Data processing method, and apparatus, device and computer-readable storage medium

Abstract

The present application belongs to the technical field of communications. Disclosed are a data processing method, and an apparatus, a device and a computer-readable storage medium. The method comprises: a first apparatus acquiring first data; determining an attribute tag of the first data, wherein the attribute tag indicates attribute information of the first data in different dimensions; acquiring second data on the basis of the first data and the attribute tag, wherein the second data comprises the first data and further comprises at least one of the attribute tag and a sending policy obtained on the basis of the attribute tag, and the sending policy instructs a device, which receives the second data, as to whether to intercept the second data; and sending the second data to a second apparatus. Whether the first data needs transmission protection is determined on the basis of the attribute information in different dimensions, so as to determine a sending policy, thereby avoiding data leakage caused by releasing data that should not be sent, and thus the security of data transmission is high. In addition, the sending policy can be determined on the basis of the attribute tag, such that few flows are involved in the determination of the sending policy, and thus the operation is simple, and the efficiency is high.

Description

Data processing method, device, equipment and computer-readable storage medium

[0001] This application claims priority to Chinese patent application number 202311408942.9, filed on October 26, 2023, entitled “Data processing method, device, apparatus and computer-readable storage medium”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of communication technology, and in particular to a data processing method, apparatus, device, and computer-readable storage medium. Background Art

[0003] With the development of communication technology, the risk of data leakage is inevitable. Data leakage refers to the unauthorized disclosure, loss, or theft of sensitive data that must be kept confidential. Examples of data leakage include data theft through ransomware attacks, data theft by external attackers, and data leaks by internal personnel.

[0004] In related technologies, before data is sent, the network equipment used to process data will collect the data to be sent, segment and reassemble the collected data, decrypt the protocol, decode the application protocol, and restore the file. The restored data will be matched with sensitive information, matched with data leakage prevention (DLP) policies, and responded to DLP policies to determine whether to release the data based on the response results, thereby avoiding sending confidential data to the outside world and causing data leakage.

[0005] However, the above data processing process involves operations such as file restoration and sensitive information matching. The operations that need to be performed are highly complex and the data processing efficiency is low.

[0006] Summary of the Invention

[0007] The present application provides a data processing method, apparatus, device, and computer-readable storage medium to improve the efficiency of preventing data leakage.

[0008] In a first aspect, a data processing method is provided, which is applied to a first device, and the method includes: obtaining first data; determining an attribute tag of the first data, wherein the attribute tag indicates attribute information of the first data in different dimensions; obtaining second data based on the first data and the attribute tag, the second data including the first data, and also including the attribute tag and at least one of a sending strategy obtained based on the attribute tag, the sending strategy indicating whether a device receiving the second data intercepts the second data; and sending the second data to a second device.

[0009] Because the attribute tags indicate the attribute information of the first data in different dimensions, the attribute tags can be used to determine whether the first data requires transmission protection based on the attribute information in different dimensions, and a sending policy can be determined accordingly. This prevents data leakage caused by releasing data that should not be sent, thereby enhancing data transmission security. Furthermore, determining the sending policy based on the attribute tags involves fewer processes, is simple to operate, and is highly efficient.

[0010] In one possible implementation, determining an attribute tag for first data includes: obtaining at least one piece of classification information for the first data, the classification information indicating the importance of the first data within the corresponding classification, the first data corresponding to the at least one classification, each piece of the at least one piece of classification information indicating a different classification; and determining the attribute tag based on the at least one piece of classification information. The classification information may indicate the importance of the first data within the corresponding classification, and the attribute tag determined based on the classification information may also indicate the importance of the first data. A subsequent transmission strategy determined based on the attribute tag determines whether the first data should be released based on the importance of the first data, thereby enhancing data transmission security.

[0011] In one possible implementation, obtaining the second data based on the first data and the attribute tag includes: obtaining an encapsulation result, the encapsulation result including at least one of the attribute tag and the sending policy and the first data; and obtaining the second data based on the encapsulation result. When obtaining the second data, only the attribute tag, only the sending policy, or both the attribute tag and the sending policy can be encapsulated. This provides high flexibility in obtaining the second data.

[0012] In one possible implementation, obtaining the second data based on the encapsulation result includes: filling at least one of the attribute tag and the sending policy into a protocol field of the encapsulation result to obtain the second data. Filling the protocol field of the encapsulation result that already carries the at least one of the attribute tag and the sending policy again with the at least one of the attribute tag and the sending policy, thereby backing up the at least one of the attribute tag and the sending policy and improving transmission reliability of the second data.

[0013] In one possible implementation, obtaining the second data based on the first data and the attribute tag includes: inserting at least one of the attribute tag and the sending policy into a protocol field of the first data to obtain the second data. In addition to encapsulating the second data by inserting at least one of the attribute tag and the sending policy into a protocol field, the second data can also be obtained by inserting at least one of the attribute tag and the sending policy into a protocol field. This method for obtaining the second data is not limited, and is highly versatile.

[0014] In one possible implementation, before obtaining the second data based on the first data and the attribute tag, the method further includes: obtaining a correspondence between the attribute tag and the sending strategy; and determining the sending strategy based on the correspondence and the attribute tag. The sending strategy can be determined based on the correspondence, making the process of determining the sending strategy simple and efficient.

[0015] In one possible implementation, the attribute tag includes at least one of a confidentiality level tag, a data type tag, and an object identity tag. The confidentiality level tag indicates the sensitivity level of the first data, the data type tag indicates the data type of the first data, and the object identity tag indicates the identity level of the object corresponding to the first data. Because the attribute tag of the first data can be one or more of the confidentiality level tag, the data type tag, and the object identity tag, the attribute tag is highly flexible and widely applicable.

[0016] In a second aspect, a data processing method is provided, which is applied to a second device, and the method includes: receiving second data sent by a first device, wherein the second data includes the first data and also includes an attribute tag of the first data and at least one of a sending strategy obtained based on the attribute tag, and the attribute tag indicates attribute information of the first data in different dimensions; parsing the second data, and determining the sending strategy of the second data based on the parsing result; and determining whether to intercept the second data based on the sending strategy of the second data.

[0017] Because the attribute tags indicate the attributes of the first data in different dimensions, the attribute tags can be used to determine whether the first data requires transmission protection based on the attributes in these dimensions, thereby generating a transmission policy. This prevents data leakage caused by releasing data that should not be sent, thereby enhancing data transmission security. Furthermore, the transmission policy can be determined by simply parsing the second data, which involves fewer steps, is simple to operate, and is highly efficient.

[0018] In one possible implementation, the second data includes an attribute tag, and determining a sending policy for the second data based on a parsing result includes: determining the attribute tag based on the parsing result; obtaining a correspondence between the attribute tag and the sending policy, and determining the sending policy based on the correspondence and the determined attribute tag. If the second data includes an attribute tag, the sending policy can be determined based on the determined attribute tag and the correspondence, making the sending policy determination process simple and efficient.

[0019] In one possible implementation, determining the attribute tag based on the parsing result includes: extracting the attribute tag from the protocol field if the parsed protocol field includes the attribute tag; or, if the parsed protocol field does not include the attribute tag, performing file restoration on the parsing result and extracting the attribute tag from the restored result. If the attribute tag is present in the protocol field, parsing the protocol field can extract the attribute tag, simplifying the extraction process. If the attribute tag is encapsulated within the second data, meaning the attribute tag is not extracted from the protocol field, further file restoration is performed to successfully extract the encapsulated attribute tag. Regardless of how the attribute tag is carried by the second data, the second device can extract the attribute tag from the second data, thereby improving the reliability of obtaining the attribute tag.

[0020] In one possible implementation, the second data includes a sending policy, and determining the sending policy of the second data based on the parsing result includes: extracting the sending policy from the protocol field if the parsed protocol field includes the sending policy; or, if the parsed protocol field does not include the sending policy, restoring the parsing result and extracting the sending policy from the restored result. If the second data includes the sending policy, the sending policy can be directly extracted from the second data to obtain the sending policy. This acquisition process is simple and efficient, and a corresponding extraction method exists regardless of whether the sending policy is encapsulated in the second data or filled in the protocol field, thereby improving the reliability of obtaining the sending policy.

[0021] In one possible implementation, after determining whether to intercept the second data based on a transmission policy for the second data, the method further includes: if the transmission policy determines to allow the second data to be passed, transmitting the second data to a first network domain, the first network domain being determined based on the second data, and the first network domain being different from the network domain in which the first device is located. The second data is transmitted across network domains only if the transmission policy indicates to allow the data to be passed, providing a high degree of security in the transmission process of the second data.

[0022] In one possible implementation, the attribute tag includes at least one of a confidentiality level tag, a data type tag, and an object identity tag. The confidentiality level tag indicates the sensitivity level of the first data, the data type tag indicates the data type of the first data, and the object identity tag indicates the identity level of the object corresponding to the first data. The attribute tag of the first data can be one or more of the confidentiality level tag, the data type tag, and the object identity tag. Attribute tags offer high flexibility.

[0023] According to a third aspect, a data processing device is provided, which is applied to a first device and includes: an acquisition module for acquiring first data; a determination module for determining an attribute label of the first data, wherein the attribute label indicates attribute information of the first data in different dimensions; the acquisition module is also used to acquire second data based on the first data and the attribute label, wherein the second data includes the first data and also includes the attribute label and at least one of a sending strategy obtained based on the attribute label, wherein the sending strategy indicates whether the device receiving the second data intercepts the second data; and a sending module for sending the second data to the second device.

[0024] In one possible implementation, a determination module is used to obtain at least one classification information of the first data, where the classification information indicates the importance of the first data in the corresponding classification, the first data corresponds to at least one classification, and each classification information in the at least one classification information indicates a different classification; and an attribute label is determined based on the at least one classification information.

[0025] In a possible implementation, the acquisition module is configured to acquire an encapsulation result, where the encapsulation result includes at least one of an attribute tag and a sending strategy and the first data; and obtain the second data according to the encapsulation result.

[0026] In a possible implementation, the acquisition module is configured to fill at least one of the attribute tag and the sending strategy in the protocol field of the encapsulation result to obtain the second data.

[0027] In a possible implementation, the acquisition module is configured to fill at least one of the attribute tag and the sending strategy into the protocol field of the first data to obtain the second data.

[0028] In a possible implementation, the acquisition module is further configured to acquire a correspondence between the attribute tag and the sending strategy; and determine the sending strategy according to the correspondence and the attribute tag.

[0029] In one possible implementation, the attribute label includes at least one of a confidentiality level label, a data type label, and an object identity label, the confidentiality level label indicates the sensitivity level of the first data, the data type label indicates the data type of the first data, and the object identity label indicates the identity level of the object corresponding to the first data.

[0030] In a fourth aspect, a data processing device is provided, which is applied to a second device and includes: a receiving module for receiving second data sent by the first device, the second data including the first data, and also including at least one of an attribute label of the first data and a sending strategy obtained based on the attribute label, the attribute label indicating attribute information of the first data in different dimensions; a determination module for parsing the second data and determining the sending strategy of the second data based on the parsing results; the determination module is also used to determine whether to intercept the second data based on the sending strategy of the second data.

[0031] In a possible implementation, the second data includes an attribute tag, and the determination module is configured to determine the attribute tag according to the parsing result; obtain a correspondence between the attribute tag and the sending strategy, and determine the sending strategy according to the correspondence and the determined attribute tag.

[0032] In one possible implementation, the determination module is configured to extract the attribute tag from the protocol field when the parsed protocol field includes the attribute tag; or, to perform file restoration on the parsing result and extract the attribute tag from the restored result when the parsed protocol field does not include the attribute tag.

[0033] In one possible implementation, the second data includes a sending strategy, and the determination module is used to extract the sending strategy from the protocol field when the parsed protocol field includes the sending strategy; or, when the parsed protocol field does not include the sending strategy, perform file restoration on the parsing result and extract the sending strategy from the restoration result.

[0034] In one possible implementation, the device further includes: a forwarding module for sending the second data to a first network domain when it is determined to release the second data according to a sending policy. The first network domain is determined according to the second data, and the first network domain is different from the network domain where the first device is located.

[0035] In one possible implementation, the attribute label includes at least one of a confidentiality level label, a data type label, and an object identity label, the confidentiality level label indicates the sensitivity level of the first data, the data type label indicates the data type of the first data, and the object identity label indicates the identity level of the object corresponding to the first data.

[0036] In a fifth aspect, a data processing device is provided, which includes: a transceiver module for performing operations related to reception and / or transmission in the method of the first aspect or any possible implementation method of the first aspect, and a processing module for performing operations other than the operations related to reception and / or transmission in the method of the first aspect or any possible implementation method of the first aspect; or, a transceiver module for performing operations related to reception and / or transmission in the method of the second aspect or any possible implementation method of the second aspect, and a processing module for performing operations other than the operations related to reception and / or transmission in the method of the second aspect or any possible implementation method of the second aspect.

[0037] In a sixth aspect, a data processing device is provided, which includes a processor, and the processor is used to load and execute at least one instruction so that the data processing device executes the method in the first aspect or any possible implementation of the first aspect, or executes the method in the second aspect or any possible implementation of the second aspect.

[0038] In a possible implementation, the device includes a memory coupled to a processor, and the memory stores at least one instruction.

[0039] In the seventh aspect, a data processing system is provided, which includes a second device and a first device, the first device is used to execute the method in the first aspect or any possible implementation of the first aspect, and the second device is used to execute the method in the second aspect or any possible implementation of the second aspect.

[0040] In an eighth aspect, a computer-readable storage medium is provided, in which at least one instruction is stored. The instruction is loaded and executed by a processor to implement the data processing method in the first aspect or any possible implementation of the first aspect, or to implement the data processing method in the second aspect or any possible implementation of the second aspect.

[0041] In the ninth aspect, a computer program (product) is provided, which includes a computer program / instructions, and the computer program / instructions are executed by a processor to enable a computer to implement the data processing method in the first aspect or any possible implementation of the first aspect, or to implement the data processing method in the second aspect or any possible implementation of the second aspect.

[0042] In a tenth aspect, a communication device is provided, comprising: a transceiver, a memory, and a processor. The transceiver, the memory, and the processor communicate with each other via an internal connection path; the memory is configured to store instructions; and the processor is configured to execute the instructions stored in the memory to control the transceiver to receive signals and to control the transceiver to transmit signals. When the processor executes the instructions stored in the memory, the processor executes the method of the first aspect or any possible implementation of the first aspect, or executes the method of the second aspect or any possible implementation of the second aspect.

[0043] Optionally, there are one or more processors and one or more memories.

[0044] Optionally, the memory may be integrated with the processor, or the memory may be provided separately from the processor.

[0045] In the specific implementation process, the memory can be a non-transitory memory, such as a read-only memory (ROM), which can be integrated on the same chip as the processor or be set on different chips. This application does not limit the type of memory and the setting method of the memory and the processor.

[0046] In the eleventh aspect, a chip is provided, comprising a processor for calling and executing program instructions or codes stored in a memory, so that a communication device equipped with the chip executes the methods in the above aspects.

[0047] In the twelfth aspect, another chip is provided, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected through an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the methods in the above aspects.

[0048] It should be understood that the beneficial effects achieved by the technical solutions of the third to twelfth aspects of this application and the corresponding possible implementation methods can be referred to the above-mentioned technical effects of the first aspect and its corresponding possible implementation methods or the second aspect and its corresponding possible implementation methods, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] FIG1 is a schematic diagram of an implementation environment provided by an embodiment of the present application;

[0050] FIG2 is a schematic diagram of another implementation environment provided by an embodiment of the present application;

[0051] FIG3 is a schematic diagram of a data transmission scenario provided by an embodiment of the present application;

[0052] FIG4 is a flow chart of a data processing method provided in an embodiment of the present application;

[0053] FIG5 is a schematic diagram of interaction between a first device and a second device provided in an embodiment of the present application;

[0054] FIG6 is a schematic diagram of interaction between a first device and a second device according to another embodiment of the present application;

[0055] FIG7 is a schematic diagram of interaction between a first device and a second device according to another embodiment of the present application;

[0056] FIG8 is a schematic structural diagram of a data processing device provided in an embodiment of the present application;

[0057] FIG9 is a schematic structural diagram of another data processing device provided in an embodiment of the present application;

[0058] FIG10 is a schematic diagram of the structure of a network device provided in an embodiment of the present application;

[0059] FIG11 is a schematic diagram of the structure of another network device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] The terms used in the embodiments of this application are only used to explain the specific embodiments of this application and are not intended to limit this application. To make the purpose, technical solutions and advantages of this application clearer, the embodiments of this application will be further described in detail below with reference to the accompanying drawings.

[0061] With the development of communication technology, the data in the network has shown explosive growth. Sensitive data is often transmitted without permission, causing security issues such as data leakage. Therefore, a data processing method is needed to prevent data leakage and improve security.

[0062] In related technologies, network traffic monitoring, data restoration, and content identification are used to determine whether sensitive data exists within traffic data to be transmitted, allowing for policy-based response operations such as interception. The data processing process includes collecting traffic data to be transmitted, fragmenting and reassembling the traffic data, performing protocol decryption, applying protocol decoding, and restoring files. After restoring the traffic data through these operations, the restored data is matched against sensitive information to determine whether it is restricted sensitive data. A DLP policy is then matched based on the matching results to determine whether the traffic data should be intercepted or released. The aforementioned data processing methods, for example, suffer from low performance and efficiency in decrypting encrypted data using the transport layer security (TLS) protocol. The data processing process requires operations such as file restoration and sensitive information matching, which can lead to low data processing efficiency. Furthermore, if the transmitted traffic data is compressed, such as through encryption, it is impossible to accurately identify whether the data is sensitive data, potentially leading to data leakage and low security.

[0063] An embodiment of the present application provides a data processing method for determining whether the data needs to be intercepted and whether it can continue to be sent during the process of sending data, so as to avoid releasing data that should not be sent and causing data leakage. Please refer to Figure 1, which shows a schematic diagram of the implementation environment of the data processing method provided by an embodiment of the present application, and the implementation environment includes a first device 01 and a second device 02. Among them, a communication connection can be established between the first device 01 and the second device 02 via a wired or wireless network. Exemplarily, the first device 01 generates second data based on the first data and the attribute tag of the first data, and sends the second data to the second device 02. The second device 02 parses the received second data, determines the sending strategy based on the parsing result, and determines whether to intercept the second data based on the sending strategy.

[0064] For example, referring to FIG2 , this implementation scenario further includes a management device 03. The management device 03 establishes communication connections with the first device 01 and the second device 02, respectively. The management device 03 includes a security management module that can deliver configurations / policies involved in data processing to the first device 01 or the second device 02. Configuration refers to configuration information of the first data, such as an attribute tag of the first data, and policy may refer to a sending policy.

[0065] In one possible implementation, the first device 01, the second device 02, and the management device 03 can be any device with data transmission capabilities. The first device 01, the second device 02, and the management device 03 can be terminal devices such as desktop computers, laptop computers, or smartphones. They can also be servers, such as central servers, edge servers, or local servers in a local data center. The server can be a physical server or a cloud server providing cloud computing services. For example, the second device 02 can also be a forwarding device such as a gateway, router, or switch. Optionally, the first device 01 and the second device 02 can be independent devices or applications or network cards configured in the devices. Furthermore, the first device 01 and the second device 02 can be configured in different devices or in the same device.

[0066] The embodiment of the present application does not limit the application scenario of data processing. Figure 3 is a schematic diagram of a data transmission scenario provided by the embodiment of the present application. In Figure 3, DLP includes multiple types such as network DLP, terminal DLP, storage DLP and email DLP. The type of DLP is determined according to the data transmission scenario. Among them, network DLP refers to the execution of DLP on the data sent during the process of sending data between different network domains via the network; terminal DLP refers to the execution of DLP on the data sent during the process of sending data between different terminals; storage DLP refers to the execution of DLP on the stored data during the process of storing data. For example, as shown in Figure 3, during the storage process, data will also be transmitted between the file server and the application system, and data leakage needs to be avoided during the process of sending data. Email DLP refers to the execution of DLP on the data sent during the process of sending data via email. For different types of DLP, the second device 02 can be a terminal in the terminal DLP, or a mail server in the mail DLP. The embodiment of the present application does not limit this.

[0067] The data processing method provided in the embodiment of the present application can be applied to the implementation scenario shown in Figure 1 or Figure 2 above. The method can be interactively executed by the first device and the second device. The flowchart of the data processing method is shown in Figure 4, including S401-S407.

[0068] S401: A first device obtains first data.

[0069] Exemplarily, the first data may be any data that has a transmission requirement. The first data having a transmission requirement means that the first data needs to be transmitted. Exemplarily, when the storage space of the first data changes, the first data has a transmission requirement. For example, a user operates the first device to move the first data from the storage space of the first device to the storage space of a mobile storage device. The storage space of the first data changes, and the first data has a transmission requirement. The mobile storage device is, for example, a USB flash drive (universal serial bus flash disk). During the transmission of the first data, the first data in the original storage space may be retained, for example, if the user uses a copy operation during the transmission of the first data; the first data in the original storage space may also be deleted, for example, if the user uses a cut operation during the transmission of the first data. This is not limited in the embodiments of the present application. The transmission requirement for the first data may be currently generated. For example, the first device detects that data A has a transmission requirement based on interaction with the user, and the first device determines that data A is the first data. In addition, the first device may be the source sending device of the first data as shown in the above example, or it may be an intermediate device in the first data transmission process, that is, the first device receives the first data sent by other network devices based on the communication connection with other network devices.

[0070] In one possible scenario, the first data may also be data acquired by the first device, such as data stored by the first device. Since the first device first stores the first data, the storage space of the first data needs to be adjusted later, which involves the transmission of the first data. Therefore, the first data needs to be processed to achieve transmission protection. Regardless of the above situation of the first data, the embodiments of the present application do not limit the data type of the first data. The first data can be game data, video data, or other types of data.

[0071] S402: The first device determines an attribute tag of the first data, where the attribute tag indicates attribute information of the first data in different dimensions.

[0072] For example, the first device may receive an attribute tag set by an operator to determine the attribute tag of the first data. For example, the first device may provide an information input control, and the operator may input the attribute tag of the first data based on the information input control. The operator may be an operations and maintenance personnel or other personnel responsible for managing data security, or may be the user operating the first device as illustrated in S401.

[0073] In one possible case, the first device can also automatically determine the attribute label of the first data, and the determination process includes but is not limited to: obtaining at least one classification information of the first data, the classification information indicates the importance of the first data in the corresponding classification, the first data corresponds to at least one classification, and the classifications indicated by each classification information in the at least one classification information are different; determining the attribute label based on the at least one classification information.

[0074] The classification information of the first data includes, but is not limited to, data confidentiality information, type information, and object identity information. The data confidentiality information indicates the confidentiality level of the first data, including core, top secret, confidential, secret, public, and ordinary. The importance of first data of different confidentiality levels varies. For example, the importance of core data is higher than that of public data. In some cases, data confidentiality information can also be referred to as data classification information. The type information indicates the type of the first data. For example, in an enterprise, the type information includes enterprise application data, financial data, and contract data. The importance of different types of first data varies, with contract data being more important than financial data, which in turn is more important than enterprise application data. The object identity information indicates the identity of the object corresponding to the first data. The object corresponding to the first data can be a statistical object that collects statistics on the first data, i.e., the owner of the first data, or a user that sends the first data. For example, in an enterprise, the object identity information includes director, supervisor, and employee. In this case, the importance of first data corresponding to a director is higher than that of first data corresponding to a supervisor.

[0075] The embodiment of the present application does not limit the process of the first device obtaining the classification information. The first device can perform data analysis on the first data to determine the classification information of the first data. For example, the data content of the first data is analyzed to determine the type information of the first data, the storage path of the first data is analyzed to determine the data confidentiality information of the first data, or the user identity identification number (identity document, ID) corresponding to the first data is analyzed to determine the object identity information of the first data. Among them, the user ID can be the user ID included in the first data storage path, or it can be the user ID logged in during the first data transmission operation. For example, if user A sends the first data to the outside via email, the first device determines the user ID based on the mailbox of user A, determines the object corresponding to the first data based on the user ID, and determines the object identity information based on the position information of the object in the enterprise.

[0076] The above operations can be performed by the first device or by the management server. As shown in Figure 5, the management server includes a security management module, which is responsible for security management-related functions. The security management module includes a classification unit, a label management unit, and a policy management unit, which are responsible for policy management, label management, and data classification management. The classification unit can determine the classification information of the first data by performing data analysis on the first data, and then transmit the obtained classification information to the first device, so that the first device can obtain the classification information of the first data.

[0077] Alternatively, the classification information may be obtained by an operator of the first device through interaction with the first device, with the first device determining the classification information of the first data based on the classification information input by the operator. For example, during the process of storing the first data, the first device may pop up an information input control, and the operator must enter the classification information of the first data in the information input control before the first data can be stored in the storage space of the first device.

[0078] Regardless of how the first device obtains the classification information of the first data, an attribute tag of the first data can be determined based on at least one piece of classification information. In one possible scenario, the attribute tag includes at least one of a confidentiality level tag, a data type tag, and an object identity tag. The confidentiality level tag indicates the sensitivity level of the first data, the data type tag indicates the data type of the first data, and the object identity tag indicates the identity level of the object corresponding to the first data.

[0079] Exemplarily, the number of attribute labels of the first data may correspond one-to-one to the number of classification information. Taking the classification information including the data confidentiality information as secret, the type information as enterprise application data, and the object identity information as supervisor as an example, the confidentiality level label is determined to be secret data based on the data confidentiality information, the data type label is determined to be enterprise application data based on the type information, and the object identity label is determined to be supervisor data based on the object identity information. The number of attribute labels of the first attribute may also not correspond one-to-one to the number of classification information. Taking the type information as enterprise application data as an example, after the first device determines that the data type label is enterprise application data based on the type information, since the enterprise application data is data generated during the communication process between internal members of the enterprise, it may include some commercial secrets within the enterprise. Therefore, the first device may determine that the confidentiality level label of the first data is secret data based on the type information.

[0080] In one possible scenario, the first device can also adjust the attribute label in combination with different classification information during the process of determining the attribute label based on the classification information. For example, if the data confidentiality information of the first data is public and the type information of the first data is contract data, although the contract data needs to be disclosed to both Party A and Party B during the signing process, it also needs to be kept confidential from other objects. In the process of determining the attribute label, the first device determines that the confidentiality level label of the first data is confidential data and the data type label is contract data. For another example, the data type of the first data is financial data, the object identity level of the statistical object of the first data is employee, and the data confidentiality information of the first data is top secret. Although the first data is financial data, the first data is a detailed list of household expenses compiled by employees, rather than financial information related to the enterprise. Therefore, the first device determines that the confidentiality level label of the first data is public data.

[0081] Similar to the process of determining classification information, the process of determining attribute tags based on classification information can also be performed by other devices, such as the management server in Figure 5. The management server invokes the tag management unit to determine the attribute tag of the first data based on the classification information sent by the classification unit. The management server then transmits the attribute tag of the first data to the first device based on the communication connection with the first device, and the first device thereby obtains the attribute tag of the first data.

[0082] S403, the first device obtains the second data based on the first data and the attribute tag, the second data includes the first data, and also includes the attribute tag and at least one of the sending strategies obtained based on the attribute tag, the sending strategy indicates whether the device receiving the second data intercepts the second data.

[0083] In one possible scenario, after obtaining the attribute tag, the first device may also display the attribute tag to the user, who may then review and adjust the attribute tag based on their experience. Regardless of whether the user adjusts the attribute tag, the first device may obtain the second data based on the attribute tag and the first data. The process of obtaining the second data includes, but is not limited to, the following two methods.

[0084] Acquisition method 1: Acquire an encapsulation result, where the encapsulation result includes at least one of an attribute tag and a sending strategy and the first data; and obtain the second data according to the encapsulation result.

[0085] Exemplarily, the process of the first device determining the sending policy includes: obtaining the correspondence between the attribute tag and the sending policy; determining the sending policy based on the correspondence and the attribute tag. The correspondence can be set based on experience, and the correspondence can be set directly on the first device, that is, the first device stores the correspondence between the attribute tag and the sending policy. In this case, the first device can access the storage space and obtain the correspondence between the attribute tag and the sending policy stored in the storage space. The correspondence can also be set on other devices, such as the management server shown in Figure 6. The policy management unit of the management server is used to store the correspondence between the attribute tag and the sending policy. The first device can send a correspondence request to the management server as shown in Figure 6. The management server returns the correspondence between the sending policy and the attribute tag to the first device based on the received request.

[0086] Regardless of the method by which the first device obtains the correspondence between the attribute label and the sending strategy, the correspondence between the attribute label and the sending strategy can be found based on the attribute label of the first data to determine the sending strategy that needs to be encapsulated in the second data. For example, the sending strategy corresponding to the attribute label of top secret data is restricted sending, the sending strategy corresponding to the attribute label of financial data is restricted sending, and the sending strategy corresponding to the attribute label of public data is allowed sending. Among them, the sending in restricted sending and allowed sending refers to external sending, that is, there is a difference between the network domain where the first data arrives and the network domain where the first data is sent. For example, in Figure 5, the first data in the first device in domain A is sent to domain B. Since domain A and domain B are different network domains, the sending executed by the first data in Figure 5 belongs to external sending.

[0087] In one possible implementation, when the first data corresponds to multiple attribute tags, and the sending policy corresponding to any of the attribute tags is restricted sending, the first device thus determines the sending policy as restricted sending. Alternatively, the first device determines a weight corresponding to each attribute tag, performs a weighted calculation on the multiple attribute tags, and determines the sending policy based on the weighted result. The weight corresponding to each attribute tag is determined based on the importance of the classification information corresponding to each attribute tag within the multiple classification information, as well as the importance of the classification information corresponding to each attribute tag within the corresponding classification. Continuing with the example of classification information including data confidentiality information, type information, and object identity information, the importance of data confidentiality information is higher than that of type information, which is higher than that of object identity information. Therefore, the first device determines a first weight of the data confidentiality information to be 0.5, a first weight of the type information to be 0.3, and an importance of the object identity information to be 0.2. If the data confidentiality information is secret, the type information is enterprise application data, and the object identity information is supervisor, based on the sensitivity of the secret within the sensitivity level, a second weight is set to 0.5, a second weight of the enterprise application data to be 0.3, and a second weight of the supervisor to be 0.3. Afterwards, the weight of the attribute label is determined based on the first weight and the second weight. For example, the first weight and the second weight are multiplied, and the product is the weight of the attribute label. Then, the weight of the attribute label as secret data is 0.25, the weight of the attribute label as enterprise application data is 0.09, and the weight of the attribute label as supervisor data is 0.06.

[0088] After determining the weights of the attribute tags, the first device may perform a weighted calculation based on the weights of the attribute tags. For example, the first device may determine that the initial value of the sending policy for restricting sending is negative 1, and the initial value of the sending policy for allowing sending is 1. The first device multiplies the initial value of the sending policy corresponding to each attribute tag by the weight of each attribute tag, and adds the multiple products obtained by multiplication. If the sum of the products is positive, the sending policy is determined to be allowing sending, and if the sum of the products is negative, the sending policy is determined to be restricting sending.

[0089] In addition, the above-mentioned process of determining the sending policy based on the attribute tag can be executed by the first device or by the management server. For example, the first device sends the attribute tag to the management server, and the management server determines the sending policy corresponding to the attribute tag based on the attribute tag and the corresponding relationship through the policy management unit, and sends the determined sending policy to the first device. Because the attribute tag indicates the attribute information of the first data in different dimensions, it can be determined whether the first data is sensitive data that requires transmission protection based on the attribute information in different dimensions, and then the sending policy of the first data can be determined based on whether the first data requires transmission protection. The determined sending policy has a high degree of reliability.

[0090] Regardless of how the first device obtains the sending policy, after obtaining the sending policy, it can select at least one of the attribute tag and the sending policy and encapsulate it with the first data, and determine the second data based on the encapsulation result. For example, the first device can choose to encapsulate only the first data and the attribute tag, as shown in Figure 5. In Figure 5, the first device includes a tag client for tagging and encapsulating the first data. The first device encapsulates the attribute tag and the first data through the tag client, resulting in an encapsulation result including the first data and the attribute tag.

[0091] The first device may also choose to encapsulate only the first data and the sending strategy, or may choose to encapsulate the first data, the attribute tag, and the sending strategy. For example, as shown in FIG6 , after the tag client generates the sending strategy based on the attribute tag, it encapsulates the sending strategy, the attribute tag, and the first data together to obtain an encapsulation result including the first data, the attribute tag, and the sending strategy. Referring to FIG5 and FIG6 , no matter what method the first device adopts to achieve the encapsulation of the first data, the encapsulated sending strategy or attribute tag is centrally configured at a specific location of the encapsulation result, such as the tail end or the head end of the encapsulation result. Through centralized configuration, the subsequent second device only needs to read the data at the specific location when parsing the encapsulation result to extract the attribute tag or the sending strategy. The extraction process is simple and efficient.

[0092] In one possible scenario, the first device can directly determine the encapsulation result as the second data. For example, as shown in Figures 6 and 7, the first device also includes a protocol stack, which is deployed in the operating system (OS) kernel and can be called a kernel plug-in in some cases. When the first data needs to be sent, the tag client sends the encapsulated encapsulation result to the protocol stack, and the protocol stack sends the encapsulation result to the second device. The protocol stack can, as shown in Figures 6 and 7, not perform a filling operation on the received encapsulation result, that is, use the encapsulation result as the second data to be sent.

[0093] Exemplarily, the first device may also fill the encapsulation result to obtain the second data, and the filling process includes but is not limited to: filling at least one of the attribute tag and the sending strategy in the protocol field of the encapsulation result to obtain the second data. Continuing with Figure 5 as an example, the first device parses the information carried in the encapsulation result through the protocol stack to determine the information that needs to be filled, and then fills the parsed information into the protocol field. The information refers to the sending strategy or attribute tag encapsulated in the above embodiment. By filling at least one of the attribute tag and the sending strategy in the protocol field of the encapsulation result that has encapsulated at least one of the attribute tag and the sending strategy, a backup of at least one of the attribute tag and the sending strategy is achieved, thereby avoiding damage to the second data during transmission, resulting in the device receiving the second data failing to parse the protocol field and being unable to extract the attribute tag or sending strategy filled in the protocol field. In this case, the device receiving the second data can continue to read the encapsulated attribute tag or sending strategy to obtain the sending strategy, thereby improving transmission reliability.

[0094] The process of filling at least one of the attribute tags and sending strategies in the protocol field of the encapsulation result is similar to the process of filling at least one of the attribute tags and sending strategies in the protocol field of the first data. For detailed process, please refer to the relevant description in the second acquisition method, and will not be repeated here.

[0095] Acquisition method 2: Fill at least one of the attribute tag and the sending strategy into the protocol field of the first data to obtain the second data.

[0096] Continuing with FIG5 as an example, the tag client of the first device can obtain at least one of the attribute tag and the sending strategy, and then send the obtained attribute tag and at least one of the sending strategy and the first data directly to the protocol stack. The protocol stack performs field parsing on the received first data, and then fills at least one of the attribute tag and the sending strategy in the protocol field. The embodiment of the present application does not limit the protocol field to be filled. In the Internet Protocol version 4 (IPv4) scenario, the protocol field can be an option field in the Transmission Control Protocol / Internet Protocol (TCP / IP). In the Internet Protocol version 6 (IPv6) scenario, the protocol field can be a field in the extended message header of the first data. Taking the filling of the attribute tag as an example, the protocol stack can directly assign the value of the attribute tag to the protocol field, or determine the first value corresponding to the attribute tag and assign the protocol field to the first value. Taking the attribute tag as top secret as an example, the first value corresponding to top secret is, for example, 1. Taking the attribute tag as core as an example, the first value corresponding to core is, for example, 0.

[0097] S404: The first device sends second data to the second device.

[0098] In one possible implementation, when the first data does not need to be transmitted immediately, for example, if the first data shown in S401 is data stored in the first device, the first device will first store the second data in a storage space or local disk after generating the second data. Later, when the first data needs to be transmitted, since the second data includes the first data, the first data can be transmitted by sending the second data to the second device, as shown in Figures 5-7. This improves data transmission efficiency by directly sending the generated second data when the first data needs to be transmitted.

[0099] Exemplarily, the second device is a device configured at the network boundary and used to transmit data to different network domains. The second device can be deployed independently in the network environment and deployed in series for data monitoring, protocol field parsing, and tag policy execution. Taking the network topology diagram shown in Figure 3 as an example, the second device can be a mail server configured at the network boundary to manage whether to send mail to other network domains, or a gateway device in the network DLP shown in Figure 3. In the case where the first data to be sent needs to be sent to other network domains, the first device will send the second data including the first data to the second device, so that the second device can manage the external transmission of the second data.

[0100] S405, the second device receives second data sent by the first device, the second data includes the first data, and also includes at least one of an attribute tag of the first data and a sending strategy obtained based on the attribute tag, the attribute tag indicates attribute information of the first data in different dimensions.

[0101] Exemplarily, the second data received by the second device is obtained based on the first data and the attribute tag. The second data includes the first data and at least one of the attribute tag and a transmission policy. The attribute tag indicates attribute information of the first data in different dimensions. A detailed description of the second data can be found in the relevant content of S403 and is not repeated here.

[0102] S406: The second device parses the second data and determines a sending strategy for the second data according to the parsing result.

[0103] Because the second data is obtained based on the attribute tags, which indicate attribute information of the first data in different dimensions, the second device can parse the second data and determine whether the first data is sensitive data requiring transmission protection based on the attribute information, thereby determining a transmission policy for the second data including the first data. In one possible implementation, in the case where the second data in S403 includes at least one of a transmission policy and an attribute tag, the second device can determine the transmission policy for the second data based on the parsing results in various ways, including but not limited to the following.

[0104] Determination method 1: When the second data includes an attribute tag, the second device parses the second data and determines the attribute tag based on the parsing result; obtains the correspondence between the attribute tag and the sending strategy, and determines the sending strategy based on the correspondence and the determined attribute tag.

[0105] Exemplarily, the second device performs protocol parsing on the message header of the second data and determines the attribute tag based on the parsing result, wherein the parsing result includes a protocol field. The process of determining the attribute tag based on the parsing result includes but is not limited to: when the attribute tag is included in the parsed protocol field, extracting the attribute tag from the protocol field; or, when the attribute tag is not included in the parsed protocol field, performing file restoration on the parsing result and extracting the attribute tag from the restored result.

[0106] In the case where the first device fills the protocol field with an attribute tag during the process of acquiring the second data, for example, by directly filling the attribute tag or first encapsulating and then filling the attribute tag in S403, the protocol field parsed by the second device will include the attribute tag. The second device can directly extract the attribute tag included in the protocol field, simplifying the process of obtaining the attribute tag for the second device and improving extraction efficiency. The fact that the protocol field includes an attribute tag indicates that the protocol field is a valued field, and the second device can determine the corresponding attribute tag based on the value of the protocol field.

[0107] In one possible case, the protocol field obtained by the second device does not include the attribute tag, and this situation exists for two reasons, including but not limited to. Reason one is that the first device does not fill the attribute tag in the protocol field during the process of obtaining the second data, such as the case where the attribute tag and the first data are encapsulated in S403, and the encapsulation result is determined to be the second data. Reason two is that the first device first encapsulates the attribute tag and then fills the attribute tag, but because the second data is damaged during the transmission process, the second device fails to parse the protocol field. Regardless of whether the attribute tag is not included in the protocol field obtained by the analysis due to reason one or reason two, the second device can determine that the second data is obtained by encapsulating the attribute tag and the first data when the attribute tag is not included in the protocol field, and continue to perform file restoration on the parsing result to achieve decapsulation of the second data. Among them, the protocol field does not include the attribute tag, for example, the protocol field is an unassigned idle field, and the file restoration is, for example, performing payload parsing on the second data to obtain the attribute tag encapsulated in the payload.

[0108] Regardless of how the second device determines the attribute tag, the sending strategy can be determined based on the extracted attribute tag. The process of the second device determining the sending strategy is similar to that of the first device, and can be found in the relevant description in S403, which will not be repeated here.

[0109] Determination method two: when the second data includes a sending policy, parse the second data and extract the sending policy included in the parsing result.

[0110] In one possible case, after performing protocol parsing on the second data, the process of extracting the sending policy included in the parsed result includes: extracting the sending policy from the protocol field when the parsed protocol field includes the sending policy; or, performing file restoration on the parsed result and extracting the sending policy from the restored result when the parsed protocol field does not include the sending policy. The process of extracting the sending policy from the protocol field is similar to the process of extracting the attribute tag from the protocol field. The process of performing file restoration on the parsed result and extracting the sending policy from the restored result is similar to the process of performing file restoration on the parsed result and extracting the sending policy from the restored result. Please refer to the relevant description in the first determination method, which will not be repeated here. Since the second data includes a data-specific sending policy, the second device can implement transmission control according to the data-specific sending policy by extracting the sending policy. The granularity of the transmission control is the data granularity, which is fine and has high accuracy.

[0111] In the case where the second data includes both attribute tags and a sending policy, the second device can flexibly select determination method one or determination method two to determine the sending policy. For example, the second device can choose to adopt determination method two, extract only the sending policy, and perform the operation of S407 based on the extracted sending policy. The second device can also choose to extract the sending policy and attribute tags, determine the sending policy based on the extracted attribute tags, verify the extracted sending policy with the determined sending policy, and if the determined sending policy and the extracted sending policy are consistent, perform the operation of S407 based on the sending policy. If the determined sending policy and the extracted sending policy are inconsistent, the sending of the second data is restricted.

[0112] S407: The second device determines whether to intercept the second data according to the sending policy of the second data.

[0113] In one possible implementation, the second device may choose to determine whether to intercept the second data based solely on the sending policy. When the sending policy indicates that sending is restricted, the second data may be intercepted, such as shown in Figures 5-7 , and the second data may be intercepted. When the sending policy indicates that sending is allowed, the second data may be released, such as shown in Figures 5-7 . Exemplarily, when the second device determines to release the second data based on the sending policy, the second data is sent to the first network domain. The first network domain is determined based on the second data, and the second device may parse the destination address of the second data and determine the second network domain to which the second data needs to be sent based on the destination address. The first network domain is different from the network domain in which the first device is located.

[0114] In one possible case, the second device can also determine whether the second data needs to be sent across network domains based on the source address and destination address of the second data, and determine whether to intercept the second data based on the determination result and the sending policy. When the sending policy is to allow sending, regardless of whether the second data needs to be sent across network domains, it can be determined to release the second data. When the sending policy is to restrict sending, and the second data does not belong to cross-domain transmission, it is determined to release the second data. When the sending policy is to restrict sending, and the second data belongs to cross-domain transmission, it is determined to intercept the second data. Cross-domain sending means that the network domain to which the second data is sent is different from the network domain where the first device is located. Taking Figure 5 as an example, the first network domain is domain B, and the network domain where the first device is located is domain A, then the second data is transmitted across network domains.

[0115] In addition, the second device can directly send the second data during the process of sending the second data. The downstream network device can then continue to determine whether the second data requires transmission protection based on the received second data to determine the transmission strategy for the second data. The second device can also restore the first data based on the second data and send the restored first data. Restoration can be performed by, for example, decapsulating the second data to obtain the encapsulated first data, or deleting the information populated in the protocol field of the second data to obtain the first data. By restoring the first data and sending the first data, the amount of transmitted data is reduced, thereby improving transmission efficiency.

[0116] The above is the process of the second device sending the second data. In one possible case, the second device will also record the transmission information of the second data, which includes but is not limited to: user information of the user who sends the second data, the transmission time of the second data, the transmission method of the second data, and the sending strategy of the second data, so as to monitor the data transmission according to the transmission information. In one possible implementation, the second device can trigger an early warning mechanism when it detects that the sending strategy of the second data is to restrict sending. For example, an alarm message is sent to the operation object, and the alarm message includes the transmission information of the second data. The second device can immediately trigger the early warning mechanism when there is intercepted second data, or it can trigger the alarm mechanism when the amount of restricted second data reaches the early warning threshold set based on experience. Through the early warning, the operation object is promptly reminded that sensitive data that needs to be protected is being transmitted, so that the operation object can check according to the transmission information and achieve data protection.

[0117] In summary, the data processing method provided by the embodiment of the present application, since the attribute label indicates the attribute information of the first data in different dimensions, can be used to determine whether the first data needs transmission protection based on the attribute information of different dimensions through the attribute label to obtain a sending strategy, thereby avoiding sending data that should not be transmitted, resulting in data leakage, and having high security. In addition, since the sending strategy can be determined only based on the attribute label, the process involved in determining the sending strategy is small, the operation is simple, and the efficiency is high. Furthermore, by not limiting the method by which the first device obtains the second data based on the attribute label and the first data, the flexibility is high. And no matter what method the first device uses to obtain the second data, the second device has a corresponding parsing method to smoothly obtain the sending strategy based on the parsing result of the second data, and the versatility is wide.

[0118] The above describes the data processing method of the embodiment of the present application. Corresponding to the above method, the embodiment of the present application also provides a data processing device. Figure 8 is a structural diagram of a data processing device provided by the embodiment of the present application. Based on the following multiple modules shown in Figure 8, the data processing device shown in Figure 8 can perform all or part of the operations of the first device shown in Figure 4 above. It should be understood that the device may include more additional modules than the modules shown or omit some of the modules shown therein, and the embodiment of the present application does not limit this. As shown in Figure 8, the device includes:

[0119] An acquisition module 801 is configured to acquire first data;

[0120] A determination module 802 is configured to determine an attribute tag of the first data, where the attribute tag indicates attribute information of the first data in different dimensions;

[0121] The acquisition module 801 is further configured to acquire second data based on the first data and the attribute tag, where the second data includes the first data and at least one of the attribute tag and a sending policy obtained based on the attribute tag, where the sending policy indicates whether a device receiving the second data should intercept the second data;

[0122] The sending module 803 sends the second data to the second device.

[0123] In one possible implementation, the determination module 802 is used to obtain at least one classification information of the first data, where the classification information indicates the importance of the first data in the corresponding classification, the first data corresponds to at least one classification, and each classification information in the at least one classification information indicates a different classification; and determine an attribute label based on the at least one classification information.

[0124] In a possible implementation, the acquisition module 801 is configured to acquire an encapsulation result, where the encapsulation result includes at least one of an attribute tag and a sending strategy and the first data; and obtain the second data according to the encapsulation result.

[0125] In a possible implementation, the acquisition module 801 is configured to fill at least one of the attribute tag and the sending strategy into the protocol field of the encapsulation result to obtain the second data.

[0126] In a possible implementation, the acquisition module 801 is configured to fill at least one of the attribute tag and the sending strategy into the protocol field of the first data to obtain the second data.

[0127] In a possible implementation, the acquisition module 801 is further configured to acquire a correspondence between an attribute tag and a sending strategy; and determine the sending strategy according to the correspondence and the attribute tag.

[0128] In one possible implementation, the attribute label includes at least one of a confidentiality level label, a data type label, and an object identity label, the confidentiality level label indicates the sensitivity level of the first data, the data type label indicates the data type of the first data, and the object identity label indicates the identity level of the object corresponding to the first data.

[0129] Because the attribute tags indicate attribute information of the first data in different dimensions, the device determines whether the first data requires transmission protection and determines a transmission strategy based on the attribute information in different dimensions. This prevents the release of data that should not be transmitted, prevents data leakage, and enhances data transmission security. Determining the transmission strategy solely based on the attribute tags involves fewer steps, is simple to operate, and is highly efficient.

[0130] The present application also provides another data processing device. FIG9 is a schematic diagram of the structure of a data processing device provided by the present application. Based on the following multiple modules shown in FIG9, the data processing device shown in FIG9 can perform all or part of the operations of the second device shown in FIG4 above. It should be understood that the device may include more additional modules than the modules shown or omit some of the modules shown therein, and the present application does not limit this. As shown in FIG9, the device includes:

[0131] A receiving module 901 is configured to receive second data sent by a first device, where the second data includes the first data and at least one of an attribute tag of the first data and a sending strategy obtained based on the attribute tag, where the attribute tag indicates attribute information of the first data in different dimensions;

[0132] Determining module 902, configured to parse the second data and determine a sending strategy for the second data according to the parsing result;

[0133] The determination module 902 is further configured to determine whether to intercept the second data according to a sending policy of the second data.

[0134] In a possible implementation, the second data includes an attribute tag, and the determination module 902 is configured to determine the attribute tag according to the parsing result; obtain a correspondence between the attribute tag and the sending strategy, and determine the sending strategy according to the correspondence and the determined attribute tag.

[0135] In one possible implementation, the determination module 902 is configured to extract the attribute tag from the protocol field when the parsed protocol field includes the attribute tag; or, to perform file restoration on the parsing result and extract the attribute tag from the restored result when the parsed protocol field does not include the attribute tag.

[0136] In one possible implementation, the second data includes a sending strategy, and the determination module 902 is used to extract the sending strategy from the protocol field when the parsed protocol field includes the sending strategy; or, to perform file restoration on the parsing result and extract the sending strategy from the restoration result when the parsed protocol field does not include the sending strategy.

[0137] In one possible implementation, the device further includes: a forwarding module for sending the second data to a first network domain when it is determined to release the second data according to a sending policy. The first network domain is determined according to the second data, and the first network domain is different from the network domain where the first device is located.

[0138] In one possible implementation, the attribute label includes at least one of a confidentiality level label, a data type label, and an object identity label, the confidentiality level label indicates the sensitivity level of the first data, the data type label indicates the data type of the first data, and the object identity label indicates the identity level of the object corresponding to the first data.

[0139] Because the attribute tags indicate the attributes of the first data in different dimensions, the device determines whether the first data requires transmission protection and determines a transmission strategy based on the attribute information in different dimensions. This prevents the release of data that should not be sent, prevents data leakage, and enhances data transmission security. The transmission strategy can be determined by simply parsing the second data, which involves fewer steps, is simple to operate, and is highly efficient.

[0140] It should be understood that the devices provided in FIG. 8 or FIG. 9 above are merely examples of the division of the functional modules described above when implementing their functions. In actual applications, the functions described above can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the devices and method embodiments provided in the above embodiments are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0141] Referring to Figure 10 , Figure 10 shows a schematic diagram of the structure of a network device 1000 provided in accordance with an exemplary embodiment of the present application. The network device 1000 shown in Figure 10 is configured to perform the operations involved in the data processing method shown in Figure 4 . The network device 1000 is, for example, a switch or router, and can be implemented using a general bus architecture.

[0142] As shown in FIG. 10 , a network device 1000 includes at least one processor 1001 , a memory 1003 , and at least one communication interface 1004 .

[0143] The processor 1001 is, for example, a general-purpose central processing unit (CPU), a digital signal processor (DSP), a network processor (NP), a graphics processing unit (GPU), a neural-network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the solution of the present application. For example, the processor 1001 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. It can implement or execute the various logic blocks, modules, and circuits described in conjunction with the disclosure of the embodiments of the present application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0144] Optionally, network device 1000 also includes a bus. The bus is used to transmit information between the various components of network device 1000. The bus may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, for example. Buses can be categorized as address buses, data buses, control buses, and the like. For ease of illustration, FIG10 shows only one thick line, but this does not imply that there is only one bus or only one type of bus.

[0145] The memory 1003 is, for example, a read-only memory (ROM) or other type of static storage device that can store static information and instructions, or a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1003 is, for example, independent and connected to the processor 1001 via a bus. The memory 1003 can also be integrated with the processor 1001.

[0146] The communication interface 1004 uses any transceiver-like device for communicating with other devices or communication networks. The communication network can be Ethernet, a radio access network (RAN), or a wireless local area network (WLAN). The communication interface 1004 can include a wired communication interface or a wireless communication interface. Specifically, the communication interface 1004 can be an Ethernet interface, a fast Ethernet (FE) interface, a gigabit Ethernet (GE) interface, an asynchronous transfer mode (ATM) interface, a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. In the embodiment of the present application, the communication interface 1004 can be used for the network device 1000 to communicate with other devices.

[0147] In a specific implementation, as an embodiment, the processor 1001 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG10 . Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0148] In a specific implementation, as an embodiment, the network device 1000 may include multiple processors, such as processor 1001 and processor 1005 shown in FIG10 . Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0149] In a specific implementation, as an embodiment, the network device 1000 may further include an output device and an input device. The output device communicates with the processor 1001 and can display information in a variety of ways. For example, the output device can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device communicates with the processor 1001 and can receive user input in a variety of ways. For example, the input device can be a mouse, a keyboard, a touch screen device, or a sensor device.

[0150] In some embodiments, the memory 1003 is used to store program code 1010 for executing the solution of the present application, and the processor 1001 can execute the program code 1010 stored in the memory 1003. That is, the network device 1000 can implement the data processing method provided by the method embodiment through the processor 1001 and the program code 1010 in the memory 1003. The program code 1010 may include one or more software modules. Optionally, the processor 1001 itself may also store program code or instructions for executing the solution of the present application.

[0151] In a specific embodiment, the network device 1000 of the embodiment of the present application may correspond to the computing device in the above-mentioned various method embodiments.

[0152] Among them, each step of the data processing method shown in Figure 4 is completed by the hardware integrated logic circuit or software instructions in the processor of the network device 1000. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as being executed by the hardware processor, or can be executed by a combination of hardware and software modules in the processor. The software module can be located in a storage medium mature in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.

[0153] Referring to FIG11 , FIG11 shows a schematic diagram of the structure of a network device 1100 provided in another exemplary embodiment of the present application. The network device 1100 shown in FIG11 is configured to perform all or part of the operations involved in the data processing method shown in FIG4 . The network device 1100 is, for example, a switch, a router, etc., and can be implemented using a general bus architecture.

[0154] As shown in FIG. 11 , the network device 1100 includes a main control board 1110 and an interface board 1130 .

[0155] The main control board (MCB), also known as the main processing unit (MPU) or route processor card, is used to control and manage various components in network device 1100, including routing calculations, device management, device maintenance, and protocol processing. MCB 1110 includes a central processing unit (CPU) 1111 and memory 1112.

[0156] Interface board 1130 is also known as a line processing unit (LPU), line card, or service board. It provides various service interfaces and implements data packet forwarding. Service interfaces include, but are not limited to, Ethernet interfaces and POS (Packet over SONET / SDH) interfaces. Ethernet interfaces, for example, are Flexible Ethernet Clients (FlexE Clients). Interface board 1130 includes a central processing unit (CPU) 1131, a network processor (NPU) 1132, a forwarding table memory 1134, and a physical interface card (PIC) 1133.

[0157] The central processing unit 1131 on the interface board 1130 is used to control and manage the interface board 1130 and communicate with the central processing unit 1111 on the main control board 1110 .

[0158] The network processor 1132 is used to implement message forwarding processing. The network processor 1132 can be in the form of a forwarding chip. The forwarding chip can be a network processor (NP). In some embodiments, the forwarding chip can be implemented using an application-specific integrated circuit (ASIC) or a field programmable gate array (FPGA). Specifically, the network processor 1132 is used to forward received messages based on the forwarding table stored in the forwarding entry memory 1134. If the destination address of the message is the address of the network device 1100, the message is sent to the CPU (such as the central processing unit 1131) for processing. If the destination address of the message is not the address of the network device 1100, the next hop and outgoing interface corresponding to the destination address are searched in the forwarding table based on the destination address, and the message is forwarded to the outgoing interface corresponding to the destination address. Processing of uplink messages can include processing the message inbound interface and forwarding table lookup; processing of downlink messages can include forwarding table lookup, etc. In some embodiments, the central processing unit can also perform the functions of the forwarding chip, such as implementing software forwarding based on a general-purpose CPU, thereby eliminating the need for a forwarding chip in the interface board.

[0159] Physical interface card 1133 implements physical layer interconnection. Raw traffic enters interface board 1130 through this card, and processed packets are sent from this physical interface card 1133. Physical interface card 1133, also known as a daughter card, can be installed on interface board 1130. It converts optical and electrical signals into packets, performs a validity check on these packets, and then forwards them to network processor 1132 for processing. In some embodiments, central processing unit 1131 can also perform the functions of network processor 1132, such as implementing software forwarding based on a general-purpose CPU, eliminating the need for network processor 1132 in physical interface card 1133.

[0160] Optionally, network device 1100 includes multiple interface boards. For example, network device 1100 further includes interface board 1140. Interface board 1140 includes a central processing unit 1141, a network processor 1142, a forwarding table entry memory 1144, and a physical interface card 1143. The functions and implementation of each component in interface board 1140 are the same as or similar to those of interface board 1130 and are not described in detail here.

[0161] Optionally, network device 1100 further includes a switching fabric board 1120. Switching fabric board 1120 may also be referred to as a switch fabric unit (SFU). If network device 1100 includes multiple interface boards, switching fabric board 1120 is used to exchange data between the interface boards. For example, interface board 1130 and interface board 1140 can communicate via switching fabric board 1120.

[0162] The main control board 1110 is coupled to the interface board. For example, the main control board 1110, the interface board 1130, the interface board 1140, and the switching network board 1120 are connected to the system backplane via a system bus to achieve intercommunication. In one possible implementation, an inter-process communication (IPC) channel is established between the main control board 1110 and the interface boards 1130 and 1140, and communication is performed between the main control board 1110 and the interface boards 1130 and 1140 via the IPC channel.

[0163] Logically, network device 1100 includes a control plane and a forwarding plane. The control plane includes a main control board 1110 and a central processing unit 1111. The forwarding plane includes various components that perform forwarding, such as a forwarding table entry memory 1134, physical interface cards 1133, and a network processor 1132. The control plane performs functions such as routing, generating forwarding tables, processing signaling and protocol messages, and configuring and maintaining the network device's status. The control plane sends the generated forwarding tables to the forwarding plane. On the forwarding plane, the network processor 1132 forwards messages received by the physical interface card 1133 based on the forwarding tables sent by the control plane. The forwarding tables sent by the control plane can be stored in the forwarding table entry memory 1134. In some embodiments, the control plane and forwarding plane can be completely separate and not located on the same network device.

[0164] It's worth noting that there may be one or more main control boards (SPUs), which can include both active and standby SPUs. There may also be one or more interface boards. The higher the network device's data processing capabilities, the more interface boards it provides. Interface boards can also have one or more physical interface cards. There may be no SPUs, one or more SPUs, and multiple SPUs can provide load balancing and redundancy. In a centralized forwarding architecture, network devices may not require SPUs; the interface boards handle service data processing for the entire system. In a distributed forwarding architecture, network devices may have at least one SPU, which enables data exchange between multiple interface boards, providing high-capacity data exchange and processing capabilities. Therefore, network devices with distributed architectures have greater data access and processing capabilities than those with centralized architectures. Alternatively, a network device can consist of a single card, without a switching fabric board (SFB), integrating the functions of the interface board and the main control board. In this case, the central processing unit (CPU) on the interface board and the CPU on the main control board can be combined into a single CPU on this card, performing the combined functions of the two. This type of network device has lower data exchange and processing capabilities (for example, low-end network devices such as switches or routers). The specific architecture used depends on the specific network deployment scenario and is not specified here.

[0165] In a specific embodiment, the network device 1100 corresponds to the data processing apparatus shown in Figure 8 or Figure 9. In some embodiments, the determination module 802 in the data processing apparatus shown in Figure 8 corresponds to the central processing unit 1111 or the network processor 1132 in the network device 1100.

[0166] An embodiment of the present application further provides a communication device, comprising: a transceiver, a memory, and a processor. The transceiver, the memory, and the processor communicate with each other via an internal connection path. The memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to control the transceiver to receive signals and control the transceiver to send signals. When the processor executes the instructions stored in the memory, the processor executes a data processing method.

[0167] It should be understood that the processor may be a CPU, or other general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor supporting the Advanced Reduced Instruction Set Machine (ARM) architecture.

[0168] Furthermore, in an optional embodiment, the memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. The memory may also include a non-volatile random access memory. For example, the memory may also store device type information.

[0169] The memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a ROM, a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an EEPROM, or a flash memory. The volatile memory may be a RAM, which is used as an external cache. By way of example but not limitation, many forms of RAM are available. For example, static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0170] The present application also provides a data processing device, including a processor configured to load and execute at least one instruction to enable the data processing device to implement the data processing method provided in the present application. Optionally, the device also includes a memory coupled to the processor and configured to store the at least one instruction.

[0171] An embodiment of the present application also provides a data processing system, which includes a first device and a second device, and the first device and the second device are used to interactively execute the data processing method provided by the embodiment of the present application.

[0172] An embodiment of the present application further provides a computer-readable storage medium, in which at least one instruction is stored. The instruction is loaded and executed by a processor to enable a computer to implement any of the data processing methods described above.

[0173] The embodiments of the present application further provide a computer program (product), which, when executed by a computer, can enable a processor or computer to execute the corresponding steps and / or processes in the above method embodiments.

[0174] An embodiment of the present application also provides a chip, which includes a processor for calling and executing instructions stored in a memory from the memory, so that a communication device equipped with the chip executes any of the data processing methods described above.

[0175] An embodiment of the present application also provides another chip, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute any of the data processing methods described above.

[0176] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described herein are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive).

[0177] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of relevant data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the first data involved in this application were all obtained with full authorization.

[0178] Those skilled in the art will appreciate that the various method steps and modules described in conjunction with the embodiments disclosed herein can be implemented in software, hardware, firmware, or any combination thereof. In order to clearly illustrate the interchangeability of hardware and software, the steps and components of each embodiment have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0179] Those skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware, or may be accomplished by a program to instruct the relevant hardware, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0180] When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer program instructions. As an example, the method of the embodiment of the present application can be described in the context of a machine executable instruction, and the machine executable instruction is such as included in the program module executed in the device on the real or virtual processor of the target. Generally speaking, a program module includes a routine, a program, a library, an object, a class, a component, a data structure, etc., which performs a specific task or realizes a specific abstract data structure. In various embodiments, the function of the program module can be merged or split between the described program modules. The machine executable instruction for the program module can be executed in a local or distributed device. In a distributed device, the program module can be located in both a local and a remote storage medium.

[0181] The computer program code for realizing the method for the embodiment of the application can be written in one or more programming languages.These computer program codes can be provided to the processor of general-purpose computer, special-purpose computer or other programmable data processing device, so that program code, when being executed by computer or other programmable data processing device, causes the function / operation specified in flow chart and / or block diagram to be implemented.Program code can be executed completely on computer, partly on computer, as independent software package, partly on computer and partly on remote computer or completely on remote computer or server.

[0182] In the context of the embodiments of the present application, computer program code or related data may be carried by any suitable carrier to enable a device, apparatus, or processor to perform the various processes and operations described above. Examples of carriers include signals, computer-readable media, and the like.

[0183] Examples of signals may include electrical, optical, radio, acoustic or other forms of propagated signals, such as carrier waves, infrared signals, etc.

[0184] A machine-readable medium may be any tangible medium that contains or stores a program for or in connection with an instruction execution system, apparatus, or device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination thereof. More detailed examples of machine-readable storage media include an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0185] Those skilled in the art will clearly understand that, for the sake of convenience and brevity of description, the specific working processes of the above-described systems, devices, and modules can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0186] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the modules is merely a logical function division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, or can be electrical, mechanical or other forms of connection.

[0187] Modules described as separate components may or may not be physically separate, and components displayed as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0188] In addition, the functional modules in the various embodiments of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into a single module. The above-mentioned integrated modules may be implemented in the form of hardware or software functional modules.

[0189] If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0190] In this application, the terms "first", "second", etc. are used to distinguish between identical or similar items with substantially the same effects and functions. It should be understood that there is no logical or temporal dependency between "first", "second", and "nth", nor is there any limitation on quantity or execution order. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another. For example, without departing from the scope of the various described examples, a first image may be referred to as a second image, and similarly, a second image may be referred to as a first image. Both the first image and the second image may be images, and in some cases, may be separate and different images.

[0191] It should also be understood that in the various embodiments of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0192] In this application, the term "at least one" means one or more, and the term "plurality" means two or more. For example, "plurality of second messages" means two or more second messages. The terms "system" and "network" are often used interchangeably herein.

[0193] It should be understood that the terminology used in the description of the various examples herein is for the purpose of describing particular examples only and is not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0194] It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the listed items. The term "and / or" describes an association between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this application generally indicates that the associated objects are in an "or" relationship.

[0195] It will also be understood that the term “comprise” (also known as “includes,” “including,” “comprises,” and / or “comprising”) when used in this specification specifies the presence of stated features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0196] It should also be understood that the terms “if” and “if” may be interpreted to mean “when” or “upon” or “in response to determining” or “in response to detecting.” Similarly, the phrases “if it is determined that ” or “if [stated condition or event] is detected” may be interpreted to mean “upon determining ” or “in response to determining ” or “upon detecting [stated condition or event]” or “in response to detecting [stated condition or event],” depending on the context.

[0197] It should be understood that determining B based on A does not mean determining B based solely on A. B can also be determined based on A and / or other information.

[0198] It should also be understood that references throughout this specification to "one embodiment," "an embodiment," or "one possible implementation" mean that specific features, structures, or characteristics associated with that embodiment or implementation are included in at least one embodiment of the present application. Therefore, the appearance of "in one embodiment," "in an embodiment," or "one possible implementation" throughout this specification does not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

Claims

1. A data processing method, characterized in that: The method is applied to a first device, and the method includes: Acquire first data; Determine an attribute tag of the first data, where the attribute tag indicates attribute information of the first data in different dimensions; acquiring second data according to the first data and the attribute tag, the second data including the first data and at least one of the attribute tag and a sending strategy obtained based on the attribute tag, the sending strategy indicating whether a device receiving the second data intercepts the second data; The second data is sent to a second device.

2. The method according to claim 1, characterized in that: The determining the attribute label of the first data includes: Acquire at least one classification information of the first data, the classification information indicating the importance of the first data in the corresponding classification, the first data corresponding to at least one classification, and each classification information in the at least one classification information indicates a different classification; The attribute label is determined according to the at least one classification information.

3. The method according to claim 1 or 2, characterized in that: The acquiring the second data according to the first data and the attribute tag includes: Acquire an encapsulation result, where the encapsulation result includes at least one of the attribute tag and the sending strategy and the first data; The second data is obtained according to the packaging result.

4. The method according to claim 3, characterized in that The obtaining the second data according to the encapsulation result includes: At least one of the attribute tag and the sending strategy is filled in the protocol field of the encapsulation result to obtain the second data.

5. The method according to claim 1 or 2, characterized in that: The acquiring the second data according to the first data and the attribute tag includes: At least one of the attribute tag and the sending strategy is filled in the protocol field of the first data to obtain the second data.

6. The method according to any one of claims 3 to 5, characterized in that: Before acquiring the second data according to the first data and the attribute tag, the method further includes: Get the correspondence between attribute tags and sending strategies; The sending strategy is determined according to the corresponding relationship and the attribute tag.

7. The method according to any one of claims 1 to 6, characterized in that: The attribute label includes at least one of a confidentiality level label, a data type label and an object identity label, the confidentiality level label indicates a sensitivity level of the first data, the data type label indicates a data type of the first data, and the object identity label indicates an identity level of an object corresponding to the first data.

8. A data processing method, characterized in that: The method is applied to a second device, and the method includes: receiving second data sent by the first device, the second data including the first data and at least one of an attribute tag of the first data and a sending strategy obtained based on the attribute tag, wherein the attribute tag indicates attribute information of the first data in different dimensions; parsing the second data, and determining a sending strategy for the second data according to a parsing result; Determine whether to intercept the second data according to a sending policy of the second data.

9. The method according to claim 8, characterized in that The second data includes the attribute tag, and determining a sending strategy for the second data according to the parsing result includes: Determine the attribute tag according to the parsing result; The corresponding relationship between the attribute tag and the sending strategy is acquired, and the sending strategy is determined according to the corresponding relationship and the determined attribute tag.

10. The method according to claim 9, characterized in that The determining the attribute tag according to the parsing result includes: In a case where the parsed protocol field includes the attribute tag, extracting the attribute tag from the protocol field; Alternatively, when the protocol field obtained by the analysis does not include the attribute tag, the parsing result is restored to a file, and the attribute tag is extracted from the restored result.

11. The method according to claim 8, characterized in that The second data includes the sending strategy, and determining the sending strategy of the second data according to the parsing result includes: In a case where the protocol field obtained by parsing includes the sending policy, extracting the sending policy from the protocol field; Alternatively, when the protocol field obtained by the analysis does not include the sending policy, the parsing result is restored to a file, and the sending policy is extracted from the restored result.

12. The method according to any one of claims 8 to 11, characterized in that: After determining whether to intercept the second data according to the sending strategy of the second data, the method further includes: In case it is determined according to the sending policy to release the second data, the second data is sent to a first network domain, the first network domain is determined according to the second data, and the first network domain is different from the network domain where the first device is located.

13. The method according to any one of claims 8 to 12, characterized in that: The attribute label includes at least one of a confidentiality level label, a data type label and an object identity label, the confidentiality level label indicates a sensitivity level of the first data, the data type label indicates a data type of the first data, and the object identity label indicates an identity level of an object corresponding to the first data.

14. A data processing device, characterized in that: The device comprises: A transceiver module, configured to perform the receiving and / or sending related operations performed by the first device in the method of any one of claims 1 to 7; A processing module, used to perform other operations other than the receiving and / or sending related operations performed by the first device in any one of the methods described in claims 1-7.

15. A data processing device, characterized in that: The device comprises: A transceiver module, configured to perform the reception and / or transmission related operations performed by the second device in the method described in any one of claims 8 to 13; A processing module, used to perform other operations other than the receiving and / or sending related operations performed by the second device in any one of the methods described in claims 8-13.

16. A data processing device, characterized in that: The device includes a processor, and the processor is used to load and execute at least one instruction so that the data processing device implements the data processing method as described in any one of claims 1-7, or implements the data processing method as described in any one of claims 8-13.

17. A data processing system, characterized in that: The system includes a first device and a second device, wherein the first device is used to implement the data processing method as described in any one of claims 1 to 7, and the second device is used to implement the data processing method as described in any one of claims 8 to 13.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, and the instruction is loaded and executed by the processor to implement the data processing method as described in any one of claims 1 to 7, or to implement the data processing method as described in any one of claims 8 to 13.

19. A chip, characterized in that: The chip includes a processor, which is used to run program instructions or codes, so that a device including the chip executes the data processing method as described in any one of claims 1-7, or executes the data processing method as described in any one of claims 8-13.

Images