A data transmission method, apparatus, device, and storage medium

Abstract

The application discloses a data transmission method and device, equipment and storage medium, relates to the field of data transmission, and comprises the following steps: a target VPC collects data through an internal device, and sends an online request message determined based on an encrypted IP address to a cloud security platform through a preset shared port for verification; the preset shared port is a port shared by multiple VPCs; if the verification is successful, a confirmation online message obtained from the cloud security platform is verified, and after the verification is successful, an online establishment message determined based on the identifier of the target VPC is sent to the cloud security platform through the preset shared port for verification operation; if the verification is successful, data is transmitted to the cloud security platform through the preset shared port for processing. According to the application, one port is shared by multiple VPCs, the number of exposed ports is reduced, network resources are saved, the risk of being attacked is reduced, and the security of data transmission is ensured by encrypting the IP address of the internal device.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data transmission, and in particular to a data transmission method, device, equipment and storage medium. BACKGROUND

[0002] In the process of private cloud network construction, network security service SaaS (Software-as-a-Service, software as a service) is gradually evolving, and providing network security service on the cloud can bring users a convenient experience. Data aggregation in different dimensions and through large screens can enable users to clearly and intuitively understand the security status of assets, such as log auditing, database auditing and other security products that can collect a large amount of basic data for security operation. However, due to the existence of VPC (Virtual Private Cloud), it is necessary to distinguish the business of tenant network and meet the security requirements of data security. Different business data can only open a few ports for transmission.

[0003] In the prior art, when transmitting multiple types of business data from the internal network to the external network, multiple different IPs and ports are often opened for transmission. Using multiple IPs and ports means that independent network resources need to be allocated for each IP and port, which will cause waste of network resources and lead to network congestion and performance degradation. In addition, each IP and port needs to be independently secured, and once a security vulnerability occurs in one of the IPs or ports, attackers can exploit this vulnerability to attack the entire network system. In addition, since each IP and port needs to be maintained independently, the maintenance cost is increased, especially when a large number of IPs and ports need to be maintained, which will waste a lot of manpower and time. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a data transmission method, device, equipment and storage medium, which can share one port by multiple VPCs, reduce the number of externally exposed ports, save network resources, reduce the risk of attack, and ensure the security of data transmission by encrypting the IP addresses of internal devices. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a data transmission method applied to a target VPC, comprising:

[0006] Collecting load data through an internal device, and sending an online request message determined based on an encrypted internal device IP address to a cloud security platform through a preset shared port, so that the cloud security platform performs a verification operation on the online request message; the preset shared port is a port shared by multiple VPCs;

[0007] If the cloud security platform successfully checks the online request message, a confirmation online message obtained from the cloud security platform is checked, and after the checking is successful, an online establishment message determined based on the identification of the target VPC is sent to the cloud security platform through the preset common port, so that the cloud security platform checks the online establishment message.

[0008] If the cloud security platform successfully checks the online establishment message, the load data is transmitted to the cloud security platform through the preset common port, so that the cloud security platform processes the load data based on the identification of the target VPC.

[0009] Optionally, the sending of the online request message determined based on the encrypted internal device IP address to the cloud security platform through the preset common port comprises:

[0010] An internal device IP address corresponding to the internal device is obtained, and the internal device IP address is symmetrically encrypted by using a key file to obtain an encrypted internal device IP address;

[0011] The encrypted internal device IP address is added to a first preset field of the online request message, and the added online request message is sent to the cloud security platform through the preset common port.

[0012] Optionally, before the symmetric encryption of the internal device IP address by using the key file, the method further comprises:

[0013] The key file generated and issued by the cloud security platform is obtained.

[0014] Optionally, the checking operation of the cloud security platform on the online request message comprises:

[0015] The cloud security platform symmetrically decrypts the encrypted internal device IP address in the first preset field of the added online request message by using the key file to obtain a decrypted internal device IP address;

[0016] The cloud security platform judges whether the decrypted internal device IP address is consistent with the source address of the added online request message, and if so, sends a confirmation online message to the target VPC.

[0017] Optionally, the sending of the online establishment message determined based on the identification of the target VPC to the cloud security platform through the preset common port comprises:

[0018] The identification of the target VPC is added to a second preset field of the online establishment message to obtain an added online establishment message;

[0019] send the added online establishment message to the cloud security platform through the preset common port.

[0020] Optionally, the transmitting the load data to the cloud security platform through the preset common port comprises:

[0021] determining a characteristic field based on a service data type corresponding to the load data, and processing the load data by using the characteristic field and a separator to obtain processed load data;

[0022] transmitting the processed load data to the cloud security platform through the preset common port.

[0023] Optionally, the cloud security platform processes the load data based on the identification of the target VPC, comprising:

[0024] The cloud security platform acquires the identification of the target VPC in a second preset field of the added online establishment message, so as to determine the target VPC corresponding to the processed load data based on the identification, and to obtain the load data and the characteristic field by analyzing the processed load data, and then to determine the service data type corresponding to the characteristic field;

[0025] The cloud security platform performs a processing operation corresponding to the service data type on the load data to obtain a processing result, and aggregates and displays the processing result.

[0026] In a second aspect, the application provides a data transmission device applied to a target VPC, comprising:

[0027] The request message sending module is configured to collect load data through an internal device, and transmit an online request message determined based on an encrypted internal device IP address to a cloud security platform through a preset common port, so that the cloud security platform performs a verification operation on the online request message; the preset common port is a port shared by multiple VPCs.

[0028] The establishment message sending module is configured to, if the cloud security platform successfully verifies the online request message, verify a confirmation online message acquired from the cloud security platform, and after successful verification, transmit an online establishment message determined based on an identification of the target VPC to the cloud security platform through the preset common port, so that the cloud security platform performs a verification operation on the online establishment message.

[0029] The data transmission module is configured to, if the cloud security platform successfully checks the online establishment message, transmit the load data to the cloud security platform through the preset shared port, so that the cloud security platform processes the load data based on the identifier of the target VPC.

[0030] In a third aspect, the present application provides an electronic device, comprising:

[0031] a memory configured to store a computer program;

[0032] a processor configured to execute the computer program to implement the data transmission method described above.

[0033] In a fourth aspect, the present application provides a computer readable storage medium configured to store a computer program, which, when executed by a processor, implements the data transmission method described above.

[0034] In the present application, the load data is collected by an internal device, and an online request message determined based on the encrypted internal device IP address is sent to the cloud security platform through a preset shared port, so that the cloud security platform performs a checking operation on the online request message; the preset shared port is a port shared by multiple VPCs; if the cloud security platform successfully checks the online request message, a confirmation online message obtained from the cloud security platform is checked, and after the checking is successful, an online establishment message determined based on the identifier of the target VPC is sent to the cloud security platform through the preset shared port, so that the cloud security platform performs a checking operation on the online establishment message; if the cloud security platform successfully checks the online establishment message, the load data is transmitted to the cloud security platform through the preset shared port, so that the cloud security platform processes the load data based on the identifier of the target VPC. As can be seen, the present application transmits messages and data through a port shared by multiple VPCs, reduces the number of externally exposed ports, saves network resources and maintenance costs, reduces the risk of attack, and ensures the security of data transmission by encrypting the internal device IP address. In addition, the present application inserts the VPC identifier in the message, so that data from different VPCs can be distinguished according to the VPC identifier. BRIEF DESCRIPTION OF DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor based on the provided drawings.

[0036] Figure 1 A data transmission method flow chart disclosed by the present application;

[0037] Figure 2 A data transmission channel establishment structure chart disclosed by the present application;

[0038] Figure 3 A TCP syn packet transmission logic chart disclosed by the present application;

[0039] Figure 4 A specific data transmission method flow chart disclosed by the present application;

[0040] Figure 5 A data transmission device structure schematic diagram disclosed by the present application;

[0041] Figure 6 An electronic equipment structure chart disclosed by the present application. DETAILED DESCRIPTION

[0042] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0043] In the prior art, when the internal network transmits various service type data to the external network, multiple different IPs and ports are often opened for transmission, and independent network resources need to be allocated for each IP and port and independent security protection needs to be performed. Therefore, the present application provides a data transmission method, which can share one port by multiple VPCs, reduce the number of exposed ports, save network resources, reduce the risk of attack, and ensure the security of data transmission by encrypting the IP address of the internal device.

[0044] Referring to Figure 1 The embodiment of the present application discloses a data transmission method, applied to a target VPC, comprising:

[0045] Step S11: Collecting load data through an internal device, and sending an online request packet determined based on an encrypted internal device IP address to a cloud security platform through a preset shared port, so that the cloud security platform performs a verification operation on the online request packet; the preset shared port is a port shared by multiple VPCs.

[0046] In this embodiment, a VPC internally contains multiple PC devices, and each PC device is installed with a collection plug-in for collecting data. If the data collected by the devices inside the VPC is to be transmitted to the cloud security platform SaaS service, a reliable data transmission channel needs to be established. Figure 2 As shown in the figure, the VPC transmits all the messages and the data collected by the collection plug-in to the near-security-product side of the channel establishment module through the near-source side of the channel establishment module, and then sends them to the cloud security platform. Essentially, the channel establishment module is equivalent to setting a preset common port to uniformly forward all the messages and the data collected by the collection plug-in. It should be noted that the preset common port is a port shared by multiple VPCs. In this way, the number of open ports can be reduced, and network resources can be saved. In addition, the preset common port provides TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) for transmitting data; and only the specified devices can connect to the preset common port, and other devices cannot connect to the preset common port at will even if they know the port. Specifically, the establishment of TCP and UDP connections can be supported by setting the communication protocol and port in the nginx configuration file.

[0047] In this embodiment, the sending of the online request message determined based on the encrypted internal device IP address to the cloud security platform through the preset common port can include obtaining the internal device IP address corresponding to the internal device, and symmetrically encrypting the internal device IP address by using a key file to obtain an encrypted internal device IP address; adding the encrypted internal device IP address to the first preset field of the online request message, and sending the added online request message to the cloud security platform through the preset common port. Further, before symmetrically encrypting the internal device IP address by using the key file, it further includes obtaining the key file generated and distributed by the cloud security platform. As shown in the figure, Figure 3 To ensure the security of data transmission and the legality of online establishment, the security authentication module of the cloud security platform generates and distributes a key file to the target VPC, where the target VPC is any one of the multiple VPCs, and the cloud security platform manages all SaaS security products. After obtaining the key file, the target VPC symmetrically encrypts the internal device IP address by using the key file to obtain an encrypted internal device IP address, and places the encrypted internal device IP address in the Options field of the TCP syn online request message, and then sends the TCP syn online request message to the cloud security platform through the preset common port.

[0048] In the embodiment, the cloud security platform can perform the checking operation on the online request message, which can include that the cloud security platform performs symmetric decryption on the encrypted internal device IP address in the first preset field of the online request message after the addition by using the key file to obtain a decrypted internal device IP address; the cloud security platform judges whether the decrypted internal device IP address is consistent with the source address of the online request message after the addition, and if yes, sends a TCP ack confirmation online message to the target VPC. It can be understood that, as shown in Figure 3 After the cloud security platform obtains the TCP syn online request message sent by the target VPC, the cloud security platform performs symmetric decryption on the encrypted internal device IP address in the Options field by using the key file to obtain a decrypted internal device IP address. The decrypted internal device IP address is compared with the source address of the TCP syn online request message, and if they are consistent, it is determined that the connection initiator, i.e., the target VPC, is legal, and a TCP ack confirmation online message is sent to the target VPC; if they are inconsistent, it is determined that the connection initiator is illegal, and a reset is returned to reject the connection. In this way, the IP address of the VPC internal device is encrypted, and the decrypted IP address and the source address of the message are compared by the cloud security platform, so as to ensure the legality of online establishment and the security of data transmission.

[0049] In step S12, if the cloud security platform successfully checks the online request message, the cloud security platform checks a confirmation online message obtained from the cloud security platform, and after the checking is successful, sends an online establishment message determined based on the identifier of the target VPC to the cloud security platform through the preset common port, so that the cloud security platform performs a checking operation on the online establishment message.

[0050] In this embodiment, if the cloud security platform successfully verifies the TCP syn online request message, the cloud security platform sends a TCP ack confirmation online message to the target VPC, and the target VPC further verifies the TCP ack confirmation online message. If the target VPC successfully verifies the TCP ack confirmation online message, the target VPC sends a TCP syn+ack online establishment message based on the identification of the target VPC to the cloud security platform through a preset common port. Specifically, the sending of the online establishment message based on the identification of the target VPC to the cloud security platform through the preset common port can include adding the identification of the target VPC to a second preset field of the online establishment message to obtain an added online establishment message, and sending the added online establishment message to the cloud security platform through the preset common port. It can be understood that since multiple VPCs transmit messages and data through the preset common port, in order to distinguish data from different VPCs, the identification of the target VPC can be added to the Options field of the TCP syn+ack online establishment message, and then the TCP syn+ack online establishment message is sent to the cloud security platform through the preset common port. After the cloud security platform obtains the TCP syn+ack online establishment message, the cloud security platform verifies the TCP syn+ack online establishment message. If the verification fails, the connection between the target VPC and the cloud security platform cannot be established.

[0051] In step S13, if the cloud security platform successfully verifies the online establishment message, the cloud security platform transmits the load data to the cloud security platform through the preset common port, so that the cloud security platform processes the load data based on the identification of the target VPC.

[0052] In the embodiment, if the cloud security platform successfully checks the TCP syn+ack connection establishment message, the connection between the target VPC and the cloud security platform is completed, and then the target VPC transmits the load data to the cloud security platform through a preset common port. Specifically, the transmission of the load data to the cloud security platform through the preset common port can include determining a characteristic field based on the service data type corresponding to the load data, processing the load data by using the characteristic field and a delimiter to obtain processed load data, and transmitting the processed load data to the cloud security platform through the preset common port. It can be understood that the data collected by multiple devices in a VPC can also correspond to different service data types, such as log audit data and database audit data. In order to distinguish the data of different service data types, the characteristic field can be determined based on the service data type corresponding to the load data collected by the internal device, and then the characteristic field is added to the header of the load data and a delimiter is added to distinguish the characteristic field and the load data, thereby obtaining the processed load data. For example, the load data is 123, the corresponding service data type is log audit data, and then the characteristic field is determined to be logaudit, and the delimiter is determined to be == ==, and then the processed load data is logaudit == == 123, and then the processed load data logaudit == == 123 is transmitted to the cloud security platform through the preset common port. In this way, by adding the characteristic field and the delimiter to the data collected by the internal device of the VPC and then transmitting the data to the cloud security platform, the different service type data can be distinguished.

[0053] In the embodiment, the cloud security platform processes the load data based on the identifier of the target VPC, which can include that the cloud security platform acquires the identifier of the target VPC in the second preset field of the added connection establishment message, so as to determine the target VPC corresponding to the processed load data based on the identifier, and analyze the processed load data to obtain the load data and the characteristic field, and then determine the service data type corresponding to the characteristic field. The cloud security platform performs a processing operation corresponding to the service data type on the load data to obtain a processing result, and aggregates and displays the processing result. It can be understood that after the cloud security platform acquires the processed load data, the identifier of the target VPC in the Options field of the TCP syn+ack connection establishment message can be used to determine the source of the processed load data. Further, the cloud security platform analyzes the processed load data to obtain the real load data and the characteristic field, and the service data type corresponding to the characteristic field, so as to process the real load data accordingly, and aggregate and display the processing result for a user to view.

[0054] It can be seen that, on the one hand, the application transmits messages and data through multiple VPCs sharing one port, reduces the number of exposed ports, saves network resources and maintenance costs, and reduces the risk of attack; on the other hand, the application encrypts the IP addresses of internal devices, and the cloud security platform decrypts the encrypted IP addresses and compares them with the source addresses of online request messages, thereby ensuring the security of data transmission and the legality of online establishment; on the other hand, the application inserts VPC identifiers in the fields of online establishment messages, so that data from different VPCs can be distinguished according to the VPC identifiers, and the application adds a characteristic field and a separator to the load data, and then sends them to the cloud security platform, which can distinguish different types of data.

[0055] Referring to Figure 4 As shown in the drawings, the embodiment of the application discloses a data transmission method, wherein VPC1 and VPC2 collect load data through the collection plug-ins installed in their respective internal devices, and respectively obtain the key files generated and issued by the security authentication module of the cloud security platform, and use the key files to symmetrically encrypt the IP addresses of their respective internal devices to obtain encrypted internal device IP addresses, and put the encrypted internal device IP addresses into the Options fields of their respective TCP syn online request messages, and then send their respective TCP syn online request messages to the cloud security platform through a preset shared port. The cloud security platform uses the key files to respectively symmetrically decrypt the encrypted internal device IP addresses in the two Options fields to obtain decrypted internal device IP addresses, and then compares the decrypted internal device IP addresses with the source addresses of the corresponding TCP syn online request messages, and if they are consistent, it is determined that the connection initiator VPC1 and VPC2 are legal, and TCP ack confirmation online messages are respectively sent to VPC1 and VPC2.

[0056] VPC1 and VPC2 will further check the TCP ack confirmation connection message obtained respectively, if the TCP ack confirmation connection message is checked successfully, the VPC identifier of each VPC is added to the Options field of the TCP syn+ack connection establishment message, and then the TCP syn+ack connection establishment message is sent to the cloud security platform through the preset shared port. The cloud security platform checks two TCP syn+ack connection establishment messages, if the check is successful, the connection between VPC1 and the cloud security platform and the connection between VPC2 and the cloud security platform are completed. Then VPC1 and VPC2 will determine the characteristic field through the service data type corresponding to the respective load data, and add the characteristic field to the header of the respective load data, and add a delimiter to distinguish the characteristic field and the load data, so as to obtain the processed load data data1 and data2. VPC1 and VPC2 transmit the processed load data data1 and data2 to the cloud security platform through the preset shared port respectively, and the cloud security platform determines the source corresponding to the processed load data data1 and data2 through the identifier in the Options field of the TCP syn+ack connection establishment message from VPC1 and VPC2 after obtaining the processed load data data1 and data2, and then sends the identifier of VPC1 and data1 and the identifier of VPC2 and data2 into the service attribute processing module of the cloud security platform, so as to analyze the processed load data data1 and data2 respectively, obtain the real load data and the characteristic field, and the service data type corresponding to the characteristic field, so as to process the real load data according to the respective service data type, and aggregate and display the processing result, so as to be viewed by the user.

[0057] Therefore, on the one hand, the application transmits messages and data through multiple VPCs sharing one port, reduces the number of exposed ports, saves network resources and maintenance costs, and reduces the risk of being attacked; on the other hand, the application encrypts the IP address of the internal device, and the cloud security platform decrypts the encrypted IP address and compares it with the source address of the connection request message, thereby ensuring the security of data transmission and the legality of connection establishment; on the other hand, the application inserts the VPC identifier in the field of the connection establishment message, so that the data from different VPCs can be distinguished according to the VPC identifier, and the application adds the characteristic field and the delimiter to the load data before sending it to the cloud security platform, which can distinguish different service type data.

[0058] Referring to Figure 5 The embodiment of the application discloses a data transmission device applied to a target VPC, comprising:

[0059] The request message sending module 11 is configured to collect load data through an internal device, and send an online request message determined based on an encrypted internal device IP address to a cloud security platform through a preset shared port, so that the cloud security platform performs a verification operation on the online request message; the preset shared port is a port shared by multiple VPCs.

[0060] The establishment message sending module 12 is configured to, if the cloud security platform verifies the online request message successfully, verify a confirmation online message obtained from the cloud security platform, and after successful verification, send an online establishment message determined based on an identifier of the target VPC to the cloud security platform through the preset shared port, so that the cloud security platform performs a verification operation on the online establishment message.

[0061] The data transmission module 13 is configured to, if the cloud security platform verifies the online establishment message successfully, transmit the load data to the cloud security platform through the preset shared port, so that the cloud security platform processes the load data based on the identifier of the target VPC.

[0062] Therefore, the application can reduce the number of exposed ports, save network resources and maintenance costs, reduce the risk of attack, and ensure the security of data transmission by encrypting the internal device IP address. In addition, the application can distinguish data from different VPCs according to the VPC identifier by inserting the VPC identifier in the message.

[0063] In some embodiments, the request message sending module 11 can specifically include:

[0064] The IP address encryption unit is configured to obtain an internal device IP address corresponding to the internal device, and perform symmetric encryption on the internal device IP address using a key file to obtain an encrypted internal device IP address.

[0065] The first message sending unit is configured to add the encrypted internal device IP address to a first preset field of an online request message, and send the added online request message to the cloud security platform through a preset shared port.

[0066] In some embodiments, the data transmission device can further include:

[0067] The key file obtaining unit is configured to obtain a key file generated and distributed by the cloud security platform.

[0068] In some embodiments, the establishment message sending module 12 can specifically include:

[0069] an identification adding unit, configured to add an identification of the target VPC to a second preset field of the online establishment message to obtain an added online establishment message;

[0070] a second message sending unit, configured to send the added online establishment message to the cloud security platform through the preset shared port.

[0071] In some embodiments, the data transmission module 13 can specifically include:

[0072] a data processing unit, configured to determine a characteristic field based on a service data type corresponding to the load data, and process the load data by using the characteristic field and a separator to obtain processed load data;

[0073] a data transmission unit, configured to transmit the processed load data to the cloud security platform through the preset shared port.

[0074] Further, the embodiment of the present application further discloses an electronic device, Figure 6 is an electronic device 20 structure diagram shown according to an exemplary embodiment, the contents in the figure cannot be considered as any limitation on the use range of the present application.

[0075] Figure 6 A structure diagram of an electronic device 20 provided by the embodiment of the present application. The electronic device 20 can specifically include at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25 and a communication bus 26. Wherein, the memory 22 is used to store computer programs, the computer programs are loaded and executed by the processor 21 to realize the related steps in the data transmission method disclosed in any of the preceding embodiments. In addition, the electronic device 20 in the embodiment can be an electronic computer.

[0076] In the embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol followed by the communication interface 24 can be any communication protocol applicable to the technical solution of the present application, which is not limited here; the input / output interface 25 is used to obtain external input data or output data to the outside world, and the specific interface type can be selected according to the specific application needs, which is not limited here.

[0077] In addition, the memory 22 as the carrier of resource storage can be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., and the resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage mode can be temporary storage or permanent storage.

[0078] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including the computer program capable of completing the data transmission method performed by the electronic device 20 disclosed in any of the preceding embodiments, the computer program 222 can further include computer programs capable of completing other specific work.

[0079] Further, the present application also discloses a computer readable storage medium for storing a computer program; wherein the computer program is executed by a processor to implement the data transmission method disclosed above. For the specific steps of the method, please refer to the corresponding content disclosed in the preceding embodiments, which will not be repeated here.

[0080] The embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts of each embodiment can be referred to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part.

[0081] The skilled person can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of both. In order to clearly show the interchangeability of hardware and software, the composition and steps of each example have been described in the above description. Whether the functions are realized by hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0082] The steps of the method or algorithm described in combination with the embodiments disclosed herein can be directly implemented by hardware, software modules executed by a processor, or a combination of both. The software modules can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0083] Finally, it needs to be pointed out that in this document, relational terms such as first and second and the like can only be intended to distinguish one entity or operation from another entity or operation without necessarily requiring or implying any actual such relationship or order between such entities or operations. Moreover, the terms "comprising", "including", or any other variant thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, an element defined by the statement "comprising a" does not exclude the existence of additional identical elements in the process, method, article, or apparatus including the stated element.

[0084] The above describes the technical solutions provided by the present application in detail, and the principles and implementation manners of the present application are described by applying specific examples. The above description of the examples is only for helping to understand the method and core idea of the present application; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manners and application ranges can be changed, and the above description of the content of the specification should not be understood as a limitation of the present application.

Claims

1. A data transmission method, characterized by, Applied to a target VPC, comprising: Collecting load data through an internal device, and sending an online request message determined based on an encrypted internal device IP address to a cloud security platform through a preset shared port, so that the cloud security platform performs a verification operation on the online request message; the preset shared port is a port shared by multiple VPCs; If the cloud security platform successfully verifies the online request message, verifying an online confirmation message obtained from the cloud security platform, and after successful verification, sending an online establishment message determined based on the identifier of the target VPC to the cloud security platform through the preset shared port, so that the cloud security platform performs a verification operation on the online establishment message; If the cloud security platform successfully verifies the online establishment message, transmitting the load data to the cloud security platform through the preset shared port, so that the cloud security platform processes the load data based on the identifier of the target VPC; Wherein, the online establishment message determined based on the identifier of the target VPC is sent to the cloud security platform through the preset shared port, comprising: Add the identifier of the target VPC to the second preset field of the online establishment message to obtain the added online establishment message; send the added online establishment message to the cloud security platform through the preset shared port; Wherein, the load data is transmitted to the cloud security platform through the preset shared port, comprising: Determine a characteristic field based on the service data type corresponding to the load data, and process the load data using the characteristic field and a delimiter to obtain processed load data; transmit the processed load data to the cloud security platform through the preset shared port; Wherein, the cloud security platform processes the load data based on the identifier of the target VPC, comprising: The cloud security platform obtains the identifier of the target VPC in the second preset field of the added online establishment message, so as to determine the target VPC corresponding to the processed load data based on the identifier, and to analyze the processed load data to obtain the load data and the characteristic field, and then determine the service data type corresponding to the characteristic field; The cloud security platform performs a processing operation corresponding to the service data type on the load data to obtain a processing result, and aggregates and displays the processing result.

2. The data transmission method of claim 1, wherein, The online request message determined based on the encrypted internal device IP address is sent to the cloud security platform through the preset shared port, comprising: Obtain the internal device IP address corresponding to the internal device, and symmetrically encrypt the internal device IP address using a key file to obtain an encrypted internal device IP address; Add the encrypted internal device IP address to the first preset field of the online request message, and send the added online request message to the cloud security platform through the preset shared port.

3. The data transmission method of claim 2, wherein, Before the internal device IP address is symmetrically encrypted using the key file, further comprising: Obtain the key file generated and issued by the cloud security platform.

4. The data transmission method of claim 2, wherein, The cloud security platform performs a verification operation on the online request message, including: The cloud security platform uses the key file to perform symmetric decryption on the encrypted internal device IP address in the first preset field of the online request message after the addition, to obtain a decrypted internal device IP address; The cloud security platform judges whether the decrypted internal device IP address is consistent with the source address of the online request message after the addition, and if so, sends a confirmation online message to the target VPC.

5. A data transmission apparatus characterized by comprising: Applied to a target VPC, including: The request message sending module is configured to collect load data through an internal device, and send an online request message determined based on an encrypted internal device IP address to a cloud security platform through a preset common port, so that the cloud security platform performs a verification operation on the online request message; the preset common port is a port shared by multiple VPCs; The establishment message sending module is configured to, if the cloud security platform verifies the online request message successfully, verify a confirmation online message obtained from the cloud security platform, and after successful verification, send an online establishment message determined based on an identifier of the target VPC to the cloud security platform through the preset common port, so that the cloud security platform performs a verification operation on the online establishment message; The data transmission module is configured to, if the cloud security platform verifies the online establishment message successfully, transmit the load data to the cloud security platform through the preset common port, so that the cloud security platform processes the load data based on the identifier of the target VPC; The establishment message sending module is configured to add the identifier of the target VPC to a second preset field of the online establishment message to obtain an online establishment message after the addition, and send the online establishment message after the addition to the cloud security platform through the preset common port; The data transmission module is configured to determine a characteristic field based on a service data type corresponding to the load data, process the load data using the characteristic field and a delimiter to obtain processed load data, and transmit the processed load data to the cloud security platform through the preset common port; The data transmission module is configured to: the cloud security platform obtains the identifier of the target VPC in the second preset field of the online establishment message after the addition, so as to determine a target VPC corresponding to the processed load data based on the identifier, and analyze the processed load data to obtain the load data and the characteristic field, and then determine the service data type corresponding to the characteristic field; the cloud security platform performs a processing operation corresponding to the service data type on the load data to obtain a processing result, and aggregates and displays the processing result.

6. An electronic device, comprising: Including: A memory for saving a computer program; A processor for executing the computer program to implement the data transmission method of any one of claims 1 to 4.

7. A computer readable storage medium characterized by A computer program product for saving a computer program which, when executed by a processor, implements the data transmission method according to any one of claims 1 to 4.

Images