A data transmission method and related device

Abstract

Embodiments of the present application disclose a data transmission method and related devices, wherein the method comprises: receiving a first data packet from a terminal device, the first data packet comprising a first QoT level of a service corresponding to the first data packet and a forwarding policy of the first data packet; obtaining a second QoT level of a second network device; and sending the first data packet to the second network device according to the first QoT level, the second QoT level and the forwarding policy. The embodiments of the present application are beneficial to constructing a trusted network route for data transmission.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network communication, and in particular to a data transmission method and related equipment. BACKGROUND

[0002] With the continuous development of the Internet and the rapid popularization of online services, the Internet carries huge social and economic value, at the same time, it also causes a large number of attacks on the Internet. Attackers can take advantage of the security and trust vulnerabilities of the Internet to attack high-value information data, thereby causing large-scale data leakage and incalculable economic losses, such as hijacking of routers leading to website paralysis, nuclear power plant virus attack incidents, network security management software products being attacked by hackers, and the like.

[0003] Data leakage, uncertainty of data use, cybercrime, network monitoring and other threats are affecting users' trust in the network. How to ensure users' privacy and property safety in the digital revolution is an important challenge for Internet policy makers. After years of efforts, the IETF (Internet Engineering Task Force), 3GPP (Third Generation Partnership Program), and other standard organizations have designed numerous security standards and protocols for routers, base stations and other network devices, which have made network devices have preliminary security protection capabilities. However, due to various limitations, the current network is facing a new challenge: how to build a trusted data forwarding path or transmission route based on an untrusted network.

[0004] In the current solution, the sending end sends path establishment information to the target host, the receiving end sends a trusted path reservation message to the sending end after receiving the path information, the intermediate router inserts the trust level information of the router in the message after receiving the message, and the sending end receives the trusted path reservation message, matches the trust level information of the router with the information pre-configured in the database to determine whether the path is acceptable, and if it is acceptable, performs data transmission based on the path. However, since the current Internet routers interact through BGP (Border Gateway Protocol) messages, a large number of routing request signals from the sending end can easily cause signaling congestion, forming a DDoS (Distributed denial of service attack) attack on the router. It can be seen that how to provide a trusted data forwarding scheme and improve the trustworthiness of the network is still a problem to be solved in data transmission. SUMMARY

[0005] The embodiment of the present application provides a data transmission method and related equipment, which quantifies the quality of trust (QoT) of a service and a network device, and can construct a trusted network route for data transmission.

[0006] In a first aspect, the embodiment of the present application provides a data transmission method, applied to a first network device, and the method comprises the following steps.

[0007] Receiving a first data packet from a terminal device, wherein the first data packet comprises a first QoT level of a service corresponding to the first data packet and a forwarding policy of the first data packet;

[0008] Obtaining a second QoT level of a second network device;

[0009] According to the first QoT level, the second QoT level and the forwarding policy, sending the first data packet to the second network device.

[0010] It should be noted that the first network device can be any network device in the network, and the first data packet can be a complete data packet of a terminal-side service or a sub-data packet obtained by fragmenting the complete data packet on the terminal device side. The first QoT refers to the QoT of the service corresponding to the first data packet, and the second network device can be any network device in the network except the first network device.

[0011] In the embodiment of the present application, the trusted attributes of the terminal device, the service on the terminal device side, the core network node and the network device (such as a base station, a router and a gateway) in the network are quantified, the QoT level is configured, the data forwarding policy of the service on the terminal device side is configured, and when the first network device needs to forward the first data packet from the terminal device, it can be determined whether to send the first data packet to the second network device according to the first QoT level of the service, the second QoT level of the second network device and the forwarding policy of the first data packet. For example, the forwarding policy of the first data packet indicates that it can only be forwarded to a network device with a QoT level higher than or equal to the first QoT level, and when the second QoT level is higher than or equal to the first QoT level, the first network device sends the first data packet to the second network device. Of course, the forwarding policy can have many forms, and the present application does not limit the forwarding policy. It should be understood that based on the first QoT level, the second QoT level and the forwarding policy, the first data packet is sent to the second network device only when the second QoT level meets the first QoT level and the forwarding policy, so that the network device selected each time is trusted, and thus it is beneficial to construct a trusted network route for data transmission.

[0012] In some possible implementation manners, before receiving the first data packet from the terminal device, the method further includes:

[0013] sending, to the terminal device, a first message, wherein the first message comprises a third QoT level of the first network device; and

[0014] In the embodiments of the present application, the first network device can send its third QoT level to the terminal device through the first message, so that when the terminal device needs to send the first data packet, the terminal device can determine whether to send the first data packet to the first network device according to the first QoT level, the third QoT level and the forwarding policy of the first data packet, thereby facilitating the construction of a trusted network route from the sending end to the receiving end for data transmission.

[0015] In some possible implementation manners, before sending the first message to the terminal device, the method further includes: sending, to a first core network node, first configuration information and a first signature of the first configuration information, so that the first core network node determines the third QoT level according to the first signature, the first configuration information and a configuration policy of an operator; and receiving first QoT configuration information from the first core network node, wherein the first QoT configuration information comprises the third QoT level. It should be noted that the first configuration information refers to the software and hardware configuration information of the first network device, for example, the first configuration information comprises an identifier, a model, a manufacturer, a factory certificate and a version of software used of the first network device. The first core network node can be a management node for QoT configuration management.

[0016] In the embodiments of the present application, the first network device can send the first configuration information and the first signature of the first configuration information to the first core network node, so that the first core network node verifies the first signature, and in the case of verification, configures a QoT level (i.e. the third QoT level) for the first network device according to the first configuration information and the configuration policy of the operator, and sends the third QoT level to the first network device in the first QoT configuration information, so that the first network device can send the third QoT level to the terminal device and other network devices in the network, and then the terminal device or other network devices can determine whether to send data to the first network device according to the third QoT level.

[0017] In some possible implementation manners, the first message comprises any one of a master information block (MIB), a system information block (SIB), a beacon and control plane signaling from the first core network node.

[0018] In the embodiments of the present application, if the first network device is an LTE (Long Term Evolution) / 5G (5th Generation Mobile Communication Technology) network device, the first network device can send the third QoT level to the terminal device and other network devices through broadcast signaling such as a master information block (MIB) and a system information block (SIB); if the first network device is a Wi-Fi AP (Wi-Fi Access Point), the first network device can send the third QoT level to the terminal device and other network devices through a beacon. If the operator is worried that sending the third QoT level through broadcast signaling such as a master information block (MIB), a system information block (SIB) and a beacon (Beacon) will expose the third QoT level, the third QoT level can be sent to the terminal device through the control plane signaling of the first core network node, thereby helping to avoid the risk of exposing the sensitive information such as the QoT level of the network device, and further helping to improve the security and credibility of the network device.

[0019] In some possible implementation manners, after sending the first configuration information to the first core network node, the method further includes: forwarding, to the first core network node, a second message from the terminal device, the second message including location information of the terminal device, a reference network device identifier and a fourth QoT level of the terminal device, wherein the second message is used to request the first core network node to determine, from the reference network devices, a target network device accessible by the terminal device according to the fourth QoT level, the location information and the QoT level of the reference network device, wherein the reference network devices include network devices within a range determined based on the location information, and the reference network device identifier is used to indicate the reference network devices.

[0020] In the embodiments of the present application, if the terminal device needs to obtain the third QoT level of the first network device through the control plane signaling of the first core network node, the terminal device sends its own location information, reference network device identifiers of reference network devices (such as all network devices within the range) within a range determined based on the location information and its own fourth QoT level to the first core network node through the first network device in a second message, so as to help the first core network node to determine, from the reference network devices, a target network device accessible by the terminal device based on the above information, and send relevant information of the target network device to the terminal device through the control plane signaling, thereby helping to avoid the exposure risk caused by the target network device (such as the first network device) sending its own sensitive information such as the QoT level through broadcast signaling.

[0021] In some possible implementation manners, the first message comprises control plane signaling from the first core network node, and the sending of the first message to the terminal device comprises:

[0022] forwarding, to the terminal device, control plane signaling from the first core network node, the control plane signaling from the first core network node comprising the identity of the target network device and the QoT level; and wherein the target network device comprises the first network device.

[0023] In the embodiments of the present application, the first network device sends the identity of the target network device accessible by the terminal device and the QoT level to the terminal device by sending control plane signaling from the first core network to the terminal device, such as the first network device, so that the terminal device can initiate a connection request to the target network device based on the identity of the target network device, the QoT level, and the first QoT level, the forwarding policy, and other information, to perform data transmission. On the one hand, this is conducive to the terminal device selecting a trusted network device for data transmission. On the other hand, this is conducive to avoiding the risk of exposing sensitive information such as the QoT level of the target network device.

[0024] In some possible implementation manners, the forwarding policy comprises at least one of the following:

[0025] when the first QoT level is lower than or equal to the second QoT level, sending the first data packet to the second network device;

[0026] when the first QoT level is higher than the second QoT level and the service accepts degraded transmission, sending the first data packet to the second network device;

[0027] when the first QoT level is higher than the second QoT level, not sending the first data packet to the second network device;

[0028] when the first QoT level is higher than the second QoT level, fragmenting the first data packet, and sending sub-packets obtained by fragmenting to core network nodes with a QoT level higher than or equal to the first QoT level by using different paths, so that the core network nodes combine and restore the sub-packets obtained by fragmenting into the first data packet and send the first data packet to a next hop; and

[0029] when the first QoT level is higher than the second QoT level and the second QoT level is higher than or equal to the lowest QoT level adoptable by the first data packet, sending the first data packet to the second network device.

[0030] The forwarding policy can be sending the first data packet to a second network device with a second QoT level higher than or equal to the first QoT level; the forwarding policy can also be a degradable transmission, that is, if the first QoT level is higher than the second QoT level, but the terminal device configures the service to accept the degradable transmission, the first network device can send the first data packet to a second network device with a second QoT level lower than the first QoT level; the forwarding policy can also be a fragmentation, that is, if the first QoT level is higher than the second QoT level, the first network device can fragment the first data packet, and then send the sub-packets obtained by fragmentation to different network devices, including the second network device, such as network device 1 and network device 2, and the network device 1 and the network device 2 send the sub-packets obtained by fragmentation to the core network node with a QoT level higher than or equal to the first QoT level, respectively, so as to realize sending the sub-packets to the core network node with a QoT level higher than or equal to the first QoT level by using different paths, thereby relatively improving the QoT level of the network device 1 and the network device 2, and since the network device 1 and the network device 2 receive sub-packets, it is beneficial to reduce the risk of first data packet leakage, and the core network node can combine the received sub-packets to restore the first data packet, and then forward to the next hop; the forwarding policy can also be to specify the minimum QoT level that the first data packet can adopt under the condition of degradable, that is, when the second QoT level is lower than the first QoT level and the second QoT level is higher than or equal to the minimum QoT level, the first data packet can be sent to the second network device. Of course, the above is only an exemplary forwarding policy, and the present application can also include more forwarding policies or combinations of forwarding policies, according to the forwarding policy of the first data packet, the first network device can flexibly select the second network device for data transmission, thereby facilitating to improve the flexibility of data transmission while constructing a trusted network route.

[0031] In some possible implementations, the first QoT level is higher than the third QoT level, and the first data packet is a sub-packet obtained by fragmenting a data packet of the service of the terminal device;

[0032] According to the first QoT level, the second QoT level and the forwarding policy, the first data packet is sent to the second network device, comprising:

[0033] The first data packet is sent to the second core network node, so that the second core network node obtains the data packet of the service according to the first data packet and the second data packet, and sends the data packet of the service to the second network device according to the first QoT level, the second QoT level and the forwarding policy;

[0034] The second core network node has a QoT level higher than or equal to the first QoT level, the second data packet is a sub data packet obtained by the terminal device fragmenting a data packet of the service, the second data packet is sent by the third network device to the second core network node, the first QoT level is higher than a fifth QoT level of the third network device, and the data packet of the service includes the forwarding policy. It should be noted that the data packet of the service includes the forwarding policy, which means that the forwarding policy of the data packet of the service is the same as the forwarding policy of the first data packet.

[0035] In the embodiment of the present application, when the first QoT level is higher than the third QoT level, the terminal device needs to fragment the data packet of the service according to the fragmentable forwarding policy, the first data packet is a sub data packet from the terminal device, the first network device needs to send the first data packet to the second core network node having a QoT level higher than or equal to the first QoT level, meanwhile, the third network device sends the second data packet to the second core network node, and the second core network node combines all the received sub data packets (the first data packet and the second data packet) to restore the data packet of the service, and then sends the data packet of the service to the second network device according to the first QoT level, the second QoT level and the forwarding policy, so as to realize that when the first network device and the third network device do not meet the forwarding requirements of the data packet of the service, the data packet of the service can be fragmented, and the first network device and the third network device respectively send the received sub data packets to the second core network node, the second core network node sends the data packet of the service to the second network device, thereby relatively improving the QoT level of the first network device and the third network device and being conducive to reducing the risk of leakage of the data packet of the service.

[0036] In a second aspect, the embodiment of the present application provides a data transmission method applied to a first network device, and the method comprises the following steps.

[0037] Receiving a first data packet from a terminal device, the first data packet being obtained by the terminal device by layer-by-layer encryption of to-be-transmitted data using at least one symmetric key, wherein the at least one symmetric key comprises a symmetric key corresponding to a network device in a transmission path of the to-be-transmitted data, the transmission path being determined according to position information of the terminal device, a first QoT level of a service corresponding to the to-be-transmitted data, a QoT level of the network device in the transmission path, a forwarding policy of the to-be-transmitted data and a receiving end IP address of the to-be-transmitted data, and the network device in the transmission path comprising the first network device;

[0038] Decrypting the first data packet using a target symmetric key to obtain a third data packet, the target symmetric key being a symmetric key corresponding to the first network device;

[0039] Sending the third data packet to a second network device, the second network device being a next hop of the first network device in the transmission path.

[0040] It should be noted that "from" can be sent by the terminal device to the first network device directly, or sent by the terminal device to other network devices, and then forwarded by the other network devices to the first network device.

[0041] In the embodiments of the present application, the trust attributes of the terminal device in the network, the service on the terminal device side, the core network node and the network device (such as a base station, a router, a gateway, etc.) are quantified, the QoT level is configured for them, and the data forwarding strategy is configured for the service on the terminal device side. The first core network node can determine the end-to-end transmission path for the to-be-transmitted data according to the location information of the terminal device, the first QoT level of the service corresponding to the to-be-transmitted data, the QoT level of the network device in the network, the forwarding strategy of the to-be-transmitted data, and the receiving end IP address of the to-be-transmitted data, thereby facilitating the construction of a trusted network route for data transmission. Since the transmission path is selected by the first core network node, the first network device no longer needs to send its own QoT level to the terminal device, thereby facilitating the avoidance of the risk of exposure of the QoT level of the first network device. In addition, the terminal device can use the symmetric key corresponding to the network device in the transmission path to encrypt the to-be-transmitted data layer by layer, the first network device in the transmission path uses the target symmetric key to decrypt the first data packet, and the obtained is the encrypted third data packet. After the second network device decrypts the third data packet, the obtained is also the encrypted data packet. Since the network devices in the transmission path do not know the receiving end IP address of the to-be-transmitted data, they can only perform partial decryption and give the data to the next hop, and the next hop can only perform partial decryption and cannot obtain the unencrypted to-be-transmitted data, thereby facilitating the improvement of the security of the data. It should be understood that the first core network node can be a management node for QoT configuration management.

[0042] In some possible implementation manners, before receiving the first data packet from the terminal device, the method further includes:

[0043] forwarding a routing request from the terminal device to a third core network node, the routing request including the location information, the first QoT level, the forwarding strategy, and the receiving end IP address, the routing request being used to request the third core network node to determine the transmission path;

[0044] forwarding a third message from the third core network node to the terminal device, the third message including the network device in the transmission path, the certificate of the network device in the transmission path, and a temporary certificate issued by the third core network node for the terminal device.

[0045] In the embodiments of the present application, the first network device forwards the routing request of the terminal device, so that the third core network node selects a transmission path for the to-be-transmitted data according to the information in the routing request, and sends the network devices in the transmission path, the certificate of the network device and the temporary certificate of the terminal device to the terminal device through the first network device, thereby facilitating the terminal device to perform key negotiation with the corresponding network devices in the transmission path by using the certificate and the temporary certificate, and further facilitating subsequent layer-by-layer encryption of the to-be-transmitted data. It should be understood that the third core network node can be a negotiation node for QoT routing negotiation.

[0046] In some possible embodiments, the target symmetric key is obtained by the terminal device performing key negotiation with the first network device or an affiliated node of the first network device by using the certificate and the temporary certificate of the first network device;

[0047] The first data packet is obtained by the terminal device encrypting the first service flow identifier and the third data packet by using the target symmetric key, and the first service flow identifier is obtained by the terminal device performing key negotiation with the first network device or an affiliated node of the first network device by using the certificate and the temporary certificate of the first network device;

[0048] The method further includes:

[0049] Decrypting the first data packet by using the target symmetric key further obtains the first service flow identifier;

[0050] Sending the third data packet to the second network device includes:

[0051] When the first service flow identifier is the same as the second service flow identifier stored by the first network device, the third data packet is sent to the second network device.

[0052] It should be noted that the "affiliated node" refers to a slave node of the first network device, for example, in a master-slave architecture, the first network device is a master node, and its slave node is an affiliated node.

[0053] In the embodiments of the present application, based on the secure link established by the terminal device with the first network device using the certificate of the first network device and the temporary certificate of the terminal device, the first network device or the affiliated node of the first network device can perform key negotiation with the terminal device, the first network device thereby obtains the target symmetric key and the service flow identifier (stored as the second service flow identifier) of the first network device, and the terminal device thereby obtains the target symmetric key and the service flow identifier (stored as the first service flow identifier) of the first network device, so as to facilitate the terminal device to encrypt the third data packet and the first service flow identifier by using the target symmetric key, and further facilitate to improve the security of the data to be transmitted. In addition, based on the decrypted first service flow identifier, the first network device matches it with the stored second service flow identifier, if they are the same, it means that it is the service flow that needs to be processed by the first network device, then the first network device performs the operation of sending the third data packet to the second network device, otherwise, if they are not the same, it means that it is not the service flow that needs to be processed by the first network device, and the first network device can not send the third data packet to the second network device, thereby facilitating the error forwarding of data.

[0054] In some possible implementation manners, the method further includes:

[0055] storing a first context, the first context being a context of key negotiation between the terminal device and the first network device, and the first context including the second service flow identifier and the target symmetric key; or

[0056] receiving and storing a second context sent by the affiliated node, the second context being a context of key negotiation between the terminal device and the affiliated node, and the second context including the second service flow identifier and the target symmetric key.

[0057] In the embodiments of the present application, if the first network device performs key negotiation with the terminal device, the first network device needs to store the first context, if the affiliated node of the first network device performs key negotiation with the terminal device, the affiliated node needs to store the second context and send the second context to the first network device for storage, so as to facilitate the subsequent first network device to perform decryption by using the target symmetric key when receiving the first data packet, and to forward the third data packet to the next hop when the second service flow identifier is the same as the first service flow identifier, and further facilitate to realize the secure forwarding of the data to be transmitted on the transmission path.

[0058] In some possible implementation manners, before forwarding the routing request from the terminal device to the third core network node, the method further includes:

[0059] The first configuration information is transmitted to the first core network node and the first signature of the first configuration information, so that the first core network node determines a third QoT level according to the first signature, the first configuration information and the configuration policy of the operator, and obtains a transmission path according to the third QoT level. It should be noted that the first configuration information refers to the software and hardware configuration information of the first network device. For example, the first configuration information includes the identifier, model, manufacturer, factory certificate and version of the software used of the first network device. The first core network node can be a management node for QoT configuration management.

[0060] In the embodiment, the first network device can transmit the first configuration information and the first signature of the first configuration information to the first core network node, so that the first core network node verifies the first signature, and configures a QoT level (i.e., the third QoT level) for the first network device according to the first configuration information and the configuration policy of the operator if the verification is passed. Thus, a transmission path is selected for the to-be-transmitted data according to the third QoT level, and the first network device can forward the data according to the transmission path after decrypting the third data packet, without performing the path selection operation, which is beneficial to reducing the overhead of the first network device.

[0061] In some possible implementation manners, the forwarding policy includes at least one of the following:

[0062] When the first QoT level is lower than or equal to the second QoT level, the first data packet is transmitted to the second network device;

[0063] When the first QoT level is higher than the second QoT level and the service accepts the degraded transmission, the first data packet is transmitted to the second network device;

[0064] When the first QoT level is higher than the second QoT level, the first data packet is not transmitted to the second network device;

[0065] When the first QoT level is higher than the second QoT level, the first data packet is fragmented, and the sub-packets obtained by fragmenting are transmitted to the core network node with a QoT level higher than or equal to the first QoT level by using different paths, so that the core network node combines and restores the sub-packets to the first data packet and transmits the first data packet to the next hop; and

[0066] When the first QoT level is higher than the second QoT level and the second QoT level is higher than or equal to the lowest adoptable QoT level of the first data packet, the first data packet is transmitted to the second network device.

[0067] The forwarding policy can be sending the first data packet to a second network device with a second QoT level higher than or equal to the first QoT level. The forwarding policy can also be a degradable transmission, that is, if the first QoT level is higher than the second QoT level, but the terminal device configures the service to accept the degradable transmission, the first network device can send the first data packet to a second network device with a second QoT level lower than the first QoT level. The forwarding policy can also be a fragmentation, that is, if the first QoT level is higher than the second QoT level, the first network device can fragment the first data packet, and then send the sub-packets obtained by fragmentation to different network devices, including the second network device, such as network device 1 and network device 2, and the network device 1 and the network device 2 send the sub-packets obtained by fragmentation to the core network node with a QoT level higher than or equal to the first QoT level, respectively, so as to realize sending the sub-packets to the core network node with a QoT level higher than or equal to the first QoT level by using different paths, thereby relatively improving the QoT level of the network device 1 and the network device 2, and since the network device 1 and the network device 2 receive sub-packets, it is beneficial to reduce the risk of first data packet leakage, and the core network node can combine the received sub-packets to restore the first data packet, and then forward to the next hop. The forwarding policy can also specify the minimum QoT level that the first data packet can adopt under the condition of degradable transmission, that is, when the second QoT level is lower than the first QoT level and the second QoT level is higher than or equal to the minimum QoT level, the first data packet can be sent to the second network device. Of course, the above is only an exemplary forwarding policy, and the present application can include more forwarding policies or combinations of forwarding policies. According to the forwarding policy of the first data packet, the first network device can flexibly select the second network device for data transmission, thereby facilitating to improve the flexibility of data transmission while constructing a trusted network route.

[0068] In a third aspect, an embodiment of the present application provides a data transmission method applied to a terminal device, the method comprising:

[0069] Obtaining a first QoT level of a current service and a forwarding policy of a first data packet of the service;

[0070] Obtaining a third QoT level of the first network device;

[0071] According to the first QoT level, the forwarding policy and the third QoT level, sending the first data packet to the first network device.

[0072] It should be noted that the first network device can be any network device in the network, and the first data packet can be a complete data packet of a terminal-side service, or a sub-packet obtained by fragmenting the complete data packet by the terminal device.

[0073] The embodiments of the present application quantize the trusted attributes of the terminal device, the service on the terminal device side, the core network node and the network device (such as a base station, a router, a gateway, etc.) in the network, configure a QoT level for the same, and configure a data forwarding policy for the service on the terminal device side. The current service refers to the service being executed on the terminal device side, such as a call service. When the terminal device needs to send a first data packet generated by the current service, whether the first data packet is sent to the first network device can be determined according to the first QoT level of the service, the third QoT level of the first network device and the forwarding policy of the first data packet. It should be understood that, based on the first QoT level, the third QoT level and the forwarding policy, the first data packet is sent to the first network device only when the third QoT level meets the first QoT level and the forwarding policy, so that the selected first network device is trusted, and thus it is beneficial to build a trusted network route for data transmission.

[0074] In some possible implementation manners, before the first QoT level of the current service and the forwarding policy of the first data packet of the service are acquired, the method further includes:

[0075] receiving a first message sent by the first network device, the first message including the third QoT level;

[0076] storing the third QoT level;

[0077] The third QoT level is determined by the first core network node according to the first configuration information of the first network device, the first signature of the first configuration information and the configuration policy of the operator.

[0078] In the embodiments of the present application, the terminal device can obtain the third QoT level of the first network device through the first message sent by the first network device, so that when the first data packet needs to be sent, whether the first data packet is sent to the first network device can be determined according to the first QoT level, the third QoT level and the forwarding policy of the first data packet, thereby facilitating the construction of a trusted network route from the sending end to the receiving end for data transmission. It should be understood that the first core network node can be a management node for QoT configuration management.

[0079] In some possible implementation manners, after the third QoT level is stored, the method further includes:

[0080] accessing the network and sending registration signaling to a control plane node on the network side through the first network device, the registration signaling including a QoT service policy of the terminal device and a minimum QoT level required by the terminal device, the QoT service policy being used to determine a data forwarding policy for an application on the terminal device, the application including a target application corresponding to the service;

[0081] receiving, from the first network device, a fourth message forwarded from the control plane node, the fourth message comprising a highest QoT level provided by the network, wherein the fourth message is sent by the control plane node according to the QoT service policy and the minimum QoT level, or according to the subscription information of the terminal device at the network side, and the highest QoT level is used to determine the target application that can be used.

[0082] In the embodiments of the present application, the terminal device sends the registration signaling to the control plane node through the first network device, and sends the pre-configured QoT service policy and the required minimum QoT level to the control plane node. The control plane node determines to accept the registration of the terminal device according to the QoT service policy and the minimum QoT level, or according to the subscription information of the terminal device at the network side, and sends the highest QoT level provided by the network to the terminal device through the fourth message, so as to facilitate the terminal device to determine which application on the terminal device can be used according to the highest QoT level, and further to set and modify the permissions of the application on the terminal device, such as enabling and disabling.

[0083] In some possible implementation manners, the first message comprises any one of a master information block (MIB), a system information block (SIB), a beacon, and control plane signaling from the first core network node.

[0084] In the embodiments of the present application, if the first network device is an LTE / 5G network device, the first network device can send the third QoT level to the terminal device and other network devices through the broadcast signaling such as the master information block (MIB) and the system information block (SIB). If the first network device is a Wi-Fi AP, the first network device can send the third QoT level to the terminal device and other network devices through the beacon. If the operator is worried that sending the third QoT level through the broadcast signaling such as the master information block (MIB), the system information block (SIB) and the beacon will expose the third QoT level, the third QoT level can be sent to the terminal device through the control plane signaling of the first core network node, so as to facilitate avoiding the risk of exposing the sensitive information such as the QoT level of the network device, and further facilitating improving the security and credibility of the network device.

[0085] In some possible implementation manners, after receiving the fourth message forwarded from the control plane node by the first network device, the method further comprises:

[0086] sending, by the first network device, a second message to the first core network node, the second message including location information of the terminal device, a reference network device identifier, and a fourth QoT level of the terminal device, wherein the second message is used to request the first core network node to determine a target network device accessible by the terminal device from the reference network device according to the fourth QoT level, the location information, and a QoT level of the reference network device; and wherein the reference network device includes network devices within a range determined based on the location information, and the reference network device identifier is used to indicate the reference network device.

[0087] In the embodiments of the present application, if the terminal device needs to obtain the third QoT level of the first network device through the control plane signaling of the first core network node, the terminal device sends its own location information, reference network device identifiers of reference network devices (such as one or more network devices within the range) within a range determined based on the location information, and its own fourth QoT level to the first core network node through the first network device in the second message, so that the first core network node determines a target network device accessible by the terminal device from the reference network devices based on the above information, and sends relevant information of the target network device to the terminal device through the control plane signaling, thereby facilitating avoiding the exposure risk caused by the target network device sending its own sensitive information such as the QoT level in the broadcast signaling.

[0088] In some possible implementation manners, the first message includes control plane signaling from the first core network node, and the first network device sends the first message, including:

[0089] The terminal device receives the control plane signaling from the first core network node forwarded by the first network device, and the control plane signaling from the first core network node includes an identifier and a QoT level of the target network device; and wherein the target network device includes the first network device.

[0090] In the embodiments of the present application, the terminal device can obtain the target network device and the QoT level of the target network device through the control plane signaling from the first core network node, and when it needs to send a first data packet, the terminal device can initiate a connection request to the target network device based on the identifier, the QoT level, and the first QoT level, the forwarding policy, and other information of the target network device, to perform data transmission, which on one hand facilitates the terminal device to select a trusted network device (such as the first network device) to perform data transmission, and on the other hand facilitates avoiding the risk of exposing the sensitive information such as the QoT level of the target network device.

[0091] In some possible implementation manners, the forwarding policy includes at least one of the following:

[0092] When the first QoT level is lower than or equal to the third QoT level, sending the first data packet to the first network device;

[0093] when the first QoT level is higher than the third QoT level and the service accepts degraded transmission, sending the first data packet to the first network device;

[0094] when the first QoT level is higher than the third QoT level, not sending the first data packet to the first network device;

[0095] when the first QoT level is higher than the third QoT level, fragmenting the first data packet, and sending sub-packets obtained by fragmenting to core network nodes with QoT levels higher than or equal to the first QoT level by different paths, so that the core network nodes combine and restore the sub-packets obtained by fragmenting to the first data packet and send the first data packet to the next hop; and

[0096] when the first QoT level is higher than the third QoT level and the third QoT level is higher than or equal to the lowest QoT level that the first data packet can adopt, sending the first data packet to the first network device.

[0097] The forwarding policy can be that the terminal device sends the first data packet to the first network device with a third QoT level higher than or equal to the first QoT level; the forwarding policy can also be that the terminal device sends the first data packet to the first network device with a third QoT level lower than the first QoT level if the first QoT level is higher than the third QoT level and the terminal device is configured to accept degraded transmission for the service; the forwarding policy can also be that the terminal device performs fragmentation on the first data packet if the first QoT level is higher than the third QoT level, and then sends sub-packets obtained by fragmentation to different network devices, including the first network device, such as network device a and network device b, and the network device a and the network device b send the sub-packets to a core network node with a QoT level higher than or equal to the first QoT level, respectively, so as to realize sending the sub-packets to the core network node with the QoT level higher than or equal to the first QoT level by using different paths, thereby relatively improving the QoT level of the network device a and the network device b, and since the network device a and the network device b receive only the sub-packets, it is beneficial to reduce the risk of leakage of the first data packet, and the core network node can combine the received sub-packets to restore the first data packet, and then forward to the next hop; the forwarding policy can also be that the terminal device sends the first data packet to the first network device under the condition of degraded transmission, and the minimum QoT level that can be used by the first data packet is specified. Of course, the above is only an example of the forwarding policy, and the application can include more forwarding policies or combinations of the forwarding policies. According to the forwarding policy of the first data packet, the terminal device can flexibly select the first network device for data transmission, thereby constructing a trusted network route and improving the flexibility of data transmission.

[0098] In some possible implementations, the first data packet is a sub-packet obtained by the terminal device performing fragmentation on a data packet of the service;

[0099] After receiving the fourth message from the control plane node forwarded by the first network device, the method further includes:

[0100] obtaining a fifth QoT level of the third network device, the fifth QoT level being obtained according to a fifth message sent by the third network device;

[0101] if the first QoT level is higher than the third QoT level and the fifth QoT level, performing fragmentation on the data packet of the service to obtain the first data packet and a second data packet, the second data packet being a sub-packet obtained by the terminal device performing fragmentation on the data packet of the service except the first data packet, and the data packet of the service including the forwarding policy;

[0102] The method further includes:

[0103] According to the first QoT level, the forwarding policy and the fifth QoT level, the second data packet is sent to the third network device. It should be noted that the forwarding policy included in the data packet of the service means that the forwarding policy of the data packet of the service is the same as the forwarding policy of the first data packet.

[0104] In the embodiment of the application, when the first QoT level is higher than the third QoT level and the fifth QoT level, the terminal device needs to fragment the data packet of the service according to the fragmentable forwarding policy, to obtain the first data packet and the second data packet, and send the first data packet and the second data packet to the first network device and the third network device respectively, so that the second core network node with a QoT level higher than or equal to the first QoT level is respectively sent by the first network device and the third network device, and all sub-packets (the first data packet and the second data packet) received by the second core network node are combined and restored to the data packet of the service, so as to realize that when the first network device and the third network device do not meet the forwarding requirements of the data packet of the service, the data packet of the service can be fragmented, and the first network device and the third network device respectively send the received sub-packet to the second core network node, and the second core network node sends the data packet of the service to the next hop, thereby relatively improving the QoT level of the first network device and the third network device and being conducive to reducing the risk of leakage of the data packet of the service.

[0105] In some possible implementation manners, before receiving the first message sent by the first network device, the method further includes:

[0106] According to the QoT classification in the preset second QoT configuration information, a QoT level to be applied is determined, and the second QoT configuration information includes a QoT service policy;

[0107] According to the QoT service policy and the QoT level to be applied, a data forwarding policy to be applied is determined;

[0108] The fourth QoT level of the terminal device is determined according to the QoT classification. It should be noted that “preset” means that the second QoT configuration information can be configured by the terminal device itself or configured by the first core network node for the terminal device. “QoT classification” means the classification of QoT.

[0109] In the embodiments of the present application, the terminal device can configure a corresponding QoT level for the application according to the QoT classification and the QoT requirement of the application, and determine a data forwarding strategy of the application according to the QoT service policy and the QoT level of the application, so that when the terminal device performs a service and generates data subsequently, the terminal device can select a network device to which the data is to be sent and how to send the data based on the QoT level, the data forwarding strategy and the QoT level of the network device, thereby facilitating the construction of a trusted network route for data transmission.

[0110] In some possible implementation manners, before determining the QoT level of the application according to the QoT classification in the second QoT configuration information, the method further includes:

[0111] sending, by the first network device, the second configuration information and a second signature of the second configuration information to the first core network node;

[0112] receiving, by the terminal device, the second QoT configuration information forwarded by the first network device and from the first core network node, the second QoT configuration information being determined by the first core network node according to the second signature, the second configuration information and a configuration policy of the operator, and the second QoT configuration information including a fourth QoT level. It should be noted that the second configuration information refers to the software and hardware configuration information of the first network device, and the second configuration information includes, for example, an identifier, a model, a manufacturer, a factory certificate and a version of software used of the terminal device.

[0113] In the embodiments of the present application, the terminal device can send, by the first network device, the second configuration information and a second signature of the second configuration information to the first core network node, so that the first core network node verifies the second signature, and in the case of verification, configures QoT configuration information (i.e., the second QoT configuration information) for the terminal device according to the second configuration information and the configuration policy of the operator, so that the terminal device can determine a QoT level and a data forwarding strategy for an application on the terminal device according to the second QoT configuration information, thereby facilitating the construction of a subsequent trusted network route. In addition, by using the fourth QoT level in the second QoT configuration information, the terminal device can also request the first core network node to determine a target network device that can be accessed through the first network device, thereby avoiding the exposure risk caused by the target network device (such as the first network device) sending its own QoT level and other sensitive information in a broadcast signaling.

[0114] In a fourth aspect, the embodiments of the present application provide a data transmission method applied to a terminal device, and the method includes:

[0115] encrypting, by using at least one symmetric key, the to-be-transmitted data of the current service layer by layer to obtain a first data packet, the at least one symmetric key being a symmetric key corresponding to a network device in a transmission path of the to-be-transmitted data, the transmission path being determined according to location information of the terminal device, a first QoT level of the service corresponding to the to-be-transmitted data, a QoT level of the network device in the transmission path, a forwarding strategy of the to-be-transmitted data, and a receiving end IP address of the to-be-transmitted data, and the network device in the transmission path including the first network device;

[0116] sending the first data packet to the first network device.

[0117] In the embodiments, the terminal device, the service on the terminal device side, the core network node, and the network device (such as a base station, a router, a gateway, etc.) in the network are quantified for their trusted attributes, and are configured with QoT levels. The service on the terminal device side is configured with a data forwarding strategy. The first core network node can determine an end-to-end transmission path for the to-be-transmitted data according to the location information of the terminal device, the first QoT level of the service corresponding to the to-be-transmitted data, the QoT level of the network device in the network, the forwarding strategy of the to-be-transmitted data, and the receiving end IP address of the to-be-transmitted data, thereby facilitating the construction of a trusted network route for data transmission. Since the transmission path is selected by the first core network node, the first network device no longer needs to send its own QoT level to the terminal device, thereby facilitating the avoidance of the risk of exposure of the QoT level of the first network device. In addition, the current service refers to the service being executed on the terminal device side. When the to-be-transmitted data needs to be sent, the terminal device can use the symmetric key corresponding to the network device in the transmission path to encrypt the to-be-transmitted data layer by layer, and the first network device can only partially decrypt the first data packet, thereby facilitating the improvement of the security of the data. It should be understood that the first core network node can be a management node for QoT configuration management.

[0118] In some possible implementation manners, before the to-be-transmitted data of the current service is encrypted layer by layer by using the at least one symmetric key to obtain the first data packet, the method further includes:

[0119] sending, by the first network device, a routing request to the third core network node, the routing request including the location information, the first QoT level, the forwarding strategy, and the receiving end IP address, and the routing request being used to request the third core network node to determine the transmission path;

[0120] receiving, by the first network device, a third message from the third core network node, the third message including the network device in the transmission path, the certificate of the network device in the transmission path, and a temporary certificate issued by the third core network node for the terminal device.

[0121] In the embodiment of the application, the terminal device sends a routing request to the third core network node through the first network device, so that the third core network node selects a transmission path for the to-be-transmitted data according to information in the routing request, and sends network devices in the transmission path, a certificate of the network device, and a temporary certificate of the terminal device to the terminal device through the first network device, thereby facilitating the terminal device to perform key negotiation with corresponding network devices in the transmission path by using the certificate and the temporary certificate, and further facilitating subsequent layer-by-layer encryption of the to-be-transmitted data. It should be understood that the third core network node can be a negotiation node for QoT routing negotiation.

[0122] In some possible implementation manners, after receiving the third message from the third core network node forwarded by the first network device, the method further includes:

[0123] performing key negotiation with the first network device or a subordinate node of the first network device by using the certificate of the first network device and the temporary certificate, to obtain a first service flow identifier corresponding to the first network device and a target symmetric key;

[0124] The first data packet is obtained by encrypting the first service flow identifier and the third data packet by using the target symmetric key, and the third data packet is obtained by performing data encryption on the third data packet by using a symmetric key corresponding to the second network device, which is a next hop of the first network device in the transmission path.

[0125] In the embodiment of the application, the terminal device can perform key negotiation with the first network device or a subordinate node of the first network device by using the certificate of the first network device and the temporary certificate of the terminal device, and thereby obtain the target symmetric key of the first network device and a service flow identifier (stored as the first service flow identifier), so as to facilitate the terminal device to encrypt the third data packet and the first service flow identifier by using the target symmetric key, and further facilitate improvement of security of the to-be-transmitted data.

[0126] In some possible implementation manners, before sending the routing request to the third core network node through the first network device, the method further includes:

[0127] accessing a network and sending registration signaling to a control plane node on the network side through the first network device, the registration signaling including a QoT service policy of the terminal device and a minimum QoT level required by the terminal device, the QoT service policy being used to determine a data forwarding policy for an application on the terminal device, and the application including a target application corresponding to a service;

[0128] receiving a fourth message sent by the control plane node and forwarded by the first network device, the fourth message including a highest QoT level provided by the network, wherein the fourth message is sent by the control plane node according to the QoT service policy and the lowest QoT level, or according to the subscription information of the terminal device at the network side;

[0129] determining that the target application can be used according to the highest QoT level and the forwarding policy.

[0130] In the embodiments, the terminal device sends registration signaling to the control plane node through the first network device, and sends the pre-configured QoT service policy and the required lowest QoT level to the control plane node. The control plane node determines to accept the registration of the terminal device according to the QoT service policy and the lowest QoT level, or according to the subscription information of the terminal device at the network side, and sends the highest QoT level provided by the network to the terminal device through the first network device in the fourth message. Therefore, the terminal device can determine which application (such as the target application) on the terminal device can be used according to the highest QoT level, and further set and modify the permissions of the application on the terminal device, such as enabling and disabling.

[0131] In some possible implementation manners, before accessing the network and sending registration signaling to the control plane node at the network side, the method further includes:

[0132] determining the QoT level of the application according to the QoT classification in the pre-set second QoT configuration information, wherein the second QoT configuration information includes the QoT service policy;

[0133] determining the data forwarding policy of the application according to the QoT service policy and the QoT level of the application;

[0134] It should be noted that "pre-set" means that the second QoT configuration information can be configured by the terminal device itself or by the first core network node for the terminal device. "QoT classification" means the classification of QoT.

[0135] In the embodiments, the terminal device can configure the corresponding QoT level for the application according to the QoT classification and the QoT requirement of the application, and determine the data forwarding policy of the application according to the QoT service policy and the QoT level of the application. Therefore, when the application executes a service and generates data, the terminal device can select a network device to send data to and how to send data based on the QoT level, the data forwarding policy and the QoT level of the network device, thereby facilitating the construction of a trusted network route for data transmission.

[0136] In some possible implementation manners, before determining the applied QoT level according to the QoT classification in the second QoT configuration information, the method further includes:

[0137] sending, by the first network device, the second configuration information and a second signature of the second configuration information to the first core network node;

[0138] receiving, by the terminal device, the second QoT configuration information forwarded by the first network device from the first core network node, the second QoT configuration information being determined by the first core network node according to the second signature, the second configuration information and a configuration policy of the operator, and the fourth QoT level being included in the second QoT configuration information. It should be noted that the second configuration information refers to the software and hardware configuration information of the first network device, and the second configuration information includes, for example, the identity, model, manufacturer, factory certificate and version of the software used of the terminal device.

[0139] In the embodiment of the application, the terminal device can send the second configuration information and the second signature of the second configuration information to the first core network node through the first network device, so that the first core network node verifies the second signature, and in the case of verification, configures the QoT configuration information (i.e., the second QoT configuration information) for the terminal device according to the second configuration information and the configuration policy of the operator, so that the terminal device can determine the QoT level and the data forwarding policy for the application on the terminal device according to the second QoT configuration information, thereby facilitating the construction of subsequent trusted network routing. In addition, by using the fourth QoT level in the second QoT configuration information, the terminal device can also request the first core network node to determine the target network device that can be accessed through the first network device, thereby facilitating the avoidance of the exposure risk caused by the target network device (such as the first network device) sending its own QoT level and other sensitive information in the broadcast signaling.

[0140] In some possible implementation manners, the forwarding policy includes at least one of the following:

[0141] when the first QoT level is lower than or equal to the third QoT level, sending the first data packet to the first network device;

[0142] when the first QoT level is higher than the third QoT level and the service accepts the degraded transmission, sending the first data packet to the first network device;

[0143] when the first QoT level is higher than the third QoT level, not sending the first data packet to the first network device;

[0144] when the first QoT level is higher than the third QoT level, fragmenting the first data packet, and sending the fragmented sub-packets to core network nodes with a QoT level higher than or equal to the first QoT level via different paths, so that the core network nodes combine the sub-packets to restore the first data packet and send the first data packet to a next hop; and

[0145] when the first QoT level is higher than the third QoT level and the third QoT level is higher than or equal to a minimum QoT level of the first data packet, sending the first data packet to the first network device.

[0146] In an embodiment of the present application, the forwarding policy can be sending the first data packet to the first network device with a QoT level higher than or equal to the first QoT level. The forwarding policy can also be a degradable transmission, i.e., if the first QoT level is higher than the third QoT level, but the terminal device is configured to accept the degradable transmission for the service, the terminal device can send the first data packet to the first network device with a QoT level lower than the first QoT level. The forwarding policy can also be fragmentation, i.e., if the first QoT level is higher than the third QoT level, the terminal device can fragment the first data packet, and then send the fragmented sub-packets to different network devices, including the first network device, such as network device a and network device b, which send the fragmented sub-packets to core network nodes with a QoT level higher than or equal to the first QoT level, respectively. Thus, the sub-packets can be sent to the core network nodes with a QoT level higher than or equal to the first QoT level via different paths, thereby relatively improving the QoT level of network device a and network device b, and since network device a and network device b receive only sub-packets, it is beneficial to reduce the risk of first data packet leakage. The core network nodes can combine the received sub-packets to restore the first data packet, and then forward to the next hop. The forwarding policy can also specify a minimum QoT level of the first data packet under the condition of degradable transmission, i.e., when the third QoT level is lower than the first QoT level and the third QoT level is higher than or equal to the minimum QoT level, the first data packet can be sent to the first network device. Of course, the above is only an example of the forwarding policy, and the present application can include more forwarding policies or combinations of the forwarding policies. According to the forwarding policy of the first data packet, the terminal device can flexibly select the first network device for data transmission, thereby facilitating the flexibility of data transmission while constructing a trusted network route.

[0147] In a fifth aspect, an embodiment of the present application provides a data transmission apparatus applied to a first network device, and beneficial effects can be referred to the description of the first aspect, which will not be repeated here. The data transmission apparatus has functions of implementing behaviors in the method examples of the first aspect. The functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. In a possible design, the data transmission apparatus includes a first transceiver and a first processing unit; the first transceiver is configured to receive a first data packet from a terminal device, the first data packet including a first QoT level of a service corresponding to the first data packet and a forwarding policy of the first data packet; the first processing unit is configured to obtain a second QoT level of a second network device; and the first processing unit is further configured to invoke the first transceiver to send the first data packet to the second network device according to the first QoT level, the second QoT level, and the forwarding policy.

[0148] In a sixth aspect, an embodiment of the present application provides a data transmission apparatus applied to a first network device, and beneficial effects can be referred to the description of the second aspect, which will not be repeated here. The data transmission apparatus has functions of implementing behaviors in the method examples of the second aspect. The functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. In a possible design, the data transmission apparatus includes a second transceiver and a second processing unit; the second transceiver is configured to receive a first data packet from a terminal device, the first data packet being obtained by layer-by-layer encryption of to-be-transmitted data by the terminal device using at least one symmetric key, wherein the at least one symmetric key includes a symmetric key corresponding to a network device in a transmission path of the to-be-transmitted data, the transmission path being determined according to location information of the terminal device, a first QoT level of a service corresponding to the to-be-transmitted data, QoT levels of network devices in the transmission path, a forwarding policy of the to-be-transmitted data, and a receiving end IP address of the to-be-transmitted data, and the network devices in the transmission path include the first network device; the second processing unit is configured to decrypt the first data packet using a target symmetric key to obtain a third data packet, the target symmetric key being the symmetric key corresponding to the first network device; and the second transceiver is further configured to send the third data packet to a second network device, the second network device being a next hop of the first network device in the transmission path.

[0149] In a seventh aspect, an embodiment of the present application provides a data transmission apparatus applied to a terminal device, and beneficial effects can be referred to the description of the third aspect, which will not be repeated here. The data transmission apparatus has functions of implementing behaviors in the method examples of the third aspect. The functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. The data transmission apparatus includes an obtaining unit, a third transceiving unit, and a third processing unit. The obtaining unit is configured to obtain a first QoT level of a current service and a forwarding policy of a first data packet of the service. The obtaining unit is further configured to obtain a third QoT level of the first network device. The processing unit is further configured to invoke the third transceiving unit to send the first data packet to the first network device according to the first QoT level, the forwarding policy, and the third QoT level.

[0150] In an eighth aspect, an embodiment of the present application provides a data transmission apparatus applied to a terminal device, and beneficial effects can be referred to the description of the fourth aspect, which will not be repeated here. The data transmission apparatus has functions of implementing behaviors in the method examples of the fourth aspect. The functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. The data transmission apparatus includes a fourth transceiving unit and a fourth processing unit. The fourth processing unit is configured to perform layer-by-layer encryption on to-be-transmitted data of a current service by using at least one symmetric key, to obtain a first data packet. The at least one symmetric key is a symmetric key corresponding to a network device in a transmission path of the to-be-transmitted data, and the transmission path is determined according to location information of the terminal device, a first QoT level of a service corresponding to the to-be-transmitted data, QoT levels of network devices in the transmission path, a forwarding policy of the to-be-transmitted data, and a receiving end IP address of the to-be-transmitted data. The network devices in the transmission path include the first network device. The fourth transceiving unit is configured to send the first data packet to the first network device.

[0151] In a ninth aspect, an embodiment of the present application provides a first network device including a processor, a memory, a communication interface, and one or more programs. The one or more programs are stored in the memory and configured to be executed by the processor to cooperate with the communication interface to implement the method in any one of the first aspect or the second aspect.

[0152] In a tenth aspect, an embodiment of the present application provides a terminal device including a processor, a memory, a communication interface, and one or more programs. The one or more programs are stored in the memory and configured to be executed by the processor to cooperate with the communication interface to implement the method in any one of the third aspect or the fourth aspect.

[0153] In an eleventh aspect, an embodiment of the present application provides a computer readable storage medium storing program codes for execution by a device, the program codes comprising instructions for implementing the method of any one of the first aspect or the second aspect.

[0154] In a twelfth aspect, an embodiment of the present application provides a computer readable storage medium storing program codes for execution by a device, the program codes comprising instructions for implementing the method of any one of the third aspect or the fourth aspect.

[0155] In a thirteenth aspect, an embodiment of the present application provides a computer program product, when the computer program product is run by a first network device, causing the first network device to execute the method of any one of the first aspect or the second aspect.

[0156] In a fourteenth aspect, an embodiment of the present application provides a computer program product, when the computer program product is run by a terminal device, causing the terminal device to execute the method of any one of the third aspect or the fourth aspect. BRIEF DESCRIPTION OF DRAWINGS

[0157] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the background art, the drawings needed to be used in the embodiments of the present application or the background art will be described below.

[0158] Figure 1 A schematic diagram of the basic principle of the onion routing provided by an embodiment of the present application;

[0159] Figure 2 A schematic diagram of quantifying the QoT level of the intermediate network device provided by an embodiment of the present application;

[0160] Figure 3 An architecture schematic diagram of a data transmission system provided by an embodiment of the present application;

[0161] Figure 4 A flow schematic diagram of a data transmission method provided by an embodiment of the present application;

[0162] Figure 5 A whole flow schematic diagram of a data transmission method provided by an embodiment of the present application;

[0163] Figure 6 A flow schematic diagram of another data transmission method provided by an embodiment of the present application;

[0164] Figure 7 A flow schematic diagram of another data transmission method provided by an embodiment of the present application;

[0165] Figure 8Another data transmission method provided by the embodiment of the present application is shown in the flowchart of FIG. 2.

[0166] Figure 9 Another data transmission method provided by the embodiment of the present application is shown in the flowchart of FIG. 2.

[0167] Figure 10 Another data transmission method provided by the embodiment of the present application is shown in the flowchart of FIG. 2.

[0168] Figure 11 Another data transmission method provided by the embodiment of the present application is shown in the flowchart of FIG. 2.

[0169] Figure 12 Another data transmission method provided by the embodiment of the present application is shown in the flowchart of FIG. 2.

[0170] Figure 13 Another data transmission method provided by the embodiment of the present application is shown in the flowchart of FIG. 2.

[0171] Figure 14 Another data transmission method provided by the embodiment of the present application is shown in the flowchart of FIG. 2.

[0172] Figure 15 Another data transmission method provided by the embodiment of the present application is shown in the flowchart of FIG. 2. DETAILED DESCRIPTION

[0173] The terms "first", "second", "third", and "fourth" and the like in the description and in the claims of the present application are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the terms so used are interchangeable under appropriate circumstances such that the descriptive terms "first", "second", "third", and "fourth" are to be construed, at least in some instances, as interchangeable. Furthermore, the meaning of "including", "comprising", and "having" and variations thereof herein, is intended to be open such that there is no exclusion of additional non specified features or elements. For instance, a process, method, article, or apparatus that comprises a list of steps or elements is not necessarily limited to the listed steps or elements, but can include additional unspecified steps or elements, as well.

[0174] Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase "in an embodiment" in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of one another. It is expressly understood that any of the embodiments described herein are combinable with each other.

[0175] First, some terms in the present application are explained to facilitate understanding by those skilled in the art.

[0176] Master Information Block (MIB): Broadcast signaling sent by LTE / 5G base stations, used by terminal devices (such as smartphones, tablets, wearable devices, etc.) to obtain the base station's access parameters.

[0177] System Information Block (SIB): Broadcast signaling sent by the LTE / 5G base station, used by terminal equipment to obtain the base station's access parameters.

[0178] Beacon: A broadcast signal sent by a Wi-Fi base station in a wireless network, used by terminal devices to obtain access parameters.

[0179] Quality of Service (QoS): A quantitative measure of the quality of a service.

[0180] Quality of Trust (QoT): A quantitative measure of the level of trust that can be achieved.

[0181] Quality of Experience (QoE): A quantitative measure of how good or bad a user's experience with a service is.

[0182] Secondly, a brief analysis of the relevant technologies is provided. Onion Routing (TOR) is a routing method that encrypts data hop-by-hop. Its basic principle is to build a new logical network on top of the existing network—a network within a network—where data is transmitted in encrypted form. Please see [link to relevant documentation]. Figure 1 , Figure 1 This is a basic diagram illustrating the principles of Onion Router. The working modes of Onion Router are as follows:

[0183] Routing mechanism: Employs centralized + distributed routing control, such as... Figure 1 As shown, there are one or more routing servers in the network, whose function is to provide network routing services to users based on the addresses of the sender and receiver of business data. Therefore, the main route for data forwarding is a logical route built in a centralized manner on the basis of distributed routing. The path of data before entering the onion route and after leaving the onion route still adopts the traditional routing method.

[0184] Routing: When sending data, the sending end first selects a routing service from a pre-configured list of routers, and then sends a routing request from the routing server to the receiving end. The routing server selects three data forwarding routers for the user side based on the source address and receiver address provided by the sending end. Figure 1 (A, B, C) and send the selected router address to the data sender.

[0185] Route establishment: After receiving the intermediate router address provided by the routing server, the sending end establishes an encrypted link between the sending end and each intermediate router through onion signaling. After the route establishment is completed, the sending end has three data encryption keys, each of which corresponds to an intermediate router.

[0186] Data sending: The sending end uses the key negotiated with the intermediate router to encrypt and encapsulate the IP (Internet Protocol Address) data packet layer by layer. After the data is encapsulated, the sending end puts the encapsulated data into a normal IP data packet and sends it to the entry router.

[0187] Data forwarding: After the entry router receives the data packet from the sending end, it uses the symmetric key to decrypt and encapsulate and forward the data to the intermediate router (or the next hop) according to the header information of the decrypted data packet. The intermediate router continues to decrypt and forward the data packet to the exit router. The exit router performs the final decryption on the data packet and then sends the data packet to the data receiving end through a non-encrypted link.

[0188] Although the onion routing provides a data forwarding scheme with relatively high credibility and relatively good privacy protection, it also has the following shortcomings:

[0189] (1) Only network layer data transmission is considered, and the overall architecture of the communication network and the Internet is not considered, so it can only be used in a small range and cannot be used as a general standard in the network.

[0190] (2) The trustworthiness of the router is not quantitatively evaluated, and the trustworthiness of the router is evaluated based on non-technical factors, so it is difficult to use in future networks.

[0191] (3) The key negotiation between the sending end and the router uses a private protocol. If this mechanism is used in a heterogeneous network, the private protocol needs to be replaced according to the existing security protocol standard.

[0192] (4) There is no method to classify business services in the sending end.

[0193] In summary of the existing related technologies and their shortcomings, the present application quantifies the trustworthiness of the terminal device, the business on the terminal device side, the core network node and the network device in the network, configures the QoT level for them, and configures the data forwarding strategy for the business on the terminal device side, which can realize trusted data transmission in a heterogeneous network, and mainly solves the following technical problems:

[0194] I. Differentiation of network trust requirements of business services

[0195] Different service services in the network have different requirements for the trustworthiness of the network, and the current network does not differentiate the requirements of users in the trustworthiness of service services, but adopts a one-size-fits-all attitude, and the data on the terminal equipment side is forwarded by the same path, so that some service services with high network trust requirements cannot obtain the due protection, causing the governments of various countries to doubt the transmission of sensitive data, and at the same time, some service services with low network trust requirements relatively obtain excessive protection, and face the trouble of paying additional fees.

[0196] II. Quantification of network trust requirements of service services

[0197] ITU-T (ITU Telecommunication Standardization Sector) defines QoS and QoE indicators to quantify the network requirements and experience of users, but there is no indicator to quantify the network trust requirements in the face of the strong demand of governments and users for trusted data transmission. It can be seen that quantifying the network trust requirements of users has become an urgent problem to be solved, and the quantification of network trust requirements can enable the network to customize data forwarding services according to the requirements of users, differentiated services, which not only helps to improve the trust of users in the network, but also reduces the network service cost of some users, and helps to solve the trust problem of network infrastructure that has plagued governments and manufacturers.

[0198] In combination with the above problems, the technical solutions provided by the present application are mainly as follows:

[0199] (1) Introducing the concept of QoT, and quantifying QoT into different levels;

[0200] QoT is a new concept, and there is no uniform standard to define it at present. For example, the present application can refer to the definition of device by Norton, and quantify QoT into four levels:

[0201] Level 1: restricted

[0202] Level 2: public

[0203] Level 3: private

[0204] Level 4: fully trusted

[0205] Among them, level 4 is higher than level 3, level 3 is higher than level 2, and level 2 is higher than level 1. For example, the present application can also refer to the definition of QoS in the industry to divide the levels of QoT. Please refer to Table 1, in which QoT is divided into 6 levels according to the parameters of security, integrity, reliability and anonymity of the device, and the levels are sequentially increased from level 0 to level 5, that is, level 0 is the lowest level and level 5 is the highest level.

[0206] Table 1

[0207]

[0208] wherein, the security mainly considers the CC (Common Criteria, a set of international guidelines and specifications) certification score (such as 0.7 of level 1), the integrity mainly considers the score of routing fraud (such as 0.95 of level 2), the reliability mainly considers the score of hijacking (such as 0.99 of level 3), and the anonymity mainly considers the score of end-to-end encryption (such as 1.0 of level 5), wherein, “U” represents no score, and the maximum value of each parameter score is 1.0. Of course, the QoT level definition herein is only an example, and the standard organization can improve the definition of QoT according to actual needs.

[0209] (2) According to the importance of the service content, the network trust demand of the service is graded by using the same standard as the QoT quantification.

[0210] (3) According to the software and hardware configuration information of the network device, the reliability of the manufacturer, and the historical forwarding performance, the trusted degree of the network device is graded by using the same standard as the QoT quantification, please refer to Figure 2 , Figure 2 In the QoT level quantification of the intermediate network device and the core network node in Figure 2 , the QoT level is quantified as QoT=1, QoT=2 or QoT=3, wherein, 1, 2 or 3 represent level 1, level 2 or level 3, and it should be understood that

[0211] (4) The data sending end configures different data forwarding strategies for the service according to the QoT level of the service, such as selecting the network device meeting the conditions for data forwarding according to the QoT level of the service and the QoT level of the network device, or using the data packet splitting + multi-path transmission mode for data forwarding according to the QoT level of the service and the QoT level of the network device, or using the software defined network (SDN) to select the path for data forwarding according to the QoT demand of the service.

[0212] It should be understood that the technical solutions provided by the present application are applicable to a heterogeneous network, can establish a trusted network routing based on the not fully trusted network device in the heterogeneous network, and are also applicable to the 6G (6th generation mobile networks) network, wireless network or satellite network in the future.

[0213] The technical solutions provided by the present application will be described in detail in combination with specific embodiments.

[0214] Please refer to Figure 3 , Figure 3 The figure shows an architecture of a data transmission system according to an embodiment of the present application. As shown in the figure, the data transmission system comprises a data sending / receiving device, a base station / ingress gateway, a router, a first core network node and a third core network node. Figure 3

[0215] The data sending / receiving device comprises an application, a first QoT level configuration module, a first QoT service policy module and a first data transmission module. The data sending / receiving device can be any terminal device.

[0216] The first QoT level configuration module is configured to provide QoT level configuration information, and provide the application with the QoT level and related information supported by the data sending / receiving device or network, such as the highest QoT level that can be provided by the network and the charging method of the level.

[0217] The first QoT service policy module is configured to provide the application with a data forwarding policy based on QoT, such as configuring the data transmission module to send data to which base station or gateway, how to send (such as fragmentation), and whether to terminate sending data, etc.

[0218] The first data transmission module is configured to send data to the selected base station or gateway according to the data forwarding policy made by the first QoT service policy module.

[0219] The application, i.e. the application program installed on the data sending / receiving device, is configured to obtain its own configuration information from the first QoT level configuration module, so as to determine its own QoT level, and use the QoT level in subsequent data sending.

[0220] The base station / ingress gateway comprises a second QoT level configuration module, a second QoT service policy module and a second data transmission module.

[0221] The second QoT level configuration module is configured to provide QoT level configuration information, and specifically can provide the base station / ingress gateway with the highest QoT level that it can support.

[0222] The second QoT service policy module is configured to provide a data forwarding policy based on QoT for the data received by the base station / ingress gateway, so that the second data transmission module forwards the data to the next hop.

[0223] The second data transmission module is configured to send data to the selected next hop according to the data forwarding policy made by the second QoT service policy module.

[0224] ​The router comprises a third QoT level configuration module, a third QoT service policy module and a third data transmission module.

[0225] The third QoT level configuration module is configured to provide QoT level configuration information, specifically, to provide the router with the highest QoT level that it can support.

[0226] The third QoT service policy module is configured to provide a data forwarding policy based on QoT for the data received by the router, so that the third data transmission module forwards the data to the next hop.

[0227] The third data transmission module is configured to send the data to the selected next hop according to the data forwarding policy formulated by the third QoT service policy module.

[0228] The first core network node comprises a QoT configuration management module. The QoT configuration management module is configured to configure the QoT for the data sending / receiving device, the base station / entry gateway and the router based on the software and hardware configuration information of the devices, and to distribute the QoT configuration information, such as determining the QoT level of the devices.

[0229] The third core network node comprises a QoT route negotiation module. The QoT route negotiation module is configured to assist the data sending device in negotiating the key with the base station / entry gateway, the router and other network devices based on the QoT requirement of the data sending device, such as the QoT requirement of the application on the data sending device, to establish a route path that meets the QoT requirement.

[0230] It should be understood that the QoT level configuration module and the QoT service policy module of the data sending / receiving device, the base station / entry gateway and the router can realize the corresponding functions in one module, for example, the first QoT level configuration module and the first QoT service policy module can be combined into one module to serve the application and the first data transmission module.

[0231] It should be understood that the first core network node and the third core network node can be one or two functional modules deployed in the base station / entry gateway and the router, or can be a separate entity, such as a server.

[0232] It should be understood that the distribution of the QoT configuration information of the data sending / receiving device is optional, that is, the data sending / receiving device can be configured by the first core network node, or can be configured by itself, such as the data sending / receiving device can complete the configuration of the QoT level of the application and the determination of the data forwarding policy during initialization, or according to the user's operation.

[0233] It should be understood that, for the convenience of description, the above-mentioned base station / gateway, router and the like can be collectively referred to as network equipment, wherein the base station can be an LTE / 5G base station or a Wi-Fi AP, or can be a base station in a later 6G (6th generation mobile network) network, a wireless network or a satellite network.

[0234] It should be understood that, Figure 3 The above-mentioned data transmission system is only an exemplary architecture, and the data transmission system can further include more or fewer components, such as a second core network node for combining and restoring the sub-packets.

[0235] As can be seen, the embodiments of the present application can configure the QoT of the data sending / receiving device, base station / gateway, router and the like (the data sending / receiving device can configure itself) through the first core network node in the above-mentioned system architecture, specifically the QoT configuration management module of the first core network node, thereby realizing the quantification of the network trust requirement, and based on the QoT level and data forwarding strategy applied on the data sending / receiving device, in subsequent data transmission, the base station / gateway, router that is trusted and meets the QoT requirement of the user can be selected for data forwarding, thereby realizing differentiated services based on the network trust requirement, which is conducive to improving the trust of the user in the network, and is conducive to solving the network infrastructure trust problem that has plagued governments and manufacturers in various countries. In addition, through the third core network node, specifically the QoT routing negotiation module of the third core network node, the data sending / receiving device, base station / gateway, router and the like in the network can be assisted to establish an encrypted channel, which plays a role of hiding the transmission path relative to the outside, and is conducive to protecting data security and further improving the trust level of the network.

[0236] Please refer to Figure 4 , Figure 4 A flowchart of a data transmission method provided by the embodiments of the present application is shown in the figure, and the method can be applied to the data transmission system shown in the figure, and the method includes but is not limited to the following steps: Figure 3

[0237] 401: The terminal device acquires the first QoT level of the current service and the forwarding strategy of the first data packet of the service.

[0238] Wherein, the current service refers to the service being executed on the terminal device side, such as a call, software update, file upload and the like, the first QoT level of the service is also the QoT level of the target application corresponding to the service, and the first data packet can be a complete data packet of the service, or a sub-packet obtained by fragmenting the complete data packet by the terminal device.

[0239] ​For example, the terminal device can determine the QoT level of the application on the terminal device according to the QoT classification in the preset second QoT configuration information. The second QoT configuration information can be configured by the terminal device itself or by the first core network node for the terminal device. The QoT classification can refer to the definition of QoT, such as the four levels of full trust, dedicated, public, and restricted, or the six levels in Table 1. The second QoT configuration information includes a QoT service policy, which formulates some QoT-based data forwarding policies. The terminal device can determine the data forwarding policy of the application according to the QoT service policy and the QoT level of the application. For example, the first data packet of the current service can be transmitted to a base station and how to transmit the first data packet can be determined according to the first QoT level of the current service or the corresponding target application, the QoT level of the base station in the network, and the data forwarding policy in the QoT service policy. Optionally, when determining the QoT level of the application on the terminal device, the terminal device can also distinguish the type of the application service, such as payment and call applications that require higher security and confidentiality, and configure a higher QoT level for them.

[0240] In this example, the terminal device can configure the corresponding QoT level for the application according to the QoT classification and the QoT requirement of the application, and determine the data forwarding policy of the application according to the QoT service policy and the QoT level of the application. When the application performs a service and generates data, the terminal device can select a network device to which the data is transmitted and how to transmit the data based on the QoT level, the data forwarding policy, and the QoT level of the network device, thereby facilitating the construction of a trusted network route for data transmission.

[0241] For example, the terminal device can also determine its fourth QoT level by referring to the QoT classification in the second QoT configuration information and comprehensively considering other factors, including but not limited to the location information of the terminal device, the purchased service, and the second configuration information of the terminal device. The second configuration information refers to the hardware and software configuration information of the first network device. For example, the second configuration information includes the identification, model, manufacturer, factory certificate, and version of the software used by the terminal device.

[0242] Exemplarily, the terminal device can send, to the first network device, the second configuration information and a second signature of the second configuration information, the second signature being obtained by signing the second configuration information by a private key of the terminal device, the first core network node verifies the second signature, and in the case of verification, configures the terminal device with the second QoT configuration information according to the second configuration information and the configuration policy of the operator, the terminal device receives the second QoT configuration information forwarded by the first network device from the first core network node, and the second QoT configuration information includes a fourth QoT level of the terminal device, that is, the QoT configuration of the terminal device can be completed by the first core network.

[0243] In this example, the terminal device can send, to the first core network node through the first network device, the second configuration information and a second signature of the second configuration information, so that the first core network node verifies the second signature, and in the case of verification, configures the terminal device with the QoT configuration information (i.e., the second QoT configuration information) according to the second configuration information and the configuration policy of the operator, so that the terminal device can determine the QoT level and the data forwarding strategy for the application on the terminal device according to the second QoT configuration information, thereby facilitating the construction of subsequent trusted network routing. In addition, by using the fourth QoT level in the second QoT configuration information, the terminal device can also request the first core network node to determine the target network device that can be accessed through the first network device, thereby facilitating the avoidance of the exposure risk caused by the target network device (such as the first network device) sending its own QoT level and other sensitive information in broadcast signaling.

[0244] 402: The terminal device obtains a third QoT level of the first network device.

[0245] Exemplarily, before obtaining the first QoT level of the current service and the forwarding strategy of the first data packet of the service, the method further includes: the terminal device receives a first message sent by the first network device, the first message including a third QoT level; and the terminal device stores the third QoT level; wherein the third QoT level is determined by the first core network node according to the first configuration information of the first network device, a first signature of the first configuration information, and the configuration policy of the operator. It should be understood that the terminal device can obtain the third QoT level of the first network device through the first message sent by the first network device, so that when it is necessary to send the first data packet, the third QoT level can be obtained locally, and the first QoT level, the third QoT level, and the forwarding strategy of the first data packet are used to determine whether to send the first data packet to the first network device, thereby facilitating the construction of a trusted network routing from the sending end to the receiving end for data transmission.

[0246] Exemplarily, the first message comprises any one of a master information block (MIB), a system information block (SIB), a beacon, and control plane signaling from the first core network node. If the first network device is an LTE / 5G base station, the first message can be a master information block (MIB) or a system information block (SIB). If the first network device is a Wi-Fi AP, the first message can be a beacon. If the operator is concerned that there is a risk of exposing the third QoT level by sending the third QoT level through broadcast signaling such as a master information block (MIB), a system information block (SIB), and a beacon, the third QoT level can be sent to the terminal device through control plane signaling of the first core network node. Thus, it is beneficial to avoid the risk of exposing sensitive information such as the QoT level of the network device, thereby improving the security and credibility of the network device.

[0247] Exemplarily, after storing the third QoT level, the method further comprises:

[0248] The terminal device accesses the network and sends registration signaling to the control plane node of the network side through the first network device, the registration signaling comprising a QoT option (such as a QoT service policy) provided by the terminal device and a minimum QoT level required by the terminal device, the QoT service policy being used to determine a data forwarding policy for an application on the terminal device;

[0249] The terminal device receives a fourth message from the control plane node forwarded by the first network device, the fourth message comprising a highest QoT level provided by the network, wherein the fourth message is sent by the control plane node when it determines to accept the registration of the terminal device according to the QoT service policy and the minimum QoT level, or according to the subscription information of the terminal device on the network side, and the highest QoT level provided by the network is used by the terminal device to determine which applications can be used and which applications cannot be used.

[0250] In this example, the terminal device sends the registration signaling to the control plane node through the first network device, and sends the pre-configured QoT service policy and the required minimum QoT level to the control plane node. The control plane node determines to accept the registration of the terminal device according to the QoT service policy and the minimum QoT level, or according to the subscription information of the terminal device on the network side, and sends the highest QoT level that can be provided by the network to the terminal device in a fourth message through the first network device. Thus, it is convenient for the terminal device to determine which applications on the terminal device can be used according to the highest QoT level, and further, the permissions of the applications on the terminal device can be set and modified, such as enabled and disabled.

[0251] Exemplarily, after receiving the fourth message from the control plane node forwarded by the first network device, the method further comprises:

[0252] The terminal device sends a second message to the first core network node through the first network device, and the second message includes location information of the terminal device, a reference network device identifier, and a fourth QoT level of the terminal device. The second message is used to request the first core network node to determine a target network device accessible by the terminal device from the reference network device according to the fourth QoT level, the location information, and a QoT level of the reference network device. The reference network device includes network devices within a range determined based on the location information, such as network devices with a distance less than or equal to a certain threshold from the location information of the terminal device, and the reference network device identifier is used to indicate the reference network device.

[0253] In this example, if the terminal device needs to obtain the third QoT level of the first network device through control plane signaling of the first core network node, the terminal device sends its own location information, reference network device identifiers of reference network devices (such as one or more network devices within a certain range) within a range determined based on the location information, and its own fourth QoT level to the first core network node in the second message through the first network device, so that the first core network node determines a target network device accessible by the terminal device from the reference network devices based on the above information, and sends relevant information of the target network device to the terminal device through control plane signaling, thereby avoiding the exposure risk of sensitive information such as the QoT level of the target network device sent by the target network device through broadcast signaling.

[0254] The terminal device receives control plane signaling from the first core network node forwarded by the first network device.

[0255] The control plane signaling from the first core network node includes an identifier and a QoT level of the target network device, and the target network device includes the first network device. The first core network node usually sends the target network device to the terminal device in the form of a list. After receiving the target network device sent by the first core network node, the terminal device can select a corresponding target network device to initiate a connection request.

[0256] In this example, the terminal device can obtain the target network device and the QoT level of the target network device through the control plane signaling from the first core network. When it is necessary to send a first data packet, the terminal device can initiate a connection request to the target network device based on the identifier, the QoT level, and the first QoT level, the forwarding policy, and other information of the target network device, so as to perform data transmission. On the one hand, it is beneficial for the terminal device to select a trusted network device (such as the first network device) for data transmission. On the other hand, it is beneficial for avoiding the risk of exposure of sensitive information such as the QoT level of the target network device.

[0257] 403: The terminal device sends a first data packet to the first network device according to the first QoT level, the forwarding policy, and the third QoT level.

[0258] For example, the forwarding policy of the first data packet includes at least one of the following for the terminal device:

[0259] The terminal device sends the first data packet to the first network device when the first QoT level is lower than or equal to the third QoT level.

[0260] The terminal device sends the first data packet to the first network device when the first QoT level is higher than the third QoT level and the service accepts degraded transmission.

[0261] The terminal device does not send the first data packet to the first network device when the first QoT level is higher than the third QoT level.

[0262] The terminal device fragments the first data packet when the first QoT level is higher than the third QoT level, sends the sub-packets obtained by fragmentation to the core network nodes with a QoT level higher than or equal to the first QoT level using different paths, so that the core network nodes combine and restore the sub-packets obtained by fragmentation to the first data packet and send the first data packet to the next hop; and

[0263] The terminal device sends the first data packet to the first network device when the first QoT level is higher than the third QoT level and the third QoT level is higher than or equal to the lowest QoT level that the first data packet can adopt.

[0264] For example, the forwarding policy can be to send the first data packet to the first network device whose third QoT level is higher than or equal to the first QoT level; for example, the forwarding policy can also be a degradable transmission, that is, if the first QoT level is higher than the third QoT level, but the terminal device is configured to accept the degraded transmission for the service, the terminal device can send the first data packet to the first network device whose third QoT level is lower than the first QoT level; for example, the forwarding policy can also be a fragmentation, that is, if the first QoT level is higher than the third QoT level, the terminal device can fragment the first data packet, and then send the sub-packets obtained by fragmentation to different network devices, including the first network device, such as network device a and network device b, and the network device a and the network device b send the sub-packets obtained by fragmentation to the core network node whose QoT level is higher than or equal to the first QoT level, respectively, and the core network node can combine the received sub-packets to restore the first data packet, and then forward to the next hop; for example, the forwarding policy can also be to specify the minimum available QoT level of the first data packet under the condition of degradable, that is, when the third QoT level is lower than the first QoT level and the third QoT level is higher than or equal to the minimum available QoT level, the first data packet can be sent to the first network device. Of course, the above is only an example of the forwarding policy, and the present application can include more forwarding policies or combinations of forwarding policies, and according to the forwarding policy of the first data packet, the terminal device can flexibly select the first network device for data transmission.

[0265] For example, if the third QoT level of the current first network device and the fifth QoT level of the third network device are lower than the first QoT level, the terminal device can fragment the data packet of the service according to the fragmentation forwarding policy.

[0266] For example, the first data packet is a sub-packet obtained by the terminal device fragmenting the data packet of the service, and after receiving the fourth message forwarded by the first network device from the control plane node, the method further comprises:

[0267] The terminal device obtains the fifth QoT level of the third network device, and the fifth QoT level is obtained according to the fifth message sent by the third network device, and the fifth message can also be any one of the master information block MIB, the system information block SIB, the beacon, and the control plane signaling from the first core network node;

[0268] When the first QoT level is higher than the third QoT level and the fifth QoT level, the terminal device fragments the data packet of the service to obtain the first data packet and the second data packet, and the second data packet is a sub-packet obtained by the terminal device fragmenting the data packet of the service except the first data packet, and the data packet of the service includes the forwarding policy, that is, the forwarding policies of the two are the same.

[0269] Exemplarily, the method further comprises:

[0270] The terminal device sends the second data packet to the third network device according to the first QoT level, the forwarding policy and the fifth QoT level.

[0271] Specifically, the terminal device sends the first data packet and the second data packet to the first network device and the third network device respectively, the first network device and the third network device send the received sub-packets to the second core network node whose QoT level is higher than or equal to the first QoT level respectively, and the second core network node combines all the received sub-packets (the first data packet and the second data packet) to restore the data packet of the service, thereby realizing that when the first network device and the third network device do not meet the forwarding requirements of the data packet of the service, the data packet of the service can be fragmented, and the first network device and the third network device send the received sub-packets to the second core network node respectively, the second core network node sends the data packet of the service to the next hop, thereby relatively improving the QoT level of the first network device and the third network device and being conducive to reducing the risk of leakage of the data packet of the service.

[0272] 404: The first network device receives the first data packet from the terminal device.

[0273] Exemplarily, before the terminal device sends the first data packet to the first network device, the method further comprises:

[0274] The first network device sends a first message to the terminal device, and the first message includes a third QoT level of the first network device, so that when the terminal device needs to send the first data packet, the terminal device can determine whether to send the first data packet to the first network device according to the third QoT level, thereby being conducive to constructing a trusted network route from the sending end to the receiving end for data transmission.

[0275] Exemplarily, before sending the first message to the terminal device, the method further comprises: the first network device sends first configuration information and a first signature of the first configuration information to the first core network node, the first signature is obtained by signing the first configuration information by a private key of the first network device; the first core network node verifies the first signature, and in the case of verification, configures the first network device with first QoT configuration information according to the first configuration information and the configuration policy of the operator; the first network device receives the first QoT configuration information from the first core network node, and the first QoT configuration information includes the third QoT level.

[0276] The first configuration information refers to the software and hardware configuration information of the first network device, and exemplarily, the first configuration information includes the identification, model, manufacturer, factory certificate and version of the software used of the first network device.

[0277] In this example, the first network device can send the first configuration information and the first signature of the first configuration information to the first core network node, so that the first core network node verifies the first signature, and in the case of passing the verification, configures the QoT level (i.e., the third QoT level) for the first network device according to the first configuration information and the configuration policy of the operator, and sends the third QoT level to the first network device in the first QoT configuration information, so that the first network device can send the third QoT level to the terminal device and other network devices in the network, and then the terminal device or other network devices can determine whether to send data to the first network device according to the third QoT level.

[0278] For example, after sending the first configuration information to the first core network node, the method further includes: forwarding, by the first network device, a second message from the terminal device to the first core network node; and forwarding, by the first network device, control plane signaling from the first core network node to the terminal device.

[0279] Specifically, the first network device sends the identifier of the target network device and the QoT level to the terminal device through sending the control plane signaling from the first core network to the terminal device, such as the first network device, so that the terminal device can initiate a connection request to the target network device based on the identifier of the target network device, the QoT level, the first QoT level, and the forwarding policy, etc., to perform data transmission, on the one hand, it is beneficial to the terminal device to select a trusted network device for data transmission, and on the other hand, it is beneficial to avoid the risk of exposing the sensitive information such as the QoT level of the target network device.

[0280] 405: The first network device obtains a second QoT level of a second network device.

[0281] It should be understood that the second network device can also send its own configuration information to the first core network node, and the first core network node determines the QoT level for the second network device according to the configuration information of the second network device, and the second network device can send its own QoT level to other devices in the network. The first network device can store the QoT level of the second network device after receiving it, for use in subsequent data forwarding.

[0282] 406: The first network device sends a first data packet to the second network device according to the first QoT level, the second QoT level, and the forwarding policy.

[0283] For example, for the first network device, the forwarding policy of the first data packet includes at least one of the following:

[0284] When the first QoT level is lower than or equal to the second QoT level, the first data packet is sent to the second network device;

[0285] when the first QoT level is higher than the second QoT level and the service accepts degraded transmission, sending the first data packet to the second network device;

[0286] when the first QoT level is higher than the second QoT level, not sending the first data packet to the second network device;

[0287] when the first QoT level is higher than the second QoT level, fragmenting the first data packet, and sending sub-packets obtained by fragmenting to core network nodes with QoT levels higher than or equal to the first QoT level, so that the core network nodes combine the sub-packets to restore the first data packet and send the first data packet to the next hop; and

[0288] when the first QoT level is higher than the second QoT level and the second QoT level is higher than or equal to the lowest QoT level that the first data packet can adopt, sending the first data packet to the second network device.

[0289] For example, the forwarding policy can be to send the first data packet to the second network device with a second QoT level higher than or equal to the first QoT level; for example, the forwarding policy can also be degraded transmission, that is, if the first QoT level is higher than the second QoT level, but the terminal device is configured to accept degraded transmission for the service, the first network device can send the first data packet to the second network device with a second QoT level lower than the first QoT level; for example, the forwarding policy can also be fragmentation, that is, if the first QoT level is higher than the second QoT level, the first network device can fragment the first data packet, and then send the sub-packets obtained by fragmenting to different network devices, including the second network device, such as network device 1 and network device 2, which send the sub-packets obtained by fragmenting to core network nodes with QoT levels higher than or equal to the first QoT level, respectively, and the core network nodes combine the received sub-packets to restore the first data packet, and then forward to the next hop; for example, the forwarding policy can also be to specify the lowest QoT level that the first data packet can adopt under the condition of degraded transmission, that is, when the second QoT level is lower than the first QoT level and the second QoT level is higher than or equal to the lowest QoT level, the first data packet can be sent to the second network device. Of course, the above is only an example of the forwarding policy, and the present application can include more forwarding policies or combinations of forwarding policies. According to the forwarding policy of the first data packet, the first network device can flexibly select the second network device for data transmission, thereby improving the flexibility of data transmission while constructing a trusted network route.

[0290] For example, the first QoT level is higher than the third QoT level, and the first data packet is a sub-packet obtained by fragmenting the data packet of the service of the terminal device;

[0291] According to the first QoT level, the second QoT level and the forwarding policy, the first network device sends the first data packet to the second network device, comprising:

[0292] The first network device sends the first data packet to the second core network node, so that the second core network node obtains the data packet of the service according to the first data packet and the second data packet, and sends the data packet of the service to the second network device according to the first QoT level, the second QoT level and the forwarding policy;

[0293] Wherein, the QoT level of the second core network node is higher than the first QoT level, the second data packet is sent by the third network device to the second core network node, the first QoT level is higher than the fifth QoT level of the third network device, and the data packet of the service includes the forwarding policy. Wherein, the second QoT level of the second network device meets the requirement of the above-mentioned forwarding policy. For example, when the data packet of the service cannot be downgraded in the forwarding policy, the second QoT level needs to be higher than or equal to the first QoT level

[0294] In this example, when the first QoT level is higher than the third QoT level, according to the shippable forwarding policy, the terminal device needs to fragment the data packet of the service, then the first data packet is the sub-packet from the terminal device, the first network device needs to send the first data packet to the second core network node whose QoT level is higher than or equal to the first QoT level, at the same time, the third network device sends the second data packet to the second core network node, the second core network node combines all the received sub-packets (the first data packet and the second data packet) to restore the data packet of the service, and then sends the data packet of the service to the second network device according to the first QoT level, the second QoT level and the forwarding policy, so as to realize that when the first network device and the third network device do not meet the forwarding requirement of the data packet of the service, the data packet of the service can be fragmented, and the first network device and the third network device respectively send the received sub-packet to the second core network node, the second core network node sends the data packet of the service to the second network device, thereby relatively improving the QoT level of the first network device and the third network device and being conducive to reducing the risk of data packet leakage of the service.

[0295] For the convenience of understanding, please refer to Figure 5 , Figure 5 The overall flowchart of a data transmission method provided by the embodiment of the present application is shown. The specific steps are as follows:

[0296] (1) The terminal device determines the QoT level of the application according to the QoT classification, and determines the data forwarding policy of the application according to the QoT service policy and the QoT level of the application;

[0297] (2) The first network device sends first configuration information and a first signature of the first configuration information to the first core network node;

[0298] (3) The first core network node determines first QoT configuration information according to the first configuration information, the first signature and a configuration policy of an operator, and sends the first configuration information to the first network device;

[0299] (4) The first network device stores the first configuration information, and sends a first message to the terminal device;

[0300] (5) The terminal device receives the first message and stores a third QoT level of the first network device;

[0301] (6) The terminal device accesses the network, and sends registration signaling to a control plane node through the first network device;

[0302] (7) The control plane node determines to accept the registration of the terminal device according to a QoT service policy in the registration signaling and a minimum QoT level required by the terminal device, or according to subscription information of the terminal device on the network side, and sends a fourth message to the terminal device through the first network device;

[0303] (8) The terminal device determines which application can be used and which application cannot be used according to a highest QoT level in the fourth message;

[0304] (9) After a target application is started, the terminal device determines to send a first data packet to the first network device and how to send according to a first QoT level of the service, the third QoT level and a forwarding policy of the first data packet;

[0305] The first QoT level can be carried in an IP header of the first data packet, and the first data packet can be sent by using a random access message msg.

[0306] (10) The first network device obtains the first QoT level from the first data packet, and determines to send the first data packet to a second network device and how to send according to the first QoT level, a second QoT level and a forwarding policy of the first data packet.

[0307] It can be seen that in the embodiment, for the service on the terminal device side, the terminal device obtains the first QoT level of the service and the forwarding strategy of the first data packet of the service, and obtains the third QoT level of the first network device, and then sends the first data packet to the first network device according to the first QoT level, the forwarding strategy and the third QoT level, and the first network device receives the first data packet from the terminal device, and obtains the second QoT level of the second network device, and then sends the first data packet to the second network device according to the first QoT level, the second QoT level and the forwarding strategy. It should be understood that by quantifying the trusted attributes of the terminal device, the service on the terminal device side, the core network node and the network device in the network, configuring the QoT level for them, and configuring the data forwarding strategy for the service on the terminal device side, when the terminal device needs to send the first data packet generated by the current service, it can be determined whether to send the first data packet to the first network device according to the first QoT level of the service, the third QoT level of the first network device and the forwarding strategy of the first data packet, when the first network device needs to forward the first data packet from the terminal device, it can be determined whether to send the first data packet to the second network device according to the first QoT level of the service, the second QoT level of the second network device and the forwarding strategy of the first data packet, so that the network device selected each time is trusted, and then it is beneficial to build a trusted network route for data transmission.

[0308] Please refer to Figure 6 , Figure 6 Another flowchart of a data transmission method provided by the embodiment of the application is shown in the figure. The method can also be applied to the data transmission system shown in Figure 3 The method includes but is not limited to the following steps:

[0309] 601: The terminal device determines the applied QoT level according to the QoT classification in the preset second QoT configuration information, and determines the applied data forwarding strategy according to the QoT service strategy in the second QoT configuration information and the applied QoT level.

[0310] 602: The terminal device accesses the network without starting the service.

[0311] 603: The terminal device sends a second message to the first core network node through the first network device.

[0312] The second message includes location information of the terminal device, a reference network device identifier, and a fourth QoT level of the terminal device, and further includes an identifier of the terminal device. The second message is used to request the first core network node to determine a target network device accessible by the terminal device from the reference network device according to the fourth QoT level, the location information, and a QoT level of the reference network device. The reference network device includes network devices within a range determined based on the location information, and the reference network device identifier is used to indicate the reference network device. The fourth QoT level can be configured by the terminal device itself or configured by the first core network node for the terminal device. Optionally, the second message can be a random access message msg.

[0313] 604: The first core network node determines a target network device accessible by the terminal device from the reference network device according to the fourth QoT level, the location information, and a QoT level of the reference network device, and sends control plane signaling from the first core network node to the terminal device through the first network device.

[0314] 605: The terminal device receives the control plane signaling from the first core network node forwarded by the first network device, and stores a list of the target network devices and the QoT levels corresponding to the target network devices.

[0315] The control plane signaling from the first core network node includes identifiers and QoT levels of the target network devices, and further includes an identifier of the terminal device. The target network devices include the first network device. Optionally, the control plane signaling from the first core network node can be a random access message msg.

[0316] 606: The terminal device initiates connection to the first network device according to the fourth QoT level and a third QoT level.

[0317] For example, the terminal device matches the QoT level corresponding to the target network device with the fourth QoT level, and when the terminal device determines that the third QoT level is higher than or equal to the fourth QoT level, the terminal device initiates a connection request to the first network device.

[0318] 607: The terminal device starts a target application, and obtains a first QoT level of a current service and a forwarding strategy of a first data packet of the service.

[0319] 608: The terminal device obtains a third QoT level of the first network device.

[0320] 609: The terminal device sends the first data packet to the first network device according to the first QoT level, the forwarding strategy, and the third QoT level.

[0321] 610: The first network device receives the first data packet from the terminal device.

[0322] 611: The first network device acquires a second QoT level of the second network device.

[0323] 612: The first network device sends the first data packet to the second network device according to the first QoT level, the second QoT level, and the forwarding policy.

[0324] The second QoT level of the second network device meets the requirement of the above forwarding policy. For example, when the data packet of the service cannot be downgraded in the forwarding policy, the second QoT level needs to be higher than or equal to the first QoT level.

[0325] It can be seen that in the embodiment, when the operator does not want to expose the privacy information such as the QoT level of the network device through the broadcast signaling such as the master information block MIB, the system information block SIB, and the beacon, the terminal device can acquire the target network device that can be accessed and the QoT level of the target network device through the control plane signaling of the first core network node, thereby being beneficial to avoiding the risk that the sensitive information such as the QoT level of the network device is exposed, and further being beneficial to improving the security and credibility of the network device.

[0326] Please refer to Figure 7 , Figure 7 Another flowchart of a data transmission method provided by the embodiment of the application is shown, and the method can also be applied to the data transmission system shown in Figure 3 The method includes but is not limited to the following steps:

[0327] 701: The terminal device determines the applied QoT level according to the QoT classification in the second QoT configuration information, and determines the data forwarding policy of the application according to the QoT service policy in the second QoT configuration information and the applied QoT level.

[0328] 702: The terminal device starts the target application, acquires the first QoT level of the current service, and acquires the forwarding policy of the data packet of the service.

[0329] 703: The terminal device acquires a third QoT level of the first network device and a fifth QoT level of the third network device.

[0330] The first network device and the third network device are the network devices currently connected by the terminal device.

[0331] 704: The terminal device fragments the data packet of the service when the first QoT level is higher than the third QoT level and the fifth QoT level, to obtain a first data packet and a second data packet.

[0332] The first data packet is a sub-packet obtained by the terminal device fragmenting a data packet of a service, and the second data packet is a sub-packet obtained by the terminal device fragmenting the data packet of the service, except the first data packet. The first data packet can include part of data of the service, and the second data packet can include another part of data of the service. It should be understood that the sub-packets generally refer to IP packets (packets).

[0333] 705: The terminal device sends the first data packet to the first network device and sends the second data packet to the third network device.

[0334] The second data packet can be sent by using a random access message msg, and the terminal device can also encrypt the first data packet and the second data packet before sending.

[0335] 706: The first network device receives the first data packet from the terminal device and sends the first data packet to the second core network node.

[0336] 707: The third network device receives the first data packet from the terminal device and sends the first data packet to the second core network node.

[0337] The QoT level of the second core network node meets the requirements of the first QoT level and the forwarding policy. For example, the forwarding policy indicates that the data packet of the service needs to be forwarded by a network device or a core network node with a QoT level higher than or equal to the first QoT level, and does not accept downgraded transmission, so the QoT level of the second core network node needs to be higher than or equal to the first QoT level.

[0338] 708: The second core network node combines and restores the first data packet and the second data packet into the data packet of the service.

[0339] 709: The second core network node sends the data packet of the service to the second network device according to the first QoT level, the second QoT level, and the forwarding policy.

[0340] The second core network node stores the second QoT level of the second network device, and the second QoT level of the second network device meets the requirements of the forwarding policy. For example, when the data packet of the service cannot be downgraded in the forwarding policy, the second QoT level needs to be higher than or equal to the first QoT level.

[0341] It can be seen that in the embodiment, when the third QoT level of the first network device and the fifth QoT level of the third network device to which the terminal device is currently connected do not meet the first QoT level of the service requirement, the terminal device can fragment the data packet of the service, and send the first data packet and the second data packet to the first network device and the third network device respectively, and the first network device and the third network device send the first data packet and the second data packet to the second core network node whose QoT level meets the first QoT level and the forwarding policy respectively, so that the data packet of the service is forwarded in multiple paths (different paths), which is not only conducive to ensuring the security of the data packet of the service, but also relatively improves the trustworthiness of the first network device and the third network device.

[0342] Please refer to Figure 8 , Figure 8 Another flowchart of a data transmission method provided by the embodiment of the present application is shown, and the method can also be applied to the data transmission system shown in Figure 3 The method includes but is not limited to the following steps:

[0343] 801: The terminal device performs layer-by-layer encryption on the to-be-transmitted data of the current service by using at least one symmetric key, to obtain a first data packet.

[0344] The at least one symmetric key is a symmetric key corresponding to a network device in a transmission path of the to-be-transmitted data, and the transmission path is determined according to the location information of the terminal device, the first QoT level of the service corresponding to the to-be-transmitted data, the QoT level of the network device in the transmission path, the forwarding policy of the to-be-transmitted data, and the IP address of the receiving end of the to-be-transmitted data, and the network device in the transmission path includes the first network device.

[0345] For example, the terminal device can determine the QoT level applied to the terminal device according to the QoT classification in the preset second QoT configuration information, wherein the second QoT configuration information can be configured by the terminal device itself or by the first core network node for the terminal device. The QoT classification can refer to the definition of QoT as described above, such as four levels of full trust, private, public, and restricted, or six levels in Table 1. The second QoT configuration information includes a QoT service policy, which formulates some data forwarding policies based on QoT, and the terminal device can determine the data forwarding policy to be applied according to the QoT service policy and the QoT level applied. For example, for the first data packet of the current service, the terminal device can determine which base station to send the first data packet to and how to send the first data packet according to the first QoT level of the current service or the target application corresponding thereto, the QoT level of the base station in the network, and the data forwarding policy in the QoT service policy. Optionally, when determining the QoT level for the application on the terminal device, the terminal device can also distinguish according to the type of the application service.

[0346] In this example, the terminal device can configure a corresponding QoT level for the application according to the QoT classification and the QoT requirement of the application, and determine a data forwarding strategy of the application according to the QoT service policy and the QoT level of the application, so that when the terminal device performs a service and generates data subsequently, the terminal device can select a network device to which the data is to be sent and how to send the data based on the QoT level, the data forwarding strategy and the QoT level of the network device, thereby facilitating the construction of a trusted network route for data transmission.

[0347] For example, the terminal device can also determine its fourth QoT level by referring to the QoT classification in the second QoT configuration information and comprehensively considering other factors, wherein the other factors include but are not limited to the location information of the terminal device, the purchased service, and the second configuration information of the terminal device, wherein the second configuration information refers to the software and hardware configuration information of the first network device, and for example, the second configuration information includes the identification, model, manufacturer, factory certificate and version of the software used of the terminal device.

[0348] For example, the terminal device can send the second configuration information and a second signature of the second configuration information to the first core network node through the first network device, the second signature is obtained by signing the second configuration information with the private key of the terminal device, the first core network node verifies the second signature, and in the case of verification, configures the second QoT configuration information for the terminal device according to the second configuration information and the configuration policy of the operator, the terminal device receives the second QoT configuration information forwarded by the first network device from the first core network node, and the second QoT configuration information includes the fourth QoT level of the terminal device, that is, the QoT configuration of the terminal device can be completed by the first core network.

[0349] In this example, the terminal device can send the second configuration information and a second signature of the second configuration information to the first core network node through the first network device, so that the first core network node verifies the second signature, and in the case of verification, configures the QoT configuration information (i.e. the second QoT configuration information) for the terminal device according to the second configuration information and the configuration policy of the operator, so that the terminal device can determine the QoT level and the data forwarding strategy for the application on the terminal device according to the second QoT configuration information, thereby facilitating the construction of a subsequent trusted network route. In addition, by using the fourth QoT level in the second QoT configuration information, the terminal device can also request the first core network node to determine the target network device that can be accessed through the first network device, thereby avoiding the exposure risk caused by the target network device (such as the first network device) sending its own QoT level and other sensitive information in the broadcast signaling.

[0350] Exemplarily, before the at least one symmetric key is used to encrypt the to-be-transmitted data of the current service layer by layer to obtain the first data packet, the method further includes:

[0351] The terminal device sends a routing request to the third core network node through the first network device, the routing request including the location information, the first QoT level, the forwarding policy, and the receiving end IP address, and the routing request is used to request the third core network node to determine the transmission path; optionally, the routing request can further include an identifier of the terminal device, and the routing request can be sent in a random access message msg.

[0352] The terminal device receives a third message from the third core network node forwarded by the first network device, the third message including a network device in the transmission path (which can be an identifier or an IP address of the network device), a certificate of the network device in the transmission path, and a temporary certificate issued by the third core network node for the terminal device. Optionally, the certificate of the network device in the transmission path is used to confirm the identity of the network device, i.e., to let the terminal device determine that the network device is the network device specified by the third core network node. Optionally, the temporary certificate can include the QoT level of the network device in the transmission path and the authorized validity time of the temporary certificate. It should be understood that the temporary certificate is used to represent the identity of the terminal device, so as to facilitate the network device in the transmission path to identify the terminal device during key negotiation.

[0353] In this example, the terminal device sends a routing request to the third core network node through the first network device, so that the third core network node selects a transmission path for the to-be-transmitted data according to the information in the routing request, and sends the network device in the transmission path, the certificate of the network device, and the temporary certificate of the terminal device to the terminal device through the first network device, thereby facilitating the terminal device to perform key negotiation with the corresponding network device in the transmission path by using the certificate and the temporary certificate, and further facilitating subsequent layer-by-layer encryption of the to-be-transmitted data.

[0354] Exemplarily, after receiving the third message from the third core network node forwarded by the first network device, the method further includes:

[0355] The terminal device performs key negotiation with the first network device or an affiliated node of the first network device by using the certificate and the temporary certificate of the first network device, to obtain a first service flow identifier (flow ID (Identity document, unique code)) corresponding to the first network device and a target symmetric key;

[0356] Optionally, the terminal device and the first network device or the node affiliated to the first network device can use the TLS (Transport Layer Security) / DTLS (Datagram Transport Layer Security) protocol for authentication and key agreement, and use the session key of the TLS / DTLS protocol or a derived key thereof as a symmetric key.

[0357] The first data packet is obtained by encrypting the first service flow identifier and the third data packet using the target symmetric key, and the third data packet is obtained by encrypting data using the symmetric key corresponding to the second network device, which is the next hop of the first network device in the transmission path.

[0358] For example, the data to be transmitted needs to pass through multiple network devices in the transmission path, such as multiple routers, and the first network device and the second network device are network devices that must be passed through in the multiple network devices, and the third QoT level of the first network device and the second QoT level of the second network device are lower than the first QoT level. The terminal device establishes a secure link with each network device in the multiple network devices using the certificate of each network device and its own temporary certificate, and performs key agreement with each network device or the node affiliated thereto to obtain the service flow identifier and the symmetric key corresponding to each network device. Assuming that the second network device is the network device closest to the receiving end, i.e., the forwarding address of the second network device is the IP address of the receiving end, the terminal device obtains the service flow identifier corresponding to the second network device as flow 2 and the symmetric key as symmetric key 2, and then encrypts flow 2 and the data to be transmitted (which can further include the second QoT level of the second network device) using symmetric key 2 to obtain the third data packet Enc 对称密钥 2 (flow 2, data to be transmitted). 对称密钥 2 (flow 2, data to be transmitted) (which can further include the third QoT level of the first network device), to obtain the first data packet Enc 对称密钥 1 (flow 1, Enc 对称密钥 2 (flow 2, data to be transmitted)).

[0359] In this example, the terminal device can establish a secure link with the first network device by using the certificate of the first network device and the temporary certificate of the terminal device, perform key negotiation with the first network device or an affiliated node of the first network device, thereby obtaining a target symmetric key of the first network device and a service flow identifier (stored as a first service flow identifier), so as to facilitate the terminal device to encrypt the third data packet and the first service flow identifier by using the target symmetric key, thereby facilitating to improve the security of the data to be transmitted.

[0360] In an example, before sending the routing request to the third core network node through the first network device, the method further includes:

[0361] The terminal device accesses the network and sends registration signaling to a control plane node on the network side through the first network device, the registration signaling including a QoT option (such as a QoT service policy) provided by the terminal device and a minimum QoT level required by the terminal device, the QoT service policy being used to determine a data forwarding policy for an application on the terminal device;

[0362] The terminal device receives a fourth message sent by the control plane node and forwarded by the first network device, the fourth message including a highest QoT level provided by the network, wherein the fourth message is sent by the control plane node when it determines to accept the registration of the terminal device according to the QoT service policy and the minimum QoT level, or according to the subscription information of the terminal device on the network side, and the highest QoT level provided by the network is used by the terminal device to determine which applications can be used and which applications cannot be used;

[0363] The terminal device determines that the target application can be used according to the highest QoT level and the forwarding policy. For example, when the highest QoT level is higher than or equal to the first QoT level and the forwarding policy is not to accept downgraded transmission, the target application can be used; on the contrary, when the highest QoT level is lower than the first QoT level and the forwarding policy is not to accept downgraded transmission, the target application cannot be used.

[0364] In this example, the terminal device sends the registration signaling to the control plane node through the first network device, sends the pre-configured QoT service policy and the required minimum QoT level to the control plane node, the control plane node determines to accept the registration of the terminal device according to the QoT service policy and the minimum QoT level, or according to the subscription information of the terminal device on the network side, and sends the highest QoT level that can be provided by the network to the terminal device in the fourth message through the first network device, thereby facilitating the terminal device to determine which applications (such as the target application) on the terminal device can be used according to the highest QoT level, and further facilitating to set and modify the permissions of the applications on the terminal device, such as enabling and disabling.

[0365] In an example, before accessing the network and sending the registration signaling to the control plane node on the network side, the method further includes:

[0366] The terminal device determines an applied QoT level according to the QoT classification in the preset second QoT configuration information, and the second QoT configuration information includes a QoT service policy;

[0367] The terminal device determines a data forwarding strategy of the application according to the QoT service policy and the applied QoT level;

[0368] The fourth QoT level of the terminal device is determined according to the QoT classification. It should be noted that "preset" means that the second QoT configuration information can be configured by the terminal device itself or configured by the first core network node for the terminal device.

[0369] For example, for the terminal device, the forwarding strategy of the first data packet includes at least one of the following:

[0370] When the first QoT level is lower than or equal to the third QoT level, the terminal device sends the first data packet to the first network device;

[0371] When the first QoT level is higher than the third QoT level and the service accepts degraded transmission, the terminal device sends the first data packet to the first network device;

[0372] When the first QoT level is higher than the third QoT level, the terminal device does not send the first data packet to the first network device;

[0373] When the first QoT level is higher than the third QoT level, the terminal device fragments the first data packet, and sends the sub-packets obtained by fragmenting to the core network nodes with QoT level higher than or equal to the first QoT level by using different paths, so that the core network nodes combine and restore the sub-packets obtained by fragmenting to the first data packet and send the first data packet to the next hop; and

[0374] When the first QoT level is higher than the third QoT level and the third QoT level is higher than or equal to the lowest applicable QoT level of the first data packet, the terminal device sends the first data packet to the first network device.

[0375] For example, the forwarding policy can be sending the first data packet to the first network device with a third QoT level higher than or equal to the first QoT level; for example, the forwarding policy can also be a degradable transmission, that is, if the first QoT level is higher than the third QoT level, but the terminal device is configured to accept the degradable transmission for the service, the terminal device can send the first data packet to the first network device with a third QoT level lower than the first QoT level; for example, the forwarding policy can also be a fragmentation, that is, if the first QoT level is higher than the third QoT level, the terminal device can fragment the first data packet, and then send the sub-packets obtained by fragmentation to different network devices, including the first network device, such as network device a and network device b, and the network device a and the network device b send the sub-packets obtained by fragmentation to the core network nodes with a QoT level higher than or equal to the first QoT level, respectively, and the core network nodes can combine the received sub-packets to restore the first data packet, and then forward to the next hop; for example, the forwarding policy can also be to specify the minimum available QoT level of the first data packet under the condition of degradable, that is, when the third QoT level is lower than the first QoT level and the third QoT level is higher than or equal to the minimum available QoT level, the first data packet can be sent to the first network device. Of course, the above is only an example of the forwarding policy, and the present application can include more forwarding policies or combinations of forwarding policies, and according to the forwarding policy of the first data packet, the terminal device can flexibly select the first network device for data transmission.

[0376] 802: The terminal device sends the first data packet to the first network device.

[0377] Wherein, the terminal device sends the first data packet Enc 对称密 Key 1 (flow 1, Enc symmetric key 2 (flow 2, data to be transmitted)).

[0378] 803: The first network device receives the first data packet from the terminal device.

[0379] For example, before receiving the first data packet from the terminal device, the method further comprises:

[0380] The first network device forwards the routing request from the terminal device to the third core network node, wherein the routing request includes the above-mentioned location information, the first QoT level, the forwarding policy and the receiving end IP address, and the routing request is used to request the third core network node to determine the transmission path;

[0381] The first network device forwards the third message from the third core network node to the terminal device, wherein the third message includes the network device in the transmission path, the certificate of the network device in the transmission path and the temporary certificate issued by the third core network node for the terminal device.

[0382] In this example, the first network device forwards the routing request of the terminal device, so that the third core network node selects a transmission path for the to-be-transmitted data according to the information in the routing request, and sends the network devices in the transmission path, the certificate of the network device, and the temporary certificate of the terminal device to the terminal device through the first network device, thereby facilitating the terminal device to perform key negotiation with the corresponding network devices in the transmission path by using the certificate and the temporary certificate, and further facilitating subsequent layer-by-layer encryption of the to-be-transmitted data.

[0383] In an example, the method further includes:

[0384] The first network device stores a first context, the first context being a context of key negotiation between the terminal device and the first network device, and the first context including the second service flow identifier and the target symmetric key; or

[0385] The first network device receives and stores a second context sent by the affiliated node, the second context being a context of key negotiation between the terminal device and the affiliated node, and the second context including the second service flow identifier and the target symmetric key, and the affiliated node also storing the second context.

[0386] In this example, if the first network device performs key negotiation with the terminal device, the first network device needs to store the first context, and if the affiliated node of the first network device performs key negotiation with the terminal device, the affiliated node needs to store the second context and send the second context to the first network device for storage, thereby facilitating the first network device to perform decryption by using the target symmetric key when receiving the first data packet, and forwarding the third data packet to the next hop when the second service flow identifier is the same as the first service flow identifier, and further facilitating the implementation of secure forwarding of the to-be-transmitted data on the transmission path.

[0387] In an example, before forwarding the routing request from the terminal device to the third core network node, the method further includes:

[0388] The first network device sends first configuration information and a first signature of the first configuration information to the first core network node, so that the first core network node verifies the first signature, and in the case of verification, configures the first network device with first QoT configuration information according to the first configuration information and the configuration strategy of the operator, such as determining a third QoT level, and further determining a transmission path for the to-be-transmitted data according to the third QoT level. The first configuration information refers to the software and hardware configuration information of the first network device, and in an example, the first configuration information includes the identifier, model, manufacturer, factory certificate, and version of the software used of the first network device.

[0389] In this example, the first network device can send first configuration information and a first signature of the first configuration information to the first core network node, so that the first core network node can verify the first signature. If the verification is successful, the first core network node can configure a QoT level (i.e., the third QoT level) for the first network device according to the first configuration information and the operator's configuration policy. Then, the transmission path is selected for the data to be transmitted according to the third QoT level. This allows the first network device to forward the data according to the transmission path after decrypting the third data packet, without having to perform a path selection operation, which helps to reduce the overhead of the first network device.

[0390] 804: The first network device uses the target symmetric key to decrypt the first data packet to obtain the third data packet.

[0391] For example, the method further includes:

[0392] The first network device uses the target symmetric key to decrypt the first data packet and obtain the first service flow identifier.

[0393] For example, the first network device uses symmetric key 1 to pair the first data packet Enc 对称密钥 1(flow 1, Enc 对称密钥 Decrypt 2(flow2, data to be transmitted) to obtain the third data packet Enc. 对称密钥 2 (flow 2, data to be transmitted) and flow 1. It should be understood that the IP header of the first data packet includes the IP address of the second network device, which is used to inform the first network device of the third data packet Enc. 对称密钥 The forwarding address for flow 2 (data to be transmitted).

[0394] 805: The first network device sends a third data packet to the second network device.

[0395] In this process, after receiving the third data packet, the second network device decrypts the third data packet using symmetric key 2, then forwards the decrypted data packet or the data to be transmitted to the next hop, and finally sends the data to be transmitted to the receiving end according to the transmission path.

[0396] For example, sending a third data packet to a second network device includes:

[0397] The first network device sends the third data packet to the second network device when the first service flow identifier is the same as the second service flow identifier stored by the first network device. It should be understood that the first service flow identifier being the same as the second service flow identifier stored by the first network device indicates that the service flow is the service flow to be processed by the first network device, and then the first network device performs the operation of sending the third data packet to the second network device. On the contrary, if the two are not the same, it indicates that the service flow is not the service flow to be processed by the first network device, and the first network device can not send the third data packet to the second network device, thereby facilitating the error forwarding of data.

[0398] For the first network device, the forwarding policy of the first data packet includes at least one of the following:

[0399] sending the first data packet to the second network device when the first QoT level is lower than or equal to the second QoT level;

[0400] sending the first data packet to the second network device when the first QoT level is higher than the second QoT level and the service accepts degraded transmission;

[0401] not sending the first data packet to the second network device when the first QoT level is higher than the second QoT level;

[0402] fragmenting the first data packet when the first QoT level is higher than the second QoT level, sending sub-packets obtained by fragmenting to core network nodes with a QoT level higher than or equal to the first QoT level by using different paths, so that the core network nodes combine and restore the sub-packets obtained by fragmenting to the first data packet and send the first data packet to the next hop; and

[0403] sending the first data packet to the second network device when the first QoT level is higher than the second QoT level and the second QoT level is higher than or equal to the lowest QoT level that can be adopted by the first data packet.

[0404] For example, the forwarding policy can be to send the first data packet to a second network device with a second QoT level higher than or equal to the first QoT level; for example, the forwarding policy can also be a degradable transmission, that is, if the first QoT level is higher than the second QoT level, but the terminal device is configured to accept the degraded transmission for the service, the first network device can send the first data packet to a second network device with a second QoT level lower than the first QoT level; for example, the forwarding policy can also be a fragmentation, that is, if the first QoT level is higher than the second QoT level, the first network device can fragment the first data packet, and then send the sub-packets obtained by fragmentation to different network devices, including the second network device, such as network device 1 and network device 2, and the network device 1 and the network device 2 respectively send the sub-packets obtained by fragmentation to a core network node with a QoT level higher than or equal to the first QoT level, and the core network node can combine the received sub-packets to restore the first data packet, and then forward to the next hop; for example, the forwarding policy can also be to specify the minimum available QoT level of the first data packet under the condition of degradable, that is, when the second QoT level is lower than the first QoT level and the second QoT level is higher than or equal to the minimum available QoT level, the first data packet can be sent to the second network device. Of course, the above is only an example of the forwarding policy, and the present application can include more forwarding policies or combinations of forwarding policies. According to the forwarding policy of the first data packet, the first network device can flexibly select the second network device for data transmission, thereby facilitating the flexibility of data transmission while constructing a trusted network route.

[0405] It should be understood that in the present embodiment, the forwarding policy is mainly used for the third core network node to select an end-to-end transmission path for the data to be transmitted. During data transmission, the sender can not refer to the forwarding policy.

[0406] For ease of understanding, please refer to Figure 9 , Figure 9 The overall flowchart of another data transmission method provided by the embodiment of the present application is shown. The specific steps are as follows:

[0407] (1) The terminal device determines the QoT level of the application according to the QoT classification, and determines the data forwarding policy of the application according to the QoT service policy and the QoT level of the application;

[0408] (2) The terminal device starts the target application and sends a routing request to the third core network node through the first network device; wherein the routing request includes the location information of the terminal device, the first QoT level, the forwarding policy and the receiving end IP address, and the routing request is used to request the third core network node to determine the transmission path;

[0409] (3) The third core network node selects an end-to-end transmission path for the terminal device according to the location information in the routing request, the first QoT level, the forwarding policy, and the receiving end IP address;

[0410] (4) The third core network node sends a third message to the terminal device through the first network device; the third message includes the network devices in the transmission path, the certificates of the network devices in the transmission path, and a temporary certificate issued by the third core network node for the terminal device, wherein the third core network node can send the network devices in the transmission path to the terminal device in the form of a list;

[0411] (5) The terminal device stores the list of network devices in the transmission path, the certificates of the network devices in the transmission path, and the temporary certificate;

[0412] (6) The terminal device performs key negotiation with the network devices in the transmission path using the certificates of the network devices in the transmission path and the temporary certificate, and obtains at least one service flow identifier and at least one symmetric key corresponding thereto;

[0413] (7) The first network device (or its affiliated node) stores a context; the context includes the second service flow identifier and the target symmetric key obtained by the first network device through key negotiation with the terminal device;

[0414] (8) The second network device (or its affiliated node) stores a context; the context includes the service flow identifier and the symmetric key obtained by the second network device through key negotiation with the terminal device;

[0415] (9) The terminal device uses at least one symmetric key to perform layer-by-layer encryption on the to-be-transmitted data of the service, and obtains a first data packet;

[0416] (10) The terminal device sends the first data packet to the first network device;

[0417] (11) The first network device receives the first data packet from the terminal device, and decrypts the first data packet using the target symmetric key to obtain a third data packet;

[0418] (12) The first network device sends the third data packet to the second network device;

[0419] (13) The second network device receives the third data packet from the first network device, and decrypts the third data packet using the symmetric key;

[0420] (14) The second network device further forwards the decrypted data.

[0421] It can be seen that, in the embodiment, by quantifying the trusted attributes of the terminal device, the service at the terminal device side, the core network node and the network device (such as a base station, a router, a gateway and the like) in the network, configuring the QoT level for the same, and configuring the data forwarding strategy for the service at the terminal device side, the first core network node can determine the end-to-end transmission path for the to-be-transmitted data according to the location information of the terminal device, the first QoT level of the service corresponding to the to-be-transmitted data, the QoT level of the network device in the network, the forwarding strategy of the to-be-transmitted data and the receiving end IP address of the to-be-transmitted data, thereby facilitating the construction of a trusted network route for data transmission. Since the transmission path is selected by the first core network node, the first network device no longer needs to send its own QoT level to the terminal device, thereby facilitating the avoidance of the risk of exposure of the QoT level of the first network device. The terminal device can use the symmetric key corresponding to the network device in the transmission path to encrypt the to-be-transmitted data layer by layer, and the intermediate network devices (including the first network device and the second network device) can only partially decrypt the received data packet, and the intermediate network devices (except the last-hop intermediate network device of the receiving end) do not know the receiving end IP address, thereby facilitating the improvement of the security of the data.

[0422] The method of the embodiments of the present application is described in detail above, and the device of the embodiments of the present application is provided below.

[0423] Please refer to Figure 10 , Figure 10 A structure diagram of a data transmission device 1000 provided by the embodiments of the present application is provided. The device 1000 is applied to a first network device, as shown in Figure 10 The device includes a first transceiver unit 1001 and a first processing unit 1002.

[0424] The first transceiver unit 1001 is configured to receive a first data packet from a terminal device, and the first data packet includes a first QoT level of a service corresponding to the first data packet and a forwarding strategy of the first data packet.

[0425] The first processing unit 1002 is configured to obtain a second QoT level of a second network device.

[0426] The first processing unit 1002 is further configured to call the first transceiver unit 1001 to send the first data packet to the second network device according to the first QoT level, the second QoT level and the forwarding strategy.

[0427] In some possible implementation manners, the first transceiver unit 1001 is further configured to send a first message to the terminal device, and the first message includes a third QoT level of the first network device; wherein the first data packet is sent by the terminal device according to the first QoT level, the third QoT level and the forwarding strategy.

[0428] In some possible implementation, the first transceiver 1001 is further configured to send the first configuration information and a first signature of the first configuration information to the first core network node, so that the first core network node determines a third QoT level according to the first signature, the first configuration information and a configuration policy of an operator; and receive first QoT configuration information from the first core network node, the first QoT configuration information including the third QoT level.

[0429] In some possible implementation, the first message includes any one of a master information block (MIB), a system information block (SIB), a beacon and control plane signaling from the first core network node.

[0430] In some possible implementation, the first transceiver 1001 is further configured to forward a second message from the terminal device to the first core network node, the second message including location information of the terminal device, a reference network device identifier and a fourth QoT level of the terminal device, wherein the second message is used to request the first core network node to determine a target network device accessible by the terminal device from the reference network device according to the fourth QoT level, the location information and a QoT level of the reference network device; and wherein the reference network device includes network devices within a range determined based on the location information, and the reference network device identifier is used to indicate the reference network device.

[0431] In some possible implementation, in the aspect of sending the first message to the terminal device, the first transceiver 1001 is specifically configured to forward control plane signaling from the first core network node to the terminal device, the control plane signaling from the first core network node including an identifier and a QoT level of the target network device; and wherein the target network device includes the first network device.

[0432] In some possible implementation, the first processing unit 1002 is further configured to instruct the first transceiving unit 1001 to send the first data packet to the second network device when the first QoT level is lower than or equal to the second QoT level; instruct the first transceiving unit 1001 to send the first data packet to the second network device when the first QoT level is higher than the second QoT level and the service accepts degraded transmission; not instruct the first transceiving unit 1001 to send the first data packet to the second network device when the first QoT level is higher than the second QoT level; instruct the first transceiving unit 1001 to send sub-packets obtained by fragmenting the first data packet to core network nodes with QoT levels higher than or equal to the first QoT level, so that the core network nodes combine the sub-packets to restore the first data packet and send the first data packet to a next hop, when the first QoT level is higher than the second QoT level; and instruct the first transceiving unit 1001 to send the first data packet to the second network device when the first QoT level is higher than the second QoT level and the second QoT level is higher than or equal to a minimum QoT level that can be adopted by the first data packet.

[0433] In some possible implementation, the first QoT level is higher than the third QoT level, and the first data packet is a sub-packet obtained by fragmenting a data packet of the service by the terminal device; and the first processing unit 1002 is specifically configured to instruct the first transceiving unit 1001 to send the first data packet to the second core network node, so that the second core network node obtains the data packet of the service according to the first data packet and a second data packet, and sends the data packet of the service to the second network device according to the first QoT level, the second QoT level, and the forwarding policy, when the first processing unit 1002 instructs the first transceiving unit 1001 to send the first data packet to the second network device according to the first QoT level, the second QoT level, and the forwarding policy; wherein the second core network node has a QoT level higher than or equal to the first QoT level, the second data packet is a sub-packet obtained by fragmenting the data packet of the service by the terminal device and excluding the first data packet, the second data packet is sent by the third network device to the second core network node, the first QoT level is higher than a fifth QoT level of the third network device, and the data packet of the service includes the forwarding policy.

[0434] See Figure 11 , Figure 11 Another structure diagram of a data transmission apparatus 1100 is provided in the embodiments of the present application. The apparatus 1100 is applied to a first network device, such as a core network node. Figure 11As shown, the apparatus includes a second transceiver unit 1101 and a second processing unit 1102; the second transceiver unit 1101 is configured to receive a first data packet from a terminal device, the first data packet being obtained by the terminal device by performing layer-by-layer encryption on to-be-transmitted data using at least one symmetric key, wherein the at least one symmetric key includes a symmetric key corresponding to a network device in a transmission path of the to-be-transmitted data, the transmission path being determined according to location information of the terminal device, a first QoT level of a service corresponding to the to-be-transmitted data, a QoT level of a network device in the transmission path, a forwarding strategy of the to-be-transmitted data, and a receiving-end IP address of the to-be-transmitted data, and the network device in the transmission path includes a first network device; the second processing unit 1102 is configured to decrypt the first data packet using a target symmetric key to obtain a third data packet, the target symmetric key being a symmetric key corresponding to the first network device; and the second transceiver unit 1101 is further configured to send the third data packet to a second network device, the second network device being a next hop of the first network device in the transmission path.

[0435] In some possible implementation manners, the second transceiver unit 1101 is further configured to forward, to a third core network node, a routing request from the terminal device, the routing request including the location information, the first QoT level, the forwarding strategy, and the receiving-end IP address, and the routing request being used to request the third core network node to determine the transmission path; and forward, to the terminal device, a third message from the third core network node, the third message including the network device in the transmission path, a certificate of the network device in the transmission path, and a temporary certificate issued by the third core network node for the terminal device.

[0436] In some possible implementation manners, the target symmetric key is obtained by the terminal device through key negotiation with the first network device or an affiliated node of the first network device, using the certificate of the first network device and the temporary certificate.

[0437] The first data packet is obtained by the terminal device by encrypting a first service flow identifier and the third data packet using the target symmetric key, and the first service flow identifier is obtained by the terminal device through key negotiation with the first network device or the affiliated node of the first network device, using the certificate of the first network device and the temporary certificate; and the second processing unit 1102 is configured to decrypt the first data packet using the target symmetric key to further obtain the first service flow identifier.

[0438] In terms of sending the third data packet to the second network device, the second transceiver unit 1101 is specifically configured to send the third data packet to the second network device when the first service flow identifier is the same as a second service flow identifier stored by the first network device.

[0439] In some possible implementations, the second processing unit 1102 is further configured to store a first context, which is the context for key negotiation between the terminal device and the first network device, and the first context includes a second service flow identifier and a target symmetric key; or receive and store a second context sent by a subordinate node through the second transceiver unit 1101, which is the context for key negotiation between the terminal device and the subordinate node, and the second context includes a second service flow identifier and a target symmetric key.

[0440] In some possible implementations, the second transceiver unit 1101 is further configured to send first configuration information and a first signature of the first configuration information to the first core network node, so that the first core network node determines the third QoT level based on the first signature, the first configuration information and the operator's configuration policy, and then obtains the transmission path based on the third QoT level.

[0441] In some possible implementations, the second processing unit 1102 is further configured to: call the second transceiver unit 1101 to send a first data packet to the second network device when the first QoT level is lower than or equal to the second QoT level; call the second transceiver unit 1101 to send a first data packet to the second network device when the first QoT level is higher than the second QoT level and the service accepts downgraded transmission; not call the second transceiver unit 1101 to send a first data packet to the second network device when the first QoT level is higher than the second QoT level; and not call the second transceiver unit 1101 to send a first data packet to the second network device when the first QoT level is higher than the second QoT level. The second processing unit 1102 is used to fragment the first data packet when the first QoT level is higher than the second QoT level, and call the second transceiver unit 1101 to send the fragmented sub-data packets to the core network node with a QoT level higher than or equal to the first QoT level using different paths, so that the core network node can combine the fragmented sub-data packets back into the first data packet and send the first data packet to the next hop; the second processing unit 1102 is also used to call the second transceiver unit 1101 to send the first data packet to the second network device when the first QoT level is higher than the second QoT level and the second QoT level is higher than or equal to the lowest QoT level that the first data packet can use.

[0442] Please see Figure 12 , Figure 12 This is a schematic diagram of another data transmission device 1200 provided in an embodiment of this application. The device 1200 is applied to a terminal device, such as... Figure 12As shown, the apparatus includes an acquisition unit 1201, a third transceiver unit 1202, and a third processing unit 1203; the acquisition unit 1201 is configured to acquire a first QoT level of a current service and a forwarding policy of a first data packet of the service; the acquisition unit 1201 is further configured to acquire a third QoT level of the first network device; the processing unit is further configured to, according to the first QoT level, the forwarding policy, and the third QoT level, invoke the third transceiver unit 1202 to send the first data packet to the first network device.

[0443] In some possible implementation manners, the third transceiver unit 1202 is further configured to receive a first message sent by the first network device, and the first message includes the third QoT level; the third processing unit 1203 is further configured to store the third QoT level; and the third QoT level is determined by the first core network node according to first configuration information of the first network device, a first signature of the first configuration information, and a configuration policy of an operator.

[0444] In some possible implementation manners, the third processing unit 1203 is further configured to access a network and invoke the third transceiver unit 1202 to send, to a control plane node on a network side through the first network device, registration signaling including a QoT service policy of the terminal device and a minimum QoT level required by the terminal device, the QoT service policy being used to determine a data forwarding policy for an application on the terminal device, and the application including a target application corresponding to the service; and the third transceiver unit 1202 is further configured to receive a fourth message forwarded by the first network device and from the control plane node, and the fourth message includes a highest QoT level provided by the network, wherein the fourth message is sent by the control plane node when it is determined, according to the QoT service policy and the minimum QoT level, or according to subscription information of the terminal device on the network side, that the terminal device is accepted, and the highest QoT level is used to determine that the target application can be used.

[0445] In some possible implementation manners, the first message includes any one of a master information block (MIB), a system information block (SIB), a beacon, and control plane signaling from the first core network node.

[0446] In some possible implementation manners, the third transceiver unit 1202 is further configured to send, to the first core network node through the first network device, a second message including location information of the terminal device, a reference network device identifier, and a fourth QoT level of the terminal device, wherein the second message is used to request the first core network node to determine, according to the fourth QoT level, the location information, and a QoT level of the reference network device, a target network device accessible by the terminal device from the reference network device; and the reference network device includes a network device within a range determined based on the location information, and the reference network device identifier is used to indicate the reference network device.

[0447] In some possible implementation, the third transceiver 1202 is specifically configured to receive the control plane signaling from the first core network node forwarded by the first network device, and the control plane signaling from the first core network node includes the identification of the target network device and the QoT level; and the target network device includes the first network device.

[0448] In some possible implementation, the third processing unit 1203 is further configured to: when the first QoT level is lower than or equal to the third QoT level, invoke the third transceiver 1202 to send the first data packet to the first network device; when the first QoT level is higher than the third QoT level and the service accepts the degraded transmission, invoke the third transceiver 1202 to send the first data packet to the first network device; when the first QoT level is higher than the third QoT level, do not invoke the third transceiver 1202 to send the first data packet to the first network device; when the first QoT level is higher than the third QoT level, fragment the first data packet, and invoke the third transceiver 1202 to send the sub-packets obtained by fragmenting to the core network nodes with the QoT level higher than or equal to the first QoT level by using different paths, so that the core network nodes combine and restore the sub-packets obtained by fragmenting into the first data packet and send the first data packet to the next hop; and when the first QoT level is higher than the third QoT level and the third QoT level is higher than or equal to the lowest adoptable QoT level of the first data packet, invoke the third transceiver 1202 to send the first data packet to the first network device.

[0449] In some possible implementation, the first data packet is a sub-packet obtained by fragmenting a data packet of the service by the terminal device; the obtaining unit 1201 is further configured to obtain a fifth QoT level of the third network device, and the fifth QoT level is obtained according to a fifth message sent by the third network device; and the third processing unit 1203 is further configured to: if the first QoT level is higher than the third QoT level and the fifth QoT level, fragment the data packet of the service to obtain the first data packet and a second data packet, the second data packet being a sub-packet obtained by fragmenting the data packet of the service by the terminal device except the first data packet, and the data packet of the service including a forwarding policy; and invoke the third transceiver 1202 to send the second data packet to the third network device according to the first QoT level, the forwarding policy and the fifth QoT level.

[0450] In some possible implementation, the third processing unit 1203 is further configured to determine the applied QoT level according to the QoT classification in the preset second QoT configuration information, and the second QoT configuration information includes a QoT service policy; and determine the data forwarding policy of the application according to the QoT service policy and the applied QoT level.

[0451] In some possible implementation, the third transceiver 1202 is further configured to send the second configuration information and a second signature of the second configuration information to the first core network node through the first network device; and receive the second QoT configuration information from the first core network node forwarded by the first network device, wherein the second QoT configuration information is determined by the first core network node according to the second signature, the second configuration information and a configuration policy of an operator, and the second QoT configuration information includes a fourth QoT level.

[0452] Please refer to Figure 13 , Figure 13 Another structure diagram of a data transmission apparatus 1300 provided by an embodiment of the present application is shown. The apparatus 1300 is applied to a terminal device, and as shown in Figure 13 , the apparatus includes a fourth transceiver 1301 and a fourth processing unit 1302. The fourth processing unit 1302 is configured to perform layer-by-layer encryption on the to-be-transmitted data of a current service by using at least one symmetric key, to obtain a first data packet, wherein the at least one symmetric key is a symmetric key corresponding to a network device in a transmission path of the to-be-transmitted data, and the transmission path is determined according to location information of the terminal device, a first QoT level of a service corresponding to the to-be-transmitted data, a QoT level of the network device in the transmission path, a forwarding policy of the to-be-transmitted data and a receiving end IP address of the to-be-transmitted data, and the network device in the transmission path includes a first network device. The fourth transceiver 1301 is configured to send the first data packet to the first network device.

[0453] In some possible implementation, the fourth transceiver 1301 is further configured to send a routing request to a third core network node through the first network device, wherein the routing request includes the above-mentioned location information, the first QoT level, the forwarding policy and the receiving end IP address, and the routing request is used to request the third core network node to determine the transmission path; and receive a third message from the third core network node forwarded by the first network device, wherein the third message includes the network device in the transmission path, a certificate of the network device in the transmission path and a temporary certificate issued by the third core network node for the terminal device.

[0454] In some possible implementation, the fourth processing unit 1302 is further configured to perform key negotiation with the first network device or an affiliated node of the first network device by using a certificate and a temporary certificate of the first network device, to obtain a first service flow identifier corresponding to the first network device and a target symmetric key; the first data packet is obtained by encrypting the first service flow identifier and the third data packet by using the target symmetric key, and the third data packet is obtained by performing data encryption on the third data packet by using a symmetric key corresponding to a second network device, the second network device being a next hop of the first network device in the transmission path.

[0455] In some possible implementation, the fourth processing unit 1302 is further configured to access a network and invoke the fourth transceiver unit 1301 to send, to a control plane node on a network side, registration signaling by using the first network device, the registration signaling including a QoT service policy of the terminal device and a minimum QoT level required by the terminal device, the QoT service policy being used to determine a data forwarding policy for an application on the terminal device, the application including a target application corresponding to a service; the fourth transceiver unit 1301 is further configured to receive a fourth message sent by the control plane node and forwarded by the first network device, the fourth message including a highest QoT level provided by the network, wherein the fourth message is sent by the control plane node according to the QoT service policy and the minimum QoT level, or according to subscription information of the terminal device on the network side; and the fourth processing unit 1302 is further configured to determine that the target application can be used according to the highest QoT level and the forwarding policy.

[0456] In some possible implementation, the fourth processing unit 1302 is further configured to determine a QoT level of the application according to a QoT classification in preset second QoT configuration information, the second QoT configuration information including the QoT service policy; determine a data forwarding policy of the application according to the QoT service policy and the QoT level of the application; and determine the fourth QoT level of the terminal device according to the QoT classification.

[0457] In some possible implementation, the fourth transceiver unit 1301 is further configured to send, to a first core network node by using the first network device, second configuration information and a second signature of the second configuration information; and receive second QoT configuration information from the first core network node and forwarded by the first network device, the second QoT configuration information being determined by the first core network node according to the second signature, the second configuration information and a configuration policy of an operator, the second QoT configuration information including the fourth QoT level.

[0458] In some possible implementation, the fourth processing unit 1302 is further configured to instruct the fourth transceiving unit 1301 to send the first data packet to the first network device when the first QoT level is lower than or equal to the third QoT level; the fourth processing unit 1302 is further configured to instruct the fourth transceiving unit 1301 to send the first data packet to the first network device when the first QoT level is higher than the third QoT level and the service accepts degraded transmission; the fourth processing unit 1302 is further configured to not instruct the fourth transceiving unit 1301 to send the first data packet to the first network device when the first QoT level is higher than the third QoT level; the fourth processing unit 1302 is further configured to, when the first QoT level is higher than the third QoT level, fragment the first data packet, instruct the fourth transceiving unit 1301 to send sub-packets obtained by fragmenting to core network nodes with a QoT level higher than or equal to the first QoT level by using different paths, so that the core network nodes combine and restore the sub-packets obtained by fragmenting to the first data packet and send the first data packet to a next hop; and the fourth processing unit 1302 is further configured to instruct the fourth transceiving unit 1301 to send the first data packet to the first network device when the first QoT level is higher than the third QoT level and the third QoT level is higher than or equal to a minimum adoptable QoT level of the first data packet.

[0459] Referring to Figure 14 , Figure 14 A structure diagram of a first network device 1400 is provided in the embodiments of the present application, and the first network device 1400 includes a processor 1401, a memory 1402, and a communication interface 1403, which are connected to each other through a bus 1404.

[0460] The memory 1402 includes, but is not limited to, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read only memory (EPROM), or a compact disc read-only memory (CD-ROM), which is used to store relevant computer programs and data. The communication interface 1403 is used to receive and send data.

[0461] The processor 1401 can be one or more central processing units (CPUs), and in the case of the processor 1401 being a CPU, the CPU can be a single-core CPU or a multi-core CPU.

[0462] The processor 1401 in the first network device 1400 is configured to read the computer program code stored in the memory 1402, and perform the following operations: receiving, by the communication interface 1403, a first data packet from a terminal device, the first data packet including a first QoT level of a service corresponding to the first data packet and a forwarding policy of the first data packet; obtaining a second QoT level of a second network device; and transmitting, by the communication interface 1403, the first data packet to the second network device according to the first QoT level, the second QoT level and the forwarding policy.

[0463] In Figure 14 In the first network device 1400 shown in the figure, when the first network device needs to forward a first data packet from a terminal device, whether to transmit the first data packet to a second network device can be determined according to a first QoT level of a service, a second QoT level of the second network device and a forwarding policy of the first data packet. For example, the forwarding policy of the first data packet indicates that the first data packet can only be forwarded to a network device with a QoT level higher than or equal to the first QoT level. When the second QoT level is higher than or equal to the first QoT level, the first network device transmits the first data packet to the second network device. Of course, the forwarding policy can have many forms, which are not limited in the present application. It should be understood that, based on the first QoT level, the second QoT level and the forwarding policy, the first data packet is transmitted to the second network device only when the second QoT level meets the first QoT level and the forwarding policy, so that the network device selected each time is trusted, which is conducive to building a trusted network route for data transmission.

[0464] The processor 1401 in the first network device 1400 is configured to read the computer program code stored in the memory 1402, and perform the following operations: receiving, by the communication interface 1403, a first data packet from a terminal device, the first data packet being obtained by layer-by-layer encryption of to-be-transmitted data by the terminal device using at least one symmetric key, wherein the at least one symmetric key includes a symmetric key corresponding to a network device in a transmission path of the to-be-transmitted data, the transmission path being determined according to position information of the terminal device, a first QoT level of a service corresponding to the to-be-transmitted data, QoT levels of network devices in the transmission path, a forwarding policy of the to-be-transmitted data and a receiving end IP address of the to-be-transmitted data, and the network devices in the transmission path including the first network device; decrypting the first data packet using a target symmetric key to obtain a third data packet, the target symmetric key being a symmetric key corresponding to the first network device; and transmitting, by the communication interface 1403, the third data packet to a second network device, the second network device being a next hop of the first network device in the transmission path.

[0465] In Figure 14The first network device 1400 shown in the embodiment of the present application, according to the position information of the terminal device, the first QoT level of the service corresponding to the to-be-transmitted data, the QoT level of the network device in the network, the forwarding strategy of the to-be-transmitted data and the receiving end IP address of the to-be-transmitted data, determines the transmission path of the to-be-transmitted data, and realizes the construction of the trusted network routing. In addition, the terminal device can encrypt the to-be-transmitted data layer by layer by using the symmetric key corresponding to the network device in the transmission path, the first network device in the transmission path uses the target symmetric key to decrypt the first data packet, and the obtained is the encrypted third data packet, and the second network device decrypts the third data packet and obtains the encrypted data packet. Since the network devices in the transmission path do not know the receiving end IP address of the to-be-transmitted data, they can only decrypt part of the data and send it to the next hop, and the next hop can only decrypt part of the data, and cannot obtain the unencrypted to-be-transmitted data, thereby improving the security of the data.

[0466] It should be noted that the implementation of each operation can also correspond to the Figure 4 corresponding description of the method embodiment shown.

[0467] It should be noted that although Figure 14 The first network device 1400 shown in the embodiment of the present application only shows the processor 1401, the memory 1402 and the communication interface 1403, but in the specific implementation process, those skilled in the art should understand that the first network device 1400 also includes other devices necessary for normal operation. At the same time, according to the specific needs, those skilled in the art should understand that the first network device 1400 can also include hardware devices for realizing other additional functions. In addition, those skilled in the art should understand that the first network device 1400 can also only include devices necessary for realizing the embodiments of the present application, and does not necessarily include Figure 14 all devices shown in the embodiment of the present application.

[0468] Please refer to Figure 15 , Figure 15 The structure schematic diagram of a terminal device 1500 provided by the embodiment of the present application, the terminal device 1500 includes a processor 1501, a memory 1502 and a communication interface 1503, and the processor 1501, the memory 1502 and the communication interface 1503 are connected with each other through a bus 1504.

[0469] The memory 1502 includes, but is not limited to, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read only memory (EPROM), or a compact disc read-only memory (CD-ROM), which is used to store relevant computer programs and data. The communication interface 1503 is used to receive and send data.

[0470] The processor 1501 can be one or more central processing units (CPUs). In the case where the processor 1501 is a CPU, the CPU can be a single-core CPU or a multi-core CPU.

[0471] The processor 1501 in the terminal device 1500 is configured to read the computer program code stored in the memory 1502, and perform the following operations: obtaining a first QoT level of a current service and a forwarding policy of a first data packet of the service; obtaining a third QoT level of a first network device; and sending, through the communication interface 1503, the first data packet to the first network device according to the first QoT level, the forwarding policy, and the third QoT level.

[0472] In Figure 15 In the terminal device 1500 shown in the figure, when the first data packet generated by the current service needs to be sent, the processor 1501 can determine whether to send the first data packet to the first network device according to the first QoT level of the service, the third QoT level of the first network device, and the forwarding policy of the first data packet. It should be understood that, based on the first QoT level, the third QoT level, and the forwarding policy, the first data packet is sent to the first network device only when the third QoT level meets the first QoT level and the forwarding policy, so that the selected first network device is always trusted, which is conducive to building a trusted network route for data transmission.

[0473] The processor 1501 in the terminal device 1500 is configured to read the computer program code stored in the memory 1502, and further configured to perform the following operations: performing layer-by-layer encryption on the to-be-transmitted data of the current service by using at least one symmetric key, to obtain a first data packet, the at least one symmetric key being a symmetric key corresponding to a network device in a transmission path of the to-be-transmitted data, the transmission path being determined according to location information of the terminal device, a first QoT level of a service corresponding to the to-be-transmitted data, a QoT level of the network device in the transmission path, a forwarding strategy of the to-be-transmitted data, and an IP address of a receiving end of the to-be-transmitted data, the network device in the transmission path including the first network device; and sending, by using the communication interface 1503, the first data packet to the first network device.

[0474] In Figure 15 In the terminal device 1500 shown in the figure, the transmission path of the to-be-transmitted data is determined according to the location information of the terminal device 1500, the first QoT level of the service corresponding to the to-be-transmitted data, the QoT level of the network device in the network, the forwarding strategy of the to-be-transmitted data, and the IP address of the receiving end of the to-be-transmitted data, thereby realizing the construction of a trusted network route. In addition, when the to-be-transmitted data needs to be sent, the processor 1501 can use the symmetric key corresponding to the network device in the transmission path to perform layer-by-layer encryption on the to-be-transmitted data, and the intermediate network device (including the first network device) can only perform partial decryption on the first data packet, thereby facilitating the improvement of the security of the data.

[0475] It should be noted that the implementation of each operation can also correspond to the Figure 8 corresponding description of the method embodiment shown in the figure.

[0476] It should be noted that although Figure 15 The terminal device 1500 shown in the figure only shows the processor 1501, the memory 1502, and the communication interface 1503, but in the specific implementation process, those skilled in the art should understand that the terminal device 1500 also includes other devices necessary for normal operation. At the same time, according to specific needs, those skilled in the art should understand that the terminal device 1500 can also include hardware devices for realizing other additional functions. In addition, those skilled in the art should understand that the terminal device 1500 can also only include devices necessary for implementing the embodiments of the present application, and does not necessarily include all the devices shown in the figure. Figure 15

[0477] The embodiments of the present application also provide a computer readable storage medium, and the computer readable storage medium stores program codes for device execution, when the program codes run on the first network device, Figures 4-7 the method flow shown in the figure is realized.

[0478] ​The embodiment of the present application further provides a computer readable storage medium, the computer readable storage medium stores program codes for equipment execution, when the program codes run on a terminal device, Figure 8 、 Figure 9 the method flow shown in the figure is implemented.

[0479] The embodiment of the present application further provides a computer program product, when the computer program product is run by a first network device, Figures 4-7 the method flow shown in the figure is implemented.

[0480] The embodiment of the present application further provides a computer program product, when the computer program product is run by a terminal device, Figure 8 、 Figure 9 the method flow shown in the figure is implemented.

[0481] It should be understood that the processor mentioned in the embodiment of the present application can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0482] It should also be understood that the memory mentioned in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically EPROM (EEPROM) or a flash memory. The volatile memory can be a Random Access Memory (RAM) used as an external cache. By way of example but not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM) and Direct Rambus RAM (DR RAM).

[0483] It should be noted that when the processor is a general processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) is integrated in the processor.

[0484] It should be noted that the memory described herein is intended to include, but not limited to, these and any other suitable types of memory.

[0485] It should be understood that in various embodiments of the present application, the size of the sequence number of each process described above does not mean the order of execution, the execution order of each process should be determined by its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0486] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described device embodiments are merely schematic. The division of the units is merely logical function division. There can be other division manners in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between different units, can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0487] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0488] In addition, the functional units in each embodiment of the present application can be integrated into a processing unit, or each unit can be physically present, or two or more units can be integrated into one unit.

[0489] In the present application, "at least one" means one or more, and "multiple" means two or more. "And / or" describes the association relationship between the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the following three cases: A exists alone, A and B exist together, and B exists alone, where A and B can be singular or plural. In the textual description of the present application, the character " / ", generally indicates that the front and rear associated objects are in an "or" relationship.

[0490] The steps in the method embodiments of the present application can be adjusted, combined and deleted according to actual needs.

[0491] The modules in the device embodiments of the present application can be combined, divided and deleted according to actual needs.

[0492] The above embodiments are merely used to illustrate the technical solutions of the present application, rather than limit them. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A data transmission method, characterized by, The method is applied to a first network device, and the method comprises: receiving a first data packet from a terminal device, wherein the first data packet comprises a first trust quality level of a service corresponding to the first data packet and a forwarding policy of the first data packet; the forwarding policy of the first data packet comprises at least one of the following: not accepting trust quality level degradation transmission, accepting trust quality level degradation transmission, fragmenting the first data packet and sending sub-packets obtained by fragmentation to a core network node when the trust quality level cannot be met, and a lowest trust quality level that can be accepted when the trust quality level degradation transmission is accepted; obtaining a second trust quality level of a second network device; sending the first data packet to the second network device according to the first trust quality level, the second trust quality level and the forwarding policy.

2. The method of claim 1, wherein, Before receiving the first data packet from the terminal device, the method further comprises: sending a first message to the terminal device, wherein the first message comprises a third trust quality level of the first network device; wherein the first data packet is sent by the terminal device according to the first trust quality level, the third trust quality level and the forwarding policy.

3. The method of claim 2, wherein, Before sending the first message to the terminal device, the method further comprises: sending first configuration information and a first signature of the first configuration information to a first core network node, so that the first core network node determines the third trust quality level according to the first signature, the first configuration information and a configuration policy of an operator; receiving first trust quality configuration information from the first core network node, wherein the first trust quality configuration information comprises the third trust quality level.

4. The method of claim 3, wherein: the first message comprises any one of a master information block (MIB), a system information block (SIB), a beacon and control plane signaling from the first core network node.

5. The method of claim 4, wherein, After sending the first configuration information to the first core network node, the method further comprises: forwarding a second message from the terminal device to the first core network node, wherein the second message comprises location information of the terminal device, a reference network device identifier and a fourth trust quality level of the terminal device, and the second message is used to request the first core network node to determine a target network device accessible by the terminal device from a reference network device according to the fourth trust quality level, the location information and a trust quality level of the reference network device; wherein the reference network device comprises a network device within a range determined based on the location information, and the reference network device identifier is used to indicate the reference network device.

6. The method of claim 5, wherein, the first message comprises control plane signaling from the first core network node, and the sending of the first message to the terminal device comprises: forwarding the control plane signaling from the first core network node to the terminal device, wherein the control plane signaling from the first core network node comprises an identifier and a trust quality level of the target network device; wherein the target network device comprises the first network device.

7. The method according to any one of claims 1 to 6, characterized in that, The forwarding policy comprises at least one of the following: When the first trust level is lower than or equal to the second trust level, sending the first data packet to the second network device; When the first trust level is higher than the second trust level and the service accepts degraded transmission, sending the first data packet to the second network device; When the first trust level is higher than the second trust level, not sending the first data packet to the second network device; When the first trust level is higher than the second trust level, fragmenting the first data packet, sending the fragmented sub-packets to core network nodes with a trust level higher than or equal to the first trust level by different paths, so that the core network nodes combine the fragmented sub-packets to restore the first data packet and send the first data packet to the next hop; When the first trust level is higher than the second trust level and the second trust level is higher than or equal to the minimum trust level that can be accepted by the first data packet, sending the first data packet to the second network device. The first trust level is higher than the third trust level, and the first data packet is a sub-packet obtained by fragmenting a data packet of the service by the terminal device; 8. The method of claim 6, wherein, According to the first trust level, the second trust level and the forwarding policy, the first data packet is sent to the second network device, comprising: sending the first data packet to a second core network node, so that the second core network node obtains a data packet of the service according to the first data packet and a second data packet, and sends the data packet of the service to the second network device according to the first trust level, the second trust level and the forwarding policy; Wherein, the trust level of the second core network node is higher than or equal to the first trust level, the second data packet is a sub-packet obtained by fragmenting the data packet of the service by the terminal device except the first data packet, the second data packet is sent by a third network device to the second core network node, the first trust level is higher than a fifth trust level of the third network device, and the data packet of the service comprises the forwarding policy. Applied to a terminal device, the method comprises:

9. A data transmission method, characterized by, Obtaining a first trust level of a current service and a forwarding policy of a first data packet of the service; the forwarding policy of the first data packet comprises at least one of the following: not accepting degraded transmission of trust level, accepting degraded transmission of trust level, fragmenting the first data packet and sending the fragmented sub-packet to a core network node when the trust level cannot be met, and the minimum trust level that can be accepted when accepting degraded transmission of trust level; Obtaining a third trust level of a first network device; According to the first trust level, the forwarding policy and the third trust level, the first data packet is sent to the first network device. ​ 10. The method of claim 9, wherein, Before acquiring the first trust level of the current service and the forwarding policy of the first data packet of the service, the method further comprises: receiving a first message sent by the first network device, wherein the first message comprises the third trust level; storing the third trust level; wherein the third trust level is determined by the first core network node according to first configuration information of the first network device, a first signature of the first configuration information, and a configuration policy of an operator.

11. The method of claim 10, wherein, After storing the third trust level, the method further comprises: accessing a network and sending, to a control plane node of a network side through the first network device, registration signaling, wherein the registration signaling comprises a trust quality service policy of the terminal device and a minimum trust level required by the terminal device, and the trust quality service policy is used to determine a data forwarding policy for an application on the terminal device, and the application comprises a target application corresponding to the service; receiving a fourth message forwarded by the first network device and from the control plane node, wherein the fourth message comprises a highest trust level provided by the network, and the fourth message is sent by the control plane node according to the trust quality service policy and the minimum trust level, or according to subscription information of the terminal device at the network side, and the highest trust level is used to determine that the target application can be used.

12. The method of claim 10, wherein: the first message comprises any one of a master information block (MIB), a system information block (SIB), a beacon, and control plane signaling from the first core network node.

13. The method of claim 11, wherein, After receiving the fourth message forwarded by the first network device and from the control plane node, the method further comprises: sending, to the first core network node through the first network device, a second message comprising location information of the terminal device, a reference network device identifier, and a fourth trust level of the terminal device, wherein the second message is used to request the first core network node to determine, from reference network devices, a target network device accessible by the terminal device according to the fourth trust level, the location information, and trust levels of the reference network devices; and wherein the reference network devices comprise network devices within a range determined based on the location information, and the reference network device identifier is used to indicate the reference network devices.

14. The method of claim 13, wherein, the first message comprises control plane signaling from the first core network node, and the receiving the first message sent by the first network device comprises: receiving control plane signaling from the first core network node and forwarded by the first network device, wherein the control plane signaling from the first core network node comprises an identifier and a trust level of the target network device; wherein the target network device comprises the first network device.

15. The method of claim 11, wherein, the forwarding policy comprises at least one of: when the first trust level is lower than or equal to the third trust level, sending the first data packet to the first network device; when the first trust level is higher than the third trust level and the service accepts degraded transmission, sending the first data packet to the first network device; when the first trust level is higher than the third trust level, not sending the first data packet to the first network device; when the first trust level is higher than the third trust level, fragmenting the first data packet, sending sub-packets obtained by fragmenting to core network nodes with trust levels higher than or equal to the first trust level by using different paths, so that the core network nodes combine the sub-packets to restore the first data packet and send the first data packet to the next hop; and when the first trust level is higher than the third trust level and the third trust level is higher than or equal to the minimum trust level that can be adopted by the first data packet, sending the first data packet to the first network device. The first data packet is a sub-packet obtained by fragmenting a data packet of the service by the terminal device; 16. The method of claim 15, wherein, After receiving the fourth message from the control plane node forwarded by the first network device, the method further comprises: obtaining a fifth trust level of a third network device, the fifth trust level being obtained according to a fifth message sent by the third network device; if the first trust level is higher than the third trust level and the fifth trust level, fragmenting a data packet of the service to obtain the first data packet and a second data packet, the second data packet being a sub-packet obtained by fragmenting the data packet of the service by the terminal device except the first data packet, the data packet of the service including the forwarding policy; The method further comprises: sending the second data packet to the third network device according to the first trust level, the forwarding policy and the fifth trust level. Before receiving the first message sent by the first network device, the method further comprises:

17. The method of claim 16, wherein, determining the trust level of the application according to a trust level classification in preset second trust level configuration information, the second trust level configuration information including the trust level service policy; determining the data forwarding policy of the application according to the trust level service policy and the trust level of the application; The fourth trust level of the terminal device is determined according to the trust level classification. Before determining the trust level of the application according to the trust level classification in the second trust level configuration information, the method further comprises:

18. The method of claim 17, wherein, sending second configuration information and a second signature of the second configuration information to the first core network node through the first network device; ​ receive the second trust quality configuration information from the first core network node forwarded by the first network device, the second trust quality configuration information being determined by the first core network node according to the second signature, the second configuration information and a configuration policy of an operator, and the second trust quality configuration information including the fourth trust quality level.

19. A data transmission apparatus, characterized by comprising: The apparatus applied to a first network device comprises a first transceiving unit and a first processing unit. The first transceiving unit is configured to receive a first data packet from a terminal device, the first data packet including a first trust quality level of a service corresponding to the first data packet and a forwarding policy of the first data packet; and the forwarding policy of the first data packet includes at least one of the following: no acceptance of trust quality level degradation transmission, acceptance of trust quality level degradation transmission, fragmentation of the first data packet and sending sub-packets obtained by fragmentation to a core network node when the trust quality level cannot be met, and a lowest trust quality level that can be accepted when the trust quality level degradation transmission is accepted. The first processing unit is configured to obtain a second trust quality level of a second network device. The first processing unit is further configured to send the first data packet to the second network device according to the first trust quality level, the second trust quality level and the forwarding policy.

20. A data transmission apparatus, characterized by comprising: The apparatus applied to a terminal device comprises an obtaining unit, a third transceiving unit and a third processing unit. The obtaining unit is configured to obtain a first trust quality level of a current service and a forwarding policy of a first data packet of the service; and the forwarding policy of the first data packet includes at least one of the following: no acceptance of trust quality level degradation transmission, acceptance of trust quality level degradation transmission, fragmentation of the first data packet and sending sub-packets obtained by fragmentation to a core network node when the trust quality level cannot be met, and a lowest trust quality level that can be accepted when the trust quality level degradation transmission is accepted. The obtaining unit is further configured to obtain a third trust quality level of a first network device. The processing unit is further configured to call the third transceiving unit to send the first data packet to the first network device according to the first trust quality level, the forwarding policy and the third trust quality level.

21. A first network device, comprising: A computer program product comprising a computer readable storage medium having program code stored therein, the program code configured to cause a processor to perform the method of any of claims 1-8.

22. A terminal device, comprising: A computer program product comprising a computer readable storage medium having program code stored therein, the program code configured to cause a processor to perform the method of any of claims 9-18.

23. A computer-readable storage medium, characterized in that, The computer readable storage medium stores program code for execution by a device, the program code comprising program code for implementing the method of any of claims 1-8.

24. A computer-readable storage medium, characterized in that, The computer readable storage medium stores program codes for execution by a device, the program codes comprising program codes for implementing the method of any of claims 9-18.

25. A computer program product, characterised in that, When the computer program product is run by a first network device, the first network device is caused to perform the method of any of claims 1-8.

26. A computer program product, characterised in that, When the computer program product is run by a terminal device, the terminal device is caused to perform the method of any of claims 9-18.

Images