WO2022099683A1 - 一种数据传输方法、装置、设备、系统及存储介质 - Google Patents

一种数据传输方法、装置、设备、系统及存储介质 Download PDF

Info

Publication number
WO2022099683A1
WO2022099683A1 PCT/CN2020/129003 CN2020129003W WO2022099683A1 WO 2022099683 A1 WO2022099683 A1 WO 2022099683A1 CN 2020129003 W CN2020129003 W CN 2020129003W WO 2022099683 A1 WO2022099683 A1 WO 2022099683A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
transmitted
segment data
segment
destination
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2020/129003
Other languages
English (en)
French (fr)
Inventor
单卫华
张春丽
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Cloud Computing Technologies Co Ltd
Original Assignee
Huawei Cloud Computing Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Cloud Computing Technologies Co Ltd filed Critical Huawei Cloud Computing Technologies Co Ltd
Priority to CN202080007541.0A priority Critical patent/CN114830572B/zh
Priority to PCT/CN2020/129003 priority patent/WO2022099683A1/zh
Priority to EP20961238.1A priority patent/EP4236137A4/en
Publication of WO2022099683A1 publication Critical patent/WO2022099683A1/zh
Priority to US18/318,319 priority patent/US20230283479A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/06—Protocols specially adapted for file transfer, e.g. file transfer protocol [FTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Definitions

  • the present application relates to the technical field of data security, and in particular, to a data transmission method, apparatus, device, system and storage medium.
  • Hash-based Message Authentication Code (HMAC) technology performs signature verification on the data to be transmitted to improve the reliability of the data communicated between the source and destination.
  • the destination end can verify whether the data to be transmitted is consistent with the data to be transmitted sent by the source end according to the digital signature generated by the source end for the data to be transmitted.
  • the verification efficiency of the data to be transmitted by the destination is low.
  • the present application provides a data transmission method for improving the verification efficiency of data to be transmitted.
  • the present application also provides a data transmission apparatus, device, system, computer-readable storage medium, and computer program product.
  • the present application provides a data transmission method, which is applied to the source end.
  • the source end can obtain data to be transmitted, such as data generated by one or more applications on the source end, and transfer the data to be transmitted. Divide the data into multiple segments, and determine the sending order of each segment data, so that the check information of each segment data can be generated according to the segment data and the sending order of each segment data, and then,
  • the signature device may send the multiple pieces of data and the verification information corresponding to the multiple pieces of data to the destination end. In this way, the destination end can check the received segment data and the verification information based on the receiving sequence of each segment data, so as to determine whether each segment data has a transmission abnormality during the transmission process.
  • the destination end can determine that the data to be transmitted has a transmission abnormality, and there is no need to wait until The entire data to be transmitted can be determined only after the transmission of the data to be transmitted is completed, thereby effectively improving the verification efficiency of the data to be transmitted.
  • the destination end can check, according to the receiving sequence of the segmented data, whether the multiple segmented data in the data to be transmitted has been tampered with, replaced and reorganized during the transmission process. In this way, while the efficiency of data verification is improved, the security of data transmission is further improved.
  • the source end is the sender of data during a session
  • the destination end is the receiver of data during a session.
  • the source end and the destination end may be implemented by hardware or software, and the source end and the destination end may be implemented by the same type of hardware or software, or may be implemented by different types of hardware or software, which is not limited in this embodiment. .
  • the process of generating the verification information of each segment data at the source end may be, specifically, sending each segment data and each segment data The sequence is combined with the key to perform HMAC operation to obtain the check information corresponding to each segment data.
  • the source end may perform character splicing between the segmented data and the sending sequence of the segmented data, and perform a hash operation on the spliced data to generate a corresponding digest, and then , the source end can encrypt the generated digest using a pre-stored key, and use the encrypted ciphertext as the verification information corresponding to the segmented data.
  • the destination end checks the segmented data, it can perform character splicing between the received segmented data and the received sequence of the segmented data, and perform the same hash operation on the spliced data to generate corresponding
  • the destination can use the pre-saved key to decrypt the received verification information. Then, the destination end can determine whether there is a transmission abnormality during the transmission of the segmented data by comparing whether the generated digest is consistent with the decrypted digest.
  • the source end may use a corresponding hash algorithm to perform a hash operation on the segmented data to generate a digest corresponding to the segmented data, and then the source end may save the data in advance Character splicing is performed between the encryption key and the sending sequence of the segmented data, and the generated digest is encrypted based on the new key obtained by the splicing, so that the obtained encrypted ciphertext can be used as the corresponding check information of the segmented data. .
  • the destination end when it verifies the segmented data, it can perform character splicing between the receiving sequence of the segmented data and the decryption key saved in advance, and based on the new key obtained by splicing, the received verification information can be spliced.
  • Decryption is performed to obtain a digest; at the same time, the destination terminal can generate a digest based on the received segment data, and determine whether there is a transmission abnormality in the segment data by comparing the generated digest with the decrypted digest.
  • the source end may use a corresponding hashing algorithm to hash the segmented data in the cloud to generate a digest corresponding to the segmented data, and then the source end may Characters are spliced between the digest and the sending sequence corresponding to the segmented data to obtain a new digest, and the new digest obtained by splicing is encrypted with a pre-saved key, so that the obtained encrypted ciphertext can be used as the corresponding segment of the data.
  • Check information may be used for each segmented data.
  • the destination terminal when verifying the segmented data, can decrypt the received verification information by using the pre-stored decryption key, and remove the sending order from the decrypted digest to obtain a new digest; , the destination can perform a hash operation on the received segmented data to generate a corresponding digest. In this way, the destination end can compare whether the two digests are consistent, so as to determine whether there is a transmission abnormality during the transmission of the segmented data.
  • the data to be transmitted may be transmitted between the source and the destination through a session, then, before transmitting data to the destination, the source may first send the current session identifier to the destination, and then the source
  • the terminal When generating the verification information corresponding to each segment data, the terminal may generate the verification information of each segment data according to each segment data, the sending sequence of each segment data, and the session identifier.
  • the destination end when verifying each segmented data, the destination end can perform the verification in combination with the session identifier corresponding to the segmented data, so that during the transmission of segmented data, there are two different sessions with the same sending order.
  • the destination end can also verify that the segment data currently received is not the segment data sent by the source end, thereby further improving the reliability of data communication.
  • the source end may send the session identifier to the destination end before sending the first segment data and the verification information of the first segment data to the destination end, and specifically may be to the destination end
  • the endpoint sends a request header that carries the identifier of the session.
  • the request that carries the session identifier sent by the source end to the destination end may also include verification information corresponding to the request header, so that the destination end can use the verification information to verify the received request header. , so as to determine whether the content carried in the received request header has been tampered with during transmission.
  • the source end when the source end sends multiple segment data and check information corresponding to the multiple segment data to the destination end, it may specifically send the last segment data, the last segment data to the destination end Verification information of the segment data and an end identifier, wherein the end identifier indicates that the transmission of multiple segment data is completed.
  • the destination can determine whether the currently received multiple segment data is all segment data to be transmitted to the destination by the source through the end identifier, so that the destination can timely identify whether the segment data is in the transmission process. truncated by the attacker.
  • the source end may start multiple transmission threads, and divide the acquired resources to be transmitted to obtain a plurality of data to be transmitted.
  • Each transmission thread sends at least one segment data of the data to be transmitted and check information corresponding to the segment data to the destination end.
  • the data to be transmitted can be transmitted in parallel from the source end to the destination end, so that the transmission efficiency of the resources to be transmitted between the source end and the destination end can be improved.
  • the source end may first send a request header carrying description data to the destination end before sending at least one segment data of the data to be transmitted and the corresponding check information to the destination end through each transmission thread Therefore, the destination end can determine, based on the description data of the data to be transmitted, that the multiple received data to be transmitted belong to the same resource to be transmitted, so that the destination end can integrate the multiple received data to be transmitted.
  • the description data may include at least one of the following: an identifier of a resource to be transmitted and a slice range of the data to be transmitted.
  • the identifier of the resource to be transmitted may be, for example, the file name of the resource to be transmitted
  • the slice range of the data to be transmitted may be, for example, the slice identifier and slice size of the data.
  • the source end may also generate verification information corresponding to each segmented data based on time information and/or location information, thereby increasing the verification dimension for segmented data and further improving data verification. reliability.
  • an embodiment of the present application further provides a data transmission method, and the method is applied to a destination end.
  • the destination end can receive multiple segmented data from the source end and the corresponding check information for each segmented data, wherein the received multiple segmented data is obtained by dividing the data to be transmitted by the source end; then, the destination The terminal can determine the receiving sequence of each segment data, and verify each segment in the data to be transmitted according to each segment data, the receiving sequence of each segment data, and the check information of each segment data Whether the data is transmitted abnormally.
  • the destination end can determine that the data to be transmitted has a transmission abnormality, and there is no need to wait until The entire data to be transmitted can be determined only after the transmission of the data to be transmitted is completed, thereby effectively improving the verification efficiency of the data to be transmitted.
  • the destination end can check, according to the receiving sequence of the segmented data, whether the multiple segmented data in the data to be transmitted has been tampered with, replaced and reorganized during the transmission process. In this way, while the efficiency of data verification is improved, the security of data transmission is further improved.
  • the check information is HMAC, and when the destination end checks whether each segment data in the data to be transmitted is abnormally transmitted, it may specifically be based on each segment data, each segment data The receiving sequence of the segment data, the key, and the received check information determine whether each segment data in the data to be transmitted is abnormally transmitted.
  • the source end may send the segment data and the segment data Perform character splicing in sequence, and perform hash operation on the spliced data to generate a corresponding digest. Then, the source can use the pre-saved key to encrypt the generated digest, and use the encrypted ciphertext as the corresponding segment data. verification information.
  • the destination end when the destination end checks the segmented data, it can perform character splicing between the received segmented data and the received sequence of the segmented data, and perform the same hash operation on the spliced data to generate corresponding At the same time, the destination can use the pre-saved key to decrypt the received verification information. Then, the destination end can determine whether there is a transmission abnormality during the transmission of the segmented data by comparing whether the generated digest is consistent with the decrypted digest.
  • the source end may use a corresponding hash algorithm to perform a hash operation on the segmented data to generate a digest corresponding to the segmented data, and then the source end may save the data in advance Character splicing is performed between the encryption key and the sending sequence of the segmented data, and the generated digest is encrypted based on the new key obtained by the splicing, so that the obtained encrypted ciphertext can be used as the corresponding check information of the segmented data. .
  • the destination end when it verifies the segmented data, it can perform character splicing between the receiving sequence of the segmented data and the decryption key saved in advance, and based on the new key obtained by splicing, the received verification information can be spliced.
  • Decryption is performed to obtain a digest; at the same time, the destination terminal can generate a digest based on the received segment data, and determine whether there is a transmission abnormality in the segment data by comparing the generated digest with the decrypted digest.
  • the source end may use a corresponding hashing algorithm to hash the segmented data in the cloud to generate a digest corresponding to the segmented data, and then the source end may Characters are spliced between the digest and the sending sequence corresponding to the segmented data to obtain a new digest, and the new digest obtained by splicing is encrypted with a pre-saved key, so that the obtained encrypted ciphertext can be used as the corresponding segment of the data.
  • Check information may be used for each segmented data.
  • the destination terminal when verifying the segmented data, can decrypt the received verification information by using the pre-stored decryption key, and remove the sending order from the decrypted digest to obtain a new digest; , the destination can perform a hash operation on the received segmented data to generate a corresponding digest. In this way, the destination end can compare whether the two digests are consistent, so as to determine whether there is a transmission abnormality during the transmission of the segmented data.
  • the destination end can receive the data to be transmitted sent by the source end through the session, and the destination end can also receive the identifier of the session from the source end; then the destination end is checking whether the segmented data is abnormal in transmission.
  • the destination end is checking whether the segmented data is abnormal in transmission.
  • the receiving sequence of each segment data, the check information of each segment data and the identifier of the current session verify whether each segment data in the data to be transmitted is transmitted abnormal.
  • the destination can verify that the currently received segmented data is not sent by the source.
  • the data is segmented, thereby further improving the reliability of data communication.
  • the destination end may receive a request header from the source end, and the request header carries the identifier of the current session between the source end and the destination end, so that the destination end can parse the session from the request header logo.
  • the destination end may receive the verification information corresponding to the request header sent by the source terminal, so as to determine, based on the verification information corresponding to the request header, whether the content carried in the request header has been tamper.
  • the destination end may receive the last segment data from the source end, the last segment data The check information of the segmented data and an end identifier, wherein the end identifier indicates that the transmission of multiple segmented data is completed.
  • the destination can determine whether the currently received multiple segment data is all segment data to be transmitted to the destination by the source through the end identifier, so that the destination can timely identify whether the segment data is in the transmission process. truncated by the attacker.
  • the destination end when the destination end receives multiple segmented data from the source end and the check information corresponding to each segmented data, the destination end may specifically receive at least one pending data sent by the source end through each transmission thread.
  • the segmented data of the transmission data and the corresponding verification information, wherein, different transmission threads are used to transmit different data to be transmitted obtained by dividing the resources to be transmitted, so that the source end transmits the data to be transmitted in parallel to the destination end, which can improve the speed of transmission.
  • the destination end may receive a request carrying description information from the source end before receiving at least one segment data of the data to be transmitted and the corresponding verification information sent by the source end through each transmission thread header, where the identifier of the resource to be transmitted may be, for example, the file name of the resource to be transmitted, and the slice range of the data to be transmitted may be, for example, the slice identifier and slice size of the data.
  • the source end may also generate verification information corresponding to each segmented data based on time information and/or location information, thereby increasing the verification dimension for segmented data and further improving data verification. reliability.
  • the present application provides a source end for implementing each module of the data transmission method performed by the source end in the first aspect or any possible implementation manner of the first aspect.
  • the present application provides a destination end, and the source end is used to implement each module of the data transmission method executed by the destination end in the second aspect or any possible implementation manner of the second aspect.
  • the present application provides a data transmission system, including a source end and a destination end, wherein the source end is configured to execute the data transmission method in the first aspect or any possible implementation manner of the first aspect, and the destination end It is used to perform the above-mentioned second aspect and the data transmission method in any possible implementation manner of the second aspect.
  • the present application provides a computing device, the computing device includes a processor and a memory; the processor is configured to execute instructions stored in the memory, and execute the first aspect or any of the possible options of the first aspect.
  • the data transmission method performed by the source in the embodiment.
  • the present application provides a computing device, the computing device includes a processor and a memory; the processor is configured to execute instructions stored in the memory, and execute the second aspect or any of the possible possibilities of the second aspect.
  • the present application provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, which, when executed on a computer device, cause the computer device to perform the above-mentioned first aspect or the first aspect.
  • the present application provides a computer-readable storage medium, where an instruction is stored in the computer-readable storage medium, which, when executed on a computer device, causes the computer device to perform the above-mentioned second aspect or the second aspect.
  • an instruction is stored in the computer-readable storage medium, which, when executed on a computer device, causes the computer device to perform the above-mentioned second aspect or the second aspect. The method described in any one of the implementations.
  • the present application provides a computer program product comprising instructions, which, when run on a computer device, cause the computer device to perform the method described in the first aspect or any one of the implementations of the first aspect.
  • the present application provides a computer program product comprising instructions, which, when executed on multiple computer devices, cause the computer devices to execute the second aspect or any one of the implementation manners of the second aspect. method.
  • the present application may further combine to provide more implementation manners.
  • 1 is a schematic diagram of the architecture of an application scenario
  • FIG. 2 is a schematic structural diagram of a data transmission system in an embodiment of the present application.
  • FIG. 3 is a schematic diagram of dividing data to be transmitted and generating verification information in an embodiment of the present application
  • FIG. 4 is a schematic diagram of parallel transmission of multiple data to be transmitted in an embodiment of the present application.
  • FIG. 5 is a schematic diagram of transmitting a request header from the source end 100 to the destination end 200 in an embodiment of the present application
  • FIG. 6 is a schematic diagram of an exemplary request header in an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of data transmission between the source end 100 and the destination end 200 in an embodiment of the present application
  • FIG. 8 is a schematic diagram of a hardware structure of a computer device in an embodiment of the application.
  • FIG. 9 is a schematic diagram of a hardware structure of another computer device in an embodiment of the present application.
  • the source before sending the file, the source can sign the entire file based on a digital signature or HMAC, and send the signature and the entire file to the destination. It is tampered with during transmission to improve the reliability of communication between the source and destination.
  • a digital signature also known as a public key digital signature
  • a digital signature is a digital string that can only be generated by the sender of the information and cannot be forged by others.
  • the digital string is also an effective indicator of the authenticity of the information sent by the sender prove.
  • a set of digital signatures usually defines two complementary operations, one for signing and the other for verification.
  • HMAC is a method for message authentication based on Hash function and key. It requires both parties to share a key, agree on an algorithm, and perform Hash operation on the transmitted data to form a fixed-size authentication code. Both parties of the communication determine the legitimacy of the transmitted data through verification of the authentication code.
  • the destination end needs to receive the complete file before verifying whether the file has a transmission abnormality, and after determining that the file has a transmission abnormality, it notifies the source end to resend the entire file. Therefore, the part of the file that does not have a transmission abnormality still needs to be retransmitted from the source end to the destination end, which makes the verification and transmission efficiency of the file low.
  • the destination end may not be able to receive the normal complete file for a long time. The attacker may also consume the computing power of the destination by continuously sending large error files based on this.
  • an embodiment of the present application provides a data transmission method, which is used to improve the verification efficiency of data such as files that need to be transmitted.
  • the source end may segment the data to be transmitted, the source end determines the sending order of multiple segmented data included in the to-be-transmitted data, and generates check information corresponding to each segmented data based on the sending order. Then, the source end can send the check information and the segmented data to the destination end. In this way, for each received segmented data, the destination terminal can check the segmented data according to the receiving order of the segmented data received by the destination terminal and the corresponding check information of the segmented data to determine the segmented data. Whether a transmission abnormality occurs during the transmission of the segmented data, that is, it is determined whether a transmission abnormality occurs during the transmission of the data to be transmitted.
  • the destination terminal can timely determine the segmented data with abnormal transmission, without waiting for the completion of transmission of the entire data to be transmitted before performing verification, thereby improving the efficiency of data verification.
  • the check information is generated according to the sending order of the segmented data, and the sending order does not need to be transmitted to the destination (the destination can generate check information based on the receiving order corresponding to the sending order and check the segmented data) , therefore, the destination end can check, according to the receiving sequence of the segmented data, whether the multiple segmented data in the data to be transmitted has been tampered with, replaced and reorganized during the transmission process. In this way, while the efficiency of data verification is improved, the security of data transmission is further improved.
  • the source can only retransmit the segmented data to the destination without retransmitting the entire data to be transmitted. Therefore, there is no transmission abnormality in the data to be transmitted. The segmented data can no longer be transmitted to the destination, so that the data transmission efficiency can be improved.
  • the data transmission system includes a source end 100 and a destination end 200 , and communication between the source end 100 and the destination end 200 is performed through an intermediate network 300 .
  • the source end 100 refers to the sender of data during a session
  • the destination end 200 refers to the receiver of data during the session.
  • the source end 100 and the destination end 200 may be any devices with communication capability, or software modules on the devices, or the like.
  • the source end 100 may be a terminal that provides data
  • the destination end 200 may be a server that receives data, etc.; or, the source end 100 may also be a server that provides data
  • the destination 200 may be a terminal that receives data, or the like.
  • the source end 100 and the destination end 200 may be the same type of device, or may be different types of devices.
  • both the source end 100 and the destination end 200 may be terminals, that is, the two terminals may send and receive data to and from each other through the intermediate network 300, or both the source end 100 and the destination end 200 may be servers, that is, the data is performed between the two servers. data communication.
  • the source end 100 may be a client running on the device, and the destination end 200 may be a cloud service module provided by a cloud platform.
  • the cloud service module can also send data to the client, that is, the source 100 is the cloud service module, and the destination 200 is the client, or both the source 100 and the destination 200 are clients or both are cloud service modules .
  • the source end 100 may include a data production apparatus 110 and a signature apparatus 120 .
  • the data production device 110 is used to generate the data to be transmitted that needs to be transmitted to the destination terminal 200 .
  • the signature device 120 is used to perform segmentation and signature processing on the data to be transmitted.
  • the data production device 110 may include one or more applications, and the signature device 120 may be embedded in the application as a software development kit (software development kit, SDK).
  • the data production apparatus 110 may include multiple applications, and the signature apparatus 120 may be used as an independent application software in the source end 100 and can simultaneously process the data to be transmitted generated by the multiple applications.
  • the signature device 120 includes a segmentation module 121 , a sorting module 122 , a verification information generation module 123 and a transmission module 124 .
  • the source end 100 may segment the data to be transmitted through the segmentation module 121 to obtain a plurality of segment data corresponding to the data to be transmitted.
  • the segmentation module 121 may segment the data to be transmitted into (N+1) segment data, which are segment data 0 (segment 0) to segment data N (segment N).
  • the segmentation module 121 may segment the data to be transmitted according to a preset size (size), and the size of the multiple segmented data obtained by the segmentation is the same.
  • the size of the last segmented data may be smaller than or equal to this size.
  • the preset size can be preset by the technician, or can be set by the source end, such as 1M Byte (MB), 64K Byte (KB), etc.
  • MB 1M Byte
  • KB 64K Byte
  • the segmentation module 121 may also segment the data to be transmitted in other manners, for example, without using a fixed preset size to segment the data, and the size of each segmented data may be different.
  • the sorting module 122 may determine the order in which the multiple segmented data are sent to the destination end 200 .
  • the sorting module 122 may take the arrangement order of each segment data in the data to be transmitted as the order in which the segment data is sent to the destination end 200 .
  • the sorting module 122 sorts the first segmented data (the first 64KB) of the data to be transmitted as 1, and the subsequent first segmented data is first sent to the destination 200 based on the sorting, and the first segmented data of the data to be transmitted is firstly sent to the destination 200
  • the order of the two pieces of data (the data from 64KB to 128KB) is 2, and the subsequent second piece of data is sent to the destination end 200 secondly based on the order, and so on.
  • the sorting module 122 may randomly sort multiple pieces of data, for example, the source end 100 may determine the sending order of each piece of data based on a preset random algorithm. Then, under normal circumstances, the order in which the source end 100 sends each segment data is different from the order in which each segment data is arranged in the data to be transmitted. In this way, even if the source end 100 is attacked when transmitting each segment data, it is difficult to determine the arrangement order of each segment data in the data to be transmitted according to the sending order/transmission order of each segment data, so that it is difficult to determine the arrangement order of each segment data in the data to be transmitted based on each segment The data to be transmitted is obtained by data reconstruction, which further improves the transmission security of the to-be-transmitted data.
  • the signature device 120 can generate corresponding verification information for each segmented data through the verification information generating module 123.
  • the verification information generation module 123 may generate corresponding verification information 0 to segment data N based on each segment data.
  • the verification information generation module 123 may combine the sending order of the target segment data, segment data, and encryption of the segment data. The key is used to generate corresponding check information for the target segment data, and the check information is used for consistency check when the subsequent target segment data is transmitted to the destination end 200 .
  • the verification information may be a digital signature corresponding to the target segment data.
  • this embodiment provides the following manners for generating verification information.
  • the verification information generation module 123 can perform data splicing (or a combination of other methods) between the target segment data and the sending sequence, and generate a summary for the spliced data content, and then use the public key saved by the source end 100 to perform the data splicing. After encrypting the digest, the digital signature corresponding to the target segment data can be obtained.
  • Method 2 After the verification information generation module 123 generates a digest for the target segment data, data splicing (or a combination of other methods) is performed on the digest and the sending sequence of the target segment data, and the public key pair saved by the source end 100 is used. The digest obtained by splicing is encrypted to obtain the digital signature corresponding to the target segment data.
  • the check information may also be the HMAC corresponding to the target segment data generated in combination with the transmission order, or may be generated in other combination with the transmission order and can be used for the target segment data. Data for consistency check, etc.
  • mode 3 when the verification information is HMAC, for each segment data (ie, target segment data), the verification information generation module 123 may combine the encryption key saved by the source end 100 with the target segment data Perform data splicing (or combine in other ways) in the corresponding sending order to obtain the spliced key, and then use the spliced key to encrypt the digest generated based on the target segment data to obtain the HMAC corresponding to the target segment data. , and used as the verification information corresponding to the target segment data.
  • the verification information generation module 123 may combine the encryption key saved by the source end 100 with the target segment data Perform data splicing (or combine in other ways) in the corresponding sending order to obtain the spliced key, and then use the spliced key to encrypt the digest generated based on the target segment data to obtain the HMAC corresponding to the target segment data. , and used as the verification information corresponding to the target segment data.
  • the verification information generation module 123 can perform data splicing between the target segment data and the encryption key to obtain the spliced data, and then use the encryption key saved by the source end 100 to perform a digest generated based on the spliced data. Encryption to obtain the HMAC corresponding to the target segment data.
  • Method 5 After generating the digest based on the target segment data, the verification information generation module 123 performs data splicing (or combination in other ways) between the digest and the sending sequence corresponding to the target segment data, and uses the encrypted data stored in the source end 100. The key pair encrypts the digest obtained by splicing, and obtains the HMAC corresponding to the target segment data.
  • data splicing or combination in other ways
  • the key pair encrypts the digest obtained by splicing, and obtains the HMAC corresponding to the target segment data.
  • the signature device 120 After obtaining the target segment data and the verification information corresponding to the target segment data, the signature device 120 sends the target segment data and the verification information to the destination terminal 200 through the transmission module 124 .
  • the source end 100 may establish a communication connection with the destination end 200 through the HyperText Transfer Protocol (HyperText Transfer Protocol, HTTP) or the HyperText Transfer Protocol Secure (HyperText Transfer Protocol Secure, HTTPS), and under the connection
  • the data to be transmitted is transmitted to the destination end 200 through the intermediate network 300 .
  • the intermediate network 300 can split each segmented data sent by the transmission module 124 and the corresponding check information of the segmented data into multiple segmented sub-data, and for each segmented segmented sub-data
  • IP Internet Protocol
  • TCP Transmission Control Protocol
  • UDP User Datagram Protocol
  • the intermediate network 300 may send each IP protocol packet corresponding to the segmented data to the destination end 200 .
  • each IP protocol packet may carry part of segment data and/or (part or all) check information corresponding to the segment data.
  • the signature device 120 in order to improve the verification reliability of the target segment data received by the destination terminal 200, the signature device 120 does not send the sending sequence of the target segment data to the destination terminal 200, thereby avoiding the sending of the target segment data.
  • the sequence is stolen during the transmission from the source end 100 to the destination end 200, so as to avoid affecting the destination end 200's verification of the received target segment data.
  • the digital signature of the target segment data is also tampered based on the stolen sending order.
  • the destination end 200 may include a transmission module 211 and a verification module 212 .
  • the transmission module 211 can be configured to receive the target segment data sent by the source end 100 and the check information corresponding to the target segment data, and can further determine the target segment data and the check information corresponding to the target segment data
  • the receiving sequence may be, for example, the number of segment data received by the destination end 200, and then the target segment data, verification information and receiving sequence are sent to the verification module 212 for data verification.
  • the verification module 212 can verify the target segment data according to the verification information, the target segment data and the receiving sequence, to determine whether the target segment data has a transmission abnormality, that is, verify the data received by the destination end 200. Whether the target segment data is consistent with the target segment data sent by the source end 100 .
  • the verification module 212 can use the private key stored in the destination terminal 200 to decrypt the received digital signature during verification to obtain the digest A, and According to the same rules, the target segment data and the receiving sequence are data spliced, and a summary B is generated according to the spliced data content. Then, the verification module 212 compares the digest A with the digest B to determine whether the two digests are consistent. If so, the verification module 212 can determine that the target segment data does not have any abnormality in transmission, that is, the target segment received by the destination end 200.
  • the segment data is consistent with the target segment data sent by the source end 100; and if the two digests are inconsistent, the verification module 212 can determine that the target segment data has a transmission abnormality, that is, the target segment data received by the destination end 200 is the same as the source segment data.
  • the target segment data sent by the terminal 100 is inconsistent. For example, the content of the target segment data may be tampered with or replaced during transmission.
  • the verification module 212 can use the private key stored in the destination terminal 200 to decrypt the received digital signature during verification to obtain the digest A, And according to the rules for generating the digital signature by the source end 100, the digest B corresponding to the target segment data is deduced from the digest A, for example, the digest B is obtained by removing the part of the sending sequence from the digest A. And, the verification module 212 can generate a digest C according to the received target segment data. Then, the verification module 212 can compare whether the digest B is consistent with the digest C.
  • the verification module 212 can determine that there is no transmission abnormality in the target segment data, and if not, the verification module 212 can determine the target segment data. There is a transmission exception.
  • the above two examples are only illustrative of the process of verifying the target segment data by the verification module 212 when the verification information is specifically a digital signature. In practical applications, other implementation manners may also be used.
  • the verification information may also be the HMAC corresponding to the target segment data generated in combination with the transmission order, or may be other data generated in combination with the transmission order and can be used to perform consistency check on the target segment data Wait.
  • the verification module 212 decrypts the decrypted data stored in the destination 200 .
  • the verification module 212 can perform data splicing (or use other Mode combination), and generate the corresponding digest A based on the data content obtained by splicing, then, the verification module 212 can use the decryption key saved by the destination terminal 200 to decrypt the received verification information to obtain the digest B, and the digest A is compared with abstract B to determine whether the two abstracts are consistent. If they are consistent, the verification module 212 may determine that the target segment data does not have a transmission abnormality; otherwise, determine that the target segment data has a transmission abnormality.
  • the verification module 212 can use the decryption key to decrypt the received verification information, obtain the digest A, and remove the target from the digest A Then, the verification module 212 can generate a digest C based on the received target segment data, and compare whether the digest B and the digest C are consistent. If they are consistent, the verification module 212 may determine that the target segment data does not have a transmission abnormality; otherwise, determine that the target segment data has a transmission abnormality.
  • the verification module 212 can adopt any applicable implementation manner for the specific implementation process of verifying the received target segment data according to the receiving sequence of the target segment data and the received verification information, This embodiment does not limit or repeat this.
  • the source end 100 and the destination end 200 transmit each segment data in the data to be transmitted, they can check the transmitted segment data according to the above process, and when the currently transmitted segment data passes the calibration At the time of verification, the source end 100 continues to transmit the next segment data to the destination end 200 . If the currently transmitted segment data fails the verification, the destination end 200 may notify the source end 100 to retransmit the segment data, and continue to verify the retransmitted segment data until the destination end 200 receives the segment data. The next segment data is transmitted only when the segment data is consistent with the segment data sent by the source end 100 . Since the data volume of each segmented data is smaller than the data volume of the data to be transmitted, by verifying each segmented data transmitted, the verification efficiency can be effectively improved.
  • the destination end 200 can timely determine the occurrence of transmission abnormality through the above verification process.
  • the source end 100 may also notify the destination end 200 that the data to be transmitted has been transmitted, so that the destination end 200 can determine that the currently received multiple segment data includes all segment data of the to-be-transmitted data.
  • the destination end 200 can also determine whether part of the segmented data in the to-be-transmitted data is truncated by the attacker during the transmission process according to whether it receives the notification sent by the source end 100 that the transmission of the to-be-transmitted data is completed.
  • the source end 210 may continue to transmit a special segment data to the destination end 200, which is hereinafter referred to as the end segment.
  • segment data may carry an end identifier, and the end identifier can be used to indicate that multiple segments of the data to be transmitted have been successfully transmitted to the destination end 200 .
  • the segment module 121 in the source end 100 can also construct an end segment data with a size of 0 while dividing the data to be transmitted and obtain multiple segment data, and the sorting module 122 determines the end segment. The order in which data is sent is the last sent.
  • the verification information generation module 123 can generate a digital signature for the end segment data according to the sending sequence corresponding to the end segment data, and then send the end segment data and the corresponding end segment data to the destination 200 by the transmission module 124. digital signature.
  • the destination terminal 200 receives the end segment data and completes the verification of the end segment data, it can determine that the transmission of multiple segments of the data to be transmitted is completed. In this way, the entire to-be-transmitted data is successfully transmitted from the source end 100 to the destination end 200 .
  • the source end 100 also sends an end identifier indicating whether the data to be transmitted ends while sending the segmented data to the destination end 200, for example, it may be sending the last segmented data and the last segmented data.
  • the end flag is sent.
  • the intermediate network 300 may generate a plurality of packets based on the segmented data (each packet carries a part of the segmented data), and send the data in the packet header (or in the packet).
  • the end indication field is newly defined in other locations), the end indication field is used to indicate that the currently transmitted segment data is the last segment data, and the value of the end indication field is defined in the message header according to the value of the end identifier . For example, when the value of the end indication field is 0, it indicates that the transmission of the data to be transmitted is not completed, and when the value of the end indication field is 1, it indicates that the transmission of the data to be transmitted is completed. In practical applications, if the segmenting module 121 divides the data to be transmitted into (N+1) segmented data, the packets corresponding to the first to Nth segmented data sent by the source end 100 to the destination end 200 are included in the data.
  • the value of the end indication field may be 0; and in the packet corresponding to the (N+1)th segment data sent by the source end 100 to the destination end 200, the value of the end indication field may be 1, which is used to inform the destination end 200 The last segment of data to be transmitted has been transmitted.
  • the above examples are only used to illustrate the implementation process of the source end 100 notifying the destination end 200 of the completion of data transmission to be transmitted.
  • the source end 100 may also notify the destination end 200 to be transmitted based on other methods.
  • the data transmission process ends.
  • the source end 100 sends a transmission end indication message to the destination end 200 alone.
  • the indication message carries an end identifier, etc., which is not limited in this embodiment.
  • the signature device 120 can implement the above processes of segmenting the data to be transmitted, determining the sending sequence, generating verification information, and sending segmented data through a single thread.
  • the signature device 120 can also be a Data is concurrently transmitted to the destination end 200 through multiple threads, so as to improve the data transmission efficiency from the source end 100 to the destination end 200 .
  • the data production apparatus 110 may divide the resource to be transmitted into a plurality of data to be transmitted, such as the first data to be transmitted and the second data to be transmitted, and transmit the two data to be transmitted. to the signature device 120.
  • the signature device 120 may have multiple threads, taking thread 1 and thread 2 as an example.
  • the signature device 120 may process one data to be transmitted with each thread based on the above-mentioned embodiment. Specifically, as shown in FIG. 4 , the signature device 120 uses thread 1 to segment the first data to be transmitted to obtain a plurality of segmented data of the first data to be transmitted, and further divides the first data to be transmitted for each segment of the first data to be transmitted.
  • the first check information is generated according to segment data of the first data to be transmitted.
  • the signature device 120 may use thread 2 to segment the second data to be transmitted, determine the sending sequence, generate verification information, and send each segment of the second data to be transmitted to the destination 200 .
  • the second check information is generated according to segment data of the second data to be transmitted.
  • the source end 100 may first start multiple transmission threads, and then divide the acquired resources to be transmitted into multiple data to be transmitted, or start multiple transmission threads after obtaining multiple data to be transmitted, or The two processes are executed at the same time, etc.
  • the specific execution sequence of the two processes is not limited.
  • the destination end 200 may have at least two threads, which are referred to as thread 3 and thread 4 below for the convenience of distinction.
  • the authentication device 210 can use thread 3 to receive each segment data and verification information corresponding to the first data to be transmitted sent by the source end 100 using thread 1, and perform corresponding verification on the received segment data; at the same time, the authentication The apparatus 210 may use thread 4 to receive each segment data and verification information corresponding to the second data to be transmitted sent by the source end 220 using thread 2, and perform corresponding verification on the received segment data.
  • the specific implementation process of the thread 3 and the thread 4 verifying the segmented data may refer to the descriptions in the above-mentioned relevant places, and will not be repeated here.
  • the source end 100 sends the first data to the destination end 200 .
  • the description data corresponding to the first data to be transmitted and the second data to be transmitted are also sent to the destination end 200.
  • the data is sent to the destination end 200 through thread 1.
  • the description data of the second data to be transmitted is sent to the destination end 200 through thread 2 .
  • the destination end 200 when receiving the segment data of the first data to be transmitted and the segment data of the second data to be transmitted, the destination end 200 can determine the first segment data to be transmitted according to the description data of the first data to be transmitted and the second data to be transmitted.
  • the segment data of the data to be transmitted and the segment data of the second data to be transmitted belong to the same resource to be transmitted, and based on each segment data of the first data to be transmitted and each segment data of the second data to be transmitted, a complete resources to be transmitted.
  • the description data of the first data to be transmitted may include, for example, an identifier (resource ID) of a resource to be transmitted to which the first data to be transmitted belongs, such as a file name, a uniform resource locator (uniform resource locator, URL) or Hashed URLs, etc.
  • the description data may further include a slice range (range) of the first data to be transmitted.
  • the slice range of the first data to be transmitted may be, for example, a slice size and a slice identifier of the first data to be transmitted.
  • the description data of the second data to be transmitted is similar to the description data of the first data to be transmitted, and details are not described here.
  • the signature device 120 can also use the thread 1 to generate the first verification information according to the sending sequence of the segment data and the description data of the first data to be transmitted. to generate.
  • the signature device 120 can use thread 1 to generate a digest for the segmented data, and combine the digest with the sending sequence corresponding to the segmented data and the description of the first data to be transmitted.
  • the data is spliced, and the data content obtained after splicing is encrypted to obtain a digital signature corresponding to the segmented data.
  • the authentication device 210 can use the public key to decrypt the received verification information corresponding to the segmented data, and reverse the data content from the decrypted data. Calculate the digest corresponding to the segmented data, so as to determine whether the segmented data received by the authentication device 210 and the segmented data sent by the signature device 120 are determined by comparing whether the digest is consistent with the digest generated based on the received segmented data Is it consistent.
  • the signature device 120 may also use thread 2 to generate the segment according to the description data of the second data to be transmitted and the sending order corresponding to the segment data
  • thread 2 For the second verification information corresponding to the data, for a specific implementation manner, reference may be made to the relevant description at the place where the first verification information is generated, which will not be repeated here.
  • the signature device 120 can also use multiple threads to simultaneously sign a plurality of different data to be transmitted provided by the data production device 110, and after the signature is completed, the multiple different data to be transmitted and the verification data are signed.
  • the verification information is transmitted to the destination in parallel, and the specific implementation process is similar to the specific implementation in which the signature device 120 signs and transmits the two data to be transmitted respectively. Please refer to the above-mentioned descriptions in relevant places, and will not be repeated here.
  • segment data with the same sending order where some segment data is exploited by the attacker and other data. Possibility to make substitutions. For example, assuming that the source A1 sends the data to be transmitted a to the destination A2, and the source B1 sends the data to be transmitted b to the destination B2 , the attacker can use the source A1 and the source A2 In the process of transmitting segmented data, parts of segmented data with the same sending order are exchanged.
  • the source end A 1 sequentially sends the segment data a 1 , a 2 , a 3 , a 4 , and a 5 in the data to be transmitted a
  • the source end A 2 sequentially sends the segment data b 1 in the data to be transmitted b , b 2 , b 3 , b 4 , b 5
  • the attacker can exchange the segment data a 3 in the data a to be transmitted and the segment data b 3 in the data b to be transmitted, so that the destination A 2
  • the received segmented data are sequentially a 1 , a 2 , b 3 , a 4 , a 5
  • the segmented data received by the destination B 2 are sequentially b 1 , b 2 , a 3 , b 4 , b 5 , in this way, the data received by the destinations A 1 and A 2 are abnormal.
  • the transmission module 124 may first send the target segment data (that is, any one of the multiple segment data of the data to be transmitted) to the destination end 200.
  • a session identifier corresponding to segment data where the session identifier is used to identify the session corresponding to the transmission of the target segment data.
  • the authentication device 210 of the destination end 200 can verify whether the received different segment data belong to the same session based on the session identifier, so that the different segment data received by the destination end 200 belong to the same session corresponding to the session resource to be transmitted.
  • the session identifier can be, for example, a task identifier (SessionID) of data transmission, a request identifier (RequestID), a Universal Unique Identifier (UUID), a random number (RandomNumber) generated for the session, a header hash Any one or more of the value (HeaderHash) and the header signature value (HeaderSignature), or it can be a feature combination of any one or more of the above information, and the combined information is used as the session identifier of the data to be transmitted, etc. .
  • the specific implementation manner of the session identifier is not limited.
  • the transmission module 124 may construct a request header, such as a request header based on the HTTP protocol, etc., and the request header carries a session identifier corresponding to the data to be transmitted.
  • the transmission module 124 may construct the request header shown in FIG. 6 , wherein some fields (headers) in the request header may be used to record attribute information of the request header, such as request type, version number, etc. information; another part of the field in the request header can be used to record the session identifier corresponding to the data to be transmitted. In practical applications, this part of the field can be used by redefining an existing field or a reserved field to realize the use of this part of the field. Record the session ID.
  • the transmission module 124 may send the request header to the destination terminal 200, as shown in FIG. 5 .
  • the destination terminal 200 can parse out the session identifier from the received request header, and determine that multiple pieces of data subsequently received are all transmitted through the session corresponding to the session identifier.
  • the verification information generation module 123 when the verification information generation module 123 generates verification information for each segment data in the data to be transmitted, it can be based on the sending order of the segment data and the session identifier (that is, the segment data) corresponding to the segment data.
  • the session identifier corresponding to the to-be-transmitted data to which the segment data belongs) generates verification information.
  • the verification information is specifically a digital signature
  • the verification information generation module 123 can perform data splicing on the sending sequence and the session identifier and the digest generated according to the segmented data, and encrypt the content of the spliced data, then , the obtained encrypted ciphertext can be the digital signature corresponding to the segmented data.
  • the verification module 212 may verify the segmented data according to the session identifier parsed from the request header and the corresponding receiving sequence of the segmented data, to obtain Determine whether the segment data received by the destination end 200 is consistent with the segment data sent by the source end 100 .
  • the authentication device 210 (specifically, the verification module 212) in the destination terminal 200 can pass the session corresponding to the segmented data.
  • the identifier determines that the segment data received by the destination end 200 is inconsistent with the segment data sent by the source end 100, thereby determining that the segment data is abnormal during the transmission process.
  • the destination end 200 may also verify the request header, specifically verifying the request header sent by the source end 100 and the destination end 200 Check whether the received request headers are consistent to determine whether the request headers are subject to tampering and other attacks during transmission.
  • the verification information generation module 123 in the source terminal 100 may also generate verification information for the constructed request header, and add the verification information of the request header to the verification part field in the request header, as shown in FIG. 6 . shown.
  • the verification module 212 can parse out the verification information corresponding to the request header from the verification part field in the request header, and use the verification information to verify the request header Check the content in.
  • the verification part may be combined with the header, or may be a field different from the header.
  • the verification part may be a tail field in the request header.
  • the request header carries the session identifier and the verification part. The specific implementation of the verification information is not limited.
  • the source terminal 100 can start sending each segment data in the data to be transmitted to the destination terminal 200; 212
  • the destination end 200 may terminate the connection with the source end 100, or request the source end 100 to retransmit the request header, etc., until the request header received by the destination end 200.
  • the source end 100 is allowed to further transmit segmented data only when it is consistent with the request header sent by the source end 100 .
  • the transmission module 124 in the source end 100 constructs the request header, more other information may be added to the request header to strengthen the verification of the data to be transmitted received by the destination end 200 .
  • the transmission module 124 may also add time information and/or location information in the request header.
  • the time information may be the maximum allowable time difference between the segmented data sent by the source end 100 and the segmented data received by the destination end 200, etc. Of course, it may also be other applicable time dimensions to calibrate the segmented data. information, etc.; location information, for example, may be the network location/geographical location allowed by the destination 200 that receives the segmented data, or may be other applicable information for verifying segmented data in the location dimension, etc. .
  • the request header generated by the source end 100 may include not only the session identifier and the digital signature corresponding to the request header, but also the above-mentioned time information and/or location information.
  • each thread may generate a corresponding request header, and the request header generated by each thread may also include the child transmitted by the thread. Data description data, etc.
  • the embodiments of the present application further provide a data transmission method, which is described next from the perspective of interaction of various devices.
  • this method is applied to above-mentioned data transmission system, and this data transmission system comprises source terminal 100 and destination terminal 200, and this method specifically comprises the steps:
  • the source end 100 obtains the data to be transmitted.
  • the applications may generate data that needs to be transmitted to the destination end 200 .
  • the destination end 200 is the Object Storage Service (OBS) provided by the cloud platform
  • OBS Object Storage Service
  • the user can upload the data to the bucket of the OBS service on the source end 100 through the client, or the client can periodically upload the data to the OBS service.
  • User data is uploaded to the bucket.
  • the data to be uploaded by the client is the data to be transmitted in this embodiment.
  • OBS Object Storage Service
  • S702 The source end 100 constructs a request header carrying the session identifier, and will send the request header to the destination end 200.
  • the attacker may replace the data in different sessions with each other during the data transmission process, so that the data received by the destination end 200 is not the data actually sent by the source end 100. Therefore, in this embodiment, the current session identifier can be transmitted to the destination terminal 200 first, so that the destination terminal can subsequently verify the received data in combination with the session identifier.
  • the source end 100 may also send the verification information corresponding to the request header to the destination terminal, so that the destination terminal 200 can use the verification information to perform information verification on the received request header, so as to determine the Whether the information carried in the request header has been tampered with during transmission.
  • S703 The source end 100 divides the data to be transmitted into multiple pieces of data.
  • the source end 100 may segment the data to be transmitted in equal-length segments according to a fixed size, then the size of each segment data may be the same, and the size of the last segment data may be the same as the size of other segment data. same or different. In other examples, the source end 100 may also obtain a plurality of segmented data obtained by division, or may have different sizes. In this embodiment, the specific implementation of how the source end 100 divides the data to be transmitted does not matter. be limited.
  • S704 The source end 100 determines the sending sequence of each segmented data.
  • the source end 100 may use the order of the segment data in the data to be transmitted as the sending order of the segment data.
  • One is sent to the destination, and the second segmented data obtained by the source 100 can be sent to the destination by the second, and so on.
  • the sending sequence of each segment data may also be different from the sequence of segment data in the data to be transmitted, which is not limited in this embodiment.
  • S705 The source end 100 generates check information of each segment data according to each segment data and the sending sequence of each segment data.
  • the verification information may be a digital signature corresponding to the segmented data, or may be an HMAC.
  • the source end 100 can generate the verification information corresponding to the segmented data according to the combination of each segmented data, the sending sequence of each segmented data, and the encryption key pre-stored by the source end 100, and the specific implementation can refer to the foregoing implementation. The relevant parts in the example are described and will not be repeated here.
  • S706 The source end 100 sends a plurality of segment data and the check information corresponding to the plurality of segment data to the destination end to the destination end.
  • the source end 100 may start a transmission thread, and use the transmission system to send the data to be transmitted to the destination end 200 .
  • the source end 100 may start multiple transmission threads at the same time, and use the multiple transmission threads to transmit different data to be transmitted to the destination end 200 respectively.
  • the specific implementation process in which the source end 100 uses each transmission thread to transmit a copy of the data to be transmitted to the destination end 200 may be similar.
  • the source end 100 when the source end 100 needs to transmit a resource to be transmitted to the destination end 200, the source end 100 can divide the resource to be transmitted into multiple different data to be transmitted, and use different transmission threads to transmit different data to be transmitted respectively. In this way, the data to be transmitted can be transmitted in parallel between the source end 100 and the destination end 200, thereby effectively improving the resource transmission efficiency.
  • the source end 100 does not transmit the sending sequence of the segmented data to the destination end 200. In this way, the attacker cannot learn the segmented data because of the The order in which the data is sent, so it is difficult to attack the parity information of the segmented data.
  • the source terminal 100 can send the description data corresponding to each copy of the data to be transmitted to the destination terminal. or slice range, so that the destination end 200 can integrate the received multiple pieces of different data to be transmitted according to the description data, so as to obtain the entire resource to be transmitted.
  • the description data may be carried in the foregoing request header, and of course, may also be sent independently, which is not limited in this embodiment.
  • the destination end 200 determines the receiving sequence of each segmented data.
  • S708 The destination end 200 verifies whether each segment data in the data to be transmitted is abnormally transmitted according to each segment data, the receiving sequence of each segment data, and the verification information of each segment data.
  • the destination terminal 200 can record the receiving sequence of the segment data, and combine the segment data and the segment data by using the reception sequence of the segment data. Check the received segment data to determine whether there is a transmission abnormality in the segment data during the transmission process.
  • the sending order of the segment data at the source end 100 is consistent with the receiving sequence of the segment data at the destination end 200 .
  • the destination terminal 200 can perform corresponding operations on the received segment data, the receiving sequence of the segment data, the key, and the received verification information, to verify whether the received segment data is transmitted. If there is an abnormality, for the specific verification process, reference may be made to the relevant descriptions in the foregoing embodiments, which will not be repeated here.
  • the source end 100 can transmit segment data to the destination end 200 one by one, and after the destination end 200 completes the verification of the currently received segment data, it notifies the source end 100 to transmit the next segment to the destination end 200. data.
  • the destination end 200 can find out in time through the verification process of the segmented data, thereby improving the verification efficiency.
  • the destination end 200 may disconnect the connection with the source end 100 when determining that the segmented data is abnormal, or notify the source end 100 to retransmit the segmented data.
  • the source end 100 may send an end identifier to the destination end 200, where the end identifier is used to identify the source end 100 to The last segment data transmitted by the destination 200. In this way, the destination end 200 can use the end identifier to determine that the multiple segment data currently received are all segment data sent by the source end 100 .
  • the destination end 200 may determine the destination end by not receiving the end identifier sent by the source end 100 or the value of the end identifier sent by the source end 100 Whether the 200 has received all the segmented data sent by the source end 100, so that when an attacker truncates part of the segmented data, the destination end 200 can find out in time.
  • the computer device 800 shown in FIG. 8 can be specifically used to implement the function of the signature device 120 in the source end 100 in the above-mentioned embodiment shown in FIG. 2
  • the computer device 900 shown in FIG. 9 can be specifically used to implement the above-mentioned embodiment shown in FIG. 2 function of the authentication device 210 in the destination terminal 200.
  • Computer device 800 includes bus 801 , processor 802 , communication interface 803 and memory 804 .
  • the processor 802 , the memory 804 and the communication interface 803 communicate through the bus 801 .
  • the signature device 120 is executed.
  • Software or program codes required for the functions of the middle segmentation module 121 , the sorting module 122 and the verification information generation module 123 are stored in the memory 804 .
  • the function of the transmission module 124 can be implemented through the communication interface 803 , and the processor 802 is configured to execute the instructions in the memory 804 to implement the method executed by the signature apparatus 120 .
  • Computer device 900 includes bus 901 , processor 902 , communication interface 903 and memory 904 .
  • the processor 902 , the memory 904 and the communication interface 903 communicate through the bus 901 .
  • the authentication device 210 is executed.
  • the software or program code required for the functionality of the verification module 212 is stored in the memory 904 .
  • the function of the transmission module 211 can be implemented through the communication interface 903 , and the processor 902 is configured to execute the instructions in the memory 904 to implement the method executed by the authentication apparatus 210 .
  • an embodiment of the present application further provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is run on a computer device, the computer device is made to execute the source end 100 described in the foregoing embodiments. method performed.
  • Embodiments of the present application further provide another computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium runs on a computer device, the computer device causes the computer device to execute the operations of the destination 200 described in the foregoing embodiments. method of execution.
  • Embodiments of the present application further provide a computer program product, and when the computer program product is executed by a computer, the computer executes any one of the foregoing data transmission methods.
  • the computer program product can be a software installation package, which can be downloaded and executed on a computer if any one of the aforementioned data providing methods needs to be used.
  • the device embodiments described above are only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be A physical unit, which can be located in one place or distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be retrieved from a website, computer, training device, or data Transmission from the center to another website site, computer, training facility or data center via wired (eg coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg infrared, wireless, microwave, etc.) means.
  • wired eg coaxial cable, fiber optic, digital subscriber line (DSL)
  • wireless eg infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be stored by a computer, or a data storage device such as a training device, a data center, or the like that includes an integration of one or more available media.
  • the usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVD), or semiconductor media (eg, Solid State Disk (SSD)), and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Bioethics (AREA)
  • Computer And Data Communications (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种数据传输方法，源端获取待传输数据，并将待传输数据切分为多个分段数据，并确定每个分段数据的发送顺序，从而可以根据该分段数据以及每个分段数据的发送顺序，生成每个分段数据的校验信息，然后将多个分段数据以及对应的校验信息发送给目的端。这样，目的端可以基于每个分段数据的接收顺序、校验信息对接收到的分段数据进行校验，从而确定分段数据在传输过程中是否存在传输异常。如此，当校验出存在分段数据出现传输异常时，目的端即可确定该待传输数据存在传输异常，无需等到整个待传输数据传输完毕才能确定，从而有效提高了待传输数据的校验效率。还提供了用于数据传输的装置、设备、系统及存储介质。

Description

一种数据传输方法、装置、设备、系统及存储介质 技术领域
本申请涉及数据安全技术领域，尤其涉及一种数据传输方法、装置、设备、系统及存储介质。
背景技术
在数据通信场景中，源端与目的端在通信时相互传输的数据，可能会因为在传输过程中遭受攻击而被篡改，为此，源端与目的端之间通常是采用数字签名或者基于哈希的消息认证码(Hash-based Message Authentication Code，HMAC)技术对待传输的数据进行签名校验，以提高源端与目的端之间通信的数据的可靠性。
但是，目的端需要在接收完整的待传输数据后，才能根据源端为该待传输数据生成的数字签名，校验其接收到的待传输数据是否与源端发送的待传输数据一致，这使得当待传输数据较大时，目的端对待传输数据的校验效率较低。
发明内容
本申请提供了一种数据传输方法，用于提高对待传输数据的校验效率。此外，本申请还提供了一种数据传输装置、设备、系统、计算机可读存储介质以及计算机程序产品。
第一方面，本申请提供了一种数据传输方法，应用于源端，源端可以获取待传输数据，例如可以是源端上的一个或者多个应用所产生的数据等，并将待传输数据切分为多个分段数据，并确定每个分段数据的发送顺序，从而可以根据该分段数据以及每个分段数据的发送顺序，生成每个分段数据的校验信息，然后，签名装置可以将多个分段数据以及多个分段数据分别对应的校验信息发送给目的端。这样，目的端可以基于每个分段数据的接收顺序对接收到的分段数据以及校验信息进行校验，从而可以确定每个分段数据在传输过程中是否存在传输异常。
如此，在对待传输数据的多个分段数据进行传输的过程中，当通过校验信息校验出存在分段数据出现传输异常时，目的端即可确定该待传输数据存在传输异常，无需等到整个待传输数据传输完毕才能确定，从而有效提高了待传输数据的校验效率。而且，由于校验信息是根据分段数据的发送顺序生成，并且该发送顺序也无需传输给目的端(目的端可以基于与发送顺序对应的接收顺序生成校验信息并对分段数据校验)，因此，目的端可以根据分段数据的接收顺序，校验出待传输数据中的多个分段数据在传输过程中是否被篡改、替换以及重组。如此，在提高数据校验的效率的同时，也进一步提高了数据传输的安全性。
其中，源端是一次会话过程中数据的发送方，而目的端是一次会话过程中数据的接收方。源端与目的端可以是由硬件或者软件实现，并且，源端与目的端可以是相同类型的硬件或者软件实现，也可以是不同类型的硬件或者软件实现，本实施例对此并不进行限定。
在一种可能的实施方式中，当校验信息具体为HMAC时，源端生成每个分段数据的校 验信息的过程，具体可以是将每个分段数据以及每个分段数据的发送顺序与密钥相组合，从而进行HMAC运算，获得每个分段数据对应的校验信息。
在一种示例中，针对于每个分段数据，源端可以将分段数据与该分段数据的发送顺序进行字符拼接，并对拼接得到的数据进行哈希运算，生成相应的摘要，然后，源端可以利用预先保存的密钥对生成的摘要进行加密，并将加密密文作为该分段数据对应的校验信息。相应的，目的端在对分段数据进行校验时，可以将接收到的分段数据与该分段数据的接收顺序进行字符拼接，并对拼接得到的数据进行同等的哈希运算，生成相应的摘要；同时，目的端可以利用预先保存的密钥对接收到的校验信息进行解密。然后，目的端可以通过比较生成的摘要与解密得到的摘要是否一致确定该分段数据在传输过程中是否存在传输异常。
在另一种示例中，针对于每个分段数据，源端可以采用相应的哈希算法对分段数据进行哈希运算，生成该分段数据对应的摘要，然后，源端可以将预先保存的加密密钥与该分段数据的发送顺序进行字符拼接，并基于拼接所得到的新密钥对生成的摘要进行加密，从而可以将得到的加密密文作为该分段数据对应的校验信息。相应的，目的端在对分段数据进行校验时，可以将该分段数据的接收顺序与预先保存的解密密钥进行字符拼接，并基于拼接得到的新密钥对接收到的校验信息进行解密，得到摘要；同时，目的端可以基于接收到的分段数据生成摘要，并通过比较生成的摘要与解密得到的摘要是否一致确定该分段数据在传输过程中是否存在传输异常。
在又一种示例中，针对于每个分段数据，源端可以采用相应的哈希算法对分段数据进行哈希云端，生成该分段数据对应的摘要，然后，源端可以将生成的摘要与该分段数据对应的发送顺序进行字符拼接，得到新的摘要，并利用预先保存的密钥对拼接得到的新摘要进行加密，从而可以将得到的加密密文作为该分段数据对应的校验信息。相应的，目的端在对分段数据进行校验时，可以利用预先保存的解密密钥对接收到的校验信息进行解密，并从解密得到的摘要中去除发送顺序，得到新的摘要；同时，目的端可以对接收到的分段数据进行哈希运算，生成相应的摘要。这样，目的端可以比较这两个摘要是否一致，以便于确定该分段数据在传输过程中是否存在传输异常。
在一种可能的实施方式中，源端与目的端之间可以通过会话传输待传输数据，则，源端在向目的端传输数据之前，可以先向目的端发送当前的会话标识，然后，源端在生成每个分段数据对应的校验信息时，可以是根据每个分段数据、每个分段数据的发送顺序以及该会话标识，生成每个分段数据的校验信息。这样，目的端在对每个分段数据进行校验时，可以结合该分段数据对应的会话标识进行校验，从而分段数据在传输过程中，存在两个不同会话中具有相同发送顺序的分段数据发生互换，目的端也可以校验出该当前所接收到的分段数据不是源端发送的分段数据，进而可以进一步提高数据通信的可靠性。
在一种可能的实施方式中，源端可以是在向目的端发送第一个分段数据以及该第一个分段数据的校验信息之前向目的端发送会话标识，并具体可以是向目的端发送携带有该会话的标识的请求头。
进一步的，源端向目的端发送的携带有该会话标识的请求中，还可以包括该请求头对 应的校验信息，从而目的端可以对利用该校验信息对接收到的请求头进行校验，从而确定接收到的请求头中所携带的内容是否在传输过程中被篡改。
在一种可能的实施方式中，源端在向目的端发送多个分段数据以及多个分段数据对应的校验信息时，具体可以是向目的端发送最后一个分段数据、最后一个分段数据的校验信息以及结束标识，其中，该结束标识指示多个分段数据传输完毕。如此，目的端可以通过该结束标识确定当前所接收到的多个分段数据，是否为源端所要传输给目的端的所有分段数据，从而目的端可以及时识别出分段数据在传输过程中是否被攻击者截断。
在一种可能的实施方式中，源端在获取待传输数据之前，可以先启动多个传输线程，并对获取的待传输资源进行切分，得到多个待传输数据，然后，源端可以通过每个传输线程，向目的端发送至少一个待传输数据的分段数据以及该分段数据对应的校验信息。如此，可以实现源端向目的端并行传输待传输数据，从而可以提高待传输资源在源端与目的端之间的传输效率。
在一种可能的实施方式中，源端在通过每个传输线程向目的端发送至少一个待传输数据的分段数据以及对应的校验信息之前，可以先发送携带有描述数据的请求头至目的端，从而目的端可以基于待传输数据的描述数据，确定接收到的多个待传输数据属于同一待传输资源，以便于目的端对接收到的多个待传输数据进行整合。其中，描述数据可以包括以下至少一种：待传输资源的标识以及待传输数据的切片范围。其中，待传输资源的标识例如可以是待传输资源的文件名等，待传输数据的切片范围例如可以是该数据的切片标识、切片大小等。
在一种可能的实施方式中，源端还可以基于时间信息和/或位置信息生成每个分段数据对应的校验信息，从而可以增加对于分段数据的校验维度，进一步提高数据校验的可靠性。
第二方面，本申请实施例还提供了一种数据传输方法，该方法应用于目的端。目的端可以接收来自源端的多个分段数据以及每个分段数据对应的校验信息，其中，所接收到的多个分段数据是由源端对待传输数据进行切分得到；然后，目的端可以确定每个分段数据的接收顺序，并根据每个分段数据、每个分段数据的接收顺序以及每个分段数据的校验信息，校验待传输数据中的每个分段数据是否传输异常。
如此，在对待传输数据的多个分段数据进行传输的过程中，当通过校验信息校验出存在分段数据出现传输异常时，目的端即可确定该待传输数据存在传输异常，无需等到整个待传输数据传输完毕才能确定，从而有效提高了待传输数据的校验效率。而且，由于校验信息是根据分段数据的发送顺序生成，并且该发送顺序也无需传输给目的端(目的端可以基于与发送顺序对应的接收顺序生成校验信息并对分段数据校验)，因此，目的端可以根据分段数据的接收顺序，校验出待传输数据中的多个分段数据在传输过程中是否被篡改、替换以及重组。如此，在提高数据校验的效率的同时，也进一步提高了数据传输的安全性。
在一种可能的实施方式中，校验信息具体为HMAC，则目的端在校验待传输数据中的每个分段数据是否传输异常时，具体可以是根据每个分段数据、每个分段数据的接收顺序、密钥以及接收到的校验信息，确定待传输数据中的每个分段数据是否传输异常。
针对于每个分段数据、每个分段数据的接收顺序以及密钥的组合，在一种示例中，针 对于每个分段数据，源端可以将分段数据与该分段数据的发送顺序进行字符拼接，并对拼接得到的数据进行哈希运算，生成相应的摘要，然后，源端可以利用预先保存的密钥对生成的摘要进行加密，并将加密密文作为该分段数据对应的校验信息。相应的，目的端在对分段数据进行校验时，可以将接收到的分段数据与该分段数据的接收顺序进行字符拼接，并对拼接得到的数据进行同等的哈希运算，生成相应的摘要；同时，目的端可以利用预先保存的密钥对接收到的校验信息进行解密。然后，目的端可以通过比较生成的摘要与解密得到的摘要是否一致确定该分段数据在传输过程中是否存在传输异常。
在另一种示例中，针对于每个分段数据，源端可以采用相应的哈希算法对分段数据进行哈希运算，生成该分段数据对应的摘要，然后，源端可以将预先保存的加密密钥与该分段数据的发送顺序进行字符拼接，并基于拼接所得到的新密钥对生成的摘要进行加密，从而可以将得到的加密密文作为该分段数据对应的校验信息。相应的，目的端在对分段数据进行校验时，可以将该分段数据的接收顺序与预先保存的解密密钥进行字符拼接，并基于拼接得到的新密钥对接收到的校验信息进行解密，得到摘要；同时，目的端可以基于接收到的分段数据生成摘要，并通过比较生成的摘要与解密得到的摘要是否一致确定该分段数据在传输过程中是否存在传输异常。
在又一种示例中，针对于每个分段数据，源端可以采用相应的哈希算法对分段数据进行哈希云端，生成该分段数据对应的摘要，然后，源端可以将生成的摘要与该分段数据对应的发送顺序进行字符拼接，得到新的摘要，并利用预先保存的密钥对拼接得到的新摘要进行加密，从而可以将得到的加密密文作为该分段数据对应的校验信息。相应的，目的端在对分段数据进行校验时，可以利用预先保存的解密密钥对接收到的校验信息进行解密，并从解密得到的摘要中去除发送顺序，得到新的摘要；同时，目的端可以对接收到的分段数据进行哈希运算，生成相应的摘要。这样，目的端可以比较这两个摘要是否一致，以便于确定该分段数据在传输过程中是否存在传输异常。
在一种可能的实施方式中，目的端可以通过会话接收到源端发送的待传输数据，则目的端还可以接收来自源端的会话的标识；则目的端在校验分段数据是否存在传输异常时，具体可以是根据每个分段数据、每个分段数据的接收顺序、每个分段数据的校验信息以及当前会话的标识，校验待传输数据中的每个分段数据是否传输异常。这样，即使分段数据在传输过程中，存在两个不同会话中具有相同发送顺序的分段数据发生互换，目的端也可以校验出该当前所接收到的分段数据不是源端发送的分段数据，进而可以进一步提高数据通信的可靠性。
在一种可能的实施方式中，目的端可以接收来自源端的请求头，该请求头中携带有当前源端与目的端之间的会话的标识，从而目的端可以从该请求头中解析出会话标识。
在一种可能的实施方式中，目的端可以接收源端发送的请求头对应的校验信息，从而基于该请求头对应的校验信息确定该请求头中所携带的内容在传输过程中是否被篡改。
在一种可能的实施方式中，目的端在接收来自源端的多个分段数据以及每个分段数据对应的校验信息的过程中，可以是接收来自源端的最后一个分段数据、最后一个分段数据的校验信息以及结束标识，其中，该结束标识指示多个分段数据传输完毕。如此，目的端 可以通过该结束标识确定当前所接收到的多个分段数据，是否为源端所要传输给目的端的所有分段数据，从而目的端可以及时识别出分段数据在传输过程中是否被攻击者截断。
在一种可能的实施方式中，目的端在接收来自源端的多个分段数据以及每个分段数据对应的校验信息时，具体可以是接收源端通过每个传输线程发送的至少一个待传输数据的分段数据以及对应的校验信息，其中，不同传输线程用于传输对待传输资源切分得到的不同待传输数据，从而源端向目的端并行传输待传输数据，进而可以提高待传输资源在源端与目的端之间的传输效率。
在一种可能的实施方式中，目的端在接收源端通过每个传输线程发送的至少一个待传输数据的分段数据以及对应的校验信息之前，可以接收来自源端的携带有描述信息的请求头，其中，待传输资源的标识例如可以是待传输资源的文件名等，待传输数据的切片范围例如可以是该数据的切片标识、切片大小等。
在一种可能的实施方式中，源端还可以基于时间信息和/或位置信息生成每个分段数据对应的校验信息，从而可以增加对于分段数据的校验维度，进一步提高数据校验的可靠性。
第三方面，本申请提供一种源端，该源端用于实现第一方面或第一方面任一种可能实现方式中源端执行的数据传输方法的各个模块。
第四方面，本申请提供一种目的端，该源端用于实现第二方面或第二方面任一种可能实现方式中目的端执行的数据传输方法的各个模块。
第五方面，本申请提供一种数据传输系统，包括源端和目的端，其中，源端用于执行上述第一方面或第一方面任一种可能的实施方式中的数据传输方法，目的端用于执行上述第二方面以及第二方面任一种可能的实施方式中的数据传输方法。
第六方面，本申请提供一种计算设备，所述计算设备包括处理器和存储器；所述处理器用于执行所述存储器中存储的指令，执行上述第一方面或第一方面任一种可能的实施方式中源端执行的数据传输方法。
第七方面，本申请提供一种计算设备，所述计算设备包括处理器和存储器；所述处理器用于执行所述存储器中存储的指令，执行上述第二方面或第二方面任一种可能的实施方式中目的端执行的数据传输方法。
第八方面，本申请提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机设备上运行时，使得该计算机设备执行上述第一方面或第一方面的任一种实现方式所述的方法。
第九方面，本申请提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机设备上运行时，使得该计算机设备执行上述第二方面或第二方面的任一种实现方式所述的方法。
第十方面，本申请提供了一种包含指令的计算机程序产品，当其在计算机设备上运行时，使得计算机设备执行上述第一方面或第一方面的任一种实现方式所述的方法。
第十一方面，本申请提供了一种包含指令的计算机程序产品，当其在多个计算机设备上运行时，使得计算机设备执行上述第二方面或第二方面的任一种实现方式所述的方法。
本申请在上述各方面提供的实现方式的基础上，还可以进行进一步组合以提供更多实 现方式。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请中记载的一些实施例，对于本领域普通技术人员来讲，还可以根据这些附图获得其它的附图。
图1为一种应用场景的架构示意图；
图2为本申请实施例中一种数据传输系统的架构示意图；
图3为本申请实施例中对待传输数据进行切分以及生成校验信息的示意图；
图4为本申请实施例中并行传输多个待传输数据的示意图；
图5为本申请实施例中源端100向目的端200传输请求头示意图；
图6为本申请实施例中一示例性请求头示意图；
图7为本申请实施例中源端100与目的端200之间传输数据的流程示意图；
图8为本申请实施例中一种计算机设备的硬件结构示意图；
图9为本申请实施例中又一种计算机设备的硬件结构示意图。
具体实施方式
实际应用中，数据在源端与目的端之间进行传输时，可能会遭受中间人攻击，导致目的端所接收到的数据(如文件、数据流等)与源端发送的数据并不相同。如图1所示，源端在通过网络(internet)将文件发送给目的端的过程中，中间人(通过代理服务器)对该文件的攻击手段主要为“篡改”，即将合法的文件段内容(也即源端发送的文件)进行修改，如将部分内容修改成其他内容等，使得目的端最终所接收到的完整文件与源端发送的原始完整文件的内容存在差异，从而影响了源端与目的端之间通信的可靠性。
基于此，源端在发送文件之前，可以基于数字签名或者HMAC为整个文件进行签名，并将签名以及整个文件发送给目的端，然后，由目的端通过校验签名来检测接收到的文件是否在传输过程中被篡改，以提高源端与目的端之间通信的可靠性。
其中，数字签名，也可以被称为公钥数字签名，具体是只有信息的发送者才能产生的别人无法伪造的一段数字串，该数字串同时也是对信息的发送者发送信息真实性的一个有效证明。一套数字签名通常定义两种互补的运算，一种用于签名，另一种用于验证。
HMAC，是一种基于Hash函数和密钥进行消息认证的方法，它要求通信双方共享密钥、约定算法、对传输数据进行Hash运算，形成固定尺寸的认证码。通信双方通过认证码的校验来确定传输数据的合法性。
但是，上述对于文件的校验方式，目的端需要在接收完整的文件后才能校验该文件是否出现传输异常，并且在确定文件存在传输异常后，通知源端重新发送整个文件。因此，该文件中未出现传输异常的部分仍旧需要重新从源端传输至目的端，这使得文件的校验以及传输效率较低。特别的，当源端与服务器之间传输的文件较大时，目的端可能长时间无法接收到正常的完整文件。攻击者也可能基于此不断发送大的错误文件消耗目的端算力。
基于此，本申请实施例提供了一种数据传输方法，用于提高对需要传输的文件等数据的校验效率。具体实现时，源端可以对待传输数据进行分段，源端确定该待传输数据包括的多个分段数据的发送顺序，并基于该发送顺序生成每个分段数据对应的校验信息。然后，源端可以将该校验信息与该分段数据发送给目的端。这样，目的端针对于每个接收到的分段数据，均可以根据目的端接收该分段数据的接收顺序以及该分段数据对应的校验信息对该分段数据进行校验，以确定该分段数据在传输过程中是否出现传输异常，也即确定待传输数据在传输过程中是否出现传输异常。
如此，在数据传输过程中，目的端可以及时确定出存在传输异常的分段数据，无需等待整个待传输数据传输完成后才能进行校验，从而提高了数据校验效率。并且，由于校验信息是根据分段数据的发送顺序生成，并且该发送顺序也无需传输给目的端(目的端可以基于与发送顺序对应的接收顺序生成校验信息并对分段数据校验)，因此，目的端可以根据分段数据的接收顺序，校验出待传输数据中的多个分段数据在传输过程中是否被篡改、替换以及重组。如此，在提高数据校验的效率的同时，也进一步提高了数据传输的安全性。
进一步的，对于目的端所确定出存在传输异常的分段数据，源端可以仅重传该分段数据至目的端，而无需重传整个待传输数据，因此，待传输数据中未出现传输异常的分段数据可以无需再传输至目的端，从而可以提高数据的传输效率。
下面结合附图，对本申请的实施例进行描述。
本申请的说明书及附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的术语在适当情况下可以互换，这仅仅是描述本申请的实施例中对相同属性的对象在描述时所采用的区分方式。
参见图2所示的数据传输系统的结构示意图，该数据传输系统包括源端100以及目的端200，源端100与目的端200之间通过中间网络300进行通信。其中，源端100是指一次会话过程中数据的发送方，而目的端200是指该会话过程中数据的接收方。源端100与目的端200可以是具有通信能力的任何设备，或者是设备上的软件模块等。具体的，当源端100与目的端200基于硬件实现时，源端100可以是提供数据的终端，目的端200可以是接收数据的服务器等；或者，源端100，也可以是提供数据的服务器，而目的端200可以是接收数据的终端等。其中，源端100与目的端200可以是同一类型的设备，也可以是不同类型的设备。如源端100与目的端200均可以是终端，即两个终端之间可以通过中间网络300相互收发数据，或者，源端100与目的端200均可以是服务器，即在两个服务器之间进行数据通信。
当源端100与目的端200具体为设备上的软件模块时，源端100可以是运行在设备上的客户端，而目的端200可以是云平台所提供的云服务模块。当然，也可以是由云服务模块向客户端发送数据，即源端100为云服务模块，而目的端200为客户端，或者源端100与目的端200均为客户端或者均为云服务模块。作为一种示例，源端100中可以包括数据生产装置110以及签名装置120。其中，数据生产装置110用于产生需要传输至目的端200的待传输数据。而签名装置120用于对待传输数据进行分段、签名等处理。
其中，该数据生产装置110可以包括一个或多个应用，而签名装置120可以作为软件开发工具包(software development kit，SDK)内嵌入该应用中。或者，数据生产装置110可以包含多个应用，而签名装置120可以作为源端100中独立的应用软件，能够同时为多个应用所产生的待传输数据进行处理。
签名装置120中包括分段模块121、排序模块122、校验信息生成模块123以及传输模块124。其中，源端100在传输数据之前，可以通过分段模块121对待传输数据进行切分，得到该待传输数据对应的多个分段数据。如图3所示，分段模块121可以将待传输数据切分成(N+1)个分段数据，分别为分段数据0(segment 0)至分段数据N(segment N)。示例性的，分段模块121可以按照预设尺寸(size)对待传输数据进行切分，切分得到的多个分段数据的尺寸相同，当然，最后一个分段数据的尺寸可以小于或等于该预设尺寸。该预设尺寸可以预先由技术人员进行预先设定，也可以是由源端自定设定，例如1M Byte(MB)，64K Byte(KB)等。比如，对于一份尺寸为1024KB的待传输数据，假设分段模块121按照64KB的预设尺寸切分待传输数据时，可以得到16个分段数据。分段模块121也可以采用其它方式对待传输数据进行分段，例如不采用固定的预设尺寸进行数据分段，每个分段数据的尺寸可以不同。
在分段模块121切分待传输数据得到多个分段数据后，排序模块122可以确定该多个分段数据向目的端200发送的顺序。示例性的，排序模块122可以将各个分段数据在待传输数据中的排布顺序，作为该分段数据发送给目的端200的顺序。例如，排序模块122将待传输数据的第一个分段数据(头64KB)排序为1，后续第一个分段数据基于该排序被第一个发送给目的端200，将待传输数据的第二个分段数据(第64KB至128KB的数据)排序为2，后续第二个分段数据基于该排序被第二个发送给目的端200，依次类推。
在其它可能的示例中，排序模块122可以是对多个分段数据进行随机排序，如，源端100可以基于预设的随机算法确定出每个分段数据的发送顺序。则，通常情况下，源端100发送各个分段数据的顺序与各个分段数据在待传输数据中的排布顺序不同。这样，即使源端100在传输各个分段数据时遭受攻击，也难以根据各个分段数据的发送顺序/传输顺序确定各个分段数据在待传输数据中的排布顺序，从而难以基于各个分段数据重构得到待传输数据，进一步提高了待传输数据的传输安全性。
在排序模块122为每个分段数据确定发送顺序后，签名装置120可以通过校验信息生成模块123为每个分段数据生成相应的校验信息，如图3所示，针对于分段模块121切分得到的分段数据0至分段数据N，校验信息生成模块123可以基于各个分段数据生成相应的校验信息0至校验信息N。具体实现时，针对于多个分段数据中的任意一个分段数据(以下称之为目标分段数据)，校验信息生成模块123可以结合目标分段数据的发送顺序、分段数据以及密钥，为该目标分段数据生成相应的校验信息，该校验信息用于后续目标分段数据在传输至目的端200时的一致性校验。
实际应用中，该校验信息，可以是该目标分段数据对应的数字签名。示例性的，本实施例提供了以下几种生成校验信息的方式。
方式一：校验信息生成模块123可以将目标分段数据与发送顺序进行数据拼接(或者 其他方式的组合)，并为拼接后的数据内容生成摘要，再利用源端100保存的公钥对该摘要进行加密，即可得到该目标分段数据对应的数字签名。
方式二：校验信息生成模块123为目标分段数据生成摘要后，将该摘要与目标分段数据的发送顺序进行数据拼接(或者其他方式的组合)，并利用源端100保存的公钥对拼接得到的摘要进行加密，从而得到该目标分段数据对应的数字签名。
在其他可能的实施方式中，该校验信息，也可以是结合发送顺序而生成的该目标分段数据对应的HMAC，或者可以是其它结合发送顺序而生成的并且能够用于对目标分段数据进行一致性校验的数据等。
例如，方式三：当校验信息具体为HMAC时，针对于每个分段数据(即目标分段数据)，校验信息生成模块123可以将源端100保存的加密密钥与目标分段数据对应的发送顺序进行数据拼接(或者采用其它方式组合)，得到拼接后的密钥，再利用拼接后的密钥对基于目标分段数据生成的摘要进行加密，得到该目标分段数据对应的HMAC，并作为该目标分段数据对应的校验信息。
方式四：校验信息生成模块123可以将目标分段数据与加密密钥进行数据拼接，得到拼接后的数据，再利用源端100保存的加密密钥对基于拼接后的数据所生成的摘要进行加密，得到该目标分段数据对应的HMAC。
方式五：校验信息生成模块123在基于目标分段数据生成摘要后，将该摘要与该目标分段数据对应的发送顺序进行数据拼接(或者其它方式组合)，并利用源端100保存的加密密钥对拼接得到的摘要进行加密，得到该目标分段数据对应的HMAC。当然，上述对于生成校验信息的具体实现方式仅作为一些示例性说明，并不用于限定其在实际应用中的具体实现。
在得到目标分段数据以及该目标分段数据对应的校验信息后，签名装置120通过传输模块124将目标分段数据以及该校验信息发送给目的端200。
作为一种示例，源端100可以与目的端200之间通过超文本传输协议(HyperText Transfer Protocol，HTTP)或者超文本传输安全协议(HyperText Transfer Protocol Secure，HTTPS)建立通信连接，并在该连接下将待传输数据通过中间网络300传输至目的端200。其中，中间网络300针对于传输模块124发送的每个分段数据以及该分段数据对应的校验信息，可以将其拆分成多个分段子数据，并针对于每个分段分段子数据采用网际互联(Internet Protocol，IP)协议将其封装成IP协议报文，如基于传输控制协议(Transmission Control Protocol，TCP)或用户数据报协议(User Datagram Protocol，UDP)对各个分段子数据进行报文封装等。然后，中间网络300可以将分段数据对应的各个IP协议报文发送给目的端200。其中，每个IP协议报文中可以携带有部分分段数据和/或该分段数据对应的(部分或全部)校验信息。
在一种可选的方案中，为提高目的端200对于接收到的目标分段数据的验证可靠性，签名装置120不将该目标分段数据的发送顺序发送给目的端200，从而避免该发送顺序在由源端100至目的端200的传输过程中被窃取，从而避免影响目的端200对于接收到的目标分段数据的校验，如攻击者可能在篡改传输的目标分段数据时，还基于窃取的发送顺序 对目标分段数据的数字签名也进行篡改等。
目的端200中可以包括传输模块211以及校验模块212。其中，传输模块211可以用于接收源端100发送的目标分段数据以及该目标分段数据对应的校验信息，并可以进一步确定该目标分段数据以及该目标分段数据对应的校验信息的接收顺序，该接收顺序例如可以是目的端200接收的第几个分段数据，然后将目标分段数据、校验信息以及接收顺序交由校验模块212进行数据校验。校验模块212可以根据该校验信息、目标分段数据以及接收顺序，对目标分段数据进行校验，以确定该目标分段数据是否存在传输异常，即校验目的端200所接收到的目标分段数据与源端100发送的目标分段数据是否一致。
作为一种示例，当校验信息具体为数字签名时。若签名装置120基于上述方式一中的实现方式生成数据签名，则校验模块212在进行校验时，可以利用目的端200保存的私钥对接收到的数字签名进行解密，得到摘要A，并按照相同规则将目标分段数据与接收顺序进行数据拼接，并根据拼接后的数据内容生成摘要B。然后，校验模块212将摘要A与摘要B进行比较，确定两个摘要是否一致，若是，则校验模块212可以确定目标分段数据不存在传输异常，即目的端200所接收到的目标分段数据与源端100发送的目标分段数据一致；而若两个摘要不一致，则校验模块212可以确定目标分段数据存在传输异常，即目的端200所接收到的目标分段数据与源端100发送的目标分段数据不一致，比如，目标分段数据可能存在内容篡改，或者在传输过程中被替换等。
在其它示例中，若签名装置120基于上述方式二生成数字签名，则校验模块212在进行校验时，可以利用目的端200保存的私钥对接收到的数字签名进行解密，得到摘要A，并根据源端100生成数字签名的规则，从该摘要A中推导出目标分段数据对应的摘要B，如从摘要A中去除发送顺序的部分获得摘要B。并且，校验模块212可以根据接收到的目标分段数据生成摘要C。然后，校验模块212可以比较该摘要B与摘要C是否一致，若是，则校验模块212可以确定目标分段数据不存在传输异常，而若不是，则校验模块212可以确定目标分段数据存在传输异常。上述两个示例，仅作为在校验信息具体为数字签名时校验模块212对目标分段数据进行校验过程的示例性说明，实际应用中，也可以采用其它实现方式。
此外，校验信息，也可以是结合发送顺序而生成的该目标分段数据对应的HMAC，或者可以是其它结合发送顺序而生成的并且能够用于对目标分段数据进行一致性校验的数据等。
示例性的，当校验信息具体为HMAC时，若签名装置120基于上述方式三生成HMAC，针对于每个分段数据(即目标分段数据)，校验模块212将目的端200保存的解密密钥与该目标分段数据对应的接收顺序进行数据拼接(或者采用其它方式组合)，得到拼接后的密钥，再利用拼接后的密钥对接收到的校验信息(即HMAC)进行解密，得到摘要A；然后校验模块212基于接收到的目标分段数据生成的摘要B，并比对摘要A与摘要B是否一致。若两个摘要一致，则校验模块212可以确定目标分段数据不存在传输异常，而若不是，则校验模块212可以确定目标分段数据存在传输异常。
当校验信息具体为HMAC时，若签名装置120基于上述方式四生成HMAC，校验模 块212可以将接收到的目标分段数据与该目标分段数据对应的接收顺序进行数据拼接(或者采用其它方式组合)，并基于拼接得到的数据内容生成相应的摘要A，然后，校验模块212可以利用目的端200保存的解密密钥对接收到的校验信息进行解密，得到摘要B，并将摘要A与摘要B进行比对，确定两个摘要是否一致。若一致，则校验模块212可以确定目标分段数据不存在传输异常，否则，确定目标分段数据存在传输异常。
当校验信息具体为HMAC时，若签名装置120基于上述方式五生成HMAC，校验模块212可以利用解密密钥对接收到的校验信息进行解密，得到摘要A，并从摘要A中去除目标分段数据对应的接收顺序，得到摘要B；然后，校验模块212可以基于接收到的目标分段数据生成摘要C，并比较摘要B与摘要C是否一致。若一致，则校验模块212可以确定目标分段数据不存在传输异常，否则，确定目标分段数据存在传输异常。
本实施例中，校验模块212可以根据目标分段数据的接收顺序以及接收到的校验信息，对接收到的目标分段数据进行校验的具体实现过程可以采用任意可适用的实现方式，本实施例对此并不进行限定和赘述。
基于上述过程，源端100与目的端200在传输待传输数据中的每个分段数据时，均可以按照上述过程对传输的分段数据进行校验，并且在当前传输的分段数据通过校验时，源端100继续向目的端200传输下一个分段数据。而若当前传输的分段数据未通过校验，则目的端200可以通知源端100重新传输该分段数据，并对重新传输的分段数据继续进行校验，直至目的端200所接收到的分段数据与源端100发送的分段数据一致时才传输下一个分段数据。由于每个分段数据的数据量小于待传输数据的数据量，因此，通过对传输的每个分段数据进行校验，可以有效提高校验效率。而且，即使任意分段数据在传输过程中发生替换(即利用其它分段数据来替换当前正在传输的分段数据)、重放(即重复发送相同分段数据)以及顺序重组(即多个分段数据在传输过程中的顺序被重新组合)等传输异常时，目的端200均可以通过上述校验过程进行及时确定传输异常的发生。
进一步的，源端100还可以通知目的端200待传输数据被传输完毕，以使得目的端200能够确定当前所接收到的多个分段数据包含待传输数据的所有分段数据。同时，目的端200也能依据是否收到源端100发送的待传输数据传输完毕的通知而确定待传输数据中的部分分段数据是否在传输过程中被攻击者截断。
在一种示例性的实现方式中，源端210在向目的端200成功传输待传输数据的所有分段数据后，可以继续向目的端200传输一个特殊的分段数据，以下称之为结束分段数据。其中，结束分段数据中可以携带有结束标识，该结束标识能够用于指示该待传输数据的多个分段数据均已经成功传输至目的端200。源端100中的分段模块121在对待传输数据进行切分并得到多个分段数据的同时，还可以构造出一个尺寸为0的结束分段数据，并由排序模块122确定该结束分段数据的发送顺序为最后发送。同时，校验信息生成模块123可以根据该结束分段数据所对应的发送顺序，为该结束分段数据生成数字签名，然后，交由传输模块124向目的端200发送该结束分段数据以及相应的数字签名。这样，当目的端200接收到该结束分段数据并完成对该结束分段数据的校验后，可以确定待传输数据的多个分段数据传输完成。如此，实现了整个待传输数据由源端100至目的端200的成功传输。
而在其它可能的实施方式中，源端100在向目的端200发送分段数据的同时，还发送待传输数据是否结束的结束标识，比如可以是在发送最后一个分段数据以及该最后一个分段数据对应的校验信息时，发送结束标识。这样，中间网络300在传输每个分段数据时，可以基于该分段数据生成多个报文(每个报文携带分段数据中的部分数据)，并在报文头(或者报文中的其它位置)中新定义结束指示字段，该结束指示字段用于指示当前传输的分段数据为最后一个分段数据，并根据该结束标识的取值在报文头中定义结束指示字段的值。例如，当该结束指示字段的值为0时，表征待传输数据未传输完毕，而当结束指示字段的值为1时，表征待传输数据传输完毕。实际应用中，若分段模块121将待传输数据切分成(N+1)个分段数据，则源端100向目的端200发送的第1个至第N个分段数据对应的报文中，结束指示字段的数值可以为0；而源端100向目的端200发送的第(N+1)个分段数据对应的报文中，结束指示字段的数值可以为1，用于告知目的端200待传输数据的最后一个分段数据已经完成传输。
当然，上述示例，仅用于对源端100通知目的端200待传输数据传输完成的实现过程的示例性说明，在其它实施例中，源端100也可以是基于其它方式通知目的端200待传输数据的传输过程结束，比如，源端100单独向目的端200发送传输结束的指示消息，该指示消息中携带有结束标识等，本实施例对此并不进行限定。
上述实施例中，签名装置120可以通过单个线程实现上述对于待传输数据的分段、确定发送顺序、生成校验信息以及发送分段数据的过程，而在实际应用中，签名装置120也可以是通过多个线程，向目的端200并发传输数据，以提高源端100向目的端200的数据传输效率。
作为一种示例性的实施方式，数据生产装置110可以将待传输资源切分成多个待传输数据，比如切分成第一待传输数据以及第二待传输数据，并将这两个待传输数据传输给签名装置120。而签名装置120可以具有多个线程，以具有线程1以及线程2为例。在对待传输数据进行签名时，签名装置120可以基于上述实施例用每个线程处理一个待传输数据。具体的，如图4所示，签名装置120利用线程1，对第一待传输数据进行切分，得到第一待传输数据的多个分段数据，并进一步为该第一待传输数据的每个分段数据确定发送顺序以及相应的第一校验信息，再利用该线程1将第一待传输数据的多个分段数据以及每个分段数据对应的第一校验信息发送给目的端200。其中，第一校验信息，即根据第一待传输数据的分段数据进行生成。类似的，对于第二待传输数据，签名装置120可以利用线程2对该第二待传输数据进行分段、确定发送顺序、生成校验信息以及向目的端200发送第二待传输数据的各个分段数据以及相应校验信息的过程。其中，第二校验信息，即根据第二待传输数据的分段数据进行生成。本实施例中，对于签名装置120利用线程1向目的端200传输第一待传输数据的具体实现过程，以及利用线程2向目的端200传输第二待传输数据的具体实现过程，可以参见上述相关之处描述，本实施例对此不再进行赘述。
其中，源端100可以先启动多个传输线程，再将获取到的待传输资源切分成多个待传输数据，也可以是在切分得到多个待传输数据后，启动多个传输线程，或者二者同时执行等，本实施例中，对这两个过程的具体执行顺序并不进行限定。
相应的，目的端200上至少可以具有两个线程，为便于区分，以下称之为线程3以及线程4。认证装置210可以利用线程3接收源端100利用线程1发送的第一待传输数据对应的各个分段数据以及校验信息，并对接收到的该分段数据进行相应的校验；同时，认证装置210可以利用线程4接收源端220利用线程2发送的第二待传输数据对应的各个分段数据以及校验信息，并对接收到的该分段数据进行相应的校验。其中，线程3以及线程4对分段数据进行校验的具体实现过程可以参见上述相关之处描述，在此不做赘述。
为便于目的端200确定第一待传输数据以及第二待传输数据为同一待传输资源下的两个不同待传输数据，在一些可能的实施方式中，源端100在向目的端200发送第一待传输数据以及第二待传输数据的各个分段数据的同时，还向目的端200发送第一待传输数据以及第二待传输数据分别对应的描述数据，具体是通过线程1向目的端200发送第一待传输数据的描述数据，通过线程2向目的端200发送第二待传输数据的描述数据。这样，目的端200在接收到第一待传输数据的分段数据以及第二待传输数据的分段数据时，可以根据第一待传输数据以及第二待传输数据的描述数据，确定该第一待传输数据的分段数据以及第二待传输数据的分段数据属于同一待传输资源，并基于第一待传输数据的各个分段数据以及第二待传输数据的各个分段数据，整合得到完整的待传输资源。
作为一种示例，第一待传输数据的描述数据，例如可以包括第一待传输数据所属的待传输资源的标识(resource ID)，如文件名、统一资源定位符(uniform resource locator，URL)或者经过哈希运算的URL等。进一步的，描述数据，还可以包括该第一待传输数据的切片范围(range)。其中，第一待传输数据的切片范围，例如可以是第一待传输数据的切片大小、切片标识等。第二待传输数据的描述数据，与第一待传输数据的描述数据类似，在此不做赘述。
进一步的，签名装置120在利用线程1为第一待传输数据的每个分段数据生成第一校验信息时，也可以根据该分段数据的发送顺序以及该第一待传输数据的描述数据进行生成。例如，当第一校验信息具体为数字签名时，签名装置120可以利用线程1为该分段数据生成摘要，并将该摘要与该分段数据对应的发送顺序、第一待传输数据的描述数据进行数据拼接，并对拼接后所得到的数据内容进行加密，得到该分段数据所对应的数字签名等。相应的，认证装置210在利用线程3为对该分段数据进行校验时，可以利用公钥对接收到的该分段数据对应的校验信息进行解密，并从解密得到的数据内容中反算出该分段数据对应的摘要，从而通过比对该摘要与根据接收到的分段数据所生成的摘要是否一致，来确定认证装置210接收到的分段数据与签名装置120发送的分段数据是否一致。类似的，针对于第二待传输数据中的各个分段数据，签名装置120也可以是利用线程2，根据第二待传输数据的描述数据以及该分段数据对应的发送顺序，生成该分段数据对应的第二校验信息，其具体实现方式可参见生成第一校验信息之处的相关描述，在此不做赘述。
实际应用中，签名装置120也可以是利用多个线程，同时对数据生产装置110提供的多个不同的待传输数据分别进行签名，并在完成签名后，将多个不同的待传输数据以及校验信息并行传输至目的端，其具体实现过程与上述签名装置120为两个待传输数据分别签名并传输的具体实现类似，可参见前述相关之处描述，在此不做赘述。
实际应用的一些场景中，在待传输数据的多个分段数据由源端100传输至目的端200的过程中，存在部分分段数据被攻击者利用其它数据的具有相同发送顺序的分段数据进行替换的可能性。比如，假设同时存在源端A 1向目的端A 2发送待传输数据a，以及源端B 1向目的端B 2发送待传输数据b，则攻击者可以在源端A 1以及源端A 2传输分段数据的过程中，将具有相同发送顺序的部分分段数据进行互换。比如，假设源端A 1依次发送待传输数据a中的分段数据a 1、a 2、a 3、a 4、a 5，源端A 2依次发送待传输数据b中的分段数据b 1、b 2、b 3、b 4、b 5，则攻击者可以将待传输数据a中的分段数据a 3与待传输数据b中的分段数据b 3进行互换，从而目的端A 2所接收到的分段数据依次为a 1、a 2、b 3、a 4、a 5，而目的端B 2所接收到的分段数据依次为b 1、b 2、a 3、b 4、b 5，如此，造成目的端A 1与A 2所接收到的数据存在异常。
基于此，在将待传输数据的各个分段数据传输至目的端200的过程中，传输模块124可以先向目的端200发送目标分段数据(即待传输数据的多个分段数据中的任意一个分段数据)对应的会话标识，该会话标识用于标识传输该目标分段数据所对应的会话。这样，目的端200的认证装置210可以基于该会话标识，校验所接收到的不同分段数据是否属于同一会话，从而使得目的端200所接收到的不同分段数据属于该会话所对应的同一待传输资源。
其中，该会话标识，例如可以是数据传输的任务标识(SessionID)、请求标识(RequestID)、通用唯一识别码(Universally Unique Identifier，UUID)、为该会话生成的随机数(RandomNumber)、头哈希值(HeaderHash)、头签名值(HeaderSignature)中的任意一种或多种，或者可以是将上述任意一种或多种信息进行特征组合，并将组合得到的信息作为待传输数据的会话标识等。本实施例中，对于会话标识的具体实现方式并不进行限定。
在一种防止替换攻击的示例性实施方式中，传输模块124可以构造请求头，如基于HTTP协议的请求头等，该请求头中携带有待传输数据对应的会话标识。作为一种示例，传输模块124可以构造出入图6所示的请求头，其中，该请求头中的部分字段(头部)可以用于记录该请求头的属性信息，如请求类型、版本号等信息；该请求头中的另一部分字段可以用于记录待传输数据对应的会话标识，实际应用中，该部分字段可以是通过对已有的字段或者保留字段进行重定义，以实现利用该部分字段记录会话标识。然后，传输模块124可以将该请求头发送给目的端200，如图5所示。这样，目的端200可以从接收到的请求头中解析出该会话标识，并确定后续接收到的多个分段数据为均通过该会话标识所对应的会话完成传输。
相应的，校验信息生成模块123在为待传输数据中的每个分段数据生成校验信息时，可以根据该分段数据的发送顺序以及该分段数据对应的会话标识(也即该分段数据所属的待传输数据对应的会话标识)生成校验信息。比如，当校验信息具体为数字签名时，校验信息生成模块123可以将该发送顺序以及会话标识与根据分段数据生成的摘要进行数据拼接，并对拼接得到的数据内容进行加密处理，则，得到的加密密文即可以是该分段数据对应的数字签名。相应的，对于目的端200接收到的各个分段数据，校验模块212可以根据从请求头中解析出的会话标识以及该分段数据对应的接收顺序，对该分段数据进行校验， 以确定目的端200所接收到的分段数据与源端100发送的分段数据是否一致。
这样，当攻击者将通过不同会话传输的不同待传输数据的分段数据进行互换时，目的端200中的认证装置210(具体可以是校验模块212)可以通过该分段数据对应的会话标识确定目的端200所接收到的分段数据与源端100发送的分段数据不一致，从而确定该分段数据在传输过程中出现异常。
在进一步可能的实施方式中，请求头在源端100与目的端200之间进行传输时，目的端200还可以对该请求头进行校验，具体校验源端100发送的请求头与目的端200接收到的请求头是否一致，以确定该请求头在传输过程中是否遭受篡改等攻击。示例性的，源端100中校验信息生成模块123还可以为构造的请求头生成校验信息，并将该请求头的校验信息添加至请求头中的校验部分字段中，如图6所示。这样，目的端200中在接收到该请求头后，校验模块212可以从该请求头中的校验部分字段中解析出该请求头对应的校验信息，并利用该校验信息对请求头中的内容进行校验。其中，该校验部分可以是与头部合并，也可以是区别于头部的字段，比如，该校验部分可以是请求头中的尾部字段，本实施例对请求头中携带会话标识以及校验信息的具体实现方式并不进行限定。当校验模块212确定目的端200接收到的请求头与源端100发送的请求头一致时，源端100可以开始向目的端200发送待传输数据中的各个分段数据；而当校验模块212确定目的端200接收到的请求头出现传输异常时，则目的端200可以终止与源端100之间的连接，或者要求源端100重新传输请求头等，并且直至目的端200接收到的请求头与源端100发送的请求头一致时才允许源端100进一步传输分段数据。
实际应用中，源端100中的传输模块124在构造请求头时，还可以在该请求头中添加更多的其它信息来加强对于目的端200所接收到的待传输数据的校验。示例性的，传输模块124还可以在请求头中添加时间信息和/或位置信息。其中，时间信息，例如可以是源端100发送分段数据与目的端200接收到分段数据之间的最大允许时间差等，当然，也可以是其它可适用的在时间维度对分段数据进行校验的信息等；位置信息，例如可以是接收到分段数据的目的端200所允许的网络位置/地理位置，或者，可以是其它可适用的在位置维度对分段数据进行校验的信息等。
值得注意的是，上述示例仅用于对源端100与目的端200协同校验分段数据的具体实现方式进行示例性说明，并不用于限定其具体实现局限于上述实现方式。应当理解，实际应用中，上述各实现方式之间可以相互组合。比如，在其它可能的实施方式中，源端100所生成的请求头中，不仅可以包括会话标识、请求头对应的数字签名，还可以包括上述时间信息和/或位置信息等。进一步的，当源端100基于多个线程向目的端200传输待传输数据时，每个线程可以生成相应的请求头，并且每个线程所生成的请求头中还可以包括该线程所传输的子数据的描述数据等。
根据上述实施例所描述的数据传输过程，本申请实施例还提供了数据传输方法，接下来从各装置交互的角度对该数据传输方法进行介绍。
参见图7所示的数据传输方法的流程图，该方法应用于上述数据传输系统，该数据传 输系统包括源端100以及目的端200，该方法具体包括如下步骤：
S701：源端100获取待传输数据。
实际应用中，源端100中可以存在运行有一个或者多个应用，并且该应用可以产生需要传输至目的端200的数据。比如，当目的端200为云平台提供的对象存储服务(Object Storage Service，OBS)时，用户可以在源端100上通过客户端将数据上传至OBS服务的桶中，或者由该客户端定时将用户数据上传至桶中。则，客户端所要上传的数据即为本实施例中的待传输数据。
S702：源端100构建携带有会话标识的请求头，并将向目的端200发送该请求头。
实际应用中，攻击者可能在数据传输过程中，将不同会话中的数据进行相互替换，从而使得目的端200所接收到的数据并非是源端100实际发送的数据，为此，本实施例中，可以先将当前的会话标识传输给目的端200，以便于目的端后续结合该会话标识对接收到的数据进行校验。
在进一步可能的实施方式中，源端100还可以向目的端发送该请求头对应的校验信息，以便于目的端200利用该校验信息对接收到的请求头进行信息校验，从而确定该请求头中所携带的信息在传输过程中是否被篡改。
S703：源端100将待传输数据切分为多个分段数据。
具体实现时，源端100可以将该待传输数据按照固定尺寸进行等长分段，则每个分段数据的尺寸可以相同，其中，最后一个分段数据的尺寸可以与其它分段数据的尺寸相同或者不同。而在其它示例中，源端100也可以是所切分得到的多个分段数据也可以是具有不同的尺寸，本实施例中，对于源端100如何切分待传输数据的具体实现并不进行限定。
S704：源端100确定每个分段数据的发送顺序。
作为一种示例，源端100可以将分段数据在待传输数据中的排序作为该分段数据的发送顺序，比如，对于源端100切分得到的第一个分段数据，其可以被第一个发送给目的端，而对于源端100切分得到的第二个分段数据，其可以被第二个发送给目的端，以此类推。当然，在其它示例中，每个分段数据的发送顺序也可以是与分段数据在待传输数据中的排序存在差异，本实施例对此并不限定。
S705：源端100根据每个分段数据以及每个分段数据的发送顺序，生成每个分段数据的校验信息。
其中，校验信息可以是该分段数据对应的数字签名，或者可以是HMAC。源端100可以根据每个分段数据、每个分段数据的发送顺序以及源端100预先保存的加密密钥的组合，生成该分段数据对应的校验信息，其具体实现可参见前述实施例中相关之处描述，在此不做赘述。
S706：源端100向目的端发送多个分段数据以及该多个分段数据对应的校验信息至目的端。
对于一份待传输数据，源端100可以启动一个传输线程，并利用该传输系统将该待传输数据发送给目的端200。实际应用中，源端100可以同时启动多个传输线程，并利用该多个传输线程分别向目的端200传输不同的待传输数据。其中，源端100利用每个传输线 程向目的端200传输一份待传输数据的具体实现过程可以相近。
特别的，当源端100需要向目的端200传输一份待传输资源时，源端100可以将该待传输资源切分成多份不同的待传输数据，并利用不同传输线程分别传输不同的待传输数据，如此，可以实现待传输资源在源端100与目的端200之间的并行传输，从而可以有效提高资源传输效率。
值得注意的是，为降低攻击者能够获知分段数据的发送顺序的可能性，源端100不将该分段数据的发送顺序传输至目的端200，这样，攻击者因为无法获知到该分段数据的发送顺序，从而难以攻击该分段数据的校验信息。
进一步的，为便于目的端200对于多份待传输数据的整合，源端100可以向目的端发送每份待传输数据对应的描述数据，该描述数据例如可以是待传输数据所属资源的标识和/或切片范围，从而目的端200可以根据该描述数据整合接收到的多份不同的待传输数据，从而整合得到整个待传输资源。示例性的，该描述数据可以被携带于上述请求头中，当然，也可以是单独发送，本实施例对此并不进行限定。
S707：目的端200确定每个分段数据的接收顺序。
S708：目的端200根据每个分段数据、每个分段数据的接收顺序以及每个分段数据的校验信息，校验待传输数据中的每个分段数据是否传输异常。
目的端200在接收到分段数据以及该分段数据对应的校验信息时，可以记录该分段数据的接收顺序，并利用该分段数据的接收顺序，结合分段数据以及该分段数据的校验信息对接收到的分段数据进行校验，以确定该分段数据在传输过程中是否存在传输异常。
值得注意的是，源端100与目的端200在传输多个分段数据的过程中，分段数据在源端100的发送顺序与该分段数据在目的端200的接收顺序保持一致。
具体实现时，目的端200可以通过对接收到的分段数据、该分段数据的接收顺序、密钥以及接收到的校验信息进行相应的运算，校验接收到的分段数据是否存在传输异常，其具体校验过程，可参见前述实施例中的相关之处描述，在此不做赘述。
实际应用中，源端100可以向目的端200逐个传输分段数据，并在目的端200完成对当前接收到的分段数据的校验后，通知源端100向目的端200传输下一个分段数据。这样，当其中任意一个分段数据在传输过程中存在传输异常，目的端200可以通过对该分段数据的校验过程及时发现，从而可以提高校验效率。进一步的，目的端200可以在确定分段数据异常时，断开与源端100之间的连接，或者通知源端100重新传输该分段数据。
在一些可能的实施方式中，为便于告知目的端200当前传输的多个分段数据为所有分段数据，源端100可以向目的端200发送结束标识，该结束标识用于标识源端100向目的端200传输的最后一个分段数据。这样，目的端200可以通过该结束标识确定当前所接收到的多个分段数据为源端100发送的所有分段数据。并且，当该多个分段数据在传输过程中存在攻击者截断时，目的端200可以通过未接收到源端100发送的结束标识或者源端100发送的结束标识的取值，来确定目的端200是否接收到了源端100发送的所有分段数据，从而当存在攻击者截断部分分段数据时，目的端200可以及时发现。
图8至图9分别提供了一种计算机设备。图8所示的计算机设备800具体可以用于实现上述图2所示实施例源端100中签名装置120的功能，图9所示的计算机设备900具体可以用于实现上述图2所示实施例中目的端200中认证装置210的功能。
计算机设备800包括总线801、处理器802、通信接口803和存储器804。处理器802、存储器804和通信接口803之间通过总线801通信。计算机设备800在实现图2以及图7所示实施例的情况下，且图2以及图7实施例中所描述的源端100中的签名装置120为通过软件实现的情况下，执行签名装置120中分段模块121、排序模块122以及校验信息生成模块123功能所需的软件或程序代码存储在存储器804中。传输模块124功能可以通过通信接口803实现，处理器802用于执行存储器804中的指令，实现签名装置120所执行的方法。
计算机设备900包括总线901、处理器902、通信接口903和存储器904。处理器902、存储器904和通信接口903之间通过总线901通信。计算机设备900在实现图2以及图7所示实施例的情况下，且图2以及图7实施例中所描述的目的端200中的认证装置210为通过软件实现的情况下，执行认证装置210中校验模块212功能所需的软件或程序代码存储在存储器904中。传输模块211功能可以通过通信接口903实现，处理器902用于执行存储器904中的指令，实现认证装置210所执行的方法。
此外，本申请实施例还提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机设备上运行时，使得计算机设备执行上述实施例中所述源端100所执行的方法。
本申请实施例还提供了另一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机设备上运行时，使得计算机设备执行上述实施例中所述目的端200所执行的方法。
本申请实施例还提供了一种计算机程序产品，所述计算机程序产品被计算机执行时，所述计算机执行前述数据传输方法的任一方法。该计算机程序产品可以为一个软件安装包，在需要使用前述数据提供方法的任一方法的情况下，可以下载该计算机程序产品并在计算机上执行该计算机程序产品。
另外需说明的是，以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。另外，本申请提供的装置实施例附图中，模块之间的连接关系表示它们之间具有通信连接，具体可以实现为一条或多条通信总线或信号线。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本申请可借助软件加必需的通用硬件的方式来实现，当然也可以通过专用硬件包括专用集成电路、专用CPU、专用存储器、专用元器件等来实现。一般情况下，凡由计算机程序完成的功能都可以很容易地用相应的硬件来实现，而且，用来实现同一功能的具体硬件结构也可以是多种多样的，例如模拟电路、数字电路或专用电路等。但是，对本申请而言更多情况下软件程 序实现是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在可读取的存储介质中，如计算机的软盘、U盘、移动硬盘、ROM、RAM、磁碟或者光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，训练设备，或者网络设备等)执行本申请各个实施例所述的方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、训练设备或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、训练设备或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的训练设备、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。

Claims (19)

  1. 一种数据传输方法，其特征在于，所述方法应用于源端，所述方法包括：
    获取待传输数据；
    将所述待传输数据切分为多个分段数据；
    确定所述多个分段数据的发送顺序；
    根据每个分段数据以及每个分段数据的发送顺序，生成每个分段数据的校验信息；
    发送所述多个分段数据以及所述多个分段数据对应的校验信息至目的端。
  2. 如权利要求1所述的方法，其特征在于，所述根据每个分段数据以及每个分段数据的发送顺序，生成每个分段数据的校验信息，包括：
    将每个分段数据和每个分段数据的发送顺序与密钥的组合，进行基于哈希的消息认证码HMAC运算，获得每个分段数据的校验信息。
  3. 如权利要求1或2所述的方法，其特征在于，所述待传输数据通过会话传输；所述根据每个分段数据以及每个分段数据的发送顺序，生成每个分段数据的校验信息，包括：
    根据每个分段数据、每个分段数据的发送顺序以及所述会话的标识，生成每个分段数据的校验信息；
    所述方法还包括：
    发送所述会话的标识至所述目的端。
  4. 如权利要求3所述的方法，其特征在于，所述发送所述会话的标识至所述目的端，包括：
    向所述目的端发送第一个分段数据以及所述第一个分段数据的校验信息之前，发送携带有所述会话的标识的请求头至所述目的端。
  5. 如权利要求1至4任一所述的方法，其特征在于，所述发送所述多个分段数据以及所述多个分段数据对应的校验信息至目的端，包括：
    发送最后一个分段数据、所述最后一个分段数据的校验信息以及结束标识至目的端，所述结束标识指示所述多个分段数据传输完毕。
  6. 如权利要求1至5任一所述的方法，其特征在于，在所述获取待传输数据前，所述方法还包括：
    启动多个传输线程；
    获取待传输资源，将所述待传输资源切分为多个待传输数据；
    所述发送所述多个分段数据以及所述多个分段数据对应的校验信息至目的端，包括：
    通过每个传输线程，发送至少一个待传输数据的分段数据以及对应的校验信息至所述目的端。
  7. 如权利要求6所述的方法，其特征在于，通过每个传输线程，发送至少一个待传输数据的分段数据以及对应的校验信息至所述目的端，包括：
    每个传输线程，向所述目的端发送所述至少一个待传输数据的第一个分段数据以及对应的校验信息之前，发送携带有描述数据的请求头至所述目的端；其中，所述描述数据包括以下至少一种：
    所述待传输资源的标识以及所述待传输数据的切片范围。
  8. 一种数据传输方法，其特征在于，所述方法应用于目的端，所述方法包括：
    接收来自源端的多个分段数据以及每个分段数据对应的校验信息，所述多个分段数据基于对待传输数据进行切分得到；
    确定每个分段数据的接收顺序；
    根据每个分段数据、每个分段数据的接收顺序以及每个分段数据的校验信息，校验所述待传输数据中的每个分段数据是否传输异常。
  9. 如权利要求8所述的方法，其特征在于，所述校验信息包括基于哈希的消息认证码HMAC，所述根据每个分段数据、每个分段数据的接收顺序以及每个分段数据的校验信息，校验所述待传输数据中的每个分段数据是否传输异常，包括：
    根据每个分段数据、每个分段数据的接收顺序、密钥以及接收到的校验信息，确定所述待传输数据中的每个分段数据是否传输异常。
  10. 如权利要求8或9所述的方法，其特征在于，所述待传输数据通过会话传输，所述方法还包括：
    接收来自所述源端的所述会话的标识；
    所述根据每个分段数据、每个分段数据的接收顺序以及每个分段数据的校验信息，校验所述待传输数据中的每个分段数据是否传输异常，包括：
    根据每个分段数据、每个分段数据的接收顺序、每个分段数据的校验信息以及所述会话的标识，校验所述待传输数据中的每个分段数据是否传输异常。
  11. 如权利要求10所述的方法，其特征在于，所述接收来自所述源端的所述会话的标识，包括：
    接收来自所述源端的携带有所述会话的标识的请求头。
  12. 如权利要求8至11任一项所述的方法，其特征在于，所述接收来自源端的多个分段数据以及每个分段数据对应的校验信息，包括：
    接收来自源端的最后一个分段数据、所述最后一个分段数据的校验信息以及结束标识，所述结束标识指示所述多个分段数据传输完毕。
  13. 如权利要求8至12任一项所述的方法，其特征在于，所述接收来自源端的多个分段数据以及每个分段数据对应的校验信息，包括：
    接收所述源端通过每个传输线程发送的至少一个待传输数据的分段数据以及对应的校验信息，不同传输线程用于传输对待传输资源切分得到的不同待传输数据。
  14. 如权利要求13所述的方法，其特征在于，所述接收所述源端通过每个传输线程发送的至少一个待传输数据的分段数据以及对应的校验信息，包括：
    在接收所述源端通过每个传输线程发送的至少一个待传输数据的分段数据以及对应的校验信息之前，接收来自所述源端的携带有描述信息的请求头，所述描述数据包括以下至少一种：
    所述待传输资源的标识以及所述待传输数据的切片范围。
  15. 一种数据传输系统，其特征在于，所述系统包括如权利要求1至7任一项所述的 源端，以及如权利要求8至14任一项所述的目的端。
  16. 一种计算设备，其特征在于，所述计算设备包括处理器和存储器；
    所述处理器用于执行所述存储器中存储的指令，执行如权利要求1至7任一项所述的方法。
  17. 一种计算设备，其特征在于，所述计算设备包括处理器和存储器；
    所述处理器用于执行所述存储器中存储的指令，执行如权利要求8至14任一项所述的方法。
  18. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当其在计算设备上运行时，使得所述计算设备执行如权利要求1至7任一项所述的方法。
  19. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当其在计算设备上运行时，使得所述计算设备执行如权利要求8至14任一项所述的方法。
PCT/CN2020/129003 2020-11-16 2020-11-16 一种数据传输方法、装置、设备、系统及存储介质 Ceased WO2022099683A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
CN202080007541.0A CN114830572B (zh) 2020-11-16 2020-11-16 一种数据传输方法、装置、设备、系统及存储介质
PCT/CN2020/129003 WO2022099683A1 (zh) 2020-11-16 2020-11-16 一种数据传输方法、装置、设备、系统及存储介质
EP20961238.1A EP4236137A4 (en) 2020-11-16 2020-11-16 DATA TRANSMISSION METHOD AND APPARATUS, APPARATUS, SYSTEM AND STORAGE MEDIUM
US18/318,319 US20230283479A1 (en) 2020-11-16 2023-05-16 Data Transmission Method and Apparatus, Device, System, and Storage Medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/129003 WO2022099683A1 (zh) 2020-11-16 2020-11-16 一种数据传输方法、装置、设备、系统及存储介质

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/318,319 Continuation US20230283479A1 (en) 2020-11-16 2023-05-16 Data Transmission Method and Apparatus, Device, System, and Storage Medium

Publications (1)

Publication Number Publication Date
WO2022099683A1 true WO2022099683A1 (zh) 2022-05-19

Family

ID=81602093

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/129003 Ceased WO2022099683A1 (zh) 2020-11-16 2020-11-16 一种数据传输方法、装置、设备、系统及存储介质

Country Status (4)

Country Link
US (1) US20230283479A1 (zh)
EP (1) EP4236137A4 (zh)
CN (1) CN114830572B (zh)
WO (1) WO2022099683A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115632863A (zh) * 2022-10-24 2023-01-20 贵州省通信产业服务有限公司 一种数据传输方法及系统
CN116233021A (zh) * 2023-03-16 2023-06-06 北京广利核系统工程有限公司 一种通信处理方法及装置
CN116610485A (zh) * 2023-07-21 2023-08-18 深圳市城市交通规划设计研究中心股份有限公司 一种隔离网闸数据校验方法、电子设备及存储介质
CN121441453A (zh) * 2025-12-25 2026-01-30 济南浪潮数据技术有限公司 数据传输校验的方法及装置、电子设备和存储介质

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US12388653B1 (en) * 2021-12-30 2025-08-12 American Express Travel Related Services Company, Inc. Stateful hash-based signatures
TWI806577B (zh) * 2022-04-28 2023-06-21 瑞昱半導體股份有限公司 數位簽章方法及數位簽章的驗證方法
CN116094718B (zh) * 2022-09-15 2025-03-21 中国电信股份有限公司 一种数据传输方法、装置、电子设备和存储介质
CN116249152A (zh) * 2022-12-31 2023-06-09 海尔优家智能科技（北京）有限公司 用于数据传输的方法及装置、无线通信模块、存储介质
CN116938548A (zh) * 2023-07-14 2023-10-24 中国人民财产保险股份有限公司 数据传输方法、装置、电子设备及可读存储介质
CN117768241B (zh) * 2024-01-26 2024-11-19 企商在线(北京)数据技术股份有限公司 一种基于ai的网络入侵检测安全管理方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102805887A (zh) * 2012-04-11 2012-12-05 郑攀 用于贴覆式胰岛素泵系统的无线通信系统
CN102938791A (zh) * 2012-11-22 2013-02-20 上海文广互动电视有限公司 3d电视内容信息发送速率自适应控制的文件传输方法
CN107294878A (zh) * 2016-04-13 2017-10-24 中国移动通信有限公司研究院 数据传输方法、系统及相关设备
CN109194593A (zh) * 2018-08-29 2019-01-11 百度在线网络技术（北京）有限公司 信息发送方法、装置、设备及计算机可读存储介质
CN110299970A (zh) * 2018-03-23 2019-10-01 天地融科技股份有限公司 一种数据报文发送方法及装置
US20190394832A1 (en) * 2017-03-14 2019-12-26 Beijing Xiaomi Mobile Software Co., Ltd. Data unit transmission method and device

Family Cites Families (29)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP3682222B2 (ja) * 2000-12-11 2005-08-10 株式会社東芝 電子透かし検出装置、電子透かし検出方法及び記録媒体
US7032224B2 (en) * 2001-12-31 2006-04-18 Slam Dunk Networks, Inc. Method for the secure and timely delivery of large messages over a distributed communication network
US7082534B2 (en) * 2002-05-31 2006-07-25 Broadcom Corporation Method and apparatus for performing accelerated authentication and decryption using data blocks
US7113773B2 (en) * 2003-05-16 2006-09-26 Qualcomm Incorporated Reliable reception of broadcast/multicast content
US7372856B2 (en) * 2004-05-27 2008-05-13 Avaya Technology Corp. Method for real-time transport protocol (RTP) packet authentication
US8572382B2 (en) * 2006-05-15 2013-10-29 Telecom Italia S.P.A. Out-of band authentication method and system for communication over a data network
US7751404B2 (en) * 2006-10-06 2010-07-06 Broadcom Corporation Method, system, and computer program product for high performance bonding resequencing
US9521186B2 (en) * 2007-09-13 2016-12-13 International Business Machines Corporation Method and system for file transfer over a messaging infrastructure
CN101729675B (zh) * 2009-12-24 2014-01-01 中兴通讯股份有限公司 基于彩信业务的适配方法及适配器装置
CN102340506A (zh) * 2011-09-29 2012-02-01 广东高新兴通信股份有限公司 一种多媒体数据传输系统及其应用方法
CN103229486B (zh) * 2012-12-03 2016-10-05 华为技术有限公司 批量文件传输方法及设备
CN103873507A (zh) * 2012-12-12 2014-06-18 鸿富锦精密工业（深圳）有限公司 数据分块上传与存储系统及方法
CN104917586B (zh) * 2014-03-11 2019-06-07 腾讯科技（深圳）有限公司 传输数据的校验方法、装置及系统
CN104579556A (zh) * 2014-12-05 2015-04-29 苏州沃斯麦机电科技有限公司 多节点间数据完整性传输系统
CN104579557A (zh) * 2014-12-05 2015-04-29 苏州沃斯麦机电科技有限公司 一种多节点间数据完整性传输方法
JP2017135527A (ja) * 2016-01-27 2017-08-03 富士通株式会社 通信装置
JP2017191965A (ja) * 2016-04-11 2017-10-19 富士通株式会社 通信装置及びパケット送受信プログラム
CN108573172B (zh) * 2017-03-08 2021-03-12 杭州海康威视数字技术股份有限公司 一种数据校验、存储方法及装置
CN107592655A (zh) * 2017-09-22 2018-01-16 深圳市沃特玛电池有限公司 一种数据分包传输系统及方法
US11190528B2 (en) * 2017-11-28 2021-11-30 Avago Technologies International Sales Pte. Limited Light-weight mechanism for checking message integrity in data packets
CN108366414B (zh) * 2018-01-15 2021-02-19 海信集团有限公司 一种基于NB-IoT的数据传输方法和装置
CN110826078A (zh) * 2018-08-14 2020-02-21 成都华为技术有限公司 数据存储方法、设备及系统
CN109561145B (zh) * 2018-11-27 2022-04-05 泰康保险集团股份有限公司 文件处理方法、装置、电子设备及存储介质
CN109831782B (zh) * 2019-01-30 2022-05-24 易联众智能（厦门）科技有限公司 一种电子卡信息的安全传输验证方法
CN110035016B (zh) * 2019-02-26 2023-03-10 北京钰安信息科技有限公司 一种数据传输方法及装置
CN110008757B (zh) * 2019-04-09 2020-11-03 江南大学 一种物联网终端固件更新中数据保护方法及系统
US11742990B2 (en) * 2019-11-12 2023-08-29 Qualcomm Incorporated Adaptive HARQ feedback and multi-threaded HARQ techniques for buffer management
CN111314449B (zh) * 2020-02-06 2021-02-02 北京东方金信科技股份有限公司 一种文件断点续传方法和系统
CN111314021A (zh) * 2020-02-07 2020-06-19 北京字节跳动网络技术有限公司 数据传输方法、装置、电子设备及计算机可读存储介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102805887A (zh) * 2012-04-11 2012-12-05 郑攀 用于贴覆式胰岛素泵系统的无线通信系统
CN102938791A (zh) * 2012-11-22 2013-02-20 上海文广互动电视有限公司 3d电视内容信息发送速率自适应控制的文件传输方法
CN107294878A (zh) * 2016-04-13 2017-10-24 中国移动通信有限公司研究院 数据传输方法、系统及相关设备
US20190394832A1 (en) * 2017-03-14 2019-12-26 Beijing Xiaomi Mobile Software Co., Ltd. Data unit transmission method and device
CN110299970A (zh) * 2018-03-23 2019-10-01 天地融科技股份有限公司 一种数据报文发送方法及装置
CN109194593A (zh) * 2018-08-29 2019-01-11 百度在线网络技术（北京）有限公司 信息发送方法、装置、设备及计算机可读存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4236137A4 *

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115632863A (zh) * 2022-10-24 2023-01-20 贵州省通信产业服务有限公司 一种数据传输方法及系统
CN116233021A (zh) * 2023-03-16 2023-06-06 北京广利核系统工程有限公司 一种通信处理方法及装置
CN116610485A (zh) * 2023-07-21 2023-08-18 深圳市城市交通规划设计研究中心股份有限公司 一种隔离网闸数据校验方法、电子设备及存储介质
CN116610485B (zh) * 2023-07-21 2024-04-30 深圳市城市交通规划设计研究中心股份有限公司 一种隔离网闸数据校验方法、电子设备及存储介质
CN121441453A (zh) * 2025-12-25 2026-01-30 济南浪潮数据技术有限公司 数据传输校验的方法及装置、电子设备和存储介质

Also Published As

Publication number Publication date
US20230283479A1 (en) 2023-09-07
CN114830572B (zh) 2025-01-07
EP4236137A1 (en) 2023-08-30
EP4236137A4 (en) 2023-11-22
CN114830572A (zh) 2022-07-29

Similar Documents

Publication Publication Date Title
WO2022099683A1 (zh) 一种数据传输方法、装置、设备、系统及存储介质
US11089032B2 (en) Signed envelope encryption
US10447674B2 (en) Key exchange through partially trusted third party
CN111447276B (zh) 一种具有密钥协商功能的加密续传方法
CN100581097C (zh) 在两计算机间传输数据的系统和方法
CN106533689B (zh) 一种在ssl/tls通信中加载数字证书的方法和装置
CN110198297B (zh) 流量数据监控方法、装置、电子设备及计算机可读介质
CN117692226A (zh) 一种工业互联网数据传输方法及系统
CN106330465B (zh) 一种分布式时间戳的处理方法、服务器及系统
CN115766119A (zh) 通信方法、装置、通信系统及存储介质
WO2023036348A1 (zh) 一种加密通信方法、装置、设备及介质
WO2025082030A1 (zh) 数据传输方法、装置、存储介质及设备
CN111490874A (zh) 一种配网安全防护方法、系统、装置及存储介质
CN115150821A (zh) 离线包的传输、存储方法及装置
CN119743303A (zh) 数据传输方法、装置、计算机设备及计算机可读介质
CN113810173B (zh) 一种校验应用信息的方法、报文处理方法及装置
CN111031067A (zh) 分布式系统的监控数据传输方法、装置及电子设备
CN116032487A (zh) 一种安全文件传输方法、装置、电子设备及存储介质
CN120979824A (zh) 基于多层防护机制的mqtt消息安全防护方法、设备及介质
KR101971995B1 (ko) 보안을 위한 보안 소켓 계층 복호화 방법
CN118250016B (zh) 一种物联网设备的tcp私有协议通信认证方法
US9800568B1 (en) Methods for client certificate delegation and devices thereof
CN115701026A (zh) 一种传输层安全协议的测试方法、装置及终端
CN111262837B (zh) 一种数据加密方法、数据解密方法、系统、设备和介质
CN117176831A (zh) 控制器网络通信方法、系统、设备及介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20961238

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020961238

Country of ref document: EP

Effective date: 20230524

NENP Non-entry into the national phase

Ref country code: DE

WWG Wipo information: grant in national office

Ref document number: 202080007541.0

Country of ref document: CN