Methods, apparatus, software products, and electronic devices for transmitting data across network segments

Abstract

This application discloses a method, apparatus, program product, and electronic device for cross-network segment data transmission, relating to the field of network security technology. The method includes: first, transmitting target request information from a first network segment to a target queue, where the target queue is a message queue deployed in the first network segment; then, determining the return data corresponding to the target request information in the target queue through a second network segment, wherein the return data is data stored in the second network segment and needs to be transmitted to the first network segment; and finally, transmitting the return data to a target database, where the target database is a memory database deployed in the first network segment. This application solves the technical problem of low data transmission security caused by the prior art requiring manual export and copying of data from different network segments with network isolation when transmitting data between them.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a method and device for transmitting data across network segments, a program product and an electronic device. BACKGROUND

[0002] With the popularity of the Internet and the development of network security technology, in order to improve the security of their own network, enterprises will divide their network into different network segments with different access permissions, and set up network isolation between different network segments. For example, an enterprise divides its network into a high network segment and a low network segment, wherein the data access permission of the high network segment is higher than that of the low network segment. In this case, the high network segment can directly access the low network segment to obtain data in the low network segment, while the low network segment cannot directly access the high network segment, so the low network segment cannot obtain the data of the high network segment in real time. In the prior art, the data in the high network segment is usually manually exported by manual means, and then the exported data is copied to the low network segment. However, there is a risk of data leakage and tampering in the process of manually exporting and copying data, thereby posing a potential threat to the security of the network and causing low data security in the data transmission process.

[0003] At present, there is no effective solution to the above problems. SUMMARY

[0004] The present application provides a method and device for transmitting data across network segments, a program product and an electronic device to at least solve the technical problem of low data transmission security caused by the need to manually export and copy data from the network segment in the prior art when transmitting data between different network segments with network isolation.

[0005] According to one aspect of the present application, a method for transmitting data across network segments is provided, comprising: transmitting target request information of a first network segment to a target queue, wherein the target request information of the first network segment is used to obtain data in a second network segment, the data in the second network segment has a higher security level than the data in the first network segment, and the target queue is a message queue deployed in the first network segment; determining return data corresponding to the target request information in the target queue through the second network segment, wherein the return data is data stored in the second network segment and needs to be transmitted to the first network segment; and transmitting the return data to a target database, wherein the target database is an in-memory database deployed in the first network segment.

[0006] Optionally, before transmitting the target request information of the first network segment to the target queue, the method for transmitting data across network segments further comprises: deploying the target queue and the target database to the first network segment; and controlling the second network segment to subscribe to the target queue.

[0007] Optionally, in the process of transmitting the target request information of the first network segment to the target queue, the method of transmitting data across network segments further comprises: controlling the application program in the first network segment to encapsulate the request information of the first network segment to obtain the target request information, wherein the target request information at least includes a request address, a request type, a request method, a request parameter and a request identifier; and transmitting the target request information to the target queue.

[0008] Optionally, in the process of determining the return data corresponding to the target request information in the target queue through the second network segment, the method of transmitting data across network segments further comprises: controlling the application program in the second network segment to obtain the target request information in the target queue; analyzing the target request information through the second network segment to obtain an analysis result; determining a target device according to the analysis result, wherein the target device is one of L devices included in the second network segment, and L is a positive integer; and querying the return data in the target device according to the analysis result.

[0009] Optionally, after transmitting the return data to the target database, the method of transmitting data across network segments further comprises: determining an effective period corresponding to the return data according to a data type of the return data; and deleting the return data from the target database in a case where the current time is not in the effective period corresponding to the return data.

[0010] Optionally, after transmitting the return data to the target database, the method of transmitting data across network segments further comprises: controlling the application program in the first network segment to query the return data in the target database every interval of a preset time period; in a case where the return data is queried, transmitting the return data to a visual terminal of a user; and in a case where a target query number is greater than a preset number or a target query time length is greater than a preset time length, generating a prompt message and transmitting the prompt message to the visual terminal of the user, wherein the target query number is a total number of queries on the return data, the target query time length is a total time length consumed in the process of querying the return data, and the prompt message is used to represent that the return data fails to be obtained.

[0011] Optionally, in the process of querying the return data in the target device according to the analysis result, the method of transmitting data across network segments further comprises: determining a data identifier according to the analysis result, wherein the data identifier is a unique identifier of the return data; and querying the return data in the target device according to the data identifier.

[0012] According to another aspect of the present application, the present application further provides an apparatus for transmitting data across network segments, comprising: a first transmission unit configured to transmit target request information of a first network segment to a target queue, wherein the target request information of the first network segment is used to acquire data in a second network segment, the data in the second network segment has a higher security level than the data in the first network segment, and the target queue is a message queue deployed in the first network segment; a first determination unit configured to determine, through the second network segment, return data corresponding to the target request information in the target queue, wherein the return data is data stored in the second network segment and needs to be transmitted to the first network segment; and a second transmission unit configured to transmit the return data to a target database, wherein the target database is a memory database deployed in the first network segment.

[0013] According to another aspect of the present application, the present application further provides a computer program product, wherein the computer program product stores a computer program, and when the computer program runs, the computer program product controls the computer program to execute the method for transmitting data across network segments according to any one of the above aspects.

[0014] According to another aspect of the present application, the present application further provides an electronic device, wherein the electronic device comprises one or more processors and a memory, the memory is configured to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method for transmitting data across network segments according to any one of the above aspects.

[0015] In the present application, first, the target request information of the first network segment is transmitted to the target queue, wherein the target request information of the first network segment is used to acquire data in the second network segment, the data in the second network segment has a higher security level than the data in the first network segment, and the target queue is a message queue deployed in the first network segment. Then, the present application determines, through the second network segment, return data corresponding to the target request information in the target queue, wherein the return data is data stored in the second network segment and needs to be transmitted to the first network segment. Finally, the present application transmits the return data to the target database, wherein the target database is a memory database deployed in the first network segment.

[0016] From the above, it can be seen that the present application deploys the target queue and the target database in the first network segment (i.e., the low network segment) having a lower security level of data, and then stores the target request information of the first network segment needing to acquire data in the target queue, and the second network segment can determine the return data needed by the first network segment by accessing the target request information in the target queue, i.e., the present application uses the target queue as an intermediate medium for data transmission between the low network segment and the high network segment.

[0017] Then, this application transmits the return data from the second network segment to the target database in the first network segment, thereby achieving the purpose of transmitting the data from the second network segment to the first network segment. That is, this application uses the target database as a transit station for the return data, thereby avoiding the operation steps of manually exporting and copying the return data from the second network segment in the prior art, and thus avoiding the risk of data leakage and tampering during the process of manually exporting and copying data.

[0018] Therefore, this application achieves the goal of avoiding the manual export and copying of return data from the second network segment by using the target queue deployed in the first network segment as an intermediate medium for data transmission between the low network segment and the high network segment, and using the target database deployed in the first network segment as a relay station for return data. This improves the technical effect of data security during data transmission and solves the technical problem of low data transmission security caused by the need to manually export and copy data from the network segment when transmitting data between different network segments with network isolation. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0020] Figure 1 This is a flowchart of an optional method for transmitting data across network segments according to an embodiment of this application;

[0021] Figure 2 This is a schematic diagram of an optional RabbitMQ and Redis clustered deployment scheme according to an embodiment of this application;

[0022] Figure 3 This is a schematic diagram of an optional RabbitMQ and Redis data transmission scheme according to an embodiment of this application;

[0023] Figure 4 This is a schematic diagram of an optional device for transmitting data across network segments according to an embodiment of this application;

[0024] Figure 5 This is a schematic diagram of an optional electronic device according to an embodiment of this application. Detailed Implementation

[0025] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0027] It should also be noted that all information (including but not limited to information used for display and analysis) and data (including but not limited to returned data) involved in this application are information and data authorized by the user or fully authorized by all parties. For example, this system has an interface with the relevant user or organization. Before obtaining relevant information, it needs to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving consent from the aforementioned user or organization.

[0028] Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of relevant information and data involved in this application all comply with the relevant laws, regulations, and standards of the relevant regions, and necessary confidentiality measures have been taken. This application does not violate public order and good morals. In addition, this application provides a corresponding operation entry point for users to choose to agree to or refuse authorization. If the user chooses to refuse authorization, the corresponding expert decision-making process will be initiated.

[0029] According to an embodiment of this application, an embodiment of a method for transmitting data across network segments is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0030] This application provides a system for transmitting data across network segments (hereinafter referred to as a data transmission system) for executing the data transmission access method for transmitting data across network segments in this application. The data transmission system can be implemented in software or a combination of software and hardware.

[0031] In one alternative embodiment, Figure 1 This is a flowchart of an optional method for transmitting data across network segments according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0032] Step S101: Transmit the target request information of the first network segment to the target queue.

[0033] In step S101, the target request information of the first network segment is used to obtain data in the second network segment. The confidentiality level of the data in the second network segment is higher than that of the data in the first network segment. The target queue is a message queue deployed in the first network segment.

[0034] Optionally, the target queue is RabbitMQ (Rabbit Message Queuing, an open-source message queue). RabbitMQ enables message passing in a distributed network or system. Message queues are a mechanism for passing messages from sender to receiver. The application of message queues can decouple different parts of an application (or different network segments), thereby improving the scalability and reliability of the system or network.

[0035] Step S102: Determine the return data corresponding to the target request information in the target queue through the second network segment.

[0036] In step S102, the returned data is the data stored in the second network segment and needs to be transmitted to the first network segment.

[0037] Optionally, if the second network segment obtains the data that the first network segment needs to acquire based on the target request information, the second network segment will encapsulate the retrieved data into return data.

[0038] Optionally, if the second network segment fails to obtain the data required by the first network segment based on the target request information, the data transmission system controls the second network segment to generate a prompt message. The prompt message indicates that the return data acquisition has failed. Subsequently, the data transmission system encapsulates the prompt message into return data and then transmits the prompt message encapsulated as return data to the first network segment. This allows the first network segment to adjust the target request information sent subsequently in a timely manner, thereby improving the success rate of subsequent data transmission.

[0039] Step S103 involves transmitting the returned data to the target database.

[0040] In step S103, the target database is an in-memory database deployed in the first network segment.

[0041] Optionally, the in-memory database is Redis (a memory-based cache database). Since Redis is a memory-based database, it has the characteristics of fast data read and write speed, which can meet the needs of high-concurrency data transmission between the first network segment and the second network segment. In addition, Redis supports rich data structures, such as strings, lists, sets and sorted sets, and the data operation is simple and flexible, which can meet the needs of different data transmission scenarios between the first network segment and the second network segment.

[0042] Optionally, the data access permissions of the first network segment are lower than those of the second network segment. Therefore, the first network segment cannot directly access the devices in the second network segment to obtain data from the second network segment. However, this application can control the first network segment to read data from the target database by storing the return data transmitted from the second network segment in the database of the first network segment, thereby enabling access to the return data from the second network segment.

[0043] As can be seen from the above, this application deploys the target queue and target database in the first network segment (i.e., the low network segment) with a lower data confidentiality level. Then, this application stores the target request information that the first network segment needs to obtain data in the target queue. The second network segment can determine the return data required by the first network segment by accessing the target request information in the target queue. That is, this application uses the target queue as an intermediate medium for data transmission between the low network segment and the high network segment.

[0044] Then, this application transmits the return data from the second network segment to the target database in the first network segment, thereby achieving the purpose of transmitting the data from the second network segment to the first network segment. That is, this application uses the target database as a transit station for the return data, thereby avoiding the operation steps of manually exporting and copying the return data from the second network segment in the prior art, and thus avoiding the risk of data leakage and tampering during the process of manually exporting and copying data.

[0045] Therefore, this application achieves the goal of avoiding the manual export and copying of return data from the second network segment by using the target queue deployed in the first network segment as an intermediate medium for data transmission between the low network segment and the high network segment, and using the target database deployed in the first network segment as a relay station for return data. This improves the technical effect of data security during data transmission and solves the technical problem of low data transmission security caused by the need to manually export and copy data from the network segment when transmitting data between different network segments with network isolation.

[0046] In an optional embodiment, before transmitting the target request information of the first network segment to the target queue, the data transmission system first deploys the target queue and the target database to the first network segment, and controls the second network segment to subscribe to the target queue.

[0047] Optionally, taking RabbitMQ as the target queue and Redis as the target database as an example, Figure 2 This is a schematic diagram of an optional RabbitMQ and Redis clustered deployment scheme according to an embodiment of this application, such as... Figure 2 As shown, both RabbitMQ and Redis, two open-source middleware, are deployed in the first network segment to enable data transmission and communication between the first and second network segments.

[0048] Optionally, RabbitMQ is used as a message queue to receive target request information sent by the first network segment and push it to the second network segment. In addition, RabbitMQ can not only receive target request information from the first network segment, but also select the corresponding request strategy according to the target request information, thereby achieving the purpose of obtaining returned data from the database in the second network segment or the third-party system in the second network segment.

[0049] Optionally, Redis is used as a cache database to store the returned data from the second network segment, from which the first network segment can read the returned data. The data transmission system improves the speed and efficiency of reading returned data by writing it to Redis.

[0050] Alternatively, assuming that both RabbitMQ and Redis, two open-source middleware, are deployed on the second network segment, during application initialization in both the first and second network segments, due to network isolation between the two segments, the first network segment cannot directly access the second network segment. Therefore, applications in the first network segment cannot connect to the RabbitMQ and Redis services deployed on the second network segment. If either RabbitMQ or Redis is deployed on the second network segment, applications in the first network segment will be unable to connect to either the RabbitMQ or Redis service deployed on the second network segment.

[0051] Therefore, it is evident that the two open-source middlewares, RabbitMQ and Redis, can only be deployed on the first network segment. In this case, RabbitMQ serves as the intermediate transmission medium for target request information between the first and second network segments. The first network segment can directly connect to the middleware, while the second network segment subscribes to RabbitMQ to achieve the goal of timely receiving queue information pushed by the application in the first network segment. Additionally, Redis serves as the intermediate transmission medium for return data between the first and second network segments. The data transmission system sets the key as a unique identifier for the return data and writes the return data into Redis in key-value pairs. Then, the first network segment is controlled to read data from Redis based on the key.

[0052] In an optional embodiment, during the process of transmitting the target request information of the first network segment to the target queue, the message transmission system first controls the application in the first network segment to encapsulate the request information of the first network segment to obtain the target request information, wherein the target request information includes at least the request address, request type, request method, request parameters and request identifier. Then, the message transmission system transmits the target request information to the target queue.

[0053] Optionally, Figure 3 This is a schematic diagram of an optional RabbitMQ and Redis data transmission scheme according to an embodiment of this application, as shown below. Figure 3 As shown, the producer is the application in the first network segment, and the data transmission system controls the producer to encapsulate the request information of the first network segment into a unified preset format, and controls the producer to push the encapsulated target request information to RabbitMQ.

[0054] Optionally, the preset format includes at least the request address, request type, request method, request parameters, and request identifier of the request information, and the request identifier can be represented by the "requestId" field, which is used to store the key value of the returned data.

[0055] In summary, the data transmission system, by controlling the producer to send target request information to RabbitMQ and controlling the consumer to receive and process target request information from RabbitMQ, not only achieves the goal of asynchronous processing of target request information, but also avoids the problems of excessive load on RabbitMQ caused by the target request information being sent to RabbitMQ too quickly, and excessive load on the second network segment caused by the consumer pushing messages to the second network segment too quickly.

[0056] In one optional embodiment, during the process of determining the return data corresponding to the target request information in the target queue through the second network segment, the data transmission system first controls the application in the second network segment to obtain the target request information in the target queue. Then, the data transmission system parses the target request information through the second network segment to obtain the parsing result. Then, the data transmission system determines the target device based on the parsing result, wherein the target device is one of the L devices included in the second network segment, where L is a positive integer. Finally, the data transmission system queries the target device to obtain the return data based on the parsing result.

[0057] Optionally, such as Figure 3 As shown, after the producer pushes the encapsulated target request information to RabbitMQ, the data transmission system controls RabbitMQ to push the target request information to the consumer that is listening to RabbitMQ, where the consumer is the application in the second network segment.

[0058] Optionally, since there are multiple devices (i.e., L devices) in the second network segment, such as databases or third-party systems in the second network segment, after the consumer obtains the target request information, it first needs to know the object to which the target request information needs to be sent (i.e., the target device). At this time, the data transmission system can control the consumer to parse the target request information encapsulated in a preset format, determine the target device based on the parsed request address and request parameters, and then determine the key value of the data to be obtained based on the parsed request identifier. The data transmission system queries and returns data in the target device based on the key value, thereby improving the efficiency of obtaining the returned data.

[0059] In one alternative embodiment, after the returned data is transmitted to the target database, the data transmission system first determines the validity period of the returned data based on the data type of the returned data. Then, if the data is not currently within the validity period of the returned data, the data transmission system deletes the returned data from the target database.

[0060] Optionally, the data transmission system avoids the permanent storage of returned data in the target database by setting an expiration period for the returned data. This prevents expired data from persistently occupying the storage space of the target database, thereby achieving the goal of timely cleaning up expired data and releasing the storage space of the target database in a timely manner, thus reducing the storage cost of the target database.

[0061] Optionally, the returned data may include sensitive data that needs to be kept confidential. Persistent storage of sensitive data can increase the risk of data leakage. By setting an expiration date for returned data that includes sensitive data and performing expiration cleanup, the data transmission system avoids persistent storage of sensitive data, thereby reducing the risk of sensitive data leakage and further improving data security.

[0062] In one optional embodiment, after transmitting the returned data to the target database, the data transmission system controls the application in the first network segment to query the returned data in the target database at preset time intervals. If the returned data is obtained, the data transmission system transmits the returned data to the user's visual terminal. In addition, if the target query count is greater than a preset number or the target query duration is greater than a preset duration, the data transmission system generates a prompt message and transmits the prompt message to the user's visual terminal. The target query count is the total number of times the returned data is queried, the target query duration is the total time consumed in the process of querying the returned data, and the prompt message is used to indicate that the return data retrieval failed.

[0063] Optionally, taking the request identifier represented by the "requestId" field as an example, after the target request information of the first network segment is successfully transmitted to the second network segment through the target queue, both the first and second network segments successfully obtain the "requestId" field value. At this time, the producer of the first network segment can query the corresponding returned data in the target database based on the "requestId" field value.

[0064] Optionally, since the returned data is written by the consumer of the second network segment, the first network segment cannot predict the exact time of writing the returned data. Therefore, after the target request information of the first network segment is successfully transmitted to the second network segment, the data transmission system controls the producer to poll the stored content in the target database. The polling interval (i.e., the preset time period) can be set to 20 milliseconds.

[0065] Optionally, the preset time period during the polling query process can be adjusted according to the actual application scenario and user needs. By controlling the producer to poll the stored content in the target database, the data transmission system can ensure that the first network segment can obtain the returned data in a timely manner after the consumer in the second network segment writes the returned data into the target database, thereby improving the efficiency of the first network segment in obtaining the returned data.

[0066] In one optional embodiment, during the process of querying the returned data in the target device based on the parsing result, the data transmission system first determines the data identifier based on the parsing result, wherein the data identifier is a unique identifier of the returned data, and then the data transmission system queries the target device to obtain the returned data based on the data identifier.

[0067] Optionally, the data identifier is represented by a "key" field, and the content of the returned data is represented by a "value" field. The returned data is stored in the target database in a "key-value" pair format. The key-value pair data structure is simpler and contains less redundant information, thus saving storage space in the target database. Furthermore, when the producer in the first network segment of the data transmission system queries data in the target database, the producer does not need to traverse the entire key-value pair structure; it only needs to query the data based on the key value to quickly locate the required data, thereby improving data retrieval efficiency.

[0068] In summary, this application provides a cross-network segment data access and transmission scheme. Specifically, by deploying two open-source middleware, RabbitMQ and Redis, in the network segment (the first network segment) that needs to obtain data from other network segments, the purpose of cross-network segment data access and transmission is achieved. Furthermore, this application does not require large-scale modifications to the original network structure in the first and second network segments during the deployment of RabbitMQ and Redis. Therefore, the technical solution of this application has good scalability.

[0069] Furthermore, this embodiment of the application writes the data that needs to be exchanged between the first network segment and the second network segment (i.e., the returned data) into Redis, and sets an appropriate timeout period (i.e., validity period) for the data written to Redis, so that even if the second network segment experiences equipment failure or communication terminal failure, the first network segment can still provide network services based on the data cached in Redis that is within the validity period, thereby improving the reliability of network services.

[0070] Furthermore, this embodiment of the application controls the producer in the first network segment to query data in Redis based on a polling mechanism. This ensures that after the consumer in the second network segment writes the returned data to Redis, the first network segment can obtain the returned data from the second network segment in real time through the polling mechanism, thereby ensuring the timeliness of the obtained returned data. In addition, during the process of querying data in Redis based on the polling mechanism, the producer queries the returned data in Redis at preset time intervals. The data transmission system will only control the producer to stop querying if the target number of queries exceeds the preset number or the target query duration exceeds the preset duration. This embodiment of the application improves the reliability of the returned data delivery process by introducing exception handling and retry mechanisms.

[0071] As can be seen from the above, this application deploys the target queue and target database in the first network segment (i.e., the low network segment) with a lower data confidentiality level. Then, this application stores the target request information that the first network segment needs to obtain data in the target queue. The second network segment can determine the return data required by the first network segment by accessing the target request information in the target queue. That is, this application uses the target queue as an intermediate medium for data transmission between the low network segment and the high network segment.

[0072] Then, this application transmits the return data from the second network segment to the target database in the first network segment, thereby achieving the purpose of transmitting the data from the second network segment to the first network segment. That is, this application uses the target database as a transit station for the return data, thereby avoiding the operation steps of manually exporting and copying the return data from the second network segment in the prior art, and thus avoiding the risk of data leakage and tampering during the process of manually exporting and copying data.

[0073] Therefore, this application achieves the goal of avoiding the manual export and copying of return data from the second network segment by using the target queue deployed in the first network segment as an intermediate medium for data transmission between the low network segment and the high network segment, and using the target database deployed in the first network segment as a relay station for return data. This improves the technical effect of data security during data transmission and solves the technical problem of low data transmission security caused by the need to manually export and copy data from the network segment when transmitting data between different network segments with network isolation.

[0074] According to another aspect of the embodiments of this application, an apparatus for transmitting data across network segments is also provided. Figure 4 This is a schematic diagram of an optional cross-network segment data transmission apparatus according to an embodiment of this application, such as... Figure 4As shown, the device for transmitting data across network segments includes: a first transmission unit 401, a first determination unit 402, and a second transmission unit 403.

[0075] Optionally, the first transmission unit is used to transmit target request information of the first network segment to the target queue, wherein the target request information of the first network segment is used to obtain data in the second network segment, the confidentiality level of the data in the second network segment is higher than the confidentiality level of the data in the first network segment, and the target queue is a message queue deployed in the first network segment; the first determining unit is used to determine the return data corresponding to the target request information in the target queue through the second network segment, wherein the return data is data stored in the second network segment and needs to be transmitted to the first network segment; the second transmission unit is used to transmit the return data to the target database, wherein the target database is a memory database deployed in the first network segment.

[0076] In an optional embodiment, the apparatus for transmitting data across network segments further includes a deployment unit and a subscription unit.

[0077] Optionally, the deployment unit is used to deploy the target queue and the target database to the first network segment; the subscription unit is used to control the second network segment to subscribe to the target queue.

[0078] In one alternative embodiment, the first transmission unit includes an encapsulation subunit and a first transmission subunit.

[0079] Optionally, an encapsulation subunit is used to control the application in the first network segment to encapsulate the request information of the first network segment to obtain target request information, wherein the target request information includes at least a request address, request type, request method, request parameters and request identifier; and a first transmission subunit is used to transmit the target request information to the target queue.

[0080] In one optional embodiment, the first determining unit includes: an acquisition subunit, a parsing subunit, a determining subunit, and a query subunit.

[0081] Optionally, the following sub-units are configured: an acquisition sub-unit for controlling the application in the second network segment to acquire target request information from the target queue; a parsing sub-unit for parsing the target request information through the second network segment to obtain the parsing result; a determination sub-unit for determining the target device based on the parsing result, wherein the target device is one of the L devices included in the second network segment, where L is a positive integer; and a query sub-unit for querying the target device based on the parsing result to obtain the returned data.

[0082] In one optional embodiment, the apparatus for transmitting data across network segments further includes a second determining unit and a deleting unit.

[0083] Optionally, the second determining unit is used to determine the validity period corresponding to the returned data based on the data type of the returned data; the deletion unit is used to delete the returned data from the target database if the data is not currently within the validity period corresponding to the returned data.

[0084] In one optional embodiment, the device for transmitting data across network segments further includes: a cyclic query unit, a third transmission unit, and a generation unit.

[0085] Optionally, a cyclic query unit is used to control the application in the first network segment to query and return data in the target database at preset time intervals; a third transmission unit is used to transmit the returned data to the user's visual terminal when the query returns data; and a generation unit is used to generate a prompt message and transmit the prompt message to the user's visual terminal when the target query count is greater than a preset count or the target query duration is greater than a preset duration. The target query count is the total number of times the returned data is queried, the target query duration is the total time consumed during the query process, and the prompt message indicates that the return data retrieval failed.

[0086] In one optional embodiment, the query subunit includes a determination module and a query module.

[0087] Optionally, the determination module is used to determine the data identifier based on the parsing result, wherein the data identifier is a unique identifier for the returned data; the query module is used to query the returned data in the target device based on the data identifier.

[0088] As can be seen from the above, this application deploys the target queue and target database in the first network segment (i.e., the low network segment) with a lower data confidentiality level. Then, this application stores the target request information that the first network segment needs to obtain data in the target queue. The second network segment can determine the return data required by the first network segment by accessing the target request information in the target queue. That is, this application uses the target queue as an intermediate medium for data transmission between the low network segment and the high network segment.

[0089] Then, this application transmits the return data from the second network segment to the target database in the first network segment, thereby achieving the purpose of transmitting the data from the second network segment to the first network segment. That is, this application uses the target database as a transit station for the return data, thereby avoiding the operation steps of manually exporting and copying the return data from the second network segment in the prior art, and thus avoiding the risk of data leakage and tampering during the process of manually exporting and copying data.

[0090] Therefore, this application achieves the goal of avoiding the manual export and copying of return data from the second network segment by using the target queue deployed in the first network segment as an intermediate medium for data transmission between the low network segment and the high network segment, and using the target database deployed in the first network segment as a relay station for return data. This improves the technical effect of data security during data transmission and solves the technical problem of low data transmission security caused by the need to manually export and copy data from the network segment when transmitting data between different network segments with network isolation.

[0091] According to another aspect of the embodiments of this application, a computer program product is also provided, the computer program product including a stored computer program, wherein, when the computer program is running, the method for controlling the computer program product to perform any of the above-mentioned methods for cross-network segment data transmission is provided.

[0092] According to another aspect of the embodiments of this application, an electronic device is also provided, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform a method for transmitting data across network segments via executing the executable instructions.

[0093] Optionally, Figure 5 This is a schematic diagram of an optional electronic device according to an embodiment of this application, such as... Figure 5 As shown, this application provides an electronic device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it implements the method for transmitting data across network segments as described above.

[0094] Optionally, when the processor executes the program, it can perform the following steps: transmitting the target request information of the first network segment to the target queue, wherein the target request information of the first network segment is used to obtain data in the second network segment, the confidentiality level of the data in the second network segment is higher than that of the data in the first network segment, and the target queue is a message queue deployed in the first network segment; determining the return data corresponding to the target request information in the target queue through the second network segment, wherein the return data is data stored in the second network segment and needs to be transmitted to the first network segment; transmitting the return data to the target database, wherein the target database is a memory database deployed in the first network segment.

[0095] Optionally, when the processor executes the program, it can perform the following steps: deploy the target queue and target database to the first network segment; and control the second network segment to subscribe to the target queue.

[0096] Optionally, when the processor executes the program, it can perform the following steps: control the application in the first network segment to encapsulate the request information of the first network segment to obtain the target request information, wherein the target request information includes at least the request address, request type, request method, request parameters and request identifier; and transmit the target request information to the target queue.

[0097] Optionally, when the processor executes the program, it can perform the following steps: control the application in the second network segment to obtain target request information in the target queue; parse the target request information through the second network segment to obtain the parsing result; determine the target device based on the parsing result, wherein the target device is one of the L devices included in the second network segment, and L is a positive integer; and query the target device to obtain the returned data based on the parsing result.

[0098] Optionally, when the processor executes the program, it can perform the following steps: determine the validity period of the returned data based on the data type of the returned data; if the returned data is not currently within its validity period, delete the returned data from the target database.

[0099] Optionally, when the processor executes the program, it can perform the following steps: control the application in the first network segment to query and return data in the target database at preset time intervals; if the returned data is obtained, transmit the returned data to the user's visual terminal; if the target query count is greater than a preset count or the target query duration is greater than a preset duration, generate a prompt message and transmit the prompt message to the user's visual terminal, wherein the target query count is the total number of times the returned data is queried, the target query duration is the total time consumed in the process of querying the returned data, and the prompt message is used to indicate that the return data retrieval failed.

[0100] Optionally, when the processor executes the program, it can perform the following steps: determine the data identifier based on the parsing result, wherein the data identifier is a unique identifier for the returned data; and query the target device to obtain the returned data based on the data identifier.

[0101] As can be seen from the above, this application deploys the target queue and target database in the first network segment (i.e., the low network segment) with a lower data confidentiality level. Then, this application stores the target request information that the first network segment needs to obtain data in the target queue. The second network segment can determine the return data required by the first network segment by accessing the target request information in the target queue. That is, this application uses the target queue as an intermediate medium for data transmission between the low network segment and the high network segment.

[0102] Then, this application transmits the return data from the second network segment to the target database in the first network segment, thereby achieving the purpose of transmitting the data from the second network segment to the first network segment. That is, this application uses the target database as a transit station for the return data, thereby avoiding the operation steps of manually exporting and copying the return data from the second network segment in the prior art, and thus avoiding the risk of data leakage and tampering during the process of manually exporting and copying data.

[0103] Therefore, this application achieves the goal of avoiding the manual export and copying of return data from the second network segment by using the target queue deployed in the first network segment as an intermediate medium for data transmission between the low network segment and the high network segment, and using the target database deployed in the first network segment as a relay station for return data. This improves the technical effect of data security during data transmission and solves the technical problem of low data transmission security caused by the need to manually export and copy data from the network segment when transmitting data between different network segments with network isolation.

[0104] The above-described embodiments or examples disclosed in this application are not exhaustive, but merely illustrative of some embodiments or examples, and are not intended to limit the scope of protection of this application. Unless otherwise specified, each step in a particular embodiment or example can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a particular embodiment or example can also be implemented as an independent embodiment, and the order of the steps in a particular embodiment or example can be arbitrarily interchanged. Furthermore, optional methods or examples in a particular embodiment or example can be arbitrarily combined; moreover, various embodiments or examples can be arbitrarily combined. For example, some or all steps of different embodiments or examples can be arbitrarily combined, and a particular embodiment or example can be arbitrarily combined with optional methods or examples of other embodiments or examples.

[0105] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0106] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0107] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0108] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0109] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory. Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0110] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0111] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0112] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0113] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method of transmitting data across network segments, the method comprising: The method comprises the following steps: transmitting target request information of a first network segment to a target queue, wherein the target request information of the first network segment is used to acquire data in a second network segment, the data in the second network segment has a higher security level than data in the first network segment, and the target queue is a message queue deployed in the first network segment; determining return data corresponding to the target request information in the target queue through the second network segment, comprising the following steps: controlling an application program in the second network segment to acquire the target request information in the target queue; analyzing the target request information through the second network segment to obtain an analysis result; determining a target device according to the analysis result, wherein the target device is one of L devices included in the second network segment, and L is a positive integer; and querying the return data in the target device according to the analysis result, wherein the return data is data stored in the second network segment and needs to be transmitted to the first network segment; wherein querying the return data in the target device according to the analysis result comprises the following steps: determining a data identifier according to the analysis result, wherein the data identifier is a unique identifier of the return data; and querying the return data in the target device according to the data identifier; transmitting the return data to a target database, wherein the target database is a memory database deployed in the first network segment.

2. The method of claim 1, wherein, Before transmitting the target request information of the first network segment to the target queue, the method further comprises the following steps: deploying the target queue and the target database to the first network segment; controlling the second network segment to subscribe to the target queue.

3. The method of claim 1, wherein, Transmitting the target request information of the first network segment to the target queue comprises the following steps: controlling an application program in the first network segment to encapsulate request information of the first network segment to obtain target request information, wherein the target request information at least includes a request address, a request type, a request method, a request parameter, and a request identifier; transmitting the target request information to the target queue.

4. The method of claim 1, wherein, After transmitting the return data to the target database, the method further comprises the following steps: determining an effective period corresponding to the return data according to a data type of the return data; in a case where the current time is not in the effective period corresponding to the return data, deleting the return data from the target database.

5. The method of claim 1, wherein, After transmitting the return data to the target database, the method further comprises the following steps: controlling an application program in the first network segment to query the return data in the target database every interval of a preset time period; in a case where the return data is queried, transmitting the return data to a visual terminal of a user; In a case where the target query number is greater than a preset number or a target query duration is greater than a preset duration, a prompt message is generated, and the prompt message is transmitted to a visual terminal of the user, wherein the target query number is a total number of queries on the return data, the target query duration is a total duration consumed in a process of querying the return data, and the prompt message is used to represent that the return data acquisition fails.

6. An apparatus for transmitting data across network segments, the apparatus comprising: Comprise: A first transmission unit is configured to transmit target request information of a first network segment to a target queue, wherein the target request information of the first network segment is used to acquire data in a second network segment, a security level of the data in the second network segment is greater than a security level of data in the first network segment, and the target queue is a message queue deployed in the first network segment; A first determination unit is configured to determine return data corresponding to target request information in the target queue through the second network segment, wherein the return data is data stored in the second network segment and needs to be transmitted to the first network segment; The first determination unit comprises: an acquisition subunit configured to control an application program in the second network segment to acquire the target request information in the target queue; an analysis subunit configured to analyze the target request information through the second network segment to obtain an analysis result; a determination subunit configured to determine a target device according to the analysis result, wherein the target device is one of L devices included in the second network segment, and L is a positive integer; and a query subunit configured to query the return data in the target device according to the analysis result; The query subunit comprises: a determination module configured to determine a data identifier according to the analysis result, wherein the data identifier is a unique identifier of the return data; and a query module configured to query the return data in the target device according to the data identifier; A second transmission unit is configured to transmit the return data to a target database, wherein the target database is a memory database deployed in the first network segment.

7. A computer program product, characterised in that, The computer program product comprises a computer program, wherein the computer program controls the computer program product to execute the method for transmitting data across network segments according to any one of claims 1 to 5 when the computer program runs.

8. An electronic device, comprising: The computer program product comprises one or more processors and a memory, wherein the memory is used to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method for transmitting data across network segments according to any one of claims 1 to 5.

Images