Data security communication system and method

Abstract

The application discloses a kind of data security communication systems and methods, it is related to safe communication technical field, the system includes: management end manages user configuration information, configuration center stores information;Client queries the user configuration information of target user to configuration center, executes user login operation, and sends service registration request to registration center;Registration center inquires the user configuration information of target user to configuration center, and registers user service;Client sends to receiving party for data communication after communication data is encrypted by public-private key data.The system architecture in the application guarantees that both sides of communication are online compliance trustworthy.Configuration center will store user configuration information only by administrator in management end application creation user configuration information.Configuration center stores user configuration information, ensures that user is compliance trustworthy, and registration center stores user service, ensures that user is logged on online.Communication process uses end-to-end encryption and decryption technology, guarantees data safe transmission.

Description

Technical Field

[0001] This application relates to the field of secure communication technology, and in particular to a data secure communication system and method. Background Technology

[0002] Communication is unavoidable in corporate work, and it can be categorized into offline and online communication. Offline communication refers to face-to-face interaction, while online communication involves using messaging software. Employees use messaging software to send and receive data via the internet. Communication between employees within a company is a crucial aspect, and data communication scenarios are ubiquitous, including work-related exchanges, file transfers, and notifications. Currently, data breaches and other security issues are commonplace, leading to increasing emphasis on data security, and national laws and regulations regarding data security are gradually being improved. The demand for secure data communication within companies is growing stronger, as protecting data security is protecting company assets.

[0003] However, existing data communication solutions have the following drawbacks: 1. Social engineering attacks. For public social networking software, anyone can add someone as a friend, and friends can exchange data. Therefore, it can be assumed that anyone can transmit data to anyone. 2. Insecure communication process. For office systems, although the system maintains a list of employees, and employees can directly initiate communication, neither party can perform encryption / decryption, signature verification, or other security checks during data transmission, making it impossible to guarantee the security of the communication process. 3. Risk of data leakage and loss. Communication software is installed on the system, which is integrated into the electronic device. Communication data is generally stored on the system, such as Android systems on mobile phones or Microsoft systems on computers. Due to the wide variety of software installed on the system, the countless websites accessed by users, the diverse sources of peripherals connected to devices, and the uncertainty of network connections, the system is highly susceptible to intrusion, posing a risk of data file theft and leakage. System malfunctions and reinstallations, software malfunctions and reinstallations, software data cleanup and migration operations, and switching terminal devices can all lead to data loss. All of the above drawbacks reduce the security of data communication. Summary of the Invention

[0004] The main purpose of this application is to provide a data security communication system and method, which aims to solve the technical problems of low communication security caused by untrusted users and data leakage during data communication.

[0005] To achieve the above objectives, this application proposes a data security communication system, which includes a management terminal, a configuration center, a registration center, and a client.

[0006] The management terminal is used to manage user configuration information through the CRUD (Create, Read, Update, Delete) function interface of the configuration center.

[0007] The configuration center is used to store the user configuration information, which includes user account, user password and public / private key data;

[0008] The client is used to query the user configuration information of the target user from the configuration center, perform user login operation according to the user account and the user password, and send a service registration request to the registration center;

[0009] The registration center is used to query the user configuration information of the target user from the configuration center when it receives the service registration request from the client, and register the user service corresponding to the target user according to the user configuration information;

[0010] The client is also used to encrypt communication data using the public and private key data when successfully registering the user service corresponding to the target user, and send the encrypted communication data to the client corresponding to the recipient for data communication.

[0011] In one embodiment, the client is further configured to obtain the input account and input password entered by the target user;

[0012] The client is also used to query the configuration center to see if the target user's user configuration information exists;

[0013] The client is further configured to, if user configuration information of the target user exists, determine whether the user account in the queried user configuration information is consistent with the input account, and determine whether the user password is consistent with the input password;

[0014] The client is further configured to perform a user login operation if the user account matches the input account and the user password matches the input password.

[0015] In one embodiment, the registration center is further configured to query the configuration center to see if the user configuration information of the target user exists;

[0016] The registration center is also used to generate a user service based on the user configuration information of the target user if the user configuration information of the target user exists, and save the user service to the user service list to complete the user service registration operation of the target user;

[0017] The registration center is also used to periodically send online detection signals to the client;

[0018] The client is also used to determine whether a user is online based on the user's login status. If the user is online, the client receives the online detection signal and sends an online feedback signal to the registration center.

[0019] The registration center is also used to remove the user service corresponding to the client from the user service list if it does not receive the online feedback signal from the client within a preset time period.

[0020] In one embodiment, the client is further configured to periodically initiate service query requests to the registry center, receive user service information fed back by the registry center based on the service query requests, and save the user service information to a local user service list;

[0021] The client is also configured to determine the receiving client in the local user service list, initiate a new service query request to the registry center, receive the latest user service information fed back by the registry center based on the new service query request, and update the local user service list based on the latest user service information.

[0022] The client is also used to determine whether the user service corresponding to the receiving client exists in the updated local user service list;

[0023] The client is also configured to query the configuration center for the user configuration information corresponding to the receiving client if the updated local user service list contains a user service corresponding to the receiving client.

[0024] The client is also configured to, if the configuration center contains user configuration information corresponding to the receiving client, encrypt the communication data using the public and private key data, and send the encrypted communication data to the receiving client for data communication.

[0025] In one embodiment, the data security communication system further includes a storage server;

[0026] The client is also used to query the configuration center for its own public and private key data and the receiver's public key data corresponding to the receiver client. The public and private key data includes its own public key and its own private key.

[0027] The client is also configured to process the communication data input by the user using a message digest algorithm to obtain a digital digest, and to encrypt the communication data and the digital digest according to the public key data of the recipient to generate first encrypted data;

[0028] The client is further configured to process the first encrypted data according to its own private key to obtain encrypted communication data, and send the encrypted communication data to the client corresponding to the receiver for data communication;

[0029] The client is also configured to encrypt the communication data according to its own public key, generate second encrypted data, and send the second encrypted data to the storage server for storage;

[0030] The storage server is used to store the second encrypted data.

[0031] To achieve the above objectives, this application proposes a data security communication method, which is applied to a data security communication system, the data security communication system including a management terminal, a configuration center, a registration center, and a client; the method includes:

[0032] The management terminal manages user configuration information through the CRUD (Create, Read, Update, Delete) function interface of the configuration center.

[0033] The configuration center stores the user configuration information, which includes user account, user password, and public / private key data.

[0034] The client queries the configuration center for the target user's user configuration information, performs a user login operation based on the user account and the user password, and sends a service registration request to the registration center.

[0035] When the registration center receives the service registration request from the client, it queries the configuration center for the user configuration information of the target user and registers the user service corresponding to the target user according to the user configuration information.

[0036] When the client successfully registers the user service corresponding to the target user, it encrypts the communication data using the public and private key data and sends the encrypted communication data to the client corresponding to the recipient for data communication.

[0037] In one embodiment, the step of querying the target user's user configuration information from the configuration center and performing a user login operation based on the user account and the user password includes:

[0038] The client obtains the target user's username and password.

[0039] The client queries the configuration center to see if the target user's user configuration information exists.

[0040] If the client has user configuration information for the target user, it determines whether the user account in the queried user configuration information is consistent with the input account, and whether the user password is consistent with the input password.

[0041] If the user account matches the entered account and the user password matches the entered password, the client will perform a user login operation.

[0042] In one embodiment, the step of querying the user configuration information of the target user from the configuration center and registering the user service corresponding to the target user according to the user configuration information when receiving the service registration request from the client includes:

[0043] The registration center queries the configuration center to see if the user configuration information of the target user exists.

[0044] If the registration center has the user configuration information of the target user, it generates a user service based on the user configuration information of the target user, saves the user service to the user service list, and completes the user service registration operation of the target user.

[0045] The registration center periodically sends online detection signals to the client.

[0046] The client determines whether a user is online based on the user's login status. If the user is online, the client receives the online detection signal and sends an online feedback signal to the registration center.

[0047] If the registration center does not receive the online feedback signal from the client within a preset time period, it will remove the user service corresponding to the client from the user service list.

[0048] In one embodiment, the step of encrypting communication data using the public and private key data and sending the encrypted communication data to the client corresponding to the recipient for data communication when the user service corresponding to the target user is successfully registered includes:

[0049] The client periodically sends service query requests to the registry center, receives user service information from the registry center based on the service query requests, and saves the user service information to the local user service list.

[0050] The client identifies the receiving client in the local user service list, initiates a new service query request to the registry center, receives the latest user service information from the registry center based on the new service query request, and updates the local user service list based on the latest user service information.

[0051] The client determines whether the user service corresponding to the receiving client exists in the updated local user service list;

[0052] If the updated local user service list contains a user service corresponding to the receiving client, the client queries the configuration center for the user configuration information corresponding to the receiving client.

[0053] If the configuration center contains user configuration information corresponding to the receiving client, the client encrypts the communication data using the public and private key data and sends the encrypted communication data to the receiving client for data communication.

[0054] In one embodiment, the data security communication system further includes a storage server;

[0055] The step of encrypting the communication data using the public and private key data and sending the encrypted communication data to the receiving client for data communication includes:

[0056] The client queries the configuration center for its own public and private key data and the receiver's public key data corresponding to the receiver client. The public and private key data includes the client's own public key and its own private key.

[0057] The client processes the communication data input by the user using a message digest algorithm to obtain a digital digest, and encrypts the communication data and the digital digest according to the public key data of the recipient to generate first encrypted data.

[0058] The client processes the first encrypted data according to its own private key to obtain encrypted communication data, and sends the encrypted communication data to the client corresponding to the receiver for data communication.

[0059] The client encrypts the communication data using its own public key to generate second encrypted data, and sends the second encrypted data to the storage server for storage;

[0060] The storage server stores the second encrypted data.

[0061] This application provides a data security communication system. The management terminal manages user configuration information, while the configuration center stores user configuration information such as account names, passwords, and public / private key data. Clients query the configuration center for the target user's configuration information, perform user login operations, and send service registration requests to the registration center. Upon receiving a request, the registration center queries the configuration center for the target user's configuration information and registers the user service. The client encrypts the communication data using public / private key data and sends the encrypted communication data to the corresponding client of the receiving party for data communication. This application's communication process utilizes the management terminal, registration center, and configuration center to ensure online compliance and trustworthiness between the communicating parties. User configuration information is only stored in the configuration center after the administrator requests its creation on the management terminal. The configuration center stores user configuration information to ensure user compliance and trustworthiness, while the registration center's user service list stores user services to ensure user login and online presence. The communication process uses end-to-end encryption and decryption technology to ensure secure data transmission. Attached Figure Description

[0062] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0063] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0064] Figure 1 This is a schematic diagram of the architecture of the data security communication system according to Embodiment 1 of this application;

[0065] Figure 2 This is a functional diagram of the management terminal in this application;

[0066] Figure 3 This is a functional diagram of the configuration center in this application;

[0067] Figure 4 This is a functional diagram of the registration center in this application;

[0068] Figure 5 This is a functional diagram of the client in this application;

[0069] Figure 6 This is a functional diagram of the storage server in this application;

[0070] Figure 7 This is a schematic diagram of the complete architecture of the data security communication system in this application;

[0071] Figure 8 This is a schematic diagram of the overall process of client data transmission and reception in this application;

[0072] Figure 9 This is a flowchart illustrating an embodiment of the data security communication method of this application.

[0073] Figure 10 This is a flowchart illustrating Embodiment 2 of the data security communication method of this application.

[0074] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0075] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0076] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0077] The main solution of this application embodiment is as follows: A data security communication system includes a management terminal, a configuration center, a registration center, and a client; the management terminal is used to manage user configuration information through the CRUD (Create, Read, Update, Delete) function interface of the configuration center; the configuration center is used to store the user configuration information, which includes user account, user password, and public / private key data; the client is used to query the user configuration information of a target user from the configuration center, perform a user login operation based on the user account and user password, and send a service registration request to the registration center; the registration center is used to query the user configuration information of the target user from the configuration center when it receives the service registration request from the client, and register the user service corresponding to the target user based on the user configuration information; the client is also used to encrypt the communication data using the public / private key data when the user service corresponding to the target user is successfully registered, and send the encrypted communication data to the client corresponding to the recipient for data communication.

[0078] This application provides a solution where the management terminal manages user configuration information, and the configuration center stores user configuration information such as account names, passwords, and public / private key data. The client queries the configuration center for the target user's configuration information, performs a user login operation, and sends a service registration request to the registration center. Upon receiving the request, the registration center queries the configuration center for the target user's configuration information and registers the user service. The client encrypts the communication data using public / private key data and sends the encrypted communication data to the corresponding client of the receiving party for data communication. This application's communication process utilizes the management terminal, registration center, and configuration center to ensure online compliance and trustworthiness between the communicating parties. User configuration information is only stored in the configuration center after the administrator requests its creation on the management terminal. The configuration center stores user configuration information to ensure user compliance and trustworthiness, while the registration center's user service list stores user services to ensure user login and online presence. The communication process uses end-to-end encryption and decryption technology to ensure data transmission security.

[0079] Based on this, embodiments of this application provide a data security communication system, referring to... Figure 1 , Figure 1 This is a schematic diagram of the architecture of the first embodiment of the data security communication system of this application.

[0080] In this embodiment, the data security communication system includes a management terminal, a configuration center, a registration center, and a client.

[0081] The management terminal is used to manage user configuration information through the CRUD (Create, Read, Update, Delete) function interface of the configuration center.

[0082] Understandably, the management interface is primarily used to manage user account information, passwords, public and private keys, and other user configuration information. The management interface can query, add, modify, and delete user configuration information through an interface, and save this information to the configuration center. The functionality of the management interface can be found in [reference needed]. Figure 2 As shown, the specific process for managing user configuration information on the management terminal is as follows: the administrator successfully logs in to the management terminal; the administrator performs operations such as adding, deleting, modifying, and querying user configuration information through the management terminal page; the management terminal calls the function interface of the configuration center to create user configuration information such as account, password, and public / private keys; the configuration center saves user configuration information such as account, password, and public / private keys.

[0083] The configuration center is used to store the user configuration information, which includes user account, user password, and public / private key data.

[0084] It should be understood that the configuration center is primarily used to create and store user account, password, public and private keys, and other configuration information, and to provide CRUD (Create, Read, Update, Delete) functions to external systems. The management console manages user configuration information through CRUD operations, while clients and the registry center retrieve user configuration information through query operations. User account and password data are used for client login, and public and private key data are used for end-to-end encryption during communication. The functionality of the configuration center can be found in [reference needed]. Figure 3 As shown.

[0085] The client is used to query the user configuration information of the target user from the configuration center, perform user login operation according to the user account and the user password, and send a service registration request to the registration center.

[0086] It should be noted that the client can query the target user's configuration information from the configuration center and perform the user login operation based on the user's account and password. During the user login process, the client will query the configuration center for user configuration information. Only if the configuration center contains the user configuration information will the client continue with the login operation. After the user logs in, the client will register the user service with the registry center.

[0087] The registration center is used to query the user configuration information of the target user from the configuration center when it receives the service registration request from the client, and register the user service corresponding to the target user according to the user configuration information.

[0088] It should be understood that the registry center is used to register and discover client user services and maintain a list of user services for logged-in clients. After a user logs in, the client sends a service registration request to the registry center. The registry center first queries the configuration center for user configuration information. Only if the configuration center contains the user configuration information will the registry center proceed with service registration. The registry center periodically sends heartbeat checks to clients, cleans up unresponsive user services, and maintains a list of user services for logged-in clients. The functions of the registry center can be found in [reference needed]. Figure 4 As shown.

[0089] The client is also used to encrypt communication data using the public and private key data when successfully registering the user service corresponding to the target user, and send the encrypted communication data to the client corresponding to the recipient for data communication.

[0090] Understandably, after a user successfully logs in and registers for the service, the sending user can send data to the receiving user's client through the client. Before sending data, the client needs to encrypt the user-input communication data using the retrieved public and private key data. The encrypted communication data is then sent to the corresponding receiving client for data communication. Before the sending user's client sends data and after the receiving user's client receives data, the client will store the data in a storage server. The client's functionality can be found in [reference needed]. Figure 5 As shown.

[0091] In this embodiment, the client is also used to obtain the input account and input password entered by the target user.

[0092] Understandably, users need to use an account and password to log in to the client. Only users with valid configuration information in the configuration center can log in. If a user's valid configuration information does not exist in the configuration center, it means the user is not an internal user configured by the administrator, is an ineligible user, is considered untrusted, and will not be able to log in to the client successfully. Specifically, when the target user opens the client and enters their account and password to log in, the client obtains the target user's entered account and password.

[0093] The client is also used to query the configuration center to see if the target user's user configuration information exists.

[0094] It should be understood that the client queries the configuration center to see if the target user's configuration information exists. The configuration center queries the database based on the account information pushed by the client. If the account's valid configuration information exists in the database, the configuration information exists; otherwise, it does not. The configuration center responds to the client: if the user configuration information exists, it means the user is an internal user configured by the administrator, a compliant user, and a trusted user, and the client can continue the login operation. If the user configuration information does not exist, it means the user is not an internal user configured by the administrator, a non-compliant user, and an untrusted user, and the client will terminate the login, resulting in login failure.

[0095] The client is further configured to, if user configuration information of the target user exists, determine whether the user account in the queried user configuration information is consistent with the input account, and determine whether the user password is consistent with the input password.

[0096] The client is further configured to perform a user login operation if the user account matches the input account and the user password matches the input password.

[0097] Understandably, if the target user's configuration information exists, the client queries the configuration center to verify the user's login password. The configuration center checks the username and password sent by the client. If the password for that username in the database matches the password sent by the client, the login password is correct; otherwise, it is incorrect. The configuration center responds to the client: if the user's login password is correct, the client verifies the password and allows the user to log in; otherwise, login is denied. If the client allows the user to log in, the user successfully logs in; otherwise, login fails.

[0098] In this embodiment, the registration center is also used to query the configuration center to see if the user configuration information of the target user exists.

[0099] It should be noted that after a user successfully logs in to the client, the client will apply to the registration center to register for user services. The registration center will maintain a list of user services. Only users with valid configuration information in the configuration center can register in the user service list. If the user account and other configuration information do not exist, it means that the user is not an internal user configured by the administrator, is an ineligible user, or is an untrusted user, and cannot successfully register in the user service list.

[0100] Specifically, a user needs to successfully log in to the client before the client will initiate a user service registration request to the registry center. The client requests the registration of a user service named the user account or user ID. After receiving the client's service registration request, the registry center will check whether the target user's user configuration information exists in the configuration center based on the user account.

[0101] The registration center is also used to generate user services based on the user configuration information of the target user if such user configuration information exists, and save the user services to the user service list to complete the user service registration operation for the target user.

[0102] Understandably, upon receiving a query request, the configuration center searches based on the user account information pushed by the registry. If the database contains valid configuration information for the account, the user configuration information exists; otherwise, it does not. The configuration center responds to the registry. If the user configuration information exists, it indicates that the user is an internal user configured by the administrator and is a compliant user, applying for compliant user service registration; otherwise, it indicates a non-compliant user service. If it is a compliant user service, the registry will maintain the user service in its user service list, and the user service registration is successful. If it is a non-compliant user service, the registry will refuse to maintain the user service in its user service list, and the user service registration fails.

[0103] The registration center is also used to periodically send online detection signals to the client.

[0104] It should be noted that the registry center uses an online detection mechanism (e.g., a heartbeat mechanism) to periodically send heartbeat checks to clients. If a client receives a heartbeat signal and responds, it proves that the user service is online, and the registry center will maintain that user service. If the registry center does not receive a response from the client, it determines that the client user may have logged off. After a certain period of time, once the client user is confirmed to be offline, the registry center removes the user service from the service list. Clients that have logged out cannot respond to registry center signals, and the registry center will remove the client user service from the service list.

[0105] Specifically, the registration center will only maintain a user service after it has been successfully registered with the registration center. The registration center will periodically send heartbeat detection signals to the client based on a heartbeat detection mechanism.

[0106] The client is also used to determine whether a user is online based on the user's login status. If the user is online, the client receives the online detection signal and sends an online feedback signal to the registration center.

[0107] It should be understood that the client determines whether a user is online based on their login status. If the user is online, the client will receive a heartbeat signal from the registry center; if the user is offline, the client will not receive a heartbeat signal. If the client receives a heartbeat signal, it will respond to the heartbeat; if it does not receive a heartbeat signal, it will not respond.

[0108] The registration center is also used to remove the user service corresponding to the client from the user service list if it does not receive the online feedback signal from the client within a preset time period.

[0109] Understandably, if the registry doesn't receive a heartbeat response, it assumes the client user may be offline. The client waits for the registry to initiate another heartbeat check to determine if the user is online. If online, the client receives the heartbeat signal from the registry; if offline, it doesn't. If the client receives the heartbeat signal, it responds; otherwise, it doesn't. If the registry receives a heartbeat response, it considers the client online and keeps the service in the service list. If it still doesn't receive a response, it confirms the user is offline and removes the service from the list. The registry periodically initiates heartbeat checks to the client and updates the service list based on the client's response.

[0110] In this embodiment, the management terminal manages user configuration information, while the configuration center stores user configuration information such as account names, passwords, and public / private key data. The client queries the configuration center for the target user's configuration information, performs a user login operation, and sends a service registration request to the registration center. Upon receiving the request, the registration center queries the configuration center for the target user's configuration information and registers the user service. The client encrypts the communication data using public / private key data and sends the encrypted communication data to the corresponding client of the receiving party for data communication. This embodiment's communication process utilizes the management terminal, registration center, and configuration center to ensure online compliance and trustworthiness for both communicating parties. User configuration information is stored in the configuration center only after the administrator applies for its creation on the management terminal. The configuration center stores user configuration information to ensure user compliance and trustworthiness, while the registration center's user service list stores user services to ensure user login and online presence. End-to-end encryption and decryption technology is used in the communication process to ensure data transmission security.

[0111] Based on the first embodiment of the above system, a second embodiment of the data security communication system of this application is proposed.

[0112] In this embodiment, the client is also used to periodically initiate service query requests to the registry center, receive user service information fed back by the registry center based on the service query requests, and save the user service information to the local user service list.

[0113] Understandably, the client periodically sends query requests to the registry center to retrieve and update its local user service list. This user service list is a list of user services for all users logged into the client. Specifically, the client periodically sends a query request to the registry center to retrieve the user service list; the registry center responds to the query request and returns the user service list; the client saves the user service list locally for easy access. The client will periodically send query requests to the registry center to retrieve the user service list and update its local user service list.

[0114] The client is also configured to identify the receiving client in the local user service list, initiate a new service query request to the registry center, receive the latest user service information fed back by the registry center based on the new service query request, and update the local user service list based on the latest user service information.

[0115] Understandably, logged-in clients can initiate communication with any other user in the local user service list, while logged-out clients cannot send or receive data. Because the local user service list is updated at intervals and cannot be guaranteed to be consistent with the user service list in the registry, the sending client needs to update the user service list from the registry after selecting a receiving client and verify the compliance of the receiving user through the configuration center.

[0116] Specifically, the sending user selects the receiving user from the client's local service list for communication. The sending client sends a request to the registry center to query the user service list. The registry center responds with the latest user service list, and the sending client updates its local user service list.

[0117] The client is also used to determine whether the user service corresponding to the receiving client exists in the updated local user service list.

[0118] It should be understood that the sending client determines whether the receiving user is online. If the receiving user service exists in the sending client's local user service list, it means the receiving user is online; if the receiving user service does not exist in the sending client's local user service list, it means the receiving user is offline.

[0119] The client is further configured to query the configuration center for the user configuration information corresponding to the receiving client if the updated local user service list contains a user service corresponding to the receiving client.

[0120] Understandably, if the updated local user service list contains the user service corresponding to the receiving client, i.e., the receiving user is online, the sending client will send a request to the configuration center to query the user configuration information.

[0121] The client is also configured to, if the configuration center contains user configuration information corresponding to the receiving client, encrypt the communication data using the public and private key data, and send the encrypted communication data to the receiving client for data communication.

[0122] It should be understood that the configuration center checks its database for valid user configuration information based on the recipient user information pushed by the sending client. If valid configuration information exists for the recipient user, the recipient user is compliant; otherwise, the recipient user is non-compliant. The configuration center responds to the sending client regarding the recipient user's compliance. If the recipient user is online and compliant, the sending client allows data transmission to the recipient user; if the recipient user is offline or non-compliant, the sending client refuses to transmit data. If the configuration center contains the corresponding user configuration information for the recipient client, the communication data is encrypted using public and private key data, and the encrypted communication data is sent to the recipient client for data communication.

[0123] In this embodiment, the data security communication system further includes a storage server.

[0124] It's worth noting that the data security communication system also includes a storage server to store the data sent and received by the client, enabling the storage and backup of user communication data files. The functions of the storage server can be found in [reference needed]. Figure 6 As shown.

[0125] The client is also used to query the configuration center for its own public and private key data and the receiver's public key data corresponding to the receiver client. The public and private key data includes its own public key and its own private key.

[0126] It should be noted that the sending user client performs security processing such as digital digest, encryption, and signing on the sent communication data. The encrypted communication data is uploaded to the storage server, and the encrypted and signed communication data is sent to the receiving user client. Specifically, sending user A enters communication data, "Data1" data file, into the client's chat box and sends the data to receiving user B's client. Sending user A's client queries the configuration center for receiving user B's public key data. At this point, sending user A possesses its own public key "PublicA", its own private key "PrivateA", and receiving user B's public key "PublicB".

[0127] The client is further configured to process the communication data input by the user using a message digest algorithm to obtain a digital digest, and to encrypt the communication data and the digital digest according to the public key data of the recipient to generate first encrypted data.

[0128] Understandably, sender user A's client uses Message-Digest Algorithm 5 (MD5) technology to process the original data file "Data1" to obtain a digital digest "Data1Digest1" corresponding to the hash value for data integrity verification. Sender user A's client then uses receiver user B's public key "PublicB" to encrypt the original data file "Data1" and the digital digest "Data1Digest1", generating the first encrypted data "Data1Private1".

[0129] The client is further configured to process the first encrypted data according to its own private key to obtain encrypted communication data, and send the encrypted communication data to the client corresponding to the receiver for data communication.

[0130] It should be understood that the sender, user A's, client uses the private key "PrivateA" to sign the first encrypted data "Data1Private1", generating the encrypted communication data "Data1Private1Sign1". The encrypted communication data "Data1Private1Sign1" is then sent to the receiver, user B's, client. This data transmission process references microservice communication, relying on a registry center and leveraging system load balancing and service discovery capabilities to achieve inter-service communication.

[0131] The client is further configured to encrypt the communication data according to its own public key, generate second encrypted data, and send the second encrypted data to the storage server for storage.

[0132] Understandably, the client uses its public key "PublicA" to encrypt the original data file "Data1", generating a second encrypted data file "Data1Private2". This second encrypted data "Data1Private2" is then uploaded to the storage server, where it is saved.

[0133] The storage server is used to store the second encrypted data.

[0134] It is worth noting that this embodiment includes a storage server for storing the data sent and received by the client, enabling the storage and backup of user communication data files. The aim is to ensure secure data storage and prevent data loss. Communication data is no longer stored within the electronic device's system. Before sending and after receiving data, the user client communicates with the storage server to upload the data files for storage. Data files will not be stolen or leaked due to system intrusion, nor will they be lost due to system malfunctions and reinstallations, software malfunctions and reinstallations, software data cleanup and migration operations, or switching terminal devices. Data files are uniformly stored on a designated storage server and managed according to enterprise network management and server management requirements, preventing data security issues caused by personal or external factors such as weak security awareness or insufficient security capabilities. The complete architecture of this application's data security communication system can be referenced. Figure 7 As shown.

[0135] It's worth noting that the overall process of the receiving client receiving data is also described here. The receiving client performs security processing on the received data, including signature verification, decryption, and integrity checks, obtaining the decrypted original data. This original data is then re-encrypted and uploaded to the storage server. The receiving client (user B) receives data sent by the sending client (user A) and processes the received encrypted data. The receiving client (user B) queries the configuration center for the sending client (user A)'s public key information. At this point, the receiving client (user B) possesses its own public key "PublicB", its own private key "PrivateB", and user A's public key "PublicA". The receiving client (user B) uses the sending client (user A)'s public key "PublicA" to verify the encrypted signature data "Data1Private1Sign1". If the verification is successful, the encrypted data "Data1Private1" is obtained; if the verification fails, it means the received data does not belong to the sending client (user A). Recipient user B's client uses the private key "PrivateB" to decrypt the encrypted data "Data1Private1". If decryption is successful, it obtains the original data file "Data1" and a digital digest "Data1Digest1". If decryption fails, it means the received data does not belong to recipient user B. Recipient user B's client uses MD5 technology to process the original data file "Data1" to obtain a digital digest "Data1Digest2". Recipient user B's client compares the generated digital digest "Data1Digest2" with the digital digest "Data1Digest1" generated by sender user A's client. If the comparison results match, it means the data has not been tampered with, and the original data file "Data1" is the complete content that sender user A wanted to send. If the comparison results do not match, it means the data file has been tampered with. Recipient user B's client uses the public key "PublicB" to encrypt the original data file "Data1", generating encrypted data "Data1Private3", and uploads it to the storage server, where the storage server saves the data. After the data undergoes signature verification, encryption / decryption verification, and data integrity checks, and is saved to the storage server, the receiving user B can use the data normally. The overall process of client-side data sending and receiving can be found in [reference needed]. Figure 8 .

[0136] In this embodiment, the client periodically sends query requests to the registration center to obtain and update its local user service list. This user service list is a list of user services for all users logged into the client. If the updated local user service list contains the recipient's user service, and the configuration center has valid recipient user configuration information, the sending client considers the recipient user to be a compliant online user and allows communication to be initiated with the recipient user. During communication, the sending client uses its own public and private key data and the recipient client's corresponding recipient public key data to perform security processing such as digital digest, encryption, and signing on the sent data content. The encrypted data content is uploaded to the storage server for storage, and the encrypted and signed data is sent to the recipient client.

[0137] Reference Figure 9 This application provides a data security communication system and a data security communication method. Figure 9 This is a flowchart illustrating the first embodiment of the data security communication method of this application. The data security communication method is applied to a data security communication system, which includes a management terminal, a configuration center, a registration center, and a client; the method includes steps S10 to S50:

[0138] Step S10: The management terminal manages user configuration information through the CRUD (Create, Read, Update, Delete) function interface of the configuration center.

[0139] Understandably, the management interface is primarily used to manage user account information, passwords, public and private keys, and other user configuration information. The management interface can query, add, modify, and delete user configuration information through an interface, and save this information to the configuration center. The functionality of the management interface can be found in [reference needed]. Figure 2 As shown, the specific process for managing user configuration information on the management terminal is as follows: the administrator successfully logs in to the management terminal; the administrator performs operations such as adding, deleting, modifying, and querying user configuration information through the management terminal page; the management terminal calls the function interface of the configuration center to create user configuration information such as account, password, and public / private keys; the configuration center saves user configuration information such as account, password, and public / private keys.

[0140] Step S20: The configuration center stores the user configuration information, which includes user account, user password, and public / private key data.

[0141] It should be understood that the configuration center is primarily used to create and store user account, password, public and private keys, and other configuration information, and to provide CRUD (Create, Read, Update, Delete) functions to external systems. The management console manages user configuration information through CRUD operations, while clients and the registry center retrieve user configuration information through query operations. User account and password data are used for client login, and public and private key data are used for end-to-end encryption during communication. The functionality of the configuration center can be found in [reference needed]. Figure 3As shown.

[0142] In step S30, the client queries the configuration center for the target user's user configuration information, performs a user login operation based on the user account and the user password, and sends a service registration request to the registration center.

[0143] It should be noted that the client can query the target user's configuration information from the configuration center and perform the user login operation based on the user's account and password. During the user login process, the client will query the configuration center for user configuration information. Only if the configuration center contains the user configuration information will the client continue with the login operation. After the user logs in, the client will register the user service with the registry center.

[0144] In step S40, when the registration center receives the service registration request from the client, it queries the configuration center for the user configuration information of the target user and registers the user service corresponding to the target user according to the user configuration information.

[0145] It should be understood that the registry center is used to register and discover client user services and maintain a list of user services for logged-in clients. After a user logs in, the client sends a service registration request to the registry center. The registry center first queries the configuration center for user configuration information. Only if the configuration center contains the user configuration information will the registry center proceed with service registration. The registry center periodically sends heartbeat checks to clients, cleans up unresponsive user services, and maintains a list of user services for logged-in clients. The functions of the registry center can be found in [reference needed]. Figure 4 As shown.

[0146] In step S50, when the client successfully registers the user service corresponding to the target user, it encrypts the communication data using the public and private key data and sends the encrypted communication data to the client corresponding to the recipient for data communication.

[0147] Understandably, after a user successfully logs in and registers for the service, the sending user can send data to the receiving user's client through the client. Before sending data, the client needs to encrypt the user-input communication data using the retrieved public and private key data. The encrypted communication data is then sent to the corresponding receiving client for data communication. Before the sending user's client sends data and after the receiving user's client receives data, the client will store the data in a storage server. The client's functionality can be found in [reference needed]. Figure 5 As shown.

[0148] In this embodiment, step S30 further includes steps S301 to S304:

[0149] Step S301: The client obtains the input account and input password entered by the target user.

[0150] Understandably, users need to use an account and password to log in to the client. Only users with valid configuration information in the configuration center can log in. If a user's valid configuration information does not exist in the configuration center, it means the user is not an internal user configured by the administrator, is an ineligible user, is considered untrusted, and will not be able to log in to the client successfully. Specifically, when the target user opens the client and enters their account and password to log in, the client obtains the target user's entered account and password.

[0151] In step S302, the client queries the configuration center to see if the user configuration information of the target user exists.

[0152] It should be understood that the client queries the configuration center to see if the target user's configuration information exists. The configuration center queries the database based on the account information pushed by the client. If the account's valid configuration information exists in the database, the configuration information exists; otherwise, it does not. The configuration center responds to the client: if the user configuration information exists, it means the user is an internal user configured by the administrator, a compliant user, and a trusted user, and the client can continue the login operation. If the user configuration information does not exist, it means the user is not an internal user configured by the administrator, a non-compliant user, and an untrusted user, and the client will terminate the login, resulting in login failure.

[0153] Step S303: If the client has user configuration information for the target user, it determines whether the user account in the queried user configuration information is consistent with the input account, and whether the user password is consistent with the input password.

[0154] In step S304, if the user account matches the input account and the user password matches the input password, the client performs a user login operation.

[0155] Understandably, if the target user's configuration information exists, the client queries the configuration center to verify the user's login password. The configuration center checks the username and password sent by the client. If the password for that username in the database matches the password sent by the client, the login password is correct; otherwise, it is incorrect. The configuration center responds to the client: if the user's login password is correct, the client verifies the password and allows the user to log in; otherwise, login is denied. If the client allows the user to log in, the user successfully logs in; otherwise, login fails.

[0156] In this embodiment, step S40 further includes steps S401 to S405:

[0157] Step S401: The registration center queries the configuration center to see if the user configuration information of the target user exists.

[0158] It should be noted that after a user successfully logs in to the client, the client will apply to the registration center to register for user services. The registration center will maintain a list of user services. Only users with valid configuration information in the configuration center can register in the user service list. If the user account and other configuration information do not exist, it means that the user is not an internal user configured by the administrator, is an ineligible user, or is an untrusted user, and cannot successfully register in the user service list.

[0159] Specifically, a user needs to successfully log in to the client before the client will initiate a user service registration request to the registry center. The client requests the registration of a user service named the user account or user ID. After receiving the client's service registration request, the registry center will check whether the target user's user configuration information exists in the configuration center based on the user account.

[0160] In step S402, if the registration center has the user configuration information of the target user, it generates a user service based on the user configuration information of the target user and saves the user service to the user service list, thus completing the user service registration operation for the target user.

[0161] Understandably, upon receiving a query request, the configuration center searches based on the user account information pushed by the registry. If the database contains valid configuration information for the account, the user configuration information exists; otherwise, it does not. The configuration center responds to the registry. If the user configuration information exists, it indicates that the user is an internal user configured by the administrator and is a compliant user, applying for compliant user service registration; otherwise, it indicates a non-compliant user service. If it is a compliant user service, the registry will maintain the user service in its user service list, and the user service registration is successful. If it is a non-compliant user service, the registry will refuse to maintain the user service in its user service list, and the user service registration fails.

[0162] In step S403, the registration center periodically sends online detection signals to the client.

[0163] It should be noted that the registry center uses an online detection mechanism (e.g., a heartbeat mechanism) to periodically send heartbeat checks to clients. If a client receives a heartbeat signal and responds, it proves that the user service is online, and the registry center will maintain that user service. If the registry center does not receive a response from the client, it determines that the client user may have logged off. After a certain period of time, once the client user is confirmed to be offline, the registry center removes the user service from the service list. Clients that have logged out cannot respond to registry center signals, and the registry center will remove the client user service from the service list.

[0164] Specifically, the registration center will only maintain a user service after it has been successfully registered with the registration center. The registration center will periodically send heartbeat detection signals to the client based on a heartbeat detection mechanism.

[0165] In step S404, the client determines whether the user is online based on the user's login status. If the user is online, the client receives the online detection signal and sends an online feedback signal to the registration center.

[0166] It should be understood that the client determines whether a user is online based on their login status. If the user is online, the client will receive a heartbeat signal from the registry center; if the user is offline, the client will not receive a heartbeat signal. If the client receives a heartbeat signal, it will respond to the heartbeat; if it does not receive a heartbeat signal, it will not respond.

[0167] In step S405, if the registration center does not receive the online feedback signal from the client within a preset time period, it removes the user service corresponding to the client from the user service list.

[0168] Understandably, if the registry doesn't receive a heartbeat response, it assumes the client user may be offline. The client waits for the registry to initiate another heartbeat check to determine if the user is online. If online, the client receives the heartbeat signal from the registry; if offline, it doesn't. If the client receives the heartbeat signal, it responds; otherwise, it doesn't. If the registry receives a heartbeat response, it considers the client online and keeps the service in the service list. If it still doesn't receive a response, it confirms the user is offline and removes the service from the list. The registry periodically initiates heartbeat checks to the client and updates the service list based on the client's response.

[0169] In this embodiment, the management terminal manages user configuration information, while the configuration center stores user configuration information such as account names, passwords, and public / private key data. The client queries the configuration center for the target user's configuration information, performs a user login operation, and sends a service registration request to the registration center. Upon receiving the request, the registration center queries the configuration center for the target user's configuration information and registers the user service. The client encrypts the communication data using public / private key data and sends the encrypted communication data to the corresponding client of the receiving party for data communication. This embodiment's communication process utilizes the management terminal, registration center, and configuration center to ensure online compliance and trustworthiness for both communicating parties. User configuration information is stored in the configuration center only after the administrator applies for its creation on the management terminal. The configuration center stores user configuration information to ensure user compliance and trustworthiness, while the registration center's user service list stores user services to ensure user login and online presence. End-to-end encryption and decryption technology is used in the communication process to ensure data transmission security.

[0170] Reference Figure 10 , Figure 10 This is a flowchart illustrating the second embodiment of the data security communication method of this application, based on the above. Figure 9 The illustrated embodiment presents a second embodiment of the data security communication method of this application.

[0171] In this embodiment, step S50 further includes steps S501 to S505:

[0172] In step S501, the client periodically initiates service query requests to the registration center, receives user service information from the registration center based on the service query requests, and saves the user service information to the local user service list.

[0173] Understandably, the client periodically sends query requests to the registry center to retrieve and update its local user service list. This user service list is a list of user services for all users logged into the client. Specifically, the client periodically sends a query request to the registry center to retrieve the user service list; the registry center responds to the query request and returns the user service list; the client saves the user service list locally for easy access. The client will periodically send query requests to the registry center to retrieve the user service list and update its local user service list.

[0174] In step S502, the client determines the receiving client in the local user service list, initiates a new service query request to the registry center, receives the latest user service information from the registry center based on the new service query request, and updates the local user service list based on the latest user service information.

[0175] Understandably, logged-in clients can initiate communication with any other user in the local user service list, while logged-out clients cannot send or receive data. Because the local user service list is updated at intervals and cannot be guaranteed to be consistent with the user service list in the registry, the sending client needs to update the user service list from the registry after selecting a receiving client and verify the compliance of the receiving user through the configuration center.

[0176] Specifically, the sending user selects the receiving user from the client's local service list for communication. The sending client sends a request to the registry center to query the user service list. The registry center responds with the latest user service list, and the sending client updates its local user service list.

[0177] Step S503: The client determines whether the user service corresponding to the receiving client exists in the updated local user service list.

[0178] It should be understood that the sending client determines whether the receiving user is online. If the receiving user service exists in the sending client's local user service list, it means the receiving user is online; if the receiving user service does not exist in the sending client's local user service list, it means the receiving user is offline.

[0179] Step S504: If the updated local user service list contains a user service corresponding to the receiving client, the client queries the configuration center for the user configuration information corresponding to the receiving client.

[0180] Understandably, if the updated local user service list contains the user service corresponding to the receiving client, i.e., the receiving user is online, the sending client will send a request to the configuration center to query the user configuration information.

[0181] In step S505, if the configuration center contains user configuration information corresponding to the receiving client, the client encrypts the communication data using the public and private key data and sends the encrypted communication data to the receiving client for data communication.

[0182] It should be understood that the configuration center checks its database for valid user configuration information based on the recipient user information pushed by the sending client. If valid configuration information exists for the recipient user, the recipient user is compliant; otherwise, the recipient user is non-compliant. The configuration center responds to the sending client regarding the recipient user's compliance. If the recipient user is online and compliant, the sending client allows data transmission to the recipient user; if the recipient user is offline or non-compliant, the sending client refuses to transmit data. If the configuration center contains the corresponding user configuration information for the recipient client, the communication data is encrypted using public and private key data, and the encrypted communication data is sent to the recipient client for data communication.

[0183] In this embodiment, the data security communication system further includes a storage server.

[0184] It's worth noting that the data security communication system also includes a storage server to store the data sent and received by the client, enabling the storage and backup of user communication data files. The functions of the storage server can be found in [reference needed]. Figure 6 As shown.

[0185] Step S505 further includes steps S5051 to S5055:

[0186] In step S5051, the client queries the configuration center for its own public and private key data and the receiver's public key data corresponding to the receiver client. The public and private key data includes the client's own public key and its own private key.

[0187] It should be noted that the sending user client performs security processing such as digital digest, encryption, and signing on the sent communication data. The encrypted communication data is uploaded to the storage server, and the encrypted and signed communication data is sent to the receiving user client. Specifically, sending user A enters communication data, "Data1" data file, into the client's chat box and sends the data to receiving user B's client. Sending user A's client queries the configuration center for receiving user B's public key data. At this point, sending user A possesses its own public key "PublicA", its own private key "PrivateA", and receiving user B's public key "PublicB".

[0188] In step S5052, the client processes the communication data input by the user using a message digest algorithm to obtain a digital digest, and encrypts the communication data and the digital digest according to the public key data of the receiver to generate first encrypted data.

[0189] Understandably, sender user A's client uses Message-Digest Algorithm 5 (MD5) technology to process the original data file "Data1" to obtain a digital digest "Data1Digest1" corresponding to the hash value for data integrity verification. Sender user A's client then uses receiver user B's public key "PublicB" to encrypt the original data file "Data1" and the digital digest "Data1Digest1", generating the first encrypted data "Data1Private1".

[0190] In step S5053, the client processes the first encrypted data according to its own private key to obtain encrypted communication data, and sends the encrypted communication data to the client corresponding to the receiver for data communication.

[0191] It should be understood that the sender, user A's, client uses the private key "PrivateA" to sign the first encrypted data "Data1Private1", generating the encrypted communication data "Data1Private1Sign1". The encrypted communication data "Data1Private1Sign1" is then sent to the receiver, user B's, client. This data transmission process references microservice communication, relying on a registry center and leveraging system load balancing and service discovery capabilities to achieve inter-service communication.

[0192] In step S5054, the client encrypts the communication data according to its own public key to generate second encrypted data, and sends the second encrypted data to the storage server for storage.

[0193] Understandably, the client uses its public key "PublicA" to encrypt the original data file "Data1", generating a second encrypted data file "Data1Private2". This second encrypted data "Data1Private2" is then uploaded to the storage server, where it is saved.

[0194] Step S5055: The storage server stores the second encrypted data.

[0195] It is worth noting that this embodiment includes a storage server for storing the data sent and received by the client, enabling the storage and backup of user communication data files. The aim is to ensure secure data storage and prevent data loss. Communication data is no longer stored within the electronic device's system. Before sending and after receiving data, the user client communicates with the storage server to upload the data files for storage. Data files will not be stolen or leaked due to system intrusion, nor will they be lost due to system malfunctions and reinstallations, software malfunctions and reinstallations, software data cleanup and migration operations, or switching terminal devices. Data files are uniformly stored on a designated storage server and managed according to enterprise network management and server management requirements, preventing data security issues caused by personal or external factors such as weak security awareness or insufficient security capabilities. The complete architecture of this application's data security communication system can be referenced. Figure 7 As shown.

[0196] It's worth noting that the overall process of the receiving client receiving data is also described here. The receiving client performs security processing on the received data, including signature verification, decryption, and integrity checks, obtaining the decrypted original data. This original data is then re-encrypted and uploaded to the storage server. The receiving client (user B) receives data sent by the sending client (user A) and processes the received encrypted data. The receiving client (user B) queries the configuration center for the sending client (user A)'s public key information. At this point, the receiving client (user B) possesses its own public key "PublicB", its own private key "PrivateB", and user A's public key "PublicA". The receiving client (user B) uses the sending client (user A)'s public key "PublicA" to verify the encrypted signature data "Data1Private1Sign1". If the verification is successful, the encrypted data "Data1Private1" is obtained; if the verification fails, it means the received data does not belong to the sending client (user A). Recipient user B's client uses the private key "PrivateB" to decrypt the encrypted data "Data1Private1". If decryption is successful, it obtains the original data file "Data1" and a digital digest "Data1Digest1". If decryption fails, it means the received data does not belong to recipient user B. Recipient user B's client uses MD5 technology to process the original data file "Data1" to obtain a digital digest "Data1Digest2". Recipient user B's client compares the generated digital digest "Data1Digest2" with the digital digest "Data1Digest1" generated by sender user A's client. If the comparison results match, it means the data has not been tampered with, and the original data file "Data1" is the complete content that sender user A wanted to send. If the comparison results do not match, it means the data file has been tampered with. Recipient user B's client uses the public key "PublicB" to encrypt the original data file "Data1", generating encrypted data "Data1Private3", and uploads it to the storage server, where the storage server saves the data. After the data undergoes signature verification, encryption / decryption verification, and data integrity checks, and is saved to the storage server, the receiving user B can use the data normally. The overall process of client-side data sending and receiving can be found in [reference needed]. Figure 8 .

[0197] In this embodiment, the client periodically sends query requests to the registration center to obtain and update its local user service list. This user service list is a list of user services for all users logged into the client. If the updated local user service list contains the recipient's user service, and the configuration center has valid recipient user configuration information, the sending client considers the recipient user to be a compliant online user and allows communication to be initiated with the recipient user. During communication, the sending client uses its own public and private key data and the recipient client's corresponding recipient public key data to perform security processing such as digital digest, encryption, and signing on the sent data content. The encrypted data content is uploaded to the storage server for storage, and the encrypted and signed data is sent to the recipient client.

[0198] It is worth noting that the solution in this application has the following advantages:

[0199] 1. Ensure that online communication users are compliant and trustworthy. User configuration information is only saved in the configuration center after an administrator requests its creation on the management terminal. Only users whose configuration information exists in the configuration center are allowed to log in to the client.

[0200] 2. Ensure secure data reception. Users can only use the communication functions of sending and receiving data after successfully logging into the client. That is, data can only be received when the receiving user is logged in and online. Data cannot be received when the user is offline, thus preventing scenarios where data files are successfully received but the receiving user is not online.

[0201] 3. Secure and reliable communication process. Based on the commonly used concepts of registry center, service discovery, and load balancing, the system finds the target user's host IP and service name through the registry center, achieves inter-service communication through service discovery and load balancing, and ensures communication security through the use of encryption / decryption, signature verification, and integrity checks.

[0202] 4. Secure data storage, less prone to loss. Communication data is no longer stored in the electronic device's system. Before sending and after receiving data, the user client communicates with the storage server to upload data files for safekeeping. Data files will not be stolen or leaked due to system intrusion, nor will they be lost due to system malfunctions and reinstallations, software malfunctions and reinstallations, software data cleanup and migration operations, or switching terminal devices.

[0203] 5. Unified Data Security Management. Data files are stored uniformly on designated storage servers and managed in accordance with enterprise network management and server management requirements to prevent data security issues from occurring due to personal reasons or external factors such as weak security awareness or insufficient security capabilities.

[0204] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the data security communication system or method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0205] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A data security communication system, characterized in that, The data security communication system includes a management terminal, a configuration center, a registration center, and a client. The management terminal is used to manage user configuration information through the CRUD (Create, Read, Update, Delete) function interface of the configuration center. The configuration center is used to store the user configuration information, which includes user account, user password and public / private key data; The client is used to query the user configuration information of the target user from the configuration center, perform user login operation according to the user account and the user password, and send a service registration request to the registration center; The registration center is used to query the user configuration information of the target user from the configuration center when it receives the service registration request from the client, and register the user service corresponding to the target user according to the user configuration information; The client is also used to encrypt communication data using the public and private key data when successfully registering the user service corresponding to the target user, and send the encrypted communication data to the client corresponding to the recipient for data communication.

2. The system as described in claim 1, characterized in that, The client is also used to receive the target user's input account and password; The client is also used to query the configuration center to see if the target user's user configuration information exists; The client is further configured to, if user configuration information of the target user exists, determine whether the user account in the queried user configuration information is consistent with the input account, and determine whether the user password is consistent with the input password; The client is further configured to perform a user login operation if the user account matches the input account and the user password matches the input password.

3. The system as described in claim 1, characterized in that, The registration center is also used to query the configuration center to see if the user configuration information of the target user exists; The registration center is also used to generate a user service based on the user configuration information of the target user if the user configuration information of the target user exists, and save the user service to the user service list to complete the user service registration operation of the target user; The registration center is also used to periodically send online detection signals to the client; The client is also used to determine whether a user is online based on the user's login status. If the user is online, the client receives the online detection signal and sends an online feedback signal to the registration center. The registration center is also used to remove the user service corresponding to the client from the user service list if it does not receive the online feedback signal from the client within a preset time period.

4. The system as described in claim 1, characterized in that, The client is also used to periodically send service query requests to the registry center, receive user service information fed back by the registry center based on the service query requests, and save the user service information to the local user service list; The client is also configured to determine the receiving client in the local user service list, initiate a new service query request to the registry center, receive the latest user service information fed back by the registry center based on the new service query request, and update the local user service list based on the latest user service information. The client is also used to determine whether the user service corresponding to the receiving client exists in the updated local user service list; The client is also configured to query the configuration center for the user configuration information corresponding to the receiving client if the updated local user service list contains a user service corresponding to the receiving client. The client is also configured to, if the configuration center contains user configuration information corresponding to the receiving client, encrypt the communication data using the public and private key data, and send the encrypted communication data to the receiving client for data communication.

5. The system as described in claim 4, characterized in that, The data security communication system also includes a storage server; The client is also used to query the configuration center for its own public and private key data and the receiver's public key data corresponding to the receiver client. The public and private key data includes its own public key and its own private key. The client is also configured to process the communication data input by the user using a message digest algorithm to obtain a digital digest, and to encrypt the communication data and the digital digest according to the public key data of the recipient to generate first encrypted data; The client is further configured to process the first encrypted data according to its own private key to obtain encrypted communication data, and send the encrypted communication data to the client corresponding to the receiver for data communication; The client is also configured to encrypt the communication data according to its own public key, generate second encrypted data, and send the second encrypted data to the storage server for storage; The storage server is used to store the second encrypted data.

6. A data security communication method, characterized in that, The method is applied to a data security communication system, which includes a management terminal, a configuration center, a registration center, and a client; the method includes: The management terminal manages user configuration information through the CRUD (Create, Read, Update, Delete) function interface of the configuration center. The configuration center stores the user configuration information, which includes user account, user password, and public / private key data. The client queries the configuration center for the target user's user configuration information, performs a user login operation based on the user account and the user password, and sends a service registration request to the registration center. When the registration center receives the service registration request from the client, it queries the configuration center for the user configuration information of the target user and registers the user service corresponding to the target user according to the user configuration information. When the client successfully registers the user service corresponding to the target user, it encrypts the communication data using the public and private key data and sends the encrypted communication data to the client corresponding to the recipient for data communication.

7. The method as described in claim 6, characterized in that, The steps of querying the target user's user configuration information from the configuration center and performing user login operations based on the user account and the user password include: The client receives the target user's username and password. The client queries the configuration center to see if the target user's user configuration information exists. If the client has user configuration information for the target user, it determines whether the user account in the queried user configuration information is consistent with the input account, and whether the user password is consistent with the input password. If the user account matches the entered account and the user password matches the entered password, the client will perform a user login operation.

8. The method as described in claim 6, characterized in that, The step of querying the user configuration information of the target user from the configuration center when receiving the service registration request from the client, and registering the user service corresponding to the target user according to the user configuration information, includes: The registration center queries the configuration center to see if the user configuration information of the target user exists. If the registration center has the user configuration information of the target user, it generates a user service based on the user configuration information of the target user, saves the user service to the user service list, and completes the user service registration operation of the target user. The registration center periodically sends online detection signals to the client. The client determines whether a user is online based on the user's login status. If the user is online, the client receives the online detection signal and sends an online feedback signal to the registration center. If the registration center does not receive the online feedback signal from the client within a preset time period, it will remove the user service corresponding to the client from the user service list.

9. The method as described in claim 6, characterized in that, The step of encrypting communication data using the public and private key data and sending the encrypted communication data to the client corresponding to the recipient for data communication when the user service corresponding to the target user is successfully registered includes: The client periodically sends service query requests to the registry center, receives user service information from the registry center based on the service query requests, and saves the user service information to the local user service list. The client identifies the receiving client in the local user service list, initiates a new service query request to the registry center, receives the latest user service information from the registry center based on the new service query request, and updates the local user service list based on the latest user service information. The client determines whether the user service corresponding to the receiving client exists in the updated local user service list; If the updated local user service list contains a user service corresponding to the receiving client, the client queries the configuration center for the user configuration information corresponding to the receiving client. If the configuration center contains user configuration information corresponding to the receiving client, the client encrypts the communication data using the public and private key data and sends the encrypted communication data to the receiving client for data communication.

10. The method as described in claim 9, characterized in that, The data security communication system also includes a storage server; The step of encrypting the communication data using the public and private key data and sending the encrypted communication data to the receiving client for data communication includes: The client queries the configuration center for its own public and private key data and the receiver's public key data corresponding to the receiver client. The public and private key data includes the client's own public key and its own private key. The client processes the communication data input by the user using a message digest algorithm to obtain a digital digest, and encrypts the communication data and the digital digest according to the public key data of the recipient to generate first encrypted data. The client processes the first encrypted data according to its own private key to obtain encrypted communication data, and sends the encrypted communication data to the client corresponding to the receiver for data communication. The client encrypts the communication data using its own public key to generate second encrypted data, and sends the second encrypted data to the storage server for storage; The storage server stores the second encrypted data.

Images