A data traceability method, apparatus, electronic device, and readable storage medium

Abstract

The application provides a data tracing method and device, electronic equipment and readable storage medium. The data tracing method comprises the following steps: when an original data packet enters a current network transmission from a first device, inserting entry mark information into the original data packet to obtain a marked data packet, the entry mark information being used for tracing the original data packet; and transmitting the marked data packet in the current network. In the application, a marked data packet with tracing information is constructed, so that in a subsequent tracing process, the first device position and the data packet sending source of the original data packet can be directly obtained from the marked data packet, without needing to perform reverse routing tracing step by step, time consumption of the tracing is shortened, and the process is simple and has low complexity.

Description

Technical Field

[0001] The present invention relates to the field of data traceability technology, and in particular to a data traceability method, apparatus, electronic device and readable storage medium. Background Technology

[0002] In incidents such as Distributed Denial of Service (DDoS), Advanced Persistent Threat (APT), or remote control Trojans, the attacks, data breaches, and public opinion surges are all based on data packets. From the perspective of the attacked host and social media platform, these data packets can be observed. If the source of these data packets can be traced, the sending host can be located, and the person behind the host can be identified. This allows for not only taking defensive measures at appropriate locations but also pursuing legal action against the perpetrator. Therefore, attribution of data packets is crucial in cyberspace.

[0003] Currently, most existing solutions have drawbacks such as requiring step-by-step reverse routing for tracing, complex tracing process, slow tracing speed, easy identification and destruction of marking information, limited length and content of marking information, restriction of data packet transport layer protocol to only a specific protocol, high network overhead, and high technical implementation complexity. Summary of the Invention

[0004] This invention provides a data tracing method, apparatus, electronic device, and readable storage medium to solve the problem of slow tracing speed caused by the complexity of existing tracing processes that require step-by-step reverse routing.

[0005] To solve the above-mentioned technical problems, the present invention is implemented as follows:

[0006] In a first aspect, embodiments of the present invention provide a data tracing method, applied to a first device, comprising:

[0007] When the original data packet enters the current network for transmission from the first device, entry tag information is inserted into the original data packet to obtain a tagged data packet, and the entry tag information is used to trace the source of the original data packet.

[0008] The tagged data packet is transmitted in the current network.

[0009] Optionally, the entry marking information includes at least the following information:

[0010] The source MAC address, the downstream port number into the first device, the upstream port MAC address and IP address of the original data packet are contained in the original data packet.

[0011] Optionally, inserting entry marker information into the original data packet to obtain a marked data packet includes:

[0012] The entry marker information is encrypted to obtain encrypted entry marker information;

[0013] The encrypted entry tag information is inserted into the transport layer payload of the original data packet to obtain a new transport layer payload;

[0014] The position information of the entry mark information in the transport layer payload is determined based on the insertion position of the entry mark information in the transport layer payload and the length of the entry mark information;

[0015] The location information is encrypted to obtain encrypted location information;

[0016] The encrypted location information is inserted into the optional field of the IP header of the original data packet;

[0017] Encrypt the new transport layer payload to obtain the transport layer payload of the tagged data packet;

[0018] The length information in the IP header and transport layer header of the marked data packet is modified according to the length of the marked data packet to obtain the marked data packet.

[0019] Secondly, embodiments of the present invention provide a data tracing method, applied to a second device, comprising:

[0020] When a tagged data packet leaves the current network from the second device, the tagged data packet is parsed to obtain ingress tag information and the original data packet. Egress tag information is obtained locally from the second device. The ingress tag information and the egress tag information are used to trace the source of the original data packet.

[0021] The entry marker information, the original data packet, and the exit marker information are sent to the traceability management platform.

[0022] Optionally, the export marking information includes at least the following information:

[0023] The original data packet contains the destination MAC address, the downstream port number that sent the original data packet, the upstream port MAC address that received the marked data packet, and the IP address.

[0024] Optionally, parsing the marked data packet to obtain ingress marker information and the original data packet includes:

[0025] Extract the location information of the encrypted ingress tag information in the transport layer payload from the optional fields of the IP header of the tagged data packet;

[0026] Decrypt the encrypted entry marker information to obtain the location information in the transport layer payload;

[0027] Based on the location information, the insertion position of the entry marker information in the transport layer payload and the length of the entry marker information are obtained;

[0028] Obtain the encrypted transport layer payload containing the ingress tag information from the tagged data packet;

[0029] Decrypt the encrypted transport layer payload containing the ingress marker information to obtain the transport layer payload containing the ingress marker information;

[0030] Based on the insertion position of the ingress marker information in the transport layer payload and the length information of the ingress marker information, the encrypted ingress marker information is extracted from the transport layer payload to obtain the encrypted ingress marker information and the transport layer payload of the original data packet;

[0031] Decrypt the encrypted entry marker information to obtain the entry marker information;

[0032] Based on the length of the data packet after extracting the entry marker information, modify the length information in the IP header and transport layer header of the marked data packet to obtain the original data packet.

[0033] Optionally, the step of parsing the marked data packets to obtain ingress marking information and the original data packets, and obtaining egress marking information locally from the second device, further includes:

[0034] The original data packet is sent to the next hop, which includes at least one of the following: a receiver, a security device, a destination host, and a network boundary access point device of another network segment.

[0035] Thirdly, embodiments of the present invention provide a data tracing method, including:

[0036] Receive ingress marker information, raw data packets, and egress marker information sent by the second device;

[0037] A tracing record is created based on the ingress marker information, the original data packet, and the egress marker information. The tracing record is used to trace the origin of the original data packet.

[0038] Optionally, creating a tracing record based on the ingress marker information, the original data packet, and the egress marker information includes:

[0039] Determine the hash value of the transport layer payload based on the transport layer payload of the original data packet;

[0040] Based on the hash value, check if there is a source record corresponding to the hash value;

[0041] If no traceability record corresponding to the hash value exists, a traceability record corresponding to the hash value is created based on the entry marker information, the original data packet, and the exit marker information.

[0042] If a traceability record corresponding to the hash value exists, then a new traceability record is added after the traceability record corresponding to the hash value based on the entry marker information, the original data packet, and the exit marker information.

[0043] Optional, also includes:

[0044] When a request to query the source record of the original data packet is received from a third device, the source record corresponding to the hash value is searched according to the hash value, wherein the request contains the hash value of the transport layer payload of the original data packet;

[0045] Based on the source tracing records, determine the query results;

[0046] The query results are sent to the third device.

[0047] Optionally, determining the query result based on the source tracing record includes:

[0048] Based on the tracing record corresponding to the hash value, determine the entry marker information corresponding to the original data packet;

[0049] If the IP address contained in the entry tag information is a public IP address, or if the IP address contained in the entry tag information is an internal IP address and the original data packet is only transmitted within the internal network, the entry tag information is sent as a query result to the third device.

[0050] If the IP address contained in the entry marker information is an internal network IP address and is transmitted across the public network, the internal network tracing record in the tracing record will be sent as the query result to the third device.

[0051] Optionally, determining the query result based on the source tracing record includes:

[0052] Based on all the traceability records corresponding to the hash value, determine all the entry marker information and all the exit marker information corresponding to the original data packet;

[0053] Based on all ingress and egress markers corresponding to the original data packet, reconstruct the end-to-end transmission path of the original data packet;

[0054] The end-to-end transmission path of the original data packet is sent as a query result to the third device.

[0055] Optional, also includes:

[0056] Set a timing device for the tracing record corresponding to each hash value;

[0057] When a traceability record corresponding to a hash value is updated or queried, the timer corresponding to the traceability record corresponding to the hash value is reset.

[0058] When the timer corresponding to the traceability record exceeds the preset retention time, or when a notification to delete the traceability record is received from a third device, the traceability record is deleted.

[0059] Fourthly, embodiments of the present invention provide a data traceability device, applied to a first device, comprising:

[0060] An insertion module is used to insert entry marker information into the original data packet when the original data packet enters the current network transmission from the first device to obtain a marked data packet. The entry marker information is used to trace the source of the original data packet.

[0061] A transmission module for transmitting the tagged data packets in the current network.

[0062] Fifthly, embodiments of the present invention provide a data traceability device, applied to a second device, comprising:

[0063] The parsing module is used to parse the marked data packet when it leaves the current network from the second device to obtain ingress marking information and the original data packet, and to obtain egress marking information from the second device locally. The ingress marking information and the egress marking information are used to trace the source of the original data packet.

[0064] The reporting module is used to send the entry marker information, the original data packet, and the exit marker information to the traceability management platform.

[0065] Sixthly, embodiments of the present invention provide a data traceability device applied to a traceability management platform, comprising:

[0066] The receiving module is used to receive ingress marker information, raw data packets, and egress marker information sent by the second device;

[0067] The generation module is used to create a tracing record based on the ingress marker information, the original data packet, and the egress marker information. The tracing record is used to trace the origin of the original data packet.

[0068] In a sixth aspect, embodiments of the present invention provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the data tracing method as described in the first aspect above; or, when the program is executed by the processor, it implements the steps of the data tracing method as described in the second aspect above; or, when the program is executed by the processor, it implements the steps of the data tracing method as described in the third aspect above.

[0069] In a seventh aspect, embodiments of the present invention provide a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the steps of the data tracing method as described in the first aspect above; or, when the computer program is executed by a processor, it implements the steps of the data tracing method as described in the second aspect above; or, when the computer program is executed by a processor, it implements the steps of the data tracing method as described in the third aspect above.

[0070] In this embodiment of the invention, when the original data packet enters the current network from the first device for transmission, a marked data packet is obtained by inserting entry marker information, thus constructing a marked data packet with injected tracing information. The marked data packet is then transmitted in the current network, so that in the subsequent tracing process, the location of the first device and the source of the original data packet can be directly obtained from the marked data packet, without the need for step-by-step reverse routing tracing, thus shortening the tracing time. The implementation process is simple and has low complexity. Attached Figure Description

[0071] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0072] Figure 1 This is a flowchart of a data tracing method applied to a first device provided by an embodiment of the present invention;

[0073] Figure 2 This is an overall flowchart of a data tracing method provided in an embodiment of the present invention;

[0074] Figure 3 This is a schematic diagram of the structure of a labeled data packet provided in an embodiment of the present invention;

[0075] Figure 4 This is a schematic diagram illustrating the principle of a labeled data packet construction process provided in an embodiment of the present invention;

[0076] Figure 5This is a flowchart of a data tracing method applied to a second device provided by an embodiment of the present invention;

[0077] Figure 6 This is a schematic diagram of the structure of a network boundary access point device provided in an embodiment of the present invention;

[0078] Figure 7 This is a flowchart illustrating a data traceability method applied to a traceability management platform, as provided in an embodiment of the present invention.

[0079] Figure 8 This is a schematic diagram of the data traceability process of a traceability management platform provided in an embodiment of the present invention;

[0080] Figure 9 This is a schematic diagram of a traceability record management process provided by an embodiment of the present invention;

[0081] Figure 10 This is a schematic diagram of a processing flow for receiving a query request sent by a third device, provided by an embodiment of the present invention;

[0082] Figure 11 This is a schematic diagram of a process for deleting traceability records provided in an embodiment of the present invention;

[0083] Figure 12 This is a schematic diagram of another process for deleting trace records provided in an embodiment of the present invention;

[0084] Figure 13 This is a schematic diagram of the processing flow of a traceability management platform provided in an embodiment of the present invention;

[0085] Figure 14 This is a schematic diagram of the structure of a data traceability device applied to a first device according to an embodiment of the present invention;

[0086] Figure 15 This is a schematic diagram of a data traceability device applied to a second device according to an embodiment of the present invention;

[0087] Figure 16 This is a schematic diagram of the structure of a data traceability device applied to a traceability management platform according to an embodiment of the present invention;

[0088] Figure 17 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0089] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0090] Please refer to Figure 1 and Figure 2 This invention provides a data tracing method applied to a first device, comprising:

[0091] Step 11: When the original data packet enters the current network for transmission from the first device, entry tag information is inserted into the original data packet to obtain a tagged data packet. The entry tag information is used to trace the origin of the original data packet.

[0092] Step 12: Transmit the tagged data packet in the current network.

[0093] In this embodiment of the invention, when the original data packet enters the current network from the first device for transmission, a marked data packet is obtained by inserting entry marker information, thus constructing a marked data packet with injected tracing information. The marked data packet is then transmitted in the current network, so that in the subsequent tracing process, the location of the first device and the source of the original data packet can be directly obtained from the marked data packet, without the need for step-by-step reverse routing tracing, thus shortening the tracing time. The implementation process is simple and has low complexity.

[0094] Please refer to Figure 3 In one embodiment, the entry marking information includes at least the following information:

[0095] The source MAC address, the downstream port number into the first device, the upstream port MAC address and IP address of the original data packet are contained in the original data packet.

[0096] Please refer to Figure 3 In this embodiment of the invention, the source Media Access Control (MAC) address (6 bytes), the downstream port number of the original data packet entering the device (1 byte), and the upstream port MAC address and IP address (4 bytes) of the device sending the tag data packet can be combined as entry tag information, wherein the length of the entry tag information is 6+1+6+4=17 bytes.

[0097] Optionally, in addition to the information mentioned above, users can select or add entry marker information according to their needs.

[0098] This invention provides a method for composing entry marker information. By composing the marker information in this invention, it is possible to trace the source of the original data packet with less marker information. Furthermore, the inserted entry marker information is not limited by the content listed in this invention, making the application scope of this invention wider and the application scenarios more diverse.

[0099] Please refer to Figure 3 and Figure 4 In one embodiment, the step of inserting entry marker information into the original data packet to obtain a marked data packet further includes:

[0100] The entry marker information is encrypted to obtain encrypted entry marker information;

[0101] The encrypted entry tag information is inserted into the transport layer payload of the original data packet to obtain a new transport layer payload;

[0102] The position information of the entry mark information in the transport layer payload is determined based on the insertion position of the entry mark information in the transport layer payload and the length of the entry mark information;

[0103] The location information is encrypted to obtain encrypted location information;

[0104] The encrypted location information is inserted into the optional field of the IP header of the original data packet;

[0105] Encrypt the new transport layer payload to obtain the transport layer payload of the tagged data packet;

[0106] The length information in the IP header and transport layer header of the marked data packet is modified according to the length of the marked data packet to obtain the marked data packet.

[0107] In this embodiment of the invention, optionally, the entry marker information can be encrypted using a symmetric encryption key. For example, the length of the encrypted entry marker information can be recorded as K bytes, where the storage length of the K value is 1 byte.

[0108] In an embodiment of the present invention, optionally, when inserting the encrypted entry mark information into the payload of the original data packet transport layer, the insertion position can be randomly determined. For example, the insertion position is recorded as the Nth byte starting from the position of the first byte of the IP packet header, where the position of the first byte of the IP packet header is 0, and N is the insertion position (the storage length of N is 2 bytes).

[0109] It is worth noting that the embodiments of the present invention provide a way to insert entry marker information into optional fields of the IP packet header and transport layer payload. However, the marker information in the embodiments of the present invention can also be inserted into other positions, such as the transport layer protocol header, and can still solve the technical problems in the embodiments of the present invention.

[0110] In this embodiment of the invention, optionally, when determining the position information of the ingress marker information in the transport layer payload, the binary values ​​of N and K can be concatenated (with a length of 3 bytes) as the insertion position information of the ingress marker information. Of course, in this embodiment of the invention, the values ​​of the optional fields in the IP header can also be replaced with other information instead of the insertion position and length.

[0111] In this embodiment of the invention, optionally, the location information can be encrypted using the same symmetric key. For example, the length of the encrypted location information is M bytes. If the encrypted location information and entry marker information inserted into the data packet are encrypted using AES-128, it is only 50 bytes (1 byte for optional field type in the IP header, 1 byte for length, 16 bytes for encrypted location information, and 32 bytes for encrypted entry marker information in the transport layer payload). Moreover, there is no need to send a separate data packet for transmitting the marker information, which does not increase the number of packets sent or additional network overhead. Therefore, the network overhead of the tracing process performed through this embodiment of the invention is low.

[0112] In this embodiment of the invention, optionally, when inserting the encrypted location information into the optional field of the IP header, the optional field type can be 229, represented in binary as 0b11100101, occupying 1 byte, and the optional field length is M+2 bytes (occupying 1 byte). Of course, the optional field type value is not limited to 229; this is merely one embodiment, and other unused type values ​​can also be used. Furthermore, the optional field type is not unique in other embodiments of the invention. It is worth noting that the length of the inserted marker information is not limited by the length of the optional field in the header. Since the length of the optional field in the IP header is limited to 40 bytes, and only encrypted insertion location information is inserted into the optional field (its length is 3 bytes when unencrypted, and 16 bytes after encryption if AES-128 is used, which does not exceed the limit), the encrypted entry marker information is inserted into the transport layer payload with unrestricted length, offering greater flexibility.

[0113] In this embodiment of the invention, optionally, when encrypting the new transport layer payload to obtain the transport layer payload of the marked data packet, the entire transport layer payload after inserting the ingress marker information can be encrypted using the same symmetric key. The encrypted data serves as the transport layer payload of the new marked data packet. Simultaneously, the length information in the IP header and transport layer header of the marked data packet is modified according to the length of the marked data packet. It is worth noting that in this embodiment of the invention, the insertion position of the encrypted ingress marker information in the transport layer payload is random, and the entire transport layer payload is transmitted after encryption. The insertion position information is also encrypted and stored in the optional field of the IP header, making it difficult to identify the inserted ingress marker information. Therefore, the marker information inserted through this embodiment of the invention has high concealment and better security.

[0114] In an embodiment of the present invention, optionally, after completing the processing of the above-mentioned marked data packets, the marked data packets with the inserted source information (entry mark information) are finally sent to the current network for transmission.

[0115] It is worth noting that, since network transmission devices at most parse the IP packet header to obtain the destination IP address for forwarding the marked data packet, they do not parse the encrypted transport layer payload. Furthermore, the IP layer and transport layer headers of the marked data packet conform to standard protocols and are compatible with existing network transmission devices. Therefore, the marked data packet in this embodiment can be transmitted and forwarded normally within the network. In addition, the location and length of the inserted traceability information in this embodiment are flexible, and the traceability information, insertion location and length, and the entire transport layer payload are all encrypted. Therefore, the traceability information is relatively concealed and can effectively avoid detection and destruction.

[0116] This invention provides a data tracing method applied to a first device. When the original data packet enters the current network, the first device flexibly injects encrypted tracing mark information, as well as encryption position and length information, into the optional fields of the IP header and the transport layer payload of the original data packet. By inserting encrypted tracing information at random positions in the transport layer payload of the original data packet, it solves the problem of existing solutions inserting fixed-length mark information at fixed positions in the data packet, which is easily identified and attacked, lacks sufficient concealment, and thus destroys the tracing information. Inserting encrypted tracing information into the optional fields of the IP header, with its insertion position and length, solves the problem of existing solutions only inserting mark information into the optional fields of the header, which limits the length and content of the tracing information. Furthermore, in this embodiment of the invention, the insertion position of the entry marker information is limited to optional fields in the IP packet header and the transport layer payload, and does not involve the transport layer protocol. Therefore, it is applicable to any transport layer protocol above IP (such as TCP and UDP). Moreover, the transport layer payload after inserting the source information is encrypted again, thereby constructing a marked data packet injected with source information. It also solves the problems in the prior art where embedding the marker information into the inter-data packet delay IPD sequence leads to high technical difficulty in synchronization between the communicating parties, susceptibility to unstable network environments, and increased implementation complexity and overhead of the synchronization mechanism. It does not require increasing the complexity of the synchronization mechanism algorithm and transmission overhead, so it is not easily affected by noise interference such as jitter and delay in the network, has high stability, and low technical complexity.

[0117] Please refer to Figure 2 and Figure 5 This invention also provides a data tracing method, applied to a second device, comprising:

[0118] Step 21: When the tagged data packet leaves the current network from the second device, the tagged data packet is parsed to obtain the ingress tag information and the original data packet, and the egress tag information is obtained locally from the second device. The ingress tag information and the egress tag information are used to trace the source of the original data packet.

[0119] Step 22: Send the entry marker information, the original data packet, and the exit marker information to the traceability management platform.

[0120] In this embodiment of the invention, when a tagged data packet leaves the current network from the second device, the tagged data packet is acquired, parsed to obtain ingress tagged information and the original data packet, and egress tagged information is obtained locally from the second device. Finally, the ingress tagged information, the original data packet, and the egress tagged information are sent to the traceability management platform. This embodiment of the invention, by sending the information used for traceability to the traceability management platform, enables the platform to directly obtain the location of the first device and the source of the original data packet from the tagged data packet during the subsequent traceability process. This eliminates the need for step-by-step reverse routing for traceability, shortens the traceability time, and simplifies the process with low complexity.

[0121] Please refer to Figure 6 It is worth noting that, optionally, in this embodiment of the invention, the functions of the first device and the second device can both be implemented by the network boundary access point device. In other words, the network access point device simultaneously possesses the functional modules of both the first and second devices. That is, when a data packet enters the network, the network boundary access point device uses the first device's functional module; when the data packet leaves the network, the network boundary access point device uses the second device's functional module. Therefore, the first device and the second device can be considered two different manifestations of the same network boundary access point device. The network boundary access point device can be an upgraded or modified switch, router, P4 programmable switch, or other data forwarding device. Of course, the functions of the first device and the second device can also be performed by different network boundary access point devices within the current network, rather than by the same network boundary access point device.

[0122] The network boundary access point device in this embodiment of the invention can be upgraded from existing devices such as switches and routers without hardware modification, making it easy to implement. Since the tagged data packets injected with traceability information conform to the processing rules of existing transmission devices, the existing transmission devices are compatible and can process them. Therefore, only the network boundary access point device needs to be deployed at the boundary of each network, and the original transmission devices can be used inside the network. For example, only the switches and routers at the network boundary need to be upgraded or replaced, and the devices inside the network do not need to be upgraded or replaced. Furthermore, the network boundary access point device can be deployed gradually, and the traceability path and scope can be expanded gradually. It does not require the deployment of all nodes in the entire network and end-to-end transmission path to be effective. The network boundary can also be expanded gradually, which is cost-effective. This solves the problem in the existing technical solution that requires the replacement of all nodes in the entire network or end-to-end transmission path with traceability routers, resulting in high investment costs and the inability to successfully trace data packets in some deployments.

[0123] Please refer to Figure 4 In one embodiment, the export marking information includes at least the following information:

[0124] The original data packet contains the destination MAC address, the downstream port number that sent the original data packet, the upstream port MAC address that received the marked data packet, and the IP address.

[0125] Please refer to Figure 3 In this embodiment of the invention, the uplink port MAC address (6 bytes), IP address (4 bytes), destination MAC address (6 bytes) in the original data packet, and downlink port number (1 byte) of the original data packet can be combined to form the exit tag information, wherein the length of the exit tag information is 6+1+6+4=17 bytes.

[0126] Optionally, in addition to the information mentioned above, export marking information can be selected or added by the user according to their needs.

[0127] This invention provides a method for composing export marking information. By using the method for composing marking information in this invention, it is possible to trace the source of the original data packet by obtaining less marking information. Furthermore, the export marking information is not limited by the content listed in this invention, making the application scope of this invention wider and the application scenarios more diverse.

[0128] Please refer to Figure 3 and Figure 4 In one embodiment, parsing the marked data packet to obtain ingress marker information and the original data packet includes:

[0129] Extract the location information of the encrypted ingress tag information in the transport layer payload from the optional fields of the IP header of the tagged data packet;

[0130] Decrypt the encrypted entry marker information to obtain the location information in the transport layer payload;

[0131] Based on the location information, the insertion position of the entry marker information in the transport layer payload and the length of the entry marker information are obtained;

[0132] Obtain the encrypted transport layer payload containing the ingress tag information from the tagged data packet;

[0133] Decrypt the encrypted transport layer payload containing the ingress marker information to obtain the transport layer payload containing the ingress marker information;

[0134] Based on the insertion position of the ingress marker information in the transport layer payload and the length information of the ingress marker information, the encrypted ingress marker information is extracted from the transport layer payload to obtain the encrypted ingress marker information and the transport layer payload of the original data packet;

[0135] Decrypt the encrypted entry marker information to obtain the entry marker information;

[0136] Based on the length of the data packet after extracting the entry marker information, modify the length information in the IP header and transport layer header of the marked data packet to obtain the original data packet.

[0137] In this embodiment of the invention, optionally, when retrieving the location information of the encrypted ingress marker information in the transport layer payload from the optional fields of the IP header of the marked data packet, for example, the optional field of type 229 in the optional fields of the IP header can be retrieved, and the optional field can be deleted from the IP header to retrieve the encrypted location information of length M.

[0138] In this embodiment of the invention, optionally, if the location information is encrypted using a symmetric key, the encrypted location information is decrypted using the symmetric key. For example, the insertion position N and length K in the encrypted entry mark information are restored.

[0139] In this embodiment of the invention, optionally, if the transport layer payload is encrypted using a symmetric key, the entire transport layer payload is decrypted using the symmetric key to obtain the transport layer payload containing the entry marker information.

[0140] In this embodiment of the invention, optionally, based on the insertion position N and length K of the ingress marker information, a portion of K consecutive bytes starting from the Nth byte (position 0) of the IP packet header is extracted and the transport layer payload of the original data packet is restored.

[0141] In this embodiment of the invention, optionally, the extracted K bytes of data are the encrypted entry marker information, which is decrypted using a symmetric key to obtain the entry marker information, wherein the length of the entry marker information is 17 bytes.

[0142] In this embodiment of the invention, optionally, since the transmission may cross network segments and Network Address Translation (NAT), the MAC and IP may change, but the transport layer load remains unchanged and the data packet does not contain any marking information, and is still called the original data packet. Therefore, the length information in the IP packet header and the transport layer packet header can be modified according to the length of the recovered data packet, and the original data packet can be restored.

[0143] In this embodiment of the invention, when a data packet leaves the current network, the second device parses the marked data packet to obtain entry marking information and the original data packet. Through the parsing method in this embodiment of the invention, the location of the first device and the source of the data packet can be directly obtained, resulting in fast tracing and high reliability.

[0144] Please refer to Figure 3 and Figure 4 In one embodiment, the step of parsing the marked data packet to obtain ingress marking information and the original data packet, and obtaining egress marking information locally from the second device, further includes:

[0145] The original data packet is sent to the next hop, which includes at least one of the following: a receiver, a security device, a destination host, and a network boundary access point device of another network segment.

[0146] In this embodiment of the invention, optionally, the device sends the original data packet, entry marker information, and exit marker information to the traceability management platform (one can be deployed across the entire network), and simultaneously sends the original data packet to the next hop. This eliminates the need to send additional data packets, complex processing algorithms, and detection methods, greatly reducing the time required for traceability.

[0147] In this embodiment of the invention, when a data packet leaves the current network, the second device decrypts and parses the source tracing marker information, updates the exit information, restores the original data packet, and sends the original data packet to the next hop (such as the receiver, security device, or the next network segment boundary access point device). Simultaneously, the original data packet and the source tracing marker information are sent to the source tracing management platform. That is, the second device only needs to store the encryption / decryption key, without needing to store and manage source tracing records. This reduces storage space usage and solves the problem in existing technologies where valuable local storage resources of the source tracing router are required to store source tracing records, and where the performance overhead of the source tracing router is consumed in managing source tracing records.

[0148] Please refer to Figure 2 , Figure 7 and Figure 8 This invention also provides a data traceability method applied to a traceability management platform, comprising:

[0149] Step 31: Receive the ingress marker information, raw data packet, and egress marker information sent by the second device;

[0150] Step 32: Create a tracing record based on the ingress marker information, the original data packet, and the egress marker information. The tracing record is used to trace the origin of the original data packet.

[0151] In this embodiment of the invention, a tracing record is created based on the ingress marker information, the original data packet, and the egress marker information obtained from the second device. The centralized storage of the tracing record on the tracing management platform solves the problem in existing technologies where valuable local storage resources of the tracing router are required to store the tracing record, thus avoiding the performance overhead of managing the tracing record. It also solves the problems of distributed segmented storage of tracing records, which leads to long tracing times due to the need for step-by-step reverse path reconstruction, and the inability to complete tracing if some tracing routers fail. This results in lower network bandwidth overhead, less storage space occupied on the second device, and eliminates the need for step-by-step reverse routing for tracing. It directly obtains the network boundary access point location and data packet sending source, resulting in fast tracing speed, high reliability, and no need for complex processing algorithms and detection methods, significantly reducing tracing time. Furthermore, it solves the problem that existing technical solutions require the deployment of a constructed proxy program on the sending device, which cannot completely eliminate the sender's awareness of the process and poses a risk of the proxy program being deliberately damaged or attacked, thus making it impossible to trace the source. The embodiments of the present invention do not require the deployment of a proxy program on the data packet sending source device, and the tracing process is completely transparent to the original data sender, thereby greatly reducing the risk of being attacked after being discovered, thus making it impossible to trace the source.

[0152] Please refer to Figure 8 In one embodiment, creating a tracing record based on the ingress marker information, the original data packet, and the egress marker information includes:

[0153] Determine the hash value of the transport layer payload based on the transport layer payload of the original data packet;

[0154] Based on the hash value, check if there is a source record corresponding to the hash value;

[0155] If no traceability record corresponding to the hash value exists, a traceability record corresponding to the hash value is created based on the entry marker information, the original data packet, and the exit marker information.

[0156] If a traceability record corresponding to the hash value exists, then a new traceability record is added after the traceability record corresponding to the hash value based on the entry marker information, the original data packet, and the exit marker information.

[0157] In this embodiment of the invention, the traceability management platform extracts the transport layer payload of the original data packet and calculates its hash value. It can be seen that the original data packet at the inlet and the original data packet at the outlet have the same transport layer payload and the same hash value. That is, the original data packets at the inlet and the outlet can be considered equivalent and are the same data. Therefore, the hash value can uniquely identify the data transmitted in the network.

[0158] In this embodiment of the invention, optionally, if there is no traceability record corresponding to the HASH value, a new traceability record with a tag number of 1 is created. The traceability record content includes the HASH value, entry tag information, original data packet, and exit tag information. Further, optionally, the traceability record content can be [HASH value, entry tag information, exit tag information, tag number]. If there is already a traceability record, a new traceability record can be added directly, and its tag number is the current maximum tag number plus 1.

[0159] In this embodiment of the invention, using the HASH value as a unique identifier for data transmitted in the network can avoid inaccurate traceability records, ensure the correspondence between the created traceability records and data packets, and thus make the traceability results more reliable.

[0160] Please refer to Figure 9 In one embodiment, it further includes:

[0161] When a request to query the source record of the original data packet is received from a third device, the source record corresponding to the hash value is searched according to the hash value, wherein the request contains the hash value of the transport layer payload of the original data packet;

[0162] Based on the source tracing records, determine the query results;

[0163] The query results are sent to the third device.

[0164] In this embodiment of the invention, optionally, when a third device (e.g., a destination host or security device) discovers that the original data packet contains abnormal events, such as attack behavior characteristics, data leakage behavior characteristics, and public opinion events, the third device may calculate the HASH value of the transport layer payload of the original data packet and send it to the traceability management platform to request a query of the traceability record and then trace the source of the data packet.

[0165] In this embodiment of the invention, by receiving a query request from a third device to query the source tracing record, and then sending the query result obtained from the source tracing record to the third device, the data packet can be traced in a timely manner based on the warning from the third device, and the source tracing is performed by the source tracing management platform. This results in low network bandwidth overhead and less storage space occupied by the network boundary access point device.

[0166] Please refer to Figure 9 In one embodiment, determining the query result based on the tracing record further includes:

[0167] Based on the tracing record corresponding to the hash value, determine the entry marker information corresponding to the original data packet;

[0168] If the IP address contained in the entry tag information is a public IP address, or if the IP address contained in the entry tag information is an internal IP address and the original data packet is only transmitted within the internal network, the entry tag information is sent as a query result to the third device.

[0169] If the IP address contained in the entry marker information is an internal network IP address and is transmitted across the public network, the internal network tracing record in the tracing record will be sent as the query result to the third device.

[0170] Furthermore, this embodiment of the invention also provides a method for determining query results based on tracing records. Optionally, the tracing record with a marker number of 1 is searched based on the HASH value in the request. If the IP address in the entry marker information is a public IP address, the data packet sending source device can be directly traced, and the platform sends the entry marker information as a query result to a third device (destination host or security device). If it is an internal IP address and only internal network transmission is performed, the data packet sending source device can be directly traced, and the platform sends the entry marker information as a query result to a third device (destination host or security device).

[0171] Optionally, if the IP address contained in the entry marking information is an internal network IP address and is transmitted across the public network, the internal network tracing records in the tracing records are searched. Specifically, starting from the tracing record with mark number 2, the first tracing record in the entry marking information whose IP is a public network IP (mark number n) is searched. The entry access point device corresponding to this record is the node that performs NAT translation. Then, the source of the original data packet is traced from the public network to the internal network in segments, and finally traced back to the data packet sending source device. The platform sends the tracing records with mark numbers from 1 to n as the query result to the third device (destination host or security device).

[0172] In this embodiment of the invention, based on the traceability records stored in the traceability management platform, the record marked with sequence number 1 in the traceability records of the corresponding data can be directly queried to the starting access point device and the data packet sending source device. If the transmission path crosses the intranet and the public network, it can also be directly traced to the public network entry point (i.e., the NAT translation node), tracing segment by segment to the starting access point device and the data packet sending source device, without having to trace back from the endpoint to the starting point step by step. This solves the problem in the existing technical solutions that when tracing data packets, it is necessary to query the traceability information from the traceability manager to the traceability router one by one from the endpoint, and the traceability path information needs to be established step by step in reverse, resulting in long traceability time. The traceability data process in this embodiment of the invention has low complexity and is faster. It also solves the problem in the existing technical solutions that it is necessary to construct and send N additional identity data packets for data packet traceability, which leads to an increase in the amount of data sent, high overhead, and consumption of more network bandwidth.

[0173] In one embodiment, determining the query result based on the tracing record includes:

[0174] Based on all the traceability records corresponding to the hash value, determine all the entry marker information and all the exit marker information corresponding to the original data packet;

[0175] Based on all ingress and egress markers corresponding to the original data packet, reconstruct the end-to-end transmission path of the original data packet;

[0176] The end-to-end transmission path of the original data packet is sent as a query result to the third device.

[0177] This invention also provides a method for restoring the complete end-to-end data transmission path based on all traceability records of the HASH value. The transmission path established by this invention is more accurate and simple to implement with low complexity.

[0178] Please refer to Figure 10 , Figure 11 and Figure 12 In one embodiment, it further includes:

[0179] Set a timing device for the tracing record corresponding to each hash value;

[0180] When a traceability record corresponding to a hash value is updated or queried, the timer corresponding to the traceability record corresponding to the hash value is reset.

[0181] When the timer corresponding to the traceability record exceeds the preset retention time, or when a notification to delete the traceability record is received from a third device, the traceability record is deleted.

[0182] In this embodiment of the invention, optionally, if the original data packet does not contain attack behavior characteristics, data leakage behavior characteristics, or public opinion events, then under certain conditions, an update or query timer can be set for a set of tracing records corresponding to each HASH value. Each time a tracing record is updated or queried, the timer is reset. If no tracing record is queried or updated after the timer exceeds a preset retention time (different retention times can be configured for different levels of tracing records), it indicates that this set of tracing records will no longer be updated or queried. Alternatively, the tracing management platform may receive a notification message from the final destination receiving device or security device of the data packet to delete the tracing record, and the tracing management platform can delete the corresponding tracing record. Through the tracing scheme in this embodiment of the invention, even if some network boundary access point devices on the transmission path fail or the tracing management platform lacks tracing records for certain intermediate paths, it does not affect the tracing of the data packet's sending source, resulting in higher reliability and making this embodiment of the invention easier to implement.

[0183] By continuously deleting unnecessary traceability records in this embodiment, storage space can be saved and reused, thereby improving space utilization.

[0184] Furthermore, the port connection information of the first and second devices (network boundary access point devices) in the entire network stored by the traceability management platform can be used in conjunction with the traceability records to trace the original data packets more clearly and precisely. By comparing and associating the port connection information with the traceability records, physical and logical connection information within and between networks can be further obtained.

[0185] Please refer to Figure 13 and Figure 14 This invention also provides a data traceability device 40, applied to a first device, comprising:

[0186] Insertion module 41 is used to insert entry marker information into the original data packet when the original data packet enters the current network transmission from the first device to obtain a marked data packet, wherein the entry marker information is used to trace the source of the original data packet;

[0187] Transmission module 42 is used to transmit the tagged data packet in the current network.

[0188] In this embodiment of the invention, optionally, the entry marking information includes at least the following information:

[0189] The source MAC address, the downstream port number into the first device, the upstream port MAC address and IP address of the original data packet are contained in the original data packet.

[0190] In this embodiment of the invention, the insertion module 41 includes:

[0191] An insertion submodule is used to encrypt the entry marker information to obtain encrypted entry marker information;

[0192] The encrypted entry tag information is inserted into the transport layer payload of the original data packet to obtain a new transport layer payload;

[0193] The position information of the entry mark information in the transport layer payload is determined based on the insertion position of the entry mark information in the transport layer payload and the length of the entry mark information;

[0194] The location information is encrypted to obtain encrypted location information;

[0195] The encrypted location information is inserted into the optional field of the IP header of the original data packet;

[0196] Encrypt the new transport layer payload to obtain the transport layer payload of the tagged data packet;

[0197] The length information in the IP header and transport layer header of the marked data packet is modified according to the length of the marked data packet to obtain the marked data packet.

[0198] The data traceability device for the first device provided in this embodiment of the invention can achieve Figure 1 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0199] Please refer to Figure 13 and Figure 15 This invention also provides a data traceability device 50, applied to a second device, comprising:

[0200] The parsing module 51 is used to parse the marked data packet when the marked data packet leaves the current network from the second device to obtain ingress marking information and the original data packet, and to obtain egress marking information from the second device locally, wherein the ingress marking information and the egress marking information are used to trace the source of the original data packet;

[0201] The reporting module 52 is used to send the entry marker information, the original data packet and the exit marker information to the traceability management platform.

[0202] In this embodiment of the invention, the export marking information includes at least the following information:

[0203] The original data packet contains the destination MAC address, the downstream port number that sent the original data packet, the upstream port MAC address that received the marked data packet, and the IP address.

[0204] In this embodiment of the invention, the parsing module 51 includes:

[0205] The parsing submodule is used to extract the location information of the encrypted ingress marker information in the transport layer payload from the optional fields of the IP header of the marked data packet;

[0206] Decrypt the encrypted entry marker information to obtain the location information in the transport layer payload;

[0207] Based on the location information, the insertion position of the entry marker information in the transport layer payload and the length of the entry marker information are obtained;

[0208] Obtain the encrypted transport layer payload containing the ingress tag information from the tagged data packet;

[0209] Decrypt the encrypted transport layer payload containing the ingress marker information to obtain the transport layer payload containing the ingress marker information;

[0210] Based on the insertion position of the ingress marker information in the transport layer payload and the length information of the ingress marker information, the encrypted ingress marker information is extracted from the transport layer payload to obtain the encrypted ingress marker information and the transport layer payload of the original data packet;

[0211] Decrypt the encrypted entry marker information to obtain the entry marker information;

[0212] Based on the length of the data packet after extracting the entry marker information, modify the length information in the IP header and transport layer header of the marked data packet to obtain the original data packet.

[0213] In this embodiment of the invention, the data traceability device 50 further includes:

[0214] The first sending module is used to send the original data packet to the next hop, wherein the next hop includes at least one of the following: a receiver, a security device, a destination host, and a network boundary access point device of another network segment.

[0215] The data traceability device for a second device provided in this embodiment of the invention can achieve... Figure 5 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0216] Please refer to Figure 13 and Figure 16 This invention also provides a data traceability device 60, applied to a traceability management platform, comprising:

[0217] The receiving module 61 is used to receive the ingress marker information, raw data packets and egress marker information sent by the second device;

[0218] The generation module 62 is used to create a tracing record based on the entry marker information, the original data packet, and the exit marker information. The tracing record is used to trace the origin of the original data packet.

[0219] In this embodiment of the invention, the generation module 62 includes:

[0220] A generation submodule is used to determine the hash value of the transport layer payload based on the transport layer payload of the original data packet;

[0221] Based on the hash value, check if there is a source record corresponding to the hash value;

[0222] If no traceability record corresponding to the hash value exists, a traceability record corresponding to the hash value is created based on the entry marker information, the original data packet, and the exit marker information.

[0223] If a traceability record corresponding to the hash value exists, then a new traceability record is added after the traceability record corresponding to the hash value based on the entry marker information, the original data packet, and the exit marker information.

[0224] In this embodiment of the invention, the data traceability device 60 further includes:

[0225] The second sending module is used to, when receiving a request from a third device to query the source record of the original data packet, search for the source record corresponding to the hash value based on the hash value, wherein the request includes the hash value of the transport layer payload of the original data packet;

[0226] Based on the source tracing records, determine the query results;

[0227] The query results are sent to the third device.

[0228] In this embodiment of the invention, the second sending module includes:

[0229] The first result module is used to determine the entry marker information corresponding to the original data packet based on the tracing record corresponding to the hash value;

[0230] If the IP address contained in the entry tag information is a public IP address, or if the IP address contained in the entry tag information is an internal IP address and the original data packet is only transmitted within the internal network, the entry tag information is sent as a query result to the third device.

[0231] If the IP address contained in the entry marker information is an internal network IP address and is transmitted across the public network, the internal network tracing record in the tracing record will be sent as the query result to the third device.

[0232] In this embodiment of the invention, the second sending module includes:

[0233] The second result module is used to determine all entry marker information and all exit marker information corresponding to the original data packet based on all traceability records corresponding to the hash value.

[0234] Based on all ingress and egress markers corresponding to the original data packet, reconstruct the end-to-end transmission path of the original data packet;

[0235] The end-to-end transmission path of the original data packet is sent as a query result to the third device.

[0236] In this embodiment of the invention, the data traceability device 60 further includes:

[0237] The storage module is used to set a timing device for the traceability record corresponding to each hash value;

[0238] When a traceability record corresponding to a hash value is updated or queried, the timer corresponding to the traceability record corresponding to the hash value is reset.

[0239] When the timer corresponding to the traceability record exceeds the preset retention time, or when a notification to delete the traceability record is received from a third device, the traceability record is deleted.

[0240] The data traceability device for a traceability management platform provided in this embodiment of the invention can achieve... Figure 7 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0241] Please refer to Figure 13 The present invention also proposes a data traceability device comprising the aforementioned first device, second device, and traceability management platform. The data traceability device provided in this embodiment of the invention can achieve... Figure 13 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0242] This invention provides an electronic device 70, see [link to relevant documentation]. Figure 17 As shown, Figure 17 This is a schematic diagram of an electronic device 70 according to an embodiment of the present invention, including a processor 71, a memory 72, and a program or instructions stored in the memory 72 and executable on the processor 71. When the program or instructions are executed by the processor, they implement the steps in any of the data traceability methods of the present invention.

[0243] This invention provides a readable storage medium on which a program or instruction is stored. When the program or instruction is executed by a processor, it implements the various processes of the data tracing method embodiment described above and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0244] Computer-readable media include both permanent and non-permanent, removable and non-removable media, which can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0245] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0246] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0247] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a service classification device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0248] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A data traceability method, applied to a first device, characterized in that, The method comprises the following steps: When an original data packet enters a current network transmission from a first device, inserting entry mark information in the original data packet to obtain a marked data packet, the entry mark information being used for tracing the original data packet; Transmitting the marked data packet in the current network; The step of inserting the entry mark information in the original data packet to obtain the marked data packet comprises the following steps: Encrypting the entry mark information to obtain encrypted entry mark information; Inserting the encrypted entry mark information into a transport layer load of the original data packet to obtain a new transport layer load; Determining position information of the entry mark information in the transport layer load according to an insertion position of the entry mark information in the transport layer load and a length of the entry mark information; Encrypting the position information to obtain encrypted position information; Inserting the encrypted position information into an IP packet header optional field of the original data packet; Encrypting the new transport layer load to obtain a transport layer load of the marked data packet; According to a length of the marked data packet, modifying length information in an IP packet header and a transport layer packet header of the marked data packet to obtain the marked data packet.

2. The method of claim 1, wherein, The entry mark information at least comprises the following information: A source MAC address in the original data packet, a downlink port number of the first device through which the original data packet enters, a MAC address and an IP address of an uplink port through which the marked data packet is sent.

3. A data traceability method, applied to a second device, characterized in that, The method comprises the following steps: When a marked data packet leaves a current network transmission from a second device, analyzing the marked data packet to obtain entry mark information and an original data packet, and obtaining exit mark information from the second device locally, wherein the entry mark information and the exit mark information are used for tracing the original data packet; Sending the entry mark information, the original data packet and the exit mark information to a tracing management platform; The step of analyzing the marked data packet to obtain the entry mark information and the original data packet comprises the following steps: Taking out encrypted position information of the entry mark information in a transport layer load from an IP packet header optional field of the marked data packet; Decrypting the encrypted position information of the entry mark information in the transport layer load to obtain position information; According to the position information, obtaining an insertion position of the entry mark information in the transport layer load and a length of the entry mark information; Obtaining an encrypted transport layer load containing the entry mark information from the marked data packet; Decrypting the encrypted transport layer load containing the entry mark information to obtain a transport layer load containing the entry mark information; According to the insertion position of the entry mark information in the transport layer load and the length information of the entry mark information, taking out the encrypted entry mark information from the transport layer load to obtain encrypted entry mark information and a transport layer load of the original data packet; Decrypting the encrypted entry mark information to obtain the entry mark information; According to the data packet length after the entrance mark information is taken out, the length information in the IP message header and the transmission layer message header of the mark data packet is modified, and the original data packet is obtained.

4. The method of claim 3, wherein, The exit mark information at least includes the following information: The destination MAC address in the original data packet, the lower link port number of sending the original data packet, the upper link port MAC address of receiving the mark data packet, and the IP address.

5. The method of claim 3, wherein, The mark data packet is parsed to obtain the entrance mark information and the original data packet, and the exit mark information is obtained from the second device locally, and then further includes: The original data packet is sent to the next hop, and the next hop includes at least one of the following: receiver, security device, destination host and network boundary access point device of other network segment.

6. A data provenance method characterized by, Applied to a traceability management platform, comprising: Receiving the entrance mark information, the original data packet and the exit mark information sent by the second device; According to the entrance mark information, the original data packet and the exit mark information, a traceability record is created, and the traceability record is used for tracing the original data packet; Wherein, the entrance mark information and the original data packet are obtained by the following way: The position information of the encrypted entrance mark information in the transmission layer load is taken out from the IP message header optional field of the mark data packet; The encrypted entrance mark information in the transmission layer load is decrypted to obtain the position information; According to the position information, the insertion position of the entrance mark information in the transmission layer load and the length of the entrance mark information are obtained; The encrypted transmission layer load containing the entrance mark information is obtained from the mark data packet; The encrypted transmission layer load containing the entrance mark information is decrypted to obtain the transmission layer load containing the entrance mark information; According to the insertion position of the entrance mark information in the transmission layer load and the length information of the entrance mark information, the encrypted entrance mark information is taken out from the transmission layer load to obtain the encrypted entrance mark information and the transmission layer load of the original data packet; The encrypted entrance mark information is decrypted to obtain the entrance mark information; According to the data packet length after the entrance mark information is taken out, the length information in the IP message header and the transmission layer message header of the mark data packet is modified, and the original data packet is obtained.

7. The method of claim 6, wherein, The creation of the traceability record according to the entrance mark information, the original data packet and the exit mark information includes: According to the transmission layer load of the original data packet, the hash value of the transmission layer load is determined; According to the hash value, it is determined whether there is a traceability record corresponding to the hash value; If there is no traceability record corresponding to the hash value, a traceability record corresponding to the hash value is created according to the entrance mark information, the original data packet and the exit mark information; If there is a traceability record corresponding to the hash value, a new traceability record is added after the traceability record corresponding to the hash value according to the entrance mark information, the original data packet and the exit mark information.

8. The method of claim 6, wherein, Further comprising: When receiving a request for querying the original data packet trace record sent by a third device, the hash value is used to search for the trace record corresponding to the hash value, wherein the request contains the hash value of the transport layer load of the original data packet; According to the trace record, a query result is determined; The query result is sent to the third device.

9. The method of claim 8, wherein, The determination of the query result according to the trace record comprises: According to the trace record corresponding to the hash value, the entry mark information corresponding to the original data packet is determined; If the IP address contained in the entry mark information is a public network IP address, or the IP address contained in the entry mark information is an intranet IP address and the original data packet is only transmitted in the intranet, the entry mark information is sent to the third device as the query result; If the IP address contained in the entry mark information is an intranet IP address and is transmitted across the public network, the trace record of the intranet in the trace record is sent to the third device as the query result.

10. The method of claim 8, wherein, The determination of the query result according to the trace record comprises: According to all the trace records corresponding to the hash value, all the entry mark information and all the exit mark information corresponding to the original data packet are determined; According to all the entry mark information and all the exit mark information corresponding to the original data packet, the end-to-end transmission path of the original data packet is restored; The end-to-end transmission path of the original data packet is sent to the third device as the query result.

11. The method of claim 6, wherein, Further comprising: A timing device is set for each trace record corresponding to the hash value; When the trace record corresponding to the hash value is updated or queried, the timer corresponding to the trace record is reset; When the timer corresponding to the trace record exceeds the preset retention time, or a notification of deleting the trace record sent by the third device is received, the trace record is deleted. 12.A data provenance apparatus applied to a first device, characterized in that, Comprise: An insertion module is used for inserting entry mark information into the original data packet to obtain a marked data packet when the original data packet enters the current network transmission from a first device, and the entry mark information is used for tracing the original data packet; A transmission module is used for transmitting the marked data packet in the current network; The insertion module comprises: An insertion sub-module is used for encrypting the entry mark information to obtain encrypted entry mark information; The encrypted entry mark information is inserted into the transport layer load of the original data packet to obtain a new transport layer load; According to the insertion position of the entry mark information in the transport layer load and the length of the entry mark information, the position information of the entry mark information in the transport layer load is determined; The position information is encrypted to obtain encrypted position information; The encrypted position information is inserted into the optional field of the IP packet header of the original data packet; The new transport layer load is encrypted to obtain the transport layer load of the marked data packet; According to the length of the marked data packet, the length information in the IP packet header and the transport layer packet header of the marked data packet is modified to obtain the marked data packet. 13.A data provenance apparatus applied to a second device, characterized in that, Comprise: The analysis module is configured to analyze the marked data packet when the marked data packet leaves the current network from the second device, to obtain entry marking information and an original data packet, and to obtain exit marking information locally from the second device, wherein the entry marking information and the exit marking information are used for tracing the original data packet; The reporting module is configured to send the entry marking information, the original data packet, and the exit marking information to a tracing management platform; The analysis module includes: The analysis submodule is configured to obtain position information of encrypted entry marking information in a transport layer load from an IP packet header optional field of the marked data packet; The position information of the encrypted entry marking information in the transport layer load is decrypted to obtain position information; According to the position information, an insertion position of the entry marking information in the transport layer load and a length of the entry marking information are obtained; The encrypted transport layer load containing the entry marking information is obtained from the marked data packet; The encrypted transport layer load containing the entry marking information is decrypted to obtain a transport layer load containing the entry marking information; According to the insertion position of the entry marking information in the transport layer load and the length information of the entry marking information, the encrypted entry marking information is obtained from the transport layer load, and a transport layer load of the original data packet is obtained; The encrypted entry marking information is decrypted to obtain the entry marking information; According to the length of the data packet after the entry marking information is obtained, length information in an IP packet header and a transport layer packet header of the marked data packet is modified to obtain an original data packet.

14. A data provenance apparatus, characterized in that, The application is applied to a tracing management platform, and includes: The receiving module is configured to receive entry marking information, an original data packet, and exit marking information sent by a second device; The generating module is configured to create a tracing record according to the entry marking information, the original data packet, and the exit marking information, wherein the tracing record is used for tracing the original data packet; The entry marking information and the original data packet are obtained by the following method: Position information of encrypted entry marking information in a transport layer load is obtained from an IP packet header optional field of a marked data packet; The position information of the encrypted entry marking information in the transport layer load is decrypted to obtain position information; According to the position information, an insertion position of the entry marking information in the transport layer load and a length of the entry marking information are obtained; The encrypted transport layer load containing the entry marking information is obtained from the marked data packet; The encrypted transport layer load containing the entry marking information is decrypted to obtain a transport layer load containing the entry marking information; According to the insertion position of the entry marking information in the transport layer load and the length information of the entry marking information, the encrypted entry marking information is obtained from the transport layer load, and a transport layer load of the original data packet is obtained; decrypt the encrypted entry mark information to obtain the entry mark information; modify the length information in the IP message header and the transmission layer message header of the mark data packet according to the length of the data packet after the entry mark information is taken out, to obtain an original data packet.

15. An electronic device, comprising: comprise: a processor, a memory, and a program stored on the memory and executable on the processor, the program being executed by the processor to implement the steps of the data provenance method according to any one of claims 1 to 2; or the program being executed by the processor to implement the steps of the data provenance method according to any one of claims 3 to 5; or the program being executed by the processor to implement the steps of the data provenance method according to any one of claims 6 to 11.

16. A computer-readable storage medium, characterized in that, a computer program is stored on a computer readable storage medium, the computer program being executed by a processor to implement the steps of the data provenance method according to any one of claims 1 to 2; or the computer program being executed by a processor to implement the steps of the data provenance method according to any one of claims 3 to 5; or the computer program being executed by a processor to implement the steps of the data provenance method according to any one of claims 6 to 11.

Images