud platform performs consistency verification on the arrival proof of the relation fragment, and matches the relation fragment with the arrival proof of the corresponding content fragment to generate the relation fragment verification result; When both the content fragment verification result and the relationship fragment verification result are passed, the cloud platform releases the corresponding reassembly license fragment according to the phased transmission queue. The receiving end performs reassembly verification on the content fragment and relationship fragment based on the license content carried by the reassembly license fragment. After the verification is successful, the set of data to be transmitted is restored.

7. The cloud computing-based intelligent network big data secure transmission method according to claim 1, characterized in that, The generation of the failure fragment specifically includes: The cloud platform reads the content fragment verification results and relationship fragment verification results to locate the content fragments or relationship fragments that failed the arrival proof verification or were inconsistent with the corresponding arrival proof. Based on the content or relational fragments that fail the arrival proof verification or are inconsistent with the corresponding arrival proof, the release of subsequent fragments with a restoration relationship with them is stopped in the phased transmission queue; Content or relational segments that have been sent but do not meet the reassembly conditions are marked as invalid segments, and invalid segments are prohibited from participating in the reassembly verification. The receiving end disconnects the executable correspondence between the failed fragment and the reconstructed license fragment based on the failed fragment marker, and returns a failure confirmation to the cloud platform. Based on the failure confirmation, the cloud platform rearranges the release phases of unreleased segments under the same sensitive association table entry and updates the phased transmission queue.

8. A cloud computing-based intelligent network big data secure transmission system, comprising executing the cloud computing-based intelligent network big data secure transmission method according to any one of claims 1 to 7, characterized in that, include: The sensitive association generation module is used to enable the cloud platform to obtain network big data transmission tasks, perform field parsing, business object identification, and combination relationship identification on the data set to be transmitted, and generate a sensitive association table. The complementary fragment generation module is used to separate the data set to be transmitted into content fragments, relation fragments, and reassembly permission fragments based on the sensitive association table, and generate a complementary fragment set. The phased queue generation module is used to establish isolation transmission constraints and generate phased transmission queues based on the restoration relationship between content fragments, relation fragments and recombination permission fragments in the complementary fragment set. The arrival proof generation module is used to send content fragments according to the phased transmission queue and generate arrival proofs; The tiered release and reassembly module enables the cloud platform to perform consistency verification on the arrival certificate, and restores the set of data to be transmitted after the verification is successful. The abnormal failure handling module is used to stop releasing subsequent fragments when the arrival proof verification fails, or when the content fragment or relationship fragment is inconsistent with the corresponding arrival proof, and to mark the sent fragments that do not meet the reassembly conditions as failed fragments.

Images