A power grid design file cross-domain layered encapsulation encryption transmission method and system

Abstract

The application provides a power grid design file cross-network domain layered packaging encryption transmission method and system, belonging to the technical field of file safe transmission. The scheme reads the power grid design file, completes layered packaging according to the metadata specification of two types of archiving modes, namely volume and single piece, and constructs an archiving data package containing an online tar archiving information package and an offline EEP packaging package; based on the SM3 hash algorithm of the national secret, a three-level layered digest is generated to realize file integrity hierarchical verification, and the SM2 asymmetric signature algorithm is used to complete source identity authentication and message tamper-proofing verification to generate an external network preliminary review result; then the verified archiving package is unidirectionally transferred to the internal network, and the internal network carries out file analysis and digest recalculation for secondary verification again; finally, according to the internal network verification result, the file is stored in the database, and the archiving transfer state and the final result are returned to the external network for closed-loop output. The application relies on the national secret layered verification and the internal and external network double auditing mechanism, can accurately locate the tampering node, and completely eliminate illegal file intrusion into the internal network.

Description

Technical Field

[0001] This application relates to the field of secure document transmission technology, and in particular to a method and system for cross-domain layered encapsulation and encrypted transmission of power grid design documents. Background Technology

[0002] The power grid company's network is divided into an external network isolation zone (DMZ) and an internal network data center zone (IDC) according to security levels. The two zones implement a dual physical and logical isolation strategy, prohibiting direct network access. All archive data must be transferred bidirectionally between structured metadata and unstructured drawing files through a dedicated internal and external network data exchange platform.

[0003] There are two main existing methods for transferring archives. One is an offline EEP-encapsulated CD / USB flash drive transfer method. This method only generates offline standard EEP (Electronic Records Encapsulation Package) files, lacks a standardized online transmission archive structure, and relies entirely on manual offline transfer. This method suffers from drawbacks such as low efficiency in large-scale power grid design archive transfers due to manual operation, a complete disconnect between offline encapsulation logic and online transmission verification logic, and inability to integrate with asynchronous archiving processes on the external network. The other method is a standard SFTP (SSH File Transfer Protocol) single-file online transfer method. This method directly uploads design files such as PDFs and DWG files, using MD5 (Message-Digest Algorithm 5) non-national cryptographic digests and SSL (Secure Sockets Layer) encryption. However, due to the lack of a layered encapsulation structure, it lacks a standardized archive directory index and metadata XML (Extensible Markup) metadata. The Extensible Markup Language (Extensible Markup Language) does not meet the DA / T48 industry standard, and the archiving system cannot automatically complete the four-property checks; it only performs a single-level summary on drawing files, without distinguishing the risks of metadata tampering, transmission packet tampering, and interface request forgery, resulting in a single level of security verification; it adopts a synchronous transmission processing mode, and the archiving of complete sets of large-scale power grid files is prone to interface timeouts. When the archiving verification fails partially, it only discards abnormal files and retains normal data, resulting in incomplete file archives; repeated calls to the archiving interface will generate multiple duplicate archives, and file change archiving only supports incremental modifications, which cannot completely cover the old version of file data; metadata and drawing files are mixed and synchronized, resulting in low efficiency in cross-network exchange and easy data synchronization errors.

[0004] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the Invention

[0005] The main purpose of this application is to propose a method and system for cross-network domain layered encapsulation and encrypted transmission of power grid design documents, aiming to improve the stability, security and transmission efficiency of cross-network document transmission.

[0006] To achieve the above objectives, one aspect of this application proposes a method for cross-domain layered encapsulation and encrypted transmission of power grid design documents, the method comprising: Read the power grid design documents and encapsulate them in layers according to the metadata encapsulation rules of volume archiving mode and single-item archiving mode to build an archive information package. The archive information package includes an online tar archive information package and an offline EEP encapsulation package. The archived information packet is subjected to layered verification based on the SM3 hash algorithm (a national cryptographic standard) to generate a layered digest, and digital signature verification is performed by combining the SM2 asymmetric encrypted message signature algorithm to obtain the signature verification result. For archived information packets that have passed the signature verification, the archived request acceptance verification is performed, and the successfully accepted archived information packets are transferred to the intranet. The archived information package is parsed and verified through the intranet, triggering the archived information package to be added to the database, and the archived information is synchronously transmitted to the external network, outputting the file archived transmission result.

[0007] Preferably, an archive package directory index file is generated according to different archiving modes, and the fixed root tag of the archive package directory index file is <archive directory>; when it is a volume archive mode, a <file> node is configured under <archive directory>, and multiple <file> nodes are attached under the <file> node; when it is a single-item archive mode, only a single <file> node is configured under <archive directory>; the required parameters configured for each node include an integer sequence number, a metadata path in XML relative path format, and an electronic file path. In the case of multiple drawings, the electronic file path is separated by English commas, and all paths use the Linux separator.

[0008] Preferably, the archived information packet is subjected to layered verification based on the SM3 hash algorithm (a national cryptographic standard) to generate a layered digest, and digital signature verification is performed in combination with the SM2 asymmetric encrypted message signature algorithm to obtain the signature verification result, including: Extract the drawing files and metadata from the archived information package; Based on the national cryptographic SM3 hash algorithm, hierarchical digests are calculated for the drawing file, the metadata and the archive information package respectively to obtain the drawing digest, metadata digest and archive package digest; The archive package summary is concatenated with the unique request number and unique identifier of the business system to generate the original string to be signed; The original string to be signed is digitally signed based on the SM2 private key to generate binary original signature data. The binary raw signature data is encoded and converted to generate an encoded signature string in string format; Summarize the drawing summary, the metadata summary, the archive package summary, and the coded signature string to generate a summary verification result; Based on the encoded signature string, the archive packet digest, the unique request number of the business system, and the unique identifier of the business system, the archive information packet with the digest verification passed is restored to the original string, and the original string is reverse-verified based on the SM2 public key to obtain the verification result.

[0009] Preferably, during layered verification, the offline EEP package is verified based on a carrier digest algorithm, including: Filter the metadata encapsulation files with the .eep extension within the offline EEP encapsulation package directory; The metadata encapsulation files are sorted according to their storage space usage to obtain a sorted list; Iterate through and calculate the national cryptographic digest SM3 of the metadata encapsulation files in the sorted list, and concatenate them sequentially to generate the total string; Perform an SM3 hash operation on the total string to obtain the global digest of the carrier.

[0010] Preferably, the process involves verifying the archiving request acceptance of the archived information package that has passed the signature verification, and then transferring the successfully accepted archived information package to the intranet, including: Upload the archived information package that has passed the signature verification and initiate an archived request by calling the archived acceptance interface; The archive information packet that initiates the archive request is subjected to security verification to obtain a security verification result. The security verification includes idempotency verification, file existence verification, SM2 signature verification, and archive directory structure verification. If the security verification result is unsatisfactory, the archiving request will be rejected; If the security verification result is qualified, the task information is temporarily stored and a successful acceptance response is returned. The successfully accepted archived information packet is then transferred to the intranet.

[0011] Preferably, when transferring the successfully accepted archived information package to the intranet, a dual-channel transmission system is built based on the isolation transfer gateway to transfer files between the intranet and the external network. The dual channels include a one-way unstructured file exchange channel and a two-way structured data exchange channel. The unstructured file exchange channel is used to transfer the archived information package from the external network to the intranet in a one-way synchronous manner. The structured data exchange channel is used for two-way transmission of the archived acceptance task list and the real-time processing status data of the archived files.

[0012] Preferably, the process of parsing and verifying the archived information package via the intranet to trigger the storage of the archived information package includes: The archived information package is decompressed and split through the intranet to restore the original archive structure. The decompressed file digest is calculated layer by layer based on the original file structure. The decompressed file digest is compared with the original digest of the archived information package to obtain the parsing verification result; If the parsing and verification results are satisfactory, the data will be written into the intranet archive business database according to the association mapping relationship between the case file and the drawings.

[0013] Preferably, when the archived information package is entered into the database on the intranet, if the parsing and verification result is unqualified, the entire package transaction rollback mechanism is immediately triggered to delete all data and records of the current archived information package and mark it as a failure of this archiving task.

[0014] To achieve the above objectives, this application also proposes a method and system for cross-domain layered encapsulation and encrypted transmission of power grid design documents. The system includes an external network business server unit, an external network isolation zone archive service unit, an internal and external network data exchange platform, and an internal network archive processing server unit. The external network service server unit is used to read power grid design documents and perform layered encapsulation according to the metadata encapsulation rules of volume archiving mode and single-item archiving mode to construct archived information packages; it is also used to generate layered digests based on the national cryptographic SM3 hash algorithm to perform layered verification of the archived information packages, and combine the SM2 asymmetric encrypted message signature algorithm to perform digital signature verification to obtain the signature verification result. The external network isolation zone archive service unit is used to accept and verify the archive request of the archived information package that has passed the signature verification. The internal and external network data exchange platform is used to transfer the successfully accepted archived information packets to the internal network; it is also used to synchronize the file archiving status information of the internal network to the external network. The intranet archive processing server unit is used to parse and verify the archive information package, trigger the archive information package to be stored in the database, and output the file archive transmission result.

[0015] To achieve the above objectives, this application also proposes an electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0016] To achieve the above objectives, this application also proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0017] To achieve the above objectives, this application also proposes a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0018] This application provides a method and system for cross-domain layered encapsulation and encrypted transmission of power grid design documents. This solution reads power grid design drawing files and packages them layered according to two industry-standard metadata encapsulation specifications: volume archiving mode and single-item archiving mode. This generates an archive information package containing online tar archive information packages and offline EEP encapsulation packages. Based on the archiving mode, it automatically matches archiving elements such as file level, drawing ownership, project attributes, and version information, eliminating the need for manual and repeated arrangement of the archive catalog. It unifies the power grid engineering archive format, avoiding problems such as chaotic archive structures across different projects and incompatibility between internal network archive systems. The online tar archive information package uniformly compresses and encapsulates drawing entity files and metadata XML, suitable for batch streaming transmission between internal and external network channels. Compression reduces transmission volume and improves cross-network transmission speed. The offline EEP encapsulation package solidifies complete archive metadata, drawing indexes, and permission information, allowing for offline archiving and backup without the online system, meeting the compliance requirements for long-term archiving and offline transfer of power grid archives.

[0019] The SM3 hash algorithm (a national cryptographic standard) is used to perform three-level hierarchical digest calculations on archived packages to achieve integrity verification. Combined with the SM2 asymmetric signature algorithm, message identity authentication and anti-tampering verification are completed, generating verification results. By generating drawing digests, metadata digests, and archived package digests, fine-grained tampering anomalies in drawings, metadata, and archived packages can be accurately located. Compared to traditional single hash verification, which can only determine overall anomalies and cannot distinguish the location of tampering, the efficiency of fault diagnosis is greatly improved. The archived serial number, business system identifier, and general package global digest are concatenated and signed with the business party's SM2 private key. Verification is performed using the public key in the external network isolation zone. This confirms that the archived application originates from an authorized business system, preventing hackers from forging archived requests, tampering with request messages, and uploading malicious files, thus meeting the security access control requirements of the power network.

[0020] A one-way transfer mechanism is adopted, allowing only compliant archived files from the external network to be pushed to the internal network. Internal network production data and confidential files cannot flow back to the external network, completely avoiding the risk of leakage of core power grid design data, aligning with the strong isolation security strategy of the power grid's internal and external networks. The external network completes basic compliance, identity, and signature verification, while the internal network recalculates the three-layer digest and verifies the directory structure and metadata compliance. This can intercept security risks caused by link eavesdropping, data packet tampering, and file loss during cross-network transmission, preventing abnormal files from flowing into the internal network database. Files are compressed and packaged for asynchronous transmission, no longer relying on HTTP synchronous interfaces to handle the transmission of ultra-large drawing files. This solves the problems of link congestion, request timeouts, and transmission interruptions when archiving large batches of DWG drawings, and supports nighttime batch background transfers without consuming daytime business bandwidth.

[0021] Based on the internal network's parsing and verification results, the system handles branch processing. If verification passes, the archive is officially entered into the database, along with drawings, metadata, and security verification parameters. Summary data can be retrieved at any time for subsequent access and borrowing to re-verify completeness. If verification fails, a full-package transaction rollback is automatically triggered, clearing any abnormal archive files temporarily cached on the internal network. This prevents corrupted or invalid junk data from occupying internal network storage, ensuring a clean and standardized internal archive database. The internal network synchronizes the status of archiving in progress, successful archiving, failed archiving, and specific reasons for failure to the external network business end, allowing business personnel to view the workflow in real time. Simultaneously, the external network retains complete verification and signature logs, summary records, and transmission sequences, forming a full-link audit ledger to meet the needs of archive auditing, security traceability, and problem review. It supports batch packaging and transfer of multiple files, batch entry into the database, and batch status queries, adapting to scenarios where large quantities of design drawings are centrally archived in power grid infrastructure projects, significantly reducing operation and maintenance costs. Attached Figure Description

[0022] Figure 1 This is a schematic diagram illustrating the steps of a method for cross-domain layered encapsulation and encrypted transmission of power grid design documents, as provided in an embodiment of this application. Figure 2 This is an overall interactive architecture diagram of a cross-domain layered encapsulation and encrypted transmission system for power grid design documents, provided in an embodiment of this application. Figure 3 This is a flowchart of the asynchronous cross-network archiving timing process in the third stage of an embodiment of this application; Figure 4 This is a hierarchical structure diagram of the archive package for two archiving modes in this application embodiment; Figure 5 This is a flowchart illustrating the national cryptographic layered digest and signature calculation process in an embodiment of this application. Figure 6 This is a flowchart of the unified online and offline national cryptographic summary generation algorithm of this application embodiment; Figure 7 This is a curve comparing the total time required for archiving power grid engineering documents throughout the entire process; Figure 8 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements.

[0024] It is understood that the terms “first,” “second,” etc., used in this application may be used herein to describe various concepts, but unless otherwise stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the words “if,” “when,” or “in response to a determination” as used herein may be interpreted as “when…” or “when…” or “in response to a determination.”

[0025] As used in this application, the terms "at least one", "multiple", "each", "any", etc., "at least one" includes one, two or more, "multiple" includes two or more, "each" refers to each of the corresponding multiples, and "any" refers to any one of the multiples.

[0026] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0027] Before providing a detailed description of the embodiments of this application, some of the nouns and terms used in the embodiments of this application will be explained first. The nouns and terms used in the embodiments of this application shall be interpreted as follows: File transfer refers to establishing a secure and controllable transmission channel between physically or logically isolated networks to achieve compliant cross-network file exchange. The core is to balance data security and transfer efficiency while maintaining direct network connectivity, avoiding the risks of data leakage and malware infection associated with traditional methods such as USB flash drive copying and WeChat transfer.

[0028] There are two main existing solutions for file transfer. One is the offline EEP-packaged CD / USB flash drive transfer solution. This solution only generates offline standard EEP files and lacks a standardized online transmission archive package structure. It relies entirely on manual offline transfer, which has drawbacks such as low efficiency in large-scale power grid design file transfer, complete separation between offline packaging logic and online transmission verification logic, and inability to connect to asynchronous archiving and acceptance processes on the external network. The other solution is the ordinary SFTP single-file online transmission solution. This solution only directly uploads design files such as PDF and DWG, using MD5 non-national cryptographic digests and SSL encryption. However, due to the lack of a layered packaging structure, a lack of standardized archive package directory index, and metadata XML not meeting the DA / T48 industry standard, the archive system cannot automatically complete the four-property checks; the security verification level is single; the synchronous transmission processing mode is prone to interface delays when a large number of files are transmitted simultaneously, and only abnormal files are discarded, resulting in incomplete archives; repeated calls cause duplicate archives; metadata and drawing files are mixed and synchronized, resulting in low efficiency in cross-network exchange and easy data synchronization errors.

[0029] In view of this, this application provides a method and system for cross-domain layered encapsulation and encrypted transmission of power grid design documents. It constructs a standardized three-layer encapsulation architecture (files, documents, and electronic drawings) adapted to power grid design archives and conforming to national archival industry standards. It unifies the design of two formats: online tar archive information packages and offline EEP encapsulation packages, incorporates an index directory, and achieves automated four-property detection of the archive system. It establishes a full-link national cryptographic verification system using SM3 three-level layered digests and SM2 interface message signatures to identify four types of security risks: drawing tampering, metadata tampering, transmission packet tampering, and interface request forgery. It designs a dual-channel, three-stage asynchronous cross-network transmission system for both internal and external networks. The transmission process decouples the entire workflow from file upload, external network acceptance, internal network processing, and result query, resolving the issue of timeouts in synchronizing large batches of design files. A new full-package transaction rollback mechanism is added, completely deleting all files in the current archive in case of archiving anomalies, preventing the retention of incomplete files. A global idempotent verification mechanism using appid (business system identifier) ​​and reqid (unique archiving request number) is established to intercept duplicate archiving; file changes automatically overwrite existing file data, eliminating redundant and duplicate data in the archive database. Structured data and unstructured files are separated into two channels for internal and external network switching, enabling the separate synchronization of metadata and drawing files, improving the stability and transmission efficiency of cross-network exchange.

[0030] This application provides a method and system for cross-domain layered encapsulation and encrypted transmission of power grid design documents, relating to the field of secure document transmission. This method and system can be applied to terminals, servers, or software running on either terminal or server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing the method and system for cross-domain layered encapsulation and encrypted transmission of power grid design documents, but is not limited to these forms.

[0031] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0032] Please see Figure 1 The diagram shown is an optional step of a method for cross-domain layered encapsulation and encrypted transmission of power grid design documents provided in an embodiment of this application. Figure 1 The methods may include, but are not limited to, steps one through four.

[0033] Step 1: Read the power grid design documents and encapsulate them in layers according to the metadata encapsulation rules of volume archiving mode and single-item archiving mode to build an archive information package. The archive information package includes an online tar archive information package and an offline EEP encapsulation package.

[0034] On the service side of the external network service server unit, the service system reads the power grid engineering archive data, distinguishes between the volume-file vf archiving mode and the single-piece f archiving mode, generates EEP metadata XML in compliance with the DA / T48-2009 standard, and completes the three-layer standardized hierarchical encapsulation of power grid design documents.

[0035] In this embodiment, two levels of EEP metadata XML encapsulation rules are set. The first level is the dossier-level XML, whose aggregation level is the dossier, which only stores the overall metadata of the dossier and does not contain the information of electronic drawing files. All text metadata is uniformly wrapped with <![CDATA[content]]> to eliminate XML special character parsing exceptions. The required fields of the dossier-level XML include unique identifier, filing unit name, year, retention period, title, total number of pieces, total number of electronic files, total number of bytes, and information system description. The second level is the file-level XML, whose aggregation level is the file, with a built-in <File Data> node. The child node <Document> of <File Data> corresponds one-to-one to a single engineering design drawing, and the core verification parameters of the engineering design drawing are stored through the <Electronic Attribute> node. The core verification parameters include the unique identifier of the electronic file, file format, computer file name, file size, upload time, number of drawing pages, and the first-layer SM3 digest; the required fields of the file-level XML include document identifier, document serial number, electronic file identifier, format information, computer file size, and the signature result corresponding to the SM3 digest of the drawing.

[0036] In some embodiments, an archive package directory index file is generated according to different archiving modes, and the fixed root tag of the archive package directory index file is <Archive Directory>; when the mode is the volume-file archiving mode, a <Dossier> node is configured under <Archive Directory>, and a plurality of <File> nodes are mounted under the <Dossier> node; when the mode is the single-piece archiving mode, only a single <File> node is configured under <Archive Directory>; the required parameters configured for each node include a sequence number in integer digital format, a metadata path in XML relative path format, and an electronic file path. In the multi-drawing scenario, the electronic file paths are separated by English commas, and all paths uniformly use Linux separators.

[0037] Generate a tar archive information package according to the naming rule, and the calculation formula for the full name of the tar archive information package is: full package name = appid-yyyyMMdd-reqid.tar; where appid is a fixed identification string assigned to the business system by the intranet IDC archive processing server unit (i.e., the archive system), which is the unique identifier of the business system, yyyyMMdd is the packaging date, which is formed by splicing a 4-digit year, a 2-digit month and a 2-digit day, and reqid is a globally unique number for a single archiving request within 32 bits generated by the business system, which is the unique request number of the business system. The tar archive information package is stored through the SFTP protocol, and the calculation formula for the storage path is: storage path = / appid / yyyy / MM / dd / archive package / full package name, where yyyy, MM, and dd are the split fields of the year, month, and day of packaging respectively, which facilitates the internal and external network data exchange platform to automatically classify and synchronize files by date.

[0038] This embodiment adopts a two-level EEP metadata separation design at the dossier level and the file level. The dossier level maintains the overall archive information of the dossier, and the file level binds all verification attributes of a single engineering design drawing. By wrapping the text metadata with <![CDATA[content]], the parsing error caused by special characters during XML parsing can be effectively avoided. The file-level XML introduces the SM3 digest as the drawing signature verification result, and incorporates key verification parameters such as the number of drawing pages, file size, and upload time into the metadata, so as to realize the verifiability of the integrity and authenticity of the archived drawings and ensure the credibility of the power grid design electronic archives. Two archive organization modes, namely the dossier-and-file archiving mode and the single-piece archiving mode, are set to adapt to different power grid engineering archive business archiving scenarios. The metadata path and the engineering design drawing file path are uniformly managed through the archive package directory .xml index file. The paths of multiple drawings are separated by commas, and the Linux path separator is unified. The index relationship of the internal files in the archive package is clear, which facilitates the subsequent internal and external network data exchange platform to quickly parse and locate dossiers, files, and drawing resources, and improves the efficiency of archive parsing and reading.

[0039] See Figure 4The diagram illustrates the directory structure of volume-based VF archiving and single-item F archiving modes. Both archiving modes use the root directory of the tar archive as the top-level path and uniformly employ Linux forward slashes as path separators. On the left, 'a' represents the volume-based VF archiving mode. The root directory of the tar archive contains the `.xml` file, which is associated with an XML file named after the case file's unique identifier and a folder named after the file's unique identifier. The unique identifier XML file contains file-level EEP metadata XML, and the file-level unique identifier folder contains engineering design drawings in PDF, OFD, and DWG formats, suitable for batch archiving scenarios where multiple drawings belong to the same case file. On the right, 'b' represents the single-item F archiving mode. The root directory of the tar archive directly branches into two main branches: the `.xml` file and the file-level unique identifier folder. The `.xml` file contains file-level EEP metadata XML, and the file-level unique identifier folder contains only a single engineering design drawing, suitable for single-drawing independent archiving scenarios. Both archiving modes have well-organized and clearly differentiated directory structures, capable of matching the differentiated business needs of batch archiving of power grid engineering cases and independent archiving of single drawings.

[0040] Step 2: Based on the national cryptographic SM3 hash algorithm, a layered digest is generated to perform layered verification of the archived information packet, and the digital signature is verified by combining it with the SM2 asymmetric encrypted message signature algorithm to obtain the signature verification result.

[0041] In some embodiments, a layered digest is generated based on the SM3 hash algorithm (a national cryptographic standard) to perform layered verification on the archived information packet, and a digital signature verification is performed in conjunction with the SM2 asymmetric encrypted message signature algorithm to obtain the signature verification result, including: Extract the drawing files and metadata from the archived information package; Based on the national cryptographic SM3 hash algorithm, hierarchical digests are calculated for drawing files, metadata, and archive information packages respectively to obtain drawing digest, metadata digest, and archive package digest; The SM3 digest is calculated hierarchically for drawing files, metadata, and archived information packages. Specifically, the drawing digest S1 = SM3(FileStream(DrawingFile)); where DrawingFile is an engineering design drawing file in PDF / OFD / DWG format. The engineering design drawing file is read in a streaming, chunked manner to avoid memory overflow during the processing of large drawings. The calculated drawing digest S1 result is stored in the <signature result> and <encoded data> fields of the file-level XML to verify whether a single drawing file has been tampered with; FileStream is a file streaming, chunked reading operation.

[0042] In the preprocessing stage, all text within the XML tag <signed object> is extracted. All whitespace characters, including spaces, newlines, tabs, and carriage returns, are removed using regular expressions to obtain the clean string CleanXmlStr. Based on this, the metadata digest S2 = SM3(CleanXmlStr) is calculated to verify whether the metadata has been tampered with, thus avoiding inconsistencies in the digest caused by changes in XML layout whitespace.

[0043] The archive digest aipdigest = S3 = SM3(FileStream(TarPackage)); where TarPackage is the tar archive information package after packaging. This archive digest is used as the core verification parameter of the archive interface request to verify whether the complete archive information package has been tampered with during the transmission process.

[0044] The archive package summary is concatenated with the unique request number and unique identifier of the business system to generate the original string to be signed; Assuming the three-layer SM3 digest verification is error-free, the archive package data signature generation and two-way identity authentication of the archive interface are completed based on the national cryptographic SM2 asymmetric signature mechanism. Specifically, the archive package digest (aipdigest), the unique request number (reqid) of the business system, and the unique identifier (appid) of the business system are concatenated according to a fixed format to generate the original string to be signed: SignRawStr = reqid + "|" + appid + "|" + aipdigest. The concatenation separator is strictly limited to the vertical bar (|) and cannot be replaced by commas, forward slashes, or other symbols. The unique request number (reqid) of the business system is used to distinguish each archive transaction and achieve idempotent control. The request identity, business source, and archive file integrity verification value are bound into a unified message to prevent the message fields from being split and tampered with.

[0045] Digital signature operations are performed on the original string to be signed based on the SM2 private key to generate binary raw signature data; The SM3withSM2 (Chinese national cryptographic standard joint signature) algorithm is used to sign the original string to be signed. The formula is SignByte = SM3withSM2(PrivateKey, SignRawStr). Here, PrivateKey is an SM2 private key stored locally in the business system, conforming to the sm2p256v1 standard elliptic curve, and exclusively stored by the initiating system. SignByte represents the binary raw signature data. During the signature operation, the SM3withSM2 algorithm first performs an SM3 hash digest operation on the original string to be signed, SignRawStr, and then performs an asymmetric digital signature based on the SM2 private key, PrivateKey, outputting the binary raw signature data, SignByte. By binding the original string to be signed with the initiator's identity key through the signature operation, it is possible to simultaneously ensure that the message has not been tampered with and that the request source is trustworthy.

[0046] The binary raw signature data is encoded and converted to generate an encoded signature string in string format; The raw binary signature data SignByte is Base64 encoded to generate an encoded signature string sign=Base64Encode(SignByte). The binary byte stream, which is inconvenient for network transmission, is converted into a readable ASCII string through encoding conversion. This string serves as a required request field for the archive acceptance interface call and is sent to the archive system along with the archive package data.

[0047] Summarize the drawing summary, metadata summary, archive package summary, and coded signature string to generate a summary verification result; Finally, the drawing summary S1, metadata summary S2, archive package summary aipdigest, and encoded signature string sign are summarized to generate the summary verification result output, which is a string of all lowercase hexadecimal characters.

[0048] Based on the encoded signature string, archive packet digest, unique request number of the business system, and unique identifier of the business system, the archive information packet with a valid digest is restored to the original string, and the original string is reverse-verified based on the SM2 public key to obtain the signature verification result.

[0049] The archiving system pre-stores the SM2 public key of the corresponding business system. Upon receiving an archiving request from the business system, it extracts the sign, reqid, appid, and aipdigest fields. It first reconstructs the original string according to the same rules, then uses the pre-stored SM2 public key to perform reverse signature verification on the original string. If the signature verification passes, the archiving request is deemed legitimate and the message has not been tampered with, and the archiving application is accepted. If the signature verification fails, a 5001 business error code is immediately returned, the archiving access request is directly rejected, and forged requests and tampered message access are intercepted, completing the secure identity authentication of the archiving interface.

[0050] The entire mechanism ultimately achieves dual security capabilities of three-layer hierarchical integrity verification and trusted authentication of the sender's identity. It can verify whether drawings, metadata, and archive packages have been tampered with layer by layer, and can also rely on SM2 asymmetric signatures to verify the identity of business entities, so as to meet the security requirements of online transmission and archiving of power grid engineering archives.

[0051] In some embodiments, during layered verification, the offline EEP package is verified based on a carrier digest algorithm, including: Filter metadata encapsulation files with the .eep extension within the offline EEP encapsulation package directory; The metadata encapsulation files are sorted according to their storage space usage to obtain a sorted list. Iterate through the metadata encapsulation files in the sorted list, calculate the national cryptographic digest SM3, and concatenate them sequentially to generate the total string TotalStr; Perform an SM3 hash operation on the total string to obtain the total digest of the carrier.

[0052] Please see Figure 6 The diagram illustrates the flowchart for calculating the global digest of an offline EEP package. Starting with the root directory of the offline EEP package as input, it filters out all metadata packages with the .eep extension within that directory. These files are then sorted in ascending order based on their storage space usage. The SM3 hash digest of each sorted .eep file is calculated sequentially using a streaming method. The SM3 hash digests of all files are then concatenated to generate a total string, TotalStr. The concatenated TotalStr is then subjected to another SM3 hash operation, and the result is converted to lowercase hexadecimal format for output. Finally, the global digest of the carrier, TotalDigest = SM3(TotalStr), is obtained. This calculation logic is compatible with both online tar archive information package verification scenarios and offline EEP package verification scenarios, achieving a single algorithm that is compatible with two power grid archive methods. It reliably verifies the overall data integrity of offline and offline carriers, identifying whether files have been tampered with or damaged during storage and transmission.

[0053] Step 3: Verify the archiving request acceptance for archived information packages that have passed the signature verification, and transfer the successfully accepted archived information packages to the intranet.

[0054] In some embodiments, the process of verifying the acceptance of archival requests for archived information packets that have passed signature verification and transferring the successfully accepted archived information packets to the intranet includes: Upload the archived information package that has passed the signature verification and initiate an archived request by calling the archived acceptance interface; The archive information packet that initiates the archive request is subjected to security verification to obtain the security verification result. The security verification includes idempotency verification, file existence verification, SM2 signature verification, and archive directory structure verification. If the security check result is unsatisfactory, the archiving request will be rejected. If the security verification result is satisfactory, the task information is temporarily stored and a successful acceptance response is returned. The successfully accepted archived information package is then transferred to the intranet.

[0055] The business system will upload the project archive package, which has undergone layered encapsulation, three-layer SM3 digest calculation, and SM2 signature processing, to the external DMZ secure file storage pool via SFTP in tar compressed format for temporary storage. File access path information will be retained, and large-capacity drawing files will be pre-stored to avoid timeouts caused by large files occupying interface links. The business system will then call the external archiving acceptance interface via POST and JSON message format. The message will include required parameters such as the business system's unique request number (reqid), unique business system identifier (appid), archiving unit code (companyco), archiving mode (model), file storage path, archive package digest (aipdigest), and encoded signature string (sign), formally initiating the archiving acceptance request. The external verification unit will sequentially perform four security checks. Only after all four security checks pass can the process proceed to the next step; failure of any one security check will reject the archiving request and terminate the current external acceptance process. After all external network security checks pass, a success notification, such as {"code":"0000","message":""}, is returned to the business system via the external network archiving acceptance interface. This response only indicates that the external network archiving request has been successfully accepted, the files and messages have been verified, and the archiving task has been cached in the external network temporary database. It does not mean that the internal network archive has been successfully entered into the database. Formal archiving and entry into the database will be handled asynchronously on the internal network. The successfully accepted archiving information packets stored in the external network temporary database are then transferred to the internal network through the internal and external network data exchange platform for further parsing and verification.

[0056] The security verification includes: ① Idempotency verification: using appid+reqid as the combined unique primary key to search the external temporary database. If the same archiving task record already exists, the historical result is directly reused to avoid repeated archiving and redundancy; ② File existence verification: reading the tar archive information package in the external secure file storage pool according to the storage path in the request message. If the file is missing or the path is incorrect, a 5002 error code is returned, indicating that the archiving has failed; ③ SM2 signature verification: the internal archive processing server unit uses the SM2 public key corresponding to the business system to reverse verify the encoded signature string sign. If the signature does not match, it is determined that the message has been tampered with or the access source is illegal, a 5001 error code is returned, and the archiving request is rejected; ④ Archive directory structure verification: parsing the top-level directory structure of the tar compressed package, checking whether the directory level and the .xml format of the archive package directory conform to the volume VF archive mode and single-item F archive mode specifications, and verifying the compliance of the directory structure.

[0057] In some embodiments, when transferring successfully accepted archived information packets to the intranet, a dual-channel transmission system is built based on the isolation transfer gateway to transfer files between the intranet and the intranet. The dual channels include a one-way unstructured file exchange channel and a two-way structured data exchange channel. The unstructured file exchange channel is used to transfer archived information packets from the intranet to the intranet in a one-way synchronous manner. The structured data exchange channel is used for two-way transmission of the archived acceptance task list and archived real-time processing status data.

[0058] In this embodiment, the internal and external network data exchange platform acts as a physically isolated transfer gateway, setting up two physically isolated channels with independent transmission attributes, strictly adhering to the unidirectional security control requirements of the power internal and external networks. The unstructured file exchange channel is a unidirectional transmission channel, only allowing large-capacity tar archive information packets from the external network to be synchronously transferred unidirectionally to the internal network. It can carry large file data such as DWG, PDF, and OFD engineering design drawings, while preventing internal network data from flowing back to the external network, ensuring the security of internal network archive resources. The structured data exchange channel is a bidirectional interactive channel, used for the external network to push archiving task instructions and basic metadata to the internal network; and for the internal network to send back archiving processing progress, storage results, and failure reasons in text-based structured data to the external network, achieving mutual communication of task progress.

[0059] Step 4: Parse and verify the archived information package via the intranet to trigger the archived information package to be added to the database, and synchronize the archived information transmission to the external network, outputting the file archived transmission result.

[0060] In some embodiments, triggering the storage of archived information packages in the database by parsing and verifying the archived information packages via the intranet includes: The archived information packages are decompressed and split via the intranet to restore the original archive structure; The decompressed file digest is calculated layer by layer based on the original file structure; The decompressed file digest is compared with the original digest of the archived information package to obtain the parsing verification result; If the parsing and verification results are satisfactory, the data will be written into the intranet archive business database according to the association mapping relationship between the case file and the drawings.

[0061] The intranet archive processing server unit receives the tar archive information package that has been transferred to the intranet through the archive package parsing unit and performs decompression operation. It reads the top-level archive package directory .xml file, splits the case file level, document level, and drawing level data according to the hierarchical structure, and restores the complete original archive structure.

[0062] The three-layer SM3 digest verification unit recalculates the three-layer SM3 digests of the decompressed file, namely the decompressed drawing digest, the decompressed metadata digest, and the decompressed package digest. The three-layer SM3 digest of the decompressed package is then compared with the three-layer original digests of the archived information package to achieve consistency verification of the layered digests. The original digests are the three-layer digests transmitted over the external network. If all three layers of SM3 digests match, the file transmission is deemed complete and tamper-free. Based on the association mapping between files and drawings, the metadata, drawing index, and file path of the verified archived information packages are written in batches to the internal network archive business database, completing the formal archive entry. If any level of digest does not match or any required metadata field is missing, the file archiving is directly deemed abnormal.

[0063] In some embodiments, when an archived information package is entered into the database on the intranet, if the parsing and verification result is unqualified, the entire package transaction rollback mechanism is immediately triggered, all data and records of the current archived information package are deleted, and the current archived task is marked as failed.

[0064] For archived information packages that fail summary consistency verification or are abnormally entered into the database, the parsing verification is deemed unqualified. The entire package transaction rollback mechanism is immediately triggered, deleting all case file entries, file records, and drawing index data corresponding to the current reqid, and marking the current archiving task as failed to prevent incomplete archives from being stored in the intranet system.

[0065] After intranet archiving is completed, the success / failure status and detailed failure reasons are synchronized to the external temporary results database via a structured data exchange channel, enabling the external network to store the archiving processing status. Business systems periodically call the archiving result query interface, supporting batch queries of multiple tasks, with a maximum length of 20 serial number arrays for a single batch query request. Three standard status codes are defined to return the results of each archiving task individually: 0000 indicates successful execution of the entire archiving process; 1000 indicates that the intranet is currently parsing, verifying, or processing the data into the database; and 5000 indicates that the archiving process has failed, accompanied by a `retmessage` field with detailed return information on the exception and failure reason. Based on the returned status, the business system completes the archiving business loop, thus ending the entire asynchronous cross-network file transfer process and ultimately obtaining the complete archived file transfer result.

[0066] When the business system updates or modifies the same set of power grid design documents, a brand new tar archive package is generated. After the new package is parsed on the intranet, all historical data of the original files / documents are deleted according to the archid, and then the new archive is put into the database. No incremental field updates are performed to ensure that the archive data is unique and there are no redundant historical versions.

[0067] Please see Figure 2 As shown, another aspect of this application embodiment provides a cross-domain layered encapsulation and encrypted transmission system for power grid design documents. The system includes an external network business server unit, an external network isolation zone archive service unit, an internal and external network data exchange platform, and an internal network archive processing server unit. The external network service server unit is used to read power grid design documents and perform layered encapsulation according to the metadata encapsulation rules of volume archiving mode and single-item archiving mode to construct archived information packages; it is also used to generate layered digests based on the national cryptographic SM3 hash algorithm to perform layered verification of the archived information packages, and combine it with the SM2 asymmetric encrypted message signature algorithm to perform digital signature verification to obtain the signature verification result; The external network isolation zone archive service unit is used to accept and verify archive requests for archived information packages that have passed the signature verification. The internal and external network data exchange platform is used to transfer successfully processed archived information packages to the internal network; it is also used to synchronize file archiving status information from the internal network to the external network. The intranet archive processing server unit is used to parse and verify archive information packets, trigger the archive information packets to be stored in the database, and output the file archive transmission results.

[0068] Please see Figure 2The diagram shows the overall interactive architecture of the system in this application embodiment. This architecture is divided into three core areas: the external network business server unit, the external network isolation zone archive service unit and the internal / external network data exchange platform, and the internal network IDC archive processing server unit. Based on the power industry's internal / external network physical isolation security standards, it adopts a dual-channel asynchronous transfer and national cryptographic full-link security verification layered architecture to achieve a closed-loop process for high-voltage substation engineering archives, from external network business generation, secure acceptance, cross-network isolated transmission to internal network archiving and storage. Specifically, the external network business server unit, as the archiving initiator, is deployed on the internet office external network side. It is used for archive material organization, packaging, national cryptographic security preprocessing, file uploading, and interface request initiation. The external network business server unit internally connects five functional sub-units from top to bottom, with data flowing from top to bottom.

[0069] The layered encapsulation unit serves as the starting module, distinguishing between volume VF archiving mode and single-item F archiving mode. It then packages drawing files, case file metadata, and full case file information in layers according to a standardized XML hierarchical structure, ultimately encapsulating them into a tar archive information package. This standardizes the archive directory structure, meets the requirements of the DA / T48 archive industry standard, and unifies the archive format from the source.

[0070] The national cryptographic digest calculation unit calculates the three-layer SM3 hash digests for the encapsulated archived information packet, namely drawing digest S1, metadata digest S2, and archived packet digest S3. The three-layer digests are then bound to the archived information packet for subsequent cross-network transmission integrity verification and tamper location.

[0071] The SM2 signature unit reads the archive packet digest (aipdigest), the unique request number (reqid) of the business system, and the unique identifier (appid) of the business system, concatenates them to generate the original string to be signed, and calls the SM3withSM2 national cryptographic signature algorithm to generate binary original signature data using the business system's SM2 private key. Then, it obtains the encoded signature string (sign) through Base64 encoding, thus completing the identity binding of the archive request and the anti-tampering encapsulation of the message.

[0072] The secure file upload unit uploads tar archive information packages to the secure file storage pool of the external network isolation zone archive service unit via the SFTP protocol, and retains the file access path, so as to realize the pre-storage of large-capacity drawing files and avoid large files occupying the interface channel and causing blockage.

[0073] The archiving interface call unit assembles a JSON request message containing fields such as serial number, unit code, archiving mode, file path, national cryptographic abstract, and SM2 signature, and calls the archiving acceptance interface of the external network isolated zone archive service unit to initiate an archiving acceptance application. At the same time, it can poll to query the final archiving result and receive archiving status information returned by the internal network IDC archive server processing unit.

[0074] The external network isolation zone archive service unit and the internal and external network data exchange platform serve as the core of secure transfer and are located in the DMZ isolation security zone between the internal and external networks. They are the physical isolation boundary hub and undertake functions such as external network front-end security verification, file temporary storage, dual-channel isolation transfer, and task status transfer.

[0075] Specifically, the external network isolated archive service unit includes a verification unit, a secure file storage pool, and an external network temporary result national cryptographic verification database. The verification unit serially performs four layers of pre-security verification, including idempotent duplicate archiving verification, SFTP file existence verification, SM2 public key signature verification, and archive package directory structure compliance verification. Failure of any one security verification results in the rejection of the archiving request. Upon successful verification, the task information is temporarily stored, and a successful acceptance response is returned. The secure file storage pool serves as persistent storage for files on the external network side, storing tar archive information packages uploaded by business systems and providing a data source for unstructured file transfer. The external network temporary result national cryptographic verification database stores the archiving task log, acceptance status, signature records, and a cache of final archiving results. It serves two purposes: idempotent verification and receiving archiving success / failure statuses synchronized from the internal network IDC archive server processing unit for external network business systems to poll and retrieve.

[0076] The internal and external network data exchange platform acts as a physically isolated transfer gateway, setting up two physically isolated channels with independent transmission attributes, strictly adhering to the unidirectional security control requirements of the power network. The unstructured file exchange channel is a unidirectional transmission channel, only allowing large-capacity tar archive information packets from the external network to be synchronously transferred to the internal network. It can carry large file data such as DWG, PDF, and OFD engineering design drawings, while preventing internal network data from flowing back to the external network, ensuring the security of internal network archive resources. The structured data exchange channel is a bidirectional interactive channel, used for the external network to push archiving task instructions and basic metadata to the internal network; and for the internal network to send back archiving processing progress, data entry results, and failure reasons in text-based structured data to the external network, achieving mutual communication of task progress.

[0077] The intranet IDC archive processing server unit, as the final end for archive entry, is deployed in the power production security intranet and is physically isolated from the external network. It is used for archive package parsing, integrity verification, formal entry, exception rollback, and result feedback.

[0078] Specifically, the archive parsing unit is used to receive tar archive information packages that have been transferred to the intranet, perform decompression operations, read the internal archive directory index XML file, split the case file level, file level, and drawing level data, and restore the complete archive structure.

[0079] The three-layer SM3 digest verification unit is used to recalculate the drawing digest S1, metadata digest S2, and archive package digest S3 of the decompressed file layer by layer, and compare the recalculated three-layer digests with the original digests transmitted from the external network. If all three-layer digests are consistent, the file transmission is determined to be complete and tamper-free; if any level of digest is inconsistent or metadata fields are missing, the archiving is determined to be abnormal.

[0080] The archive entry unit is used to write archive metadata and drawing storage indexes into the intranet formal archive database in batches according to the relationship between case file, document and drawing after the summary is verified to be correct, thus completing the formal archiving and entry of archives.

[0081] The transaction rollback unit is used to trigger the entire transaction rollback mechanism when there are faults such as summary verification mismatch, database write anomaly, or missing fields. It prevents incomplete or damaged archives from being stored on the internal network by clearing all case records, file indexes, and drawing data corresponding to the current archive sequence.

[0082] The result synchronization unit is used to send the successful / failed status of archiving and the reason for the exception back to the external temporary database through the structured exchange channel after the archiving process is completed, and wait for the external business system to poll and obtain it, forming a complete asynchronous closed loop.

[0083] The overall data interaction logic in this embodiment is as follows: external network business system encapsulation and packaging → layer-by-layer SM3 digest calculation and SM2 signature → file upload and interface application → four-layer security verification in the external network isolation zone → dual-channel isolation cross-network transfer → internal network decompression and parsing, three-layer digest verification → normal data entry / abnormal full package rollback → archived status back to the external network → business system query final result.

[0084] Please see Figure 3 The diagram shown is a three-stage asynchronous cross-network archiving sequence flowchart of an embodiment of this application. The whole is divided into three stages, relying on the dual-channel transmission architecture of physical isolation between internal and external networks, the national cryptographic SM3 layered integrity verification, SM2 signature verification, idempotent control and transaction rollback mechanism, to asynchronously separate the external network archiving application acceptance, cross-network isolation transfer, internal network parsing and database entry, and result closed-loop query, so as to solve the problems of large-capacity engineering file transmission blockage, easy data tampering, duplicate archiving, and abnormal file residue in the scenario of internal and external network isolation.

[0085] Phase One, the External DMZ Acceptance Phase: This phase is deployed in an external network isolated security zone. It only handles temporary storage of archived files, submission of archive requests, and pre-security compliance verification. No formal internal database entry is performed, thus achieving asynchronous decoupling between archive request acceptance and archive entry. Specifically, the external network business system uploads the project archive package, after layered encapsulation, three-layer SM3 digest calculation, and SM2 signature processing, in tar compressed format via SFTP protocol to the external DMZ secure file storage pool for temporary storage. File access path information is retained, and large-capacity drawing files are pre-stored to avoid large files consuming interface links and causing timeouts. The business system calls the external archive acceptance interface via POST method and JSON message format. The message carries required parameters such as the business system's unique request number (reqid), unique business system identifier (appid), unit code, archive mode, file storage path, archive package digest (aipdigest), and encoded signature string (sign), formally initiating the archive acceptance request. The external network verification unit performs four security checks sequentially. Only after all four security checks pass can the process proceed to the next step. If any security check fails, the current external network acceptance process is terminated. After all external network security checks pass, a success notification is returned to the business system through the external network archiving acceptance interface. This response only indicates that the external network file and message verification is complete and the archiving task has been cached in the external network temporary database. It does not mean that the internal network archive has been successfully entered into the database. Formal archiving and entry into the database will be handled asynchronously on the internal network.

[0086] The security verification includes: ① Idempotency verification: using appid+reqid as the combined unique primary key to search the external temporary database. If the same archiving task record already exists, the historical result is directly reused to avoid repeated archiving; ② File existence verification: reading the tar archive information package in the external secure file storage pool according to the storage path in the request message. If the file is missing or the path is incorrect, the application is deemed to have failed; ③ SM2 signature verification: the internal archive processing server unit uses the SM2 public key corresponding to the business system to reverse verify the signature string. If the signature does not match, the message is deemed to have been tampered with or the access source is illegal, and the archiving request is rejected; ④ Archive directory structure verification: verifying whether the internal hierarchical structure of the compressed package conforms to the volume vf archive mode and single f archive mode specifications.

[0087] Phase Two, the Intranet Exchange and Archive Processing Phase, relies on a dual-channel intranet and extranet data exchange platform to facilitate data transfer. Within a secure intranet environment, it performs archive package parsing, integrity verification, batch data import, and abnormal transaction rollback operations. Specifically, the intranet and extranet data exchange platform uses two physically isolated channels to transmit different types of data. The unstructured file exchange channel unidirectionally transfers extranet tar archive packages to the intranet storage area, allowing only large-capacity drawing files to be transferred from the extranet to the intranet, prohibiting reverse data flow from the intranet to ensure the security of intranet production archives. The structured data exchange channel bidirectionally transmits archiving task instructions and processing status text information. The extranet pushes task lists to the intranet, and the intranet subsequently uses this channel to send back the archiving processing status.

[0088] After receiving the completed tar archive information package, the intranet archive processing unit performs decompression, reads the archive directory index XML file within the compressed package, and breaks down the data into file level, document level, and drawing level data to restore the complete original archive structure. The intranet recalculates the decompressed file digests layer by layer, namely the decompressed drawing digest, decompressed metadata digest, and decompressed archive package digest, and compares the decompressed file digests with the original digests carried in the archive information package transmitted over the external network. If all three digests match, it is determined that the file was not lost or tampered with during cross-network transmission; if any level of digest is inconsistent or any required metadata field is missing, the file archiving is directly determined to be abnormal. Based on the parsing and verification results of the summary comparison, branch processing is performed. If the parsing and verification results are qualified, the archive metadata and drawing storage index are written to the intranet formal archive database in batches according to the hierarchical relationship of case files, documents, and drawings, and the formal archiving and storage of archives is completed. If the parsing and verification results are abnormal or the database write fails, the whole package transaction rollback mechanism is immediately triggered to delete all case file records, document indexes, and drawing data corresponding to the unique request number reqid of the current business system, clear abnormal archive entries, and avoid leaving incomplete or damaged archives on the intranet.

[0089] Phase Three, the Result Query Closed-Loop Phase: After the intranet archiving process is completed, the archiving success / failure status and detailed failure reasons are synchronized to the external temporary result database via a structured data exchange channel, enabling the external network to store the processing status. External business systems periodically call the archiving result query interface, allowing multiple reqid serial numbers to be passed in batches to retrieve the processing progress and final results of multiple archiving tasks. The system defines three standard status codes, returning the results of each archiving task one by one: 0000 indicates that the entire archiving process has been successfully executed; 1000 indicates that the intranet is currently parsing, verifying, or processing the data into the database; and 5000 indicates that the archiving process has failed, with a detailed explanation of the exception reason. Based on the returned status, the business system completes the archiving business closed loop, and the entire asynchronous cross-network archiving sequence process ends.

[0090] This embodiment asynchronously separates acceptance and storage to avoid interface timeout issues caused by large file uploads; it balances large-capacity file transfer efficiency with intranet data security through dual-channel physical isolation transmission; it achieves trusted identity and tamper-proof data throughout the process through pre-emptive four-fold security verification and intranet three-layer national cryptographic digest dual protection; and it eliminates duplicate archiving and abnormal file storage through idempotent mechanisms and transaction rollback, significantly improving the reliability of the archiving process.

[0091] Please see Figure 5 The diagram shown is a flowchart of the national cryptographic layered digest and signature calculation process in an embodiment of this application. It belongs to the core process of the security preprocessing before archiving in the external network business system. It performs SM3 hash digest calculations at three levels: layered drawing file layer, metadata layer, and archived package layer. Then, it performs national cryptographic SM2 signature calculation based on the global digest and the business identity information. Finally, it outputs three-layer digest data and signature fields for subsequent cross-network transmission integrity verification, message anti-tampering and business identity trusted authentication, realizing fine-grained tampering location and full-link security protection.

[0092] Specifically, the process begins with calculating layered summaries. The business system loads engineering design drawings one by one using a streaming method to avoid memory overflow issues caused by reading large drawings all at once. For each drawing file, the national cryptographic SM3 hash algorithm is used to perform irreversible hashing, generating a first-level file-level drawing summary S1. This summary is used to accurately locate tampering issues in individual drawings; any modification to a drawing will change the corresponding S1 value, enabling fine-grained tamper detection at the drawing level. Next, the EEP metadata XML file, which carries case file attributes and archived item information, undergoes format cleaning, empty field removal, and illegal character filtering to ensure consistent metadata format. Finally, the cleaned and complete metadata is subjected to SM3 hash calculation to generate a second-level case file metadata summary S2. This summary is used to verify whether the case file metadata and archived attribute information have been tampered with, ensuring the integrity and reliability of archived business attribute parameters. All drawing files and standardized metadata are uniformly encapsulated and compressed into a tar archive information package. The complete binary data stream of the tar archive information package is read, and the SM3 algorithm is called to calculate the archive package digest aipdigest (S3). This archive package digest covers the entire contents of the archive package and serves as the benchmark value for global integrity verification during cross-network transmission.

[0093] Then, the signature string is concatenated. This involves selecting three key parameters: the unique request number (reqid) of the business system being archived, the unique identifier (appid) of the business system, and the archive package digest (aipdigest). These parameters are then concatenated using a vertical bar (|) as the separator to generate the original string to be signed. By binding the business identity identifier with the archive package digest, the signature is ensured to have business attribution.

[0094] Next, the business system uses its own proprietary SM2 private key and relies on the SM3withSM2 national cryptographic signature algorithm specification to perform digital signature operation on the concatenated original string to be signed, generating binary original signature data to realize the identity verification of the business system and prevent third parties from forging archive application messages.

[0095] The binary raw signature data is then converted to Base64 printable character encoding to obtain the encoded signature string "sign" in string format, which is suitable for HTTP JSON message transmission scenarios and facilitates reception, parsing, and signature verification by the external network isolated archive service unit.

[0096] Finally, four types of security verification parameters are summarized and output: drawing summary S1, metadata summary S2, archive package summary aipdigest (S3), and encoded signature string sign. The security verification parameters are uploaded to the external network isolation zone archive service unit along with the archive request message.

[0097] This embodiment employs a three-layer hierarchical SM3 digest calculation to verify drawing files, case file metadata, and complete archive packages in a progressively coarser manner. It can accurately detect any file loss, content tampering, or metadata alteration during transmission. SM2 digital signatures are used for business identity authentication and overall message tamper-proof verification to prevent unauthorized systems from forging archive requests or tampering with archive messages. The combination of layered digests and digital signatures forms a robust front-end security barrier for archive initiation, providing a reliable verification benchmark for subsequent cross-network asynchronous archiving.

[0098] The following section provides a detailed description and explanation of the solutions in the embodiments of this application, using specific application examples.

[0099] To verify the practical application performance, compliance, security, and operational advantages of the layered encapsulation and national cryptographic asynchronous cross-network transmission scheme for ultra-high voltage substation engineering archives in this embodiment, a standardized hardware and software testing environment was established. Real power grid substation engineering archives were selected as test samples, and differentiated control schemes were set up for quantitative testing and qualitative effect analysis. The performance advantages of this embodiment's scheme were then visually represented using capacity-time variation curves. Figure 7 The chart shown is a comparison curve of the total time consumed in the entire process of archiving power grid engineering files.

[0100] Hardware network environment: The external network business server is equipped with an 8-core CPU, 16GB of RAM, and 2TB of mechanical storage; the internal and external network data exchange platform adopts a dual-machine hot standby isolation transfer gateway, equipped with dual-channel independent network cards for structured metadata and unstructured drawings to achieve data isolation and distribution; the internal network IDC archive processing server is equipped with a 16-core CPU, 32GB of RAM, and SSD high-speed storage media; the bandwidth of the internal and external network transmission channels is 1000Mbps, and there is no network congestion or bandwidth contention during the entire test, ensuring the uniqueness of test variables.

[0101] The test samples were selected from actual completed ultra-high voltage substation projects. The test materials were all taken from archived data of real completed ultra-high voltage substation projects, and were divided into two categories of archived sample scenarios: volume-based (VF) archived samples and single-item (F) archived samples. The volume-based (VF) archived samples consisted of a complete substation file, containing one main directory, 32 internal documents, and 216 engineering design drawings. The drawings included 142 in DWG format, 46 in PDF format, and 28 in OFD format, with a total file size of 18.6 GB. The single-item (F) archived samples consisted of 50 independent high-voltage equipment individual design drawings, with an average file size of 86 MB and a total file size of 4.3 GB.

[0102] Two control groups, A and B, were set up. Control group A was the offline EEP / USB flash drive manual offline handover and archiving scheme, which is the traditional offline archiving mode of the power grid. Control group B was the traditional SFTP single-layer synchronous online archiving scheme, which is the current mainstream online file transmission method. Experimental group C was the layered encapsulation and national cryptographic asynchronous cross-network transmission archiving scheme of this embodiment.

[0103] The full-process capacity-time metrics were calculated for both the 18.6GB batch archiving of complete sets of case files and the 4.3GB batch archiving of single drawings. The quantitative data and optimization effects are shown in Tables 1 and 2 below. Table 1 is a quantitative performance comparison table for the 18.6GB batch archiving of complete sets of case files, and Table 2 is a quantitative performance comparison table for the 4.3GB batch archiving of single drawings.

[0104] Table 1

[0105] Table 2

[0106] Therefore, this embodiment sets up a dual-channel isolated parallel transfer mechanism for structured metadata and unstructured engineering drawings. Small-volume metadata is prioritized for compliance verification and identity authentication, while large-capacity drawings are transmitted in parallel via an independent channel. This eliminates the problem of large files occupying channels and causing interface blockage or queuing. The larger the archive size, the more prominent the advantage of parallel transmission becomes, significantly improving transmission efficiency. The three-layer standardized XML hierarchical encapsulation structure, coupled with a global index file design, fully complies with the DA / T48 archival industry standard. It eliminates the need for maintenance personnel to manually correct metadata entries, significantly reducing the labor costs of archive management and comprehensively optimizing archive compliance. Relying on the three-layer hierarchical SM3 hash digest, the location of data tampering at any level of drawings, metadata, and the archive master package can be accurately located. SM2 asymmetric signatures can intercept forged archive requests. Simultaneously, the whole package transaction rollback and global digest idempotent verification mechanism completely solve the two core pain points of traditional archiving solutions: incomplete archives and duplicate archiving, significantly enhancing security and fault tolerance. The online tar archive and the offline EEP carrier share the same national cryptographic digest verification algorithm. The operation and maintenance end only needs to maintain one set of parsing and verification code system, which reduces the workload of program version iteration and fault diagnosis by more than 50%, and significantly reduces the operation and maintenance burden.

[0107] Figure 7 This is a graph comparing the total capacity of archived power grid engineering files with the total time spent on the entire archiving process. The horizontal axis of the coordinate system represents the total capacity of archived files (in GB), and the vertical axis represents the total time spent on the entire archiving process (in min). Figure 7 The results show three curves: Control Group A (offline USB manual archiving) exhibits a steep linear increase in time as data volume increases, with a very high proportion of manual operation; Control Group B (traditional SFTP synchronous archiving) shows a sharp increase in time with large file transfers, frequent interface timeouts and retries, resulting in poor transmission stability; Experimental Group C in this embodiment shows a gentle upward trend, and even with a large 18.6GB file set, there is no surge in time consumption. It is perfectly suited for the centralized archiving of large-scale power grid projects, and its transmission efficiency and stability advantages continue to amplify with the increase in archive volume. In actual testing at the 18.6GB file node, the offline manual method took 226 minutes, the traditional SFTP method took 98 minutes, and the method in this embodiment took only 31 minutes.

[0108] It is understood that the content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0109] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0110] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0111] Please see Figure 8 , Figure 8 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 801 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory 802 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 802 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 802 and is called and executed by the processor 801 using the methods described in the embodiments of this application. The 803 input / output interface is used to implement information input and output. The communication interface 804 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 805 transmits information between various components of the device (e.g., processor 801, memory 802, input / output interface 803, and communication interface 804); The processor 801, memory 802, input / output interface 803, and communication interface 804 are connected to each other within the device via bus 805.

[0112] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0113] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0114] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0115] It is understood that the content of the above method embodiments is applicable to the embodiments of this program product. The specific functions implemented by the embodiments of this program product are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0116] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0117] This application provides a method and system for cross-domain layered encapsulation and encrypted transmission of power grid design documents. This solution reads power grid design drawing files and packages them layered according to two industry-standard metadata encapsulation specifications: volume archiving mode and single-item archiving mode. This generates an archive information package containing an online tar archive information package and an offline EEP encapsulation package. Based on the archiving mode, it automatically matches archiving elements such as file level, drawing ownership, project attributes, and version information, eliminating the need for manual and repeated organization of the archive catalog. It unifies the archiving format of power grid engineering documents, avoiding problems such as chaotic archiving structures across different projects and incompatibility between internal network archive systems. The online tar archive information package uniformly compresses and encapsulates drawing entity files and metadata XML, suitable for batch streaming transmission between internal and external network channels. Compression reduces transmission volume and improves cross-network transmission speed. The offline EEP encapsulation package solidifies complete archive metadata, drawing indexes, and permission information, allowing for offline archiving and backup without the online system, meeting the compliance requirements for long-term archiving and offline transfer of power grid documents.

[0118] The SM3 hash algorithm (a national cryptographic standard) is used to perform three-level hierarchical digest calculations on archived packages to achieve integrity verification. Combined with the SM2 asymmetric signature algorithm, message identity authentication and anti-tampering verification are completed, generating verification results. By generating drawing digests, metadata digests, and archived package digests, fine-grained tampering anomalies in drawings, metadata, and archived packages can be accurately located. Compared to traditional single hash verification, which can only determine overall anomalies and cannot distinguish the location of tampering, the efficiency of fault diagnosis is greatly improved. The archived serial number, business system identifier, and general package global digest are concatenated and signed with the business party's SM2 private key. Verification is performed using the public key in the external network isolation zone. This confirms that the archived application originates from an authorized business system, preventing hackers from forging archived requests, tampering with request messages, and uploading malicious files, thus meeting the security access control requirements of the power network.

[0119] A one-way transfer mechanism is adopted, allowing only compliant archived files from the external network to be pushed to the internal network. Internal network production data and confidential files cannot flow back to the external network, completely avoiding the risk of leakage of core power grid design data, aligning with the strong isolation security strategy of the power grid's internal and external networks. The external network completes basic compliance, identity, and signature verification, while the internal network recalculates the three-layer digest and verifies the directory structure and metadata compliance. This can intercept security risks caused by link eavesdropping, data packet tampering, and file loss during cross-network transmission, preventing abnormal files from flowing into the internal network database. Files are compressed and packaged for asynchronous transmission, no longer relying on HTTP synchronous interfaces to handle the transmission of ultra-large drawing files. This solves the problems of link congestion, request timeouts, and transmission interruptions when archiving large batches of DWG drawings, and supports nighttime batch background transfers without consuming daytime business bandwidth.

[0120] Based on the internal network's parsing and verification results, the system handles branch processing. If verification passes, the archive is officially entered into the database, along with drawings, metadata, and security verification parameters. Summary data can be retrieved at any time for subsequent access and borrowing to re-verify completeness. If verification fails, a full-package transaction rollback is automatically triggered, clearing any abnormal archive files temporarily cached on the internal network. This prevents corrupted or invalid junk data from occupying internal network storage, ensuring a clean and standardized internal archive database. The internal network synchronizes the status of archiving in progress, successful archiving, failed archiving, and specific reasons for failure to the external network business end, allowing business personnel to view the workflow in real time. Simultaneously, the external network retains complete verification and signature logs, summary records, and transmission sequences, forming a full-link audit ledger to meet the needs of archive auditing, security traceability, and problem review. It supports batch packaging and transfer of multiple files, batch entry into the database, and batch status queries, adapting to scenarios where large quantities of design drawings are centrally archived in power grid infrastructure projects, significantly reducing operation and maintenance costs.

[0121] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0122] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0123] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0124] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0125] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for cross-domain layered encapsulation and encrypted transmission of power grid design documents, characterized in that, The method includes: Read the power grid design documents and encapsulate them in layers according to the metadata encapsulation rules of volume archiving mode and single-item archiving mode to build an archive information package. The archive information package includes an online tar archive information package and an offline EEP encapsulation package. The archived information packet is subjected to layered verification based on the SM3 hash algorithm (a national cryptographic standard) to generate a layered digest, and digital signature verification is performed by combining the SM2 asymmetric encrypted message signature algorithm to obtain the signature verification result. For archived information packets that have passed the signature verification, the archived request acceptance verification is performed, and the successfully accepted archived information packets are transferred to the intranet. The archived information package is parsed and verified through the intranet, triggering the archived information package to be added to the database, and the archived information is synchronously transmitted to the external network, outputting the file archived transmission result.

2. The method according to claim 1, characterized in that, An archive package directory index file is generated according to different archiving modes. The fixed root tag of the archive package directory index file is <archive directory>. When it is a volume archive mode, a <file> node is configured under <archive directory>, and multiple <file> nodes are attached under the <file> node. When it is a single item archive mode, only a single <file> node is configured under <archive directory>. The required parameters configured for each node include an integer sequence number, a metadata path in XML relative path format, and an electronic file path. In the case of multiple drawings, the electronic file path is separated by English commas, and all paths use the Linux separator.

3. The method according to claim 1, characterized in that, The archived information packet is subjected to layered verification based on a layered digest generated using the SM3 hash algorithm (a national cryptographic standard), and digital signature verification is performed using the SM2 asymmetric encryption message signature algorithm to obtain the signature verification result, including: Extract the drawing files and metadata from the archived information package; Based on the national cryptographic SM3 hash algorithm, hierarchical digests are calculated for the drawing file, the metadata and the archive information package respectively to obtain the drawing digest, metadata digest and archive package digest; The archive package summary is concatenated with the unique request number and unique identifier of the business system to generate the original string to be signed; The original string to be signed is digitally signed based on the SM2 private key to generate binary original signature data. The binary raw signature data is encoded and converted to generate an encoded signature string in string format; Summarize the drawing summary, the metadata summary, the archive package summary, and the coded signature string to generate a summary verification result; Based on the encoded signature string, the archive packet digest, the unique request number of the business system, and the unique identifier of the business system, the archive information packet with the digest verification passed is restored to the original string, and the original string is reverse-verified based on the SM2 public key to obtain the verification result.

4. The method according to claim 1, characterized in that, During layered verification, the offline EEP package is verified based on the carrier digest algorithm, including: Filter the metadata encapsulation files with the .eep extension within the offline EEP encapsulation package directory; The metadata encapsulation files are sorted according to their storage space usage to obtain a sorted list; Iterate through and calculate the national cryptographic digest SM3 of the metadata encapsulation files in the sorted list, and concatenate them sequentially to generate the total string; Perform an SM3 hash operation on the total string to obtain the global digest of the carrier.

5. The method according to claim 1, characterized in that, For archived information packets that have passed the signature verification, the archiving request acceptance verification is performed, and the successfully accepted archived information packets are transferred to the intranet, including: Upload the archived information package that has passed the signature verification and initiate an archived request by calling the archived acceptance interface; The archive information packet that initiates the archive request is subjected to security verification to obtain a security verification result. The security verification includes idempotency verification, file existence verification, SM2 signature verification, and archive directory structure verification. If the security verification result is unsatisfactory, the archiving request will be rejected; If the security verification result is qualified, the task information is temporarily stored and a successful acceptance response is returned. The successfully accepted archived information packet is then transferred to the intranet.

6. The method according to claim 5, characterized in that, When transferring the successfully received archived information package to the intranet, a dual-channel transmission system is built based on the isolation transfer gateway to transfer files between the intranet and the intranet. The dual channels include a one-way unstructured file exchange channel and a two-way structured data exchange channel. The unstructured file exchange channel is used to transfer the archived information package from the extranet to the intranet in a one-way synchronous manner. The structured data exchange channel is used for bidirectional transmission of the archive acceptance task list and archive real-time processing status data.

7. The method according to claim 1, characterized in that, The process of parsing and verifying the archived information package via the intranet to trigger the storage of the archived information package includes: The archived information package is decompressed and split through the intranet to restore the original archive structure. The decompressed file digest is calculated layer by layer based on the original file structure. The decompressed file digest is compared with the original digest of the archived information package to obtain the parsing verification result; If the parsing and verification results are satisfactory, the data will be written into the intranet archive business database according to the association mapping relationship between the case file and the drawings.

8. The method according to claim 7, characterized in that, When the archived information package is entered into the database on the intranet, if the parsing and verification result is unqualified, the entire package transaction rollback mechanism is immediately triggered, all data and records of the current archived information package are deleted, and the current archiving task is marked as failed.

9. A cross-domain layered encapsulation and encrypted transmission system for power grid design documents, applied to the method described in any one of claims 1 to 8, characterized in that, The system includes an external network business server unit, an external network isolation zone archive service unit, an internal and external network data exchange platform, and an internal network archive processing server unit. The external network service server unit is used to read power grid design documents and perform layered encapsulation according to the metadata encapsulation rules of volume archiving mode and single-item archiving mode to construct archived information packages; It is also used to generate a layered digest based on the national cryptographic SM3 hash algorithm to perform layered verification on the archived information packet, and to perform digital signature verification in combination with the SM2 asymmetric encrypted message signature algorithm to obtain the signature verification result; The external network isolation zone archive service unit is used to accept and verify the archive request of the archived information package that has passed the signature verification. The internal and external network data exchange platform is used to transfer the successfully accepted archived information packets to the internal network; it is also used to synchronize the file archiving status information of the internal network to the external network. The intranet archive processing server unit is used to parse and verify the archive information package, trigger the archive information package to be stored in the database, and output the file archive transmission result.

10. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method according to any one of claims 1 to 8.

Images