Method and device for transmitting data across network segments, program product and electronic equipment

Abstract

The invention discloses a cross-network-segment data transmission method and device, a program product and electronic equipment, and relates to the technical field of network security, and the method comprises the steps: transmitting target request information of a first network segment to a target queue, the target queue being a message queue deployed in the first network segment, and then transmitting the target request information of the first network segment to the target queue; and determining return data corresponding to the target request information in the target queue through the second network segment, the return data being data stored in the second network segment and needing to be transmitted to the first network segment, and then transmitting the return data to a target database, the target database being a memory database deployed in the first network segment. According to the method and the device, the technical problem of low data transmission security caused by the fact that data needs to be manually exported and copied from network segments in the prior art when data transmission is carried out between different network segments with network isolation is solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, program product, and electronic device for transmitting data across network segments. Background Art

[0002] With the popularization of the Internet and the development of network security technology, in order to improve the security of their own networks, enterprises will divide their networks into different network segments with different access rights, and set up network isolation between different network segments. For example, an enterprise divides its own network into a high network segment and a low network segment, wherein the data access rights of the high network segment are higher than the data access rights of the low network segment. In this case, the high network segment can directly access the low network segment, thereby obtaining the data in the low network segment, while the low network segment cannot directly access the high network segment. Therefore, the low network segment cannot obtain the data of the high network segment in real time. In the prior art, the data in the high network segment is usually manually exported by manual means, and then the exported data is copied to the low network segment. However, in the process of manually exporting and copying data, there is a risk of data leakage and tampering, which poses a potential threat to the security of the network and causes the problem of low data security during data transmission.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The present application provides a method, device, program product and electronic device for transmitting data across network segments, so as to at least solve the technical problem of low data transmission security caused by the need for manual export and copying of data from network segments when data is transmitted between different network segments with network isolation.

[0005] According to one aspect of the present application, a method for transmitting data across network segments is provided, including: transmitting target request information of a first network segment to a target queue, wherein the target request information of the first network segment is used to obtain data in a second network segment, the confidentiality level of the data in the second network segment is greater than the confidentiality level of the data in the first network segment, and the target queue is a message queue deployed in the first network segment; determining return data corresponding to the target request information in the target queue through the second network segment, wherein the return data is data stored in the second network segment and needs to be transmitted to the first network segment; and transmitting the return data to a target database, wherein the target database is a memory database deployed in the first network segment.

[0006] Optionally, before transmitting the target request information of the first network segment to the target queue, the method for transmitting data across network segments further includes: deploying the target queue and the target database to the first network segment; and controlling the second network segment to subscribe to the target queue.

[0007] Optionally, in the process of transmitting the target request information of the first network segment to the target queue, the method of transmitting data across network segments also includes: controlling the application in the first network segment to encapsulate the request information of the first network segment to obtain target request information, wherein the target request information includes at least a request address, a request type, a request method, request parameters and a request identifier; and transmitting the target request information to the target queue.

[0008] Optionally, in the process of determining the return data corresponding to the target request information in the target queue through the second network segment, the method of transmitting data across network segments also includes: controlling the application in the second network segment to obtain the target request information in the target queue; parsing the target request information through the second network segment to obtain a parsing result; determining a target device based on the parsing result, wherein the target device is one of L devices included in the second network segment, and L is a positive integer; and querying the target device based on the parsing result to obtain the return data.

[0009] Optionally, after transmitting the returned data to the target database, the method for transmitting data across network segments further includes: determining the validity period corresponding to the returned data based on the data type of the returned data; and deleting the returned data from the target database if the current moment is not within the validity period corresponding to the returned data.

[0010] Optionally, after transmitting the return data to the target database, the method for transmitting data across network segments also includes: controlling the application in the first network segment to query the return data in the target database at intervals of a preset time period; when the query obtains the return data, transmitting the return data to the user's visual terminal; when the target query number is greater than the preset number or the target query duration is greater than the preset duration, generating a prompt message and transmitting the prompt message to the user's visual terminal, wherein the target query number is the total number of queries for the return data, the target query duration is the total time consumed in the process of querying the return data, and the prompt message is used to indicate a failure to obtain the return data.

[0011] Optionally, in the process of querying the target device to obtain the returned data based on the analysis result, the method for transmitting data across network segments also includes: determining a data identifier based on the analysis result, wherein the data identifier is a unique identifier of the returned data; and querying the target device to obtain the returned data based on the data identifier.

[0012] According to another aspect of the present application, a device for transmitting data across network segments is also provided, including: a first transmission unit, used to transmit target request information of the first network segment to a target queue, wherein the target request information of the first network segment is used to obtain data in the second network segment, the confidentiality level of the data in the second network segment is greater than the confidentiality level of the data in the first network segment, and the target queue is a message queue deployed in the first network segment; a first determination unit, used to determine the return data corresponding to the target request information in the target queue through the second network segment, wherein the return data is data stored in the second network segment and needs to be transmitted to the first network segment; a second transmission unit, used to transmit the return data to a target database, wherein the target database is a memory database deployed in the first network segment.

[0013] According to another aspect of the present application, a computer program product is provided, in which a computer program is stored, wherein when the computer program is running, the computer program product is controlled to execute any one of the above-mentioned methods for transmitting data across network segments.

[0014] According to another aspect of the present application, an electronic device is also provided, wherein the electronic device includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any one of the above-mentioned methods for transmitting data across network segments.

[0015] In the present application, the target request information of the first network segment is first transmitted to the target queue, wherein the target request information of the first network segment is used to obtain data in the second network segment, the confidentiality level of the data in the second network segment is greater than the confidentiality level of the data in the first network segment, and the target queue is a message queue deployed in the first network segment. Afterwards, the present application determines the return data corresponding to the target request information in the target queue through the second network segment, wherein the return data is data stored in the second network segment and needs to be transmitted to the first network segment. Then, the present application transmits the return data to the target database, wherein the target database is a memory database deployed in the first network segment.

[0016] From the above content, it can be seen that the present application deploys the target queue and the target database in the first network segment (i.e., the low network segment) with a lower data confidentiality level. Afterwards, the present application stores the target request information that the first network segment needs to obtain data in the target queue, and the second network segment can determine the return data required by the first network segment by accessing the target request information in the target queue. That is, the present application uses the target queue as an intermediate medium for data transmission between the low network segment and the high network segment.

[0017] Then, the present application transfers the return data in the second network segment to the target database in the first network segment, thereby achieving the purpose of transferring the data in the second network segment to the first network segment, that is, the present application uses the target database as a transit site for the return data, thereby avoiding the operational steps in the prior art of manually exporting and copying the return data from the second network segment, thereby avoiding the risk of data leakage and tampering in the process of manually exporting and copying data.

[0018] It can be seen that the present application achieves the purpose of avoiding manual export and copying of returned data from the second network segment by using the target queue deployed in the first network segment as the intermediate medium for data transmission between the low network segment and the high network segment, and using the target database deployed in the first network segment as the transit site for returned data, thereby achieving the technical effect of improving data security during data transmission, and further solving the technical problem of low data transmission security caused by the need for manual export and copying of data from the network segment when data is transmitted between different network segments with network isolation. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 is a flowchart of an optional method for transmitting data across network segments according to an embodiment of the present application;

[0021] Figure 2 is a schematic diagram of an optional RabbitMQ and Redis clustering deployment solution according to an embodiment of the present application;

[0022] Figure 3 is a schematic diagram of an optional RabbitMQ and Redis data transmission solution according to an embodiment of the present application;

[0023] Figure 4 is a schematic diagram of an optional device for transmitting data across network segments according to an embodiment of the present application;

[0024] Figure 5 is a schematic diagram of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] It should also be noted that the relevant information (including but not limited to information for display and analysis) and data (including but not limited to return data) involved in this application are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set up between this system and the relevant users or institutions. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or institution through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or institution.

[0028] In addition, the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant information and data involved in this application comply with the relevant laws, regulations and standards of the relevant regions, and necessary confidentiality measures have been taken and do not violate public order and good morals. In addition, this application provides corresponding operation entrances for users to choose to agree to authorization or refuse authorization. If the user chooses to refuse authorization, he / she will enter the corresponding expert decision-making process.

[0029] According to an embodiment of the present application, an embodiment of a method for transmitting data across network segments is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0030] The present application provides a system for transmitting data across network segments (referred to as a data transmission system) for executing the access method for transmitting data across network segments in the present application. The data transmission system can be implemented in software or a combination of software and hardware.

[0031] In an optional embodiment, Figure 1 is a flowchart of an optional method for transmitting data across network segments according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0032] Step S101: transmitting target request information of a first network segment to a target queue.

[0033] In step S101, target request information of the first network segment is used to obtain data in the second network segment, the confidentiality level of the data in the second network segment is greater than the confidentiality level of the data in the first network segment, and the target queue is a message queue deployed in the first network segment.

[0034] Optionally, the target queue is RabbitMQ (Rabbit Message Queuing, an open source message queue), which can perform message transmission in a distributed network or system, wherein a message queue is a mechanism for transmitting messages from a sender to a receiver, and the application of a message queue can achieve the purpose of decoupling different parts of an application (or networks in different network segments), thereby improving the scalability and reliability of the system or network.

[0035] Step S102: determining return data corresponding to the target request information in the target queue through the second network segment.

[0036] In step S102 , the returned data is data stored in the second network segment and needs to be transmitted to the first network segment.

[0037] Optionally, when the second network segment obtains the data that the first network segment needs to obtain by querying according to the target request information, the second network segment encapsulates the queried data as return data.

[0038] Optionally, when the second network segment fails to obtain the data that the first network segment needs to obtain based on the target request information, the data transmission system controls the second network segment to generate a prompt message, wherein the prompt message is used to indicate the failure to obtain the returned data. Thereafter, the data transmission system encapsulates the prompt message as return data, and subsequently transmits the prompt message encapsulated as return data to the first network segment, so that the first network segment can promptly adjust the subsequently sent target request information, thereby improving the success rate of subsequent data transmission.

[0039] Step S103: transmitting the returned data to the target database.

[0040] In step S103, the target database is a memory database deployed in the first network segment.

[0041] Optionally, the memory database is Redis (a memory-based cache database). Since Redis is a memory-based database, Redis has the characteristics of fast data reading and writing speeds, and can meet the needs of high-concurrency data transmission between the first network segment and the second network segment. In addition, Redis supports rich data structures, such as strings, lists, sets, and ordered sets, etc. The data operation method is simple and flexible, and can meet the needs of different data transmission scenarios between the first network segment and the second network segment.

[0042] Optionally, the data access rights of the first network segment are lower than the data access rights of the second network segment. Therefore, the first network segment cannot directly access the devices in the second network segment to obtain the data in the second network segment. The present application stores the return data transmitted from the second network segment in the database in the first network segment, thereby controlling the first network segment to read the data in the target database and achieve access to the return data of the second network segment.

[0043] From the above content, it can be seen that the present application deploys the target queue and the target database in the first network segment (i.e., the low network segment) with a lower data confidentiality level. Afterwards, the present application stores the target request information that the first network segment needs to obtain data in the target queue, and the second network segment can determine the return data required by the first network segment by accessing the target request information in the target queue. That is, the present application uses the target queue as an intermediate medium for data transmission between the low network segment and the high network segment.

[0044] Then, the present application transfers the return data in the second network segment to the target database in the first network segment, thereby achieving the purpose of transferring the data in the second network segment to the first network segment, that is, the present application uses the target database as a transit site for the return data, thereby avoiding the operational steps in the prior art of manually exporting and copying the return data from the second network segment, thereby avoiding the risk of data leakage and tampering in the process of manually exporting and copying data.

[0045] It can be seen that the present application achieves the purpose of avoiding manual export and copying of returned data from the second network segment by using the target queue deployed in the first network segment as the intermediate medium for data transmission between the low network segment and the high network segment, and using the target database deployed in the first network segment as the transit site for returned data, thereby achieving the technical effect of improving data security during data transmission, and further solving the technical problem of low data transmission security caused by the need for manual export and copying of data from the network segment when data is transmitted between different network segments with network isolation.

[0046] In an optional embodiment, before transmitting the target request information of the first network segment to the target queue, the data transmission system first deploys the target queue and the target database to the first network segment, and controls the second network segment to subscribe to the target queue.

[0047] Optionally, take the target queue as RabbitMQ and the target database as Redis as an example. Figure 2 is a schematic diagram of an optional RabbitMQ and Redis clustering deployment solution according to an embodiment of the present application, such as Figure 2 As shown, both RabbitMQ and Redis open source middleware are deployed in the first network segment to achieve data transmission and communication between the first network segment and the second network segment.

[0048] Optionally, RabbitMQ is used as a message queue to receive target request information sent by the first network segment and push it to the second network segment. In addition, RabbitMQ can not only receive target request information from the first network segment, but also select corresponding request strategies based on the target request information, thereby achieving the purpose of obtaining return data from the database in the second network segment or the third-party system in the second network segment.

[0049] Optionally, Redis is used as a cache database to store the return data of the second network segment, and the first network segment can read the return data from Redis. The data transmission system improves the reading speed and efficiency of the return data by writing the return data into Redis.

[0050] Optionally, assuming that both RabbitMQ and Redis open source middleware are deployed in the second network segment, when the application in the first network segment and the second network segment is initialized, due to network isolation between the first network segment and the second network segment, the first network segment cannot directly access the second network segment, so the application in the first network segment cannot connect to the RabbitMQ service and Redis service deployed in the second network segment; when any one of the two open source middleware, RabbitMQ and Redis, is deployed in the second network segment, it will cause the problem that the application in the first network segment cannot connect to the RabbitMQ service or Redis service deployed in the second network segment.

[0051] It can be seen that the two open source middlewares, RabbitMQ and Redis, can only be deployed in the first network segment. At this time, RabbitMQ serves as the intermediate transmission medium for the target request information between the first network segment and the second network segment. The first network segment can directly connect to the middleware, and the second network segment subscribes to RabbitMQ to achieve the purpose of timely receiving the queue information pushed by the application in the first network segment; in addition, Redis serves as the intermediate transmission medium for the return data between the first network segment and the second network segment. The data transmission system sets the key as the unique identifier of the return data, and writes the return data into Redis in the form of key-value (key-value pair). After that, the first network segment is controlled to read the data in Redis according to the key.

[0052] In an optional embodiment, in the process of transmitting the target request information of the first network segment to the target queue, the message transmission system first controls the application in the first network segment to encapsulate the request information of the first network segment to obtain the target request information, wherein the target request information includes at least the request address, request type, request method, request parameters and request identifier, and then the message transmission system transmits the target request information to the target queue.

[0053] Optionally, Figure 3 is a schematic diagram of an optional RabbitMQ and Redis data transmission solution according to an embodiment of the present application, such as Figure 3 As shown, the producer is an application in the first network segment, and the data transmission system controls the producer to encapsulate the request information of the first network segment into a unified preset format, and controls the producer to push the encapsulated target request information to RabbitMQ.

[0054] Optionally, the preset format includes at least data formats such as request address, request type, request method, request parameters and request identifier of the request information, and the request identifier can be represented by a "requestId" field, and the "requestId" field is used to store the key value of the returned data.

[0055] To summarize, the data transmission system not only achieves the purpose of asynchronous processing of target request information by controlling the producer to send the target request information to RabbitMQ, and by controlling the consumer to receive and process the target request information from RabbitMQ, but also avoids the problem of excessive load on RabbitMQ caused by the target request information being sent to RabbitMQ too quickly and excessive load on the second network segment caused by the consumer pushing messages to the second network segment too quickly.

[0056] In an optional embodiment, in the process of determining the return data corresponding to the target request information in the target queue through the second network segment, the data transmission system first controls the application in the second network segment to obtain the target request information in the target queue. After that, the data transmission system parses the target request information through the second network segment to obtain the parsing result. Then, the data transmission system determines the target device based on the parsing result, wherein the target device is one of the L devices included in the second network segment, and L is a positive integer. Finally, the data transmission system queries the target device based on the parsing result to obtain the return data.

[0057] Alternatively, if Figure 3 As shown, after the producer pushes the encapsulated target request information to RabbitMQ, the data transmission system controls RabbitMQ to push the target request information to the consumer that is monitoring RabbitMQ, wherein the consumer is an application in the second network segment.

[0058] Optionally, since there are multiple devices (i.e., L devices) in the second network segment, such as a database or a third-party system in the second network segment, after the consumer obtains the target request information, the object to which the target request information needs to be sent (i.e., the target device) is first required. At this time, the data transmission system can control the consumer to parse the target request information encapsulated in a preset format, and determine the target device based on data such as the request address and request parameters obtained by the analysis. Then, the data transmission system determines the key value of the data to be obtained based on the request identifier obtained by the analysis. The data transmission system queries the returned data in the target device based on the key value, thereby improving the efficiency of obtaining the returned data.

[0059] In an optional embodiment, after the return data is transmitted to the target database, the data transmission system first determines the validity period corresponding to the return data based on the data type of the return data, and then, if the current moment is not within the validity period corresponding to the return data, the data transmission system deletes the return data from the target database.

[0060] Optionally, the data transmission system avoids permanent storage of the returned data in the target database by setting a validity period for storage in the target database for the returned data, that is, avoids expired data from persistently occupying the storage space of the target database, thereby achieving timely cleaning of expired data and timely release of the storage space of the target database, thereby reducing the storage cost of the target database.

[0061] Optionally, the returned data may include sensitive data that needs to be kept confidential. However, persistent storage of sensitive data will increase the risk of data leakage. The data transmission system avoids persistent storage of sensitive data by setting an expiration date for the returned data that includes sensitive data and performing expired cleanup, thereby reducing the risk of sensitive data leakage and further improving data security.

[0062] In an optional embodiment, after transmitting the return data to the target database, the data transmission system controls the application in the first network segment to query the return data in the target database at intervals of a preset time period, and, when the query obtains the return data, the data transmission system transmits the return data to the user's visual terminal; in addition, when the target query number is greater than the preset number or the target query duration is greater than the preset duration, the data transmission system generates a prompt message and transmits the prompt message to the user's visual terminal, wherein the target query number is the total number of queries for the return data, the target query duration is the total time consumed in the process of querying the return data, and the prompt message is used to indicate a failure to obtain the return data.

[0063] Optionally, taking the request identifier represented by the "requestId" field as an example, after the target request information of the first network segment is successfully transmitted to the second network segment through the target queue, at this time, both the first network segment and the second network segment have successfully obtained the "requestId" field value. At this time, the producer of the first network segment can query the corresponding return data in the target database based on the "requestId" field value.

[0064] Optionally, since the return data is written by the consumer of the second network segment, the first network segment cannot predict the exact writing time of the return data. Therefore, after the target request information of the first network segment is successfully transmitted to the second network segment, the data transmission system controls the producer to poll the storage content in the target database, wherein the interval time of the polling query (i.e., the preset time period) can be set to 20 milliseconds.

[0065] Optionally, the preset time period in the polling query process can be adjusted according to the actual application scenario and user needs. The data transmission system controls the producer to poll the storage content in the target database. After the consumer in the second network segment writes the returned data to the target database, the first network segment can obtain the returned data in time, thereby improving the efficiency of the first network segment in obtaining the return data.

[0066] In an optional embodiment, in the process of querying and obtaining the returned data in the target device based on the analysis result, the data transmission system first determines the data identifier based on the analysis result, wherein the data identifier is a unique identifier of the returned data, and then the data transmission system queries and obtains the returned data in the target device based on the data identifier.

[0067] Optionally, the data identifier is represented by a "key" field, and the content of the returned data is represented by a "value" field. The returned data is stored in the target database in the format of a "key-value" key-value pair. The data structure stored in the key-value pair is relatively concise and has less redundant information, thereby achieving the purpose of saving storage space of the target database. In addition, when the data transmission system controls the producer in the first network segment to query the data in the target database, the producer does not need to traverse the entire key-value pair structure, but only needs to query the data based on the key value to quickly locate the required data, thereby improving data retrieval efficiency.

[0068] To sum up, the embodiment of the present application provides a solution for data access and transmission across network segments, that is, by deploying two open source middlewares, RabbitMQ and Redis, in the network segment (first network segment) that needs to obtain data from other network segments, the purpose of data access and transmission across network segments is achieved. Moreover, in the process of deploying RabbitMQ and Redis in the embodiment of the present application, there is no need to make large-scale modifications to the original network structure in the first network segment and the second network segment. Therefore, the technical solution of the present application has good scalability.

[0069] In addition, the embodiment of the present application writes the data that needs to be interacted between the first network segment and the second network segment (i.e., return data) into Redis, and sets an appropriate timeout period (i.e., validity period) for the data written to Redis, so that when a device failure or communication terminal occurs in the second network segment, the first network segment can still provide network services based on the data cached in Redis within the validity period, thereby improving the reliability of the network service.

[0070] In addition, the embodiment of the present application controls the producer in the first network segment to query the data in Redis based on the polling mechanism, thereby ensuring that after the consumer in the second network segment writes the return data to Redis, the first network segment can obtain the return data of the second network segment in real time through the polling mechanism, thereby ensuring the timeliness of the obtained return data. Moreover, in the process of querying the data in Redis based on the polling mechanism in the embodiment of the present application, the producer queries the return data in Redis at every preset time period. When the target query number is greater than the preset number or the target query duration is greater than the preset duration, the data transmission system will control the producer to stop querying. The embodiment of the present application improves the reliability of the return data delivery process by introducing exception handling and retry mechanisms.

[0071] From the above content, it can be seen that the present application deploys the target queue and the target database in the first network segment (i.e., the low network segment) with a lower data confidentiality level. Afterwards, the present application stores the target request information that the first network segment needs to obtain data in the target queue, and the second network segment can determine the return data required by the first network segment by accessing the target request information in the target queue. That is, the present application uses the target queue as an intermediate medium for data transmission between the low network segment and the high network segment.

[0072] Then, the present application transfers the return data in the second network segment to the target database in the first network segment, thereby achieving the purpose of transferring the data in the second network segment to the first network segment, that is, the present application uses the target database as a transit site for the return data, thereby avoiding the operational steps in the prior art of manually exporting and copying the return data from the second network segment, thereby avoiding the risk of data leakage and tampering in the process of manually exporting and copying data.

[0073] It can be seen that the present application achieves the purpose of avoiding manual export and copying of returned data from the second network segment by using the target queue deployed in the first network segment as the intermediate medium for data transmission between the low network segment and the high network segment, and using the target database deployed in the first network segment as the transit site for returned data, thereby achieving the technical effect of improving data security during data transmission, and further solving the technical problem of low data transmission security caused by the need for manual export and copying of data from the network segment when data is transmitted between different network segments with network isolation.

[0074] According to another aspect of the embodiment of the present application, a device for transmitting data across network segments is also provided. Figure 4 is a schematic diagram of an optional device for transmitting data across network segments according to an embodiment of the present application, such as Figure 4As shown, the device for transmitting data across network segments includes: a first transmission unit 401, a first determination unit 402 and a second transmission unit 403.

[0075] Optionally, a first transmission unit is used to transmit target request information of the first network segment to a target queue, wherein the target request information of the first network segment is used to obtain data in a second network segment, a confidentiality level of the data in the second network segment is greater than a confidentiality level of the data in the first network segment, and the target queue is a message queue deployed in the first network segment; a first determination unit is used to determine return data corresponding to the target request information in the target queue through the second network segment, wherein the return data is data stored in the second network segment and needs to be transmitted to the first network segment; and a second transmission unit is used to transmit the return data to a target database, wherein the target database is a memory database deployed in the first network segment.

[0076] In an optional embodiment, the device for transmitting data across network segments further includes: a deployment unit and a subscription unit.

[0077] Optionally, the deployment unit is used to deploy the target queue and the target database to the first network segment; the subscription unit is used to control the second network segment to subscribe to the target queue.

[0078] In an optional embodiment, the first transmission unit includes: an encapsulation subunit and a first transmission subunit.

[0079] Optionally, an encapsulation subunit is used to control the application in the first network segment to encapsulate the request information of the first network segment to obtain target request information, wherein the target request information includes at least a request address, a request type, a request method, request parameters and a request identifier; and a first transmission subunit is used to transmit the target request information to a target queue.

[0080] In an optional embodiment, the first determining unit includes: an acquiring subunit, a parsing subunit, a determining subunit, and a querying subunit.

[0081] Optionally, an acquisition subunit is used to control an application in the second network segment to obtain target request information in a target queue; a parsing subunit is used to parse the target request information through the second network segment to obtain a parsing result; a determination subunit is used to determine a target device based on the parsing result, wherein the target device is one of L devices included in the second network segment, and L is a positive integer; and a query subunit is used to query the target device based on the parsing result to obtain return data.

[0082] In an optional embodiment, the device for transmitting data across network segments further includes: a second determining unit and a deleting unit.

[0083] Optionally, the second determination unit is used to determine the validity period corresponding to the returned data according to the data type of the returned data; the deletion unit is used to delete the returned data from the target database when the current moment is not within the validity period corresponding to the returned data.

[0084] In an optional embodiment, the device for transmitting data across network segments further includes: a cyclic query unit, a third transmission unit, and a generation unit.

[0085] Optionally, a cyclic query unit is used to control the application in the first network segment to query the return data in the target database at intervals of a preset time period; a third transmission unit is used to transmit the return data to the user's visual terminal when the query obtains the return data; a generation unit is used to generate a prompt message when the target query number is greater than the preset number or the target query duration is greater than the preset duration, and transmit the prompt message to the user's visual terminal, wherein the target query number is the total number of queries for the return data, the target query duration is the total time consumed in the process of querying the return data, and the prompt message is used to indicate a failure to obtain the return data.

[0086] In an optional embodiment, the query subunit includes: a determination module and a query module.

[0087] Optionally, the determination module is used to determine the data identifier according to the analysis result, wherein the data identifier is a unique identifier of the returned data; and the query module is used to query the target device according to the data identifier to obtain the returned data.

[0088] From the above content, it can be seen that the present application deploys the target queue and the target database in the first network segment (i.e., the low network segment) with a lower data confidentiality level. Afterwards, the present application stores the target request information that the first network segment needs to obtain data in the target queue, and the second network segment can determine the return data required by the first network segment by accessing the target request information in the target queue. That is, the present application uses the target queue as an intermediate medium for data transmission between the low network segment and the high network segment.

[0089] Then, the present application transfers the return data in the second network segment to the target database in the first network segment, thereby achieving the purpose of transferring the data in the second network segment to the first network segment, that is, the present application uses the target database as a transit site for the return data, thereby avoiding the operational steps in the prior art of manually exporting and copying the return data from the second network segment, thereby avoiding the risk of data leakage and tampering in the process of manually exporting and copying data.

[0090] It can be seen that the present application achieves the purpose of avoiding manual export and copying of returned data from the second network segment by using the target queue deployed in the first network segment as the intermediate medium for data transmission between the low network segment and the high network segment, and using the target database deployed in the first network segment as the transit site for returned data, thereby achieving the technical effect of improving data security during data transmission, and further solving the technical problem of low data transmission security caused by the need for manual export and copying of data from the network segment when data is transmitted between different network segments with network isolation.

[0091] According to another aspect of an embodiment of the present application, a computer program product is further provided, the computer program product comprising a stored computer program, wherein when the computer program is running, the computer program product is controlled to execute any one of the above-mentioned methods for transmitting data across network segments.

[0092] According to another aspect of an embodiment of the present application, an electronic device is also provided, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any of the above-mentioned methods for transmitting data across network segments by executing the executable instructions.

[0093] Optionally, Figure 5 is a schematic diagram of an optional electronic device according to an embodiment of the present application, such as Figure 5 As shown, an embodiment of the present application provides an electronic device, which includes a processor, a memory, and a program stored in the memory and executable on the processor, and when the processor executes the program, any one of the above-mentioned methods for transmitting data across network segments is implemented.

[0094] Optionally, when the processor executes the program, it can implement the following steps: transmitting the target request information of the first network segment to the target queue, wherein the target request information of the first network segment is used to obtain data in the second network segment, the confidentiality level of the data in the second network segment is greater than the confidentiality level of the data in the first network segment, and the target queue is a message queue deployed in the first network segment; determining the return data corresponding to the target request information in the target queue through the second network segment, wherein the return data is data stored in the second network segment and needs to be transmitted to the first network segment; transmitting the return data to the target database, wherein the target database is a memory database deployed in the first network segment.

[0095] Optionally, when the processor executes the program, the following steps can be implemented: deploying the target queue and the target database to the first network segment; and controlling the second network segment to subscribe to the target queue.

[0096] Optionally, when the processor executes the program, it can implement the following steps: control the application in the first network segment to encapsulate the request information of the first network segment to obtain target request information, wherein the target request information includes at least a request address, a request type, a request method, request parameters, and a request identifier; transmit the target request information to the target queue.

[0097] Optionally, the processor can implement the following steps when executing the program: control the application in the second network segment to obtain the target request information in the target queue; parse the target request information through the second network segment to obtain the parsing result; determine the target device based on the parsing result, wherein the target device is one of L devices included in the second network segment, and L is a positive integer; query the target device based on the parsing result to obtain the return data.

[0098] Optionally, the processor can implement the following steps when executing the program: determine the validity period corresponding to the returned data according to the data type of the returned data; and delete the returned data from the target database if the current moment is not within the validity period corresponding to the returned data.

[0099] Optionally, the processor can implement the following steps when executing the program: control the application in the first network segment to query the return data in the target database at intervals of a preset time period; when the query obtains return data, transmit the return data to the user's visualization terminal; when the target query number is greater than the preset number or the target query duration is greater than the preset duration, generate a prompt message and transmit the prompt message to the user's visualization terminal, wherein the target query number is the total number of queries for the return data, the target query duration is the total time consumed in the process of querying the return data, and the prompt message is used to indicate a failure to obtain the return data.

[0100] Optionally, when executing the program, the processor can implement the following steps: determining a data identifier based on the parsing result, wherein the data identifier is a unique identifier of the returned data; and querying the target device to obtain the returned data based on the data identifier.

[0101] From the above content, it can be seen that the present application deploys the target queue and the target database in the first network segment (i.e., the low network segment) with a lower data confidentiality level. Afterwards, the present application stores the target request information that the first network segment needs to obtain data in the target queue, and the second network segment can determine the return data required by the first network segment by accessing the target request information in the target queue. That is, the present application uses the target queue as an intermediate medium for data transmission between the low network segment and the high network segment.

[0102] Then, the present application transfers the return data in the second network segment to the target database in the first network segment, thereby achieving the purpose of transferring the data in the second network segment to the first network segment, that is, the present application uses the target database as a transit site for the return data, thereby avoiding the operational steps in the prior art of manually exporting and copying the return data from the second network segment, thereby avoiding the risk of data leakage and tampering in the process of manually exporting and copying data.

[0103] It can be seen that the present application achieves the purpose of avoiding manual export and copying of returned data from the second network segment by using the target queue deployed in the first network segment as the intermediate medium for data transmission between the low network segment and the high network segment, and using the target database deployed in the first network segment as the transit site for returned data, thereby achieving the technical effect of improving data security during data transmission, and further solving the technical problem of low data transmission security caused by the need for manual export and copying of data from the network segment when data is transmitted between different network segments with network isolation.

[0104] The above-mentioned embodiments or examples disclosed in the present application are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection disclosed in the present application. In the absence of contradiction, each step in a certain embodiment or example in the present application can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.

[0105] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0106] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0107] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0108] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0109] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory. The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0110] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0111] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0112] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0113] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for transmitting data across network segments, characterized in that: include: Transmitting target request information of the first network segment to a target queue, wherein the target request information of the first network segment is used to obtain data in a second network segment, the confidentiality level of the data in the second network segment is greater than the confidentiality level of the data in the first network segment, and the target queue is a message queue deployed in the first network segment; Determining, through the second network segment, return data corresponding to the target request information in the target queue, wherein the return data is data stored in the second network segment and needs to be transmitted to the first network segment; The returned data is transmitted to a target database, wherein the target database is a memory database deployed in the first network segment.

2. The method for transmitting data across network segments according to claim 1, characterized in that: Before transmitting the target request information of the first network segment to the target queue, the method for transmitting data across network segments further includes: Deploy the target queue and the target database to the first network segment; Control the second network segment to subscribe to the target queue.

3. The method for transmitting data across network segments according to claim 1, characterized in that: Transmitting the target request information of the first network segment to the target queue includes: Controlling the application in the first network segment to encapsulate the request information of the first network segment to obtain target request information, wherein the target request information at least includes a request address, a request type, a request method, a request parameter, and a request identifier; The target request information is transmitted to the target queue.

4. The method for transmitting data across network segments according to claim 1, characterized in that: Determining, through the second network segment, return data corresponding to the target request information in the target queue, includes: Controlling the application in the second network segment to obtain the target request information in the target queue; Parsing the target request information through the second network segment to obtain a parsing result; Determine a target device according to the analysis result, wherein the target device is one of L devices included in the second network segment, where L is a positive integer; The returned data is obtained by querying the target device according to the analysis result.

5. The method for transmitting data across network segments according to claim 1, characterized in that: After transmitting the returned data to the target database, the method for transmitting data across network segments further includes: Determining the validity period corresponding to the returned data according to the data type of the returned data; When the current time is not within the validity period corresponding to the returned data, the returned data is deleted from the target database.

6. The method for transmitting data across network segments according to claim 1, characterized in that: After transmitting the returned data to the target database, the method for transmitting data across network segments further includes: Control the application program in the first network segment to query the target database for the returned data at intervals of a preset time period; In the case where the returned data is obtained through the query, the returned data is transmitted to the user's visualization terminal; When the target query number is greater than the preset number or the target query duration is greater than the preset duration, a prompt message is generated and transmitted to the user's visualization terminal, wherein the target query number is the total number of queries for the returned data, the target query duration is the total time consumed in the process of querying the returned data, and the prompt message is used to indicate that the returned data has failed to be obtained.

7. The method for transmitting data across network segments according to claim 4, characterized in that: Querying the target device to obtain the returned data according to the parsing result includes: Determine a data identifier according to the parsing result, wherein the data identifier is a unique identifier of the returned data; The returned data is obtained by querying the target device according to the data identifier.

8. A device for transmitting data across network segments, characterized in that: include: A first transmission unit, configured to transmit target request information of a first network segment to a target queue, wherein the target request information of the first network segment is used to obtain data in a second network segment, the confidentiality level of the data in the second network segment is greater than the confidentiality level of the data in the first network segment, and the target queue is a message queue deployed in the first network segment; A first determining unit, configured to determine, through the second network segment, return data corresponding to the target request information in the target queue, wherein the return data is data stored in the second network segment and needs to be transmitted to the first network segment; The second transmission unit is used to transmit the returned data to a target database, wherein the target database is a memory database deployed in the first network segment.

9. A computer program product, characterized in that The computer program product comprises a computer program, wherein when the computer program is running, the computer program product is controlled to execute the method for transmitting data across network segments as claimed in any one of claims 1 to 7.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for transmitting data across network segments as described in any one of claims 1 to 7.

Images