Data transmission method and related product

Abstract

The embodiment of the invention provides a data transmission method and a related product. The method comprises the following steps: acquiring a risk influence level of to-be-transmitted data between a data sending end and a data receiving end; according to the risk influence level, performing classification processing on the to-be-transmitted data to obtain a classification result of the to-be-transmitted data; determining a data protection strategy matched with the to-be-transmitted data according to a classification result; and performing data protection processing on the to-be-transmitted data according to the data protection strategy, and performing data transmission between the data transmitting end and the data receiving end based on the processed to-be-transmitted data. Through the embodiment of the invention, the data processing and data transmission efficiency can be improved under the condition of improving the data transmission security.

Description

Technical Field

[0001] The present invention relates to the technical field of data security management, and in particular to a data transmission method and related products. Background Art

[0002] Data transmission security has become a hot topic in the research of cloud storage, data science, big data and other technologies. In the existing technology, data security transmission is usually carried out by using Hadoop distributed file system, HDFS (Hadoop Distributed File System) security based on the socket layer and hybrid security system. However, the data transmission using the above schemes is prone to high data security threats and high latency, and cannot provide sufficient security for user sensitive data in the big data environment, and the efficiency of data processing and data transmission is low. Summary of the invention

[0003] The purpose of the embodiments of the present invention is to provide a data transmission method and related products, which can solve the problems in the prior art that sufficient security cannot be provided for user sensitive data in a big data environment and the data transmission efficiency is low, and can improve the efficiency of data processing and data transmission while improving data transmission security.

[0004] In order to solve the above technical problems, the embodiment of the present invention is implemented as follows: In a first aspect, an embodiment of the present invention provides a data transmission method, including: Obtaining the risk impact level of data to be transmitted between a data sending end and a data receiving end; Classify the data to be transmitted according to the risk impact level to obtain a classification result of the data to be transmitted; Determining, based on the classification result, a data protection strategy that matches the data to be transmitted; The data to be transmitted is processed for data protection according to the data protection strategy, and data transmission between the data sending end and the data receiving end is performed based on the processed data to be transmitted.

[0005] In a second aspect, an embodiment of the present invention provides a data transmission device, including: An acquisition module, used to acquire the risk impact level of data to be transmitted between a data sending end and a data receiving end; A classification module, used for classifying the data to be transmitted according to the impact level to obtain a classification result of the data to be transmitted; A determination module, used to determine a data protection policy that matches the data to be transmitted according to the classification result; The transmission module is used to perform data protection processing on the data to be transmitted according to the data protection strategy, and perform data transmission between the data sending end and the data receiving end based on the processed data to be transmitted.

[0006] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a processor, a communication interface, a memory and a communication bus; wherein the processor, the communication interface and the memory communicate with each other through a bus; the memory is used to store computer programs; and the processor is used to execute the programs stored in the memory to implement the steps of the data transmission method as described in the first aspect.

[0007] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the data transmission method as described in the first aspect are implemented.

[0008] In a fifth aspect, an embodiment of the present invention provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the data transmission method as described in the first aspect.

[0009] It can be seen from the technical solution provided by the above embodiments of the present invention that, in the embodiments of the present invention, first, the risk impact level of the data to be transmitted between the data sending end and the data receiving end is obtained; then, according to the risk impact level, the data to be transmitted is classified and processed to obtain the classification result of the data to be transmitted; then, according to the classification result, a data protection strategy matching the data to be transmitted is determined; finally, data protection processing is performed on the data to be transmitted according to the data protection strategy, and data transmission is performed between the data sending end and the data receiving end based on the processed data to be transmitted. It can be seen that through the embodiments of the present invention, the data to be transmitted can be classified according to the risk impact level of the data to be transmitted obtained, and the corresponding data protection strategy can be matched for different types of data and corresponding data protection processing can be performed, and data transmission between the data sending end and the data receiving end can be performed based on the processed data to be transmitted, which can not only improve the security of the data transmission process, but also improve the efficiency of data processing and data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0011] Figure 1A schematic diagram of a data transmission method according to an embodiment of the present invention; Figure 2 A schematic diagram of a classification process of data to be transmitted provided by an embodiment of the present invention; Figure 3 A schematic diagram of a flow chart of a data security transmission strategy provided by an embodiment of the present invention; Figure 4 A schematic diagram of the module composition of a data transmission device provided by an embodiment of the present invention; Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0012] The embodiments of the present invention provide a data transmission method and related products.

[0013] In order to enable those skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0014] Figure 1 A flow chart of a data transmission method provided by an embodiment of the present invention, wherein the execution subject of the method may be a server, wherein the server may be an independent server, or a server cluster composed of multiple servers, or a cloud server for cloud computing processing, and the server may be a server capable of performing network operation processing. Figure 1 As shown, the method may specifically include the following steps: Step S102, obtaining the risk impact level of the data to be transmitted between the data sending end and the data receiving end; Step S104, classifying the data to be transmitted according to the risk impact level to obtain a classification result of the data to be transmitted; Step S106, determining a data protection policy that matches the data to be transmitted according to the classification result; Step S108, performing data protection processing on the data to be transmitted according to the data protection policy, and performing data transmission between the data transmitting end and the data receiving end based on the processed data to be transmitted.

[0015] It can be seen from the technical solution provided by the above embodiments of the present invention that, in the embodiments of the present invention, first, the risk impact level of the data to be transmitted between the data sending end and the data receiving end is obtained; then, according to the risk impact level, the data to be transmitted is classified and processed to obtain the classification result of the data to be transmitted; then, according to the classification result, a data protection strategy matching the data to be transmitted is determined; finally, data protection processing is performed on the data to be transmitted according to the data protection strategy, and data transmission is performed between the data sending end and the data receiving end based on the processed data to be transmitted. It can be seen that through the embodiments of the present invention, the data to be transmitted can be classified according to the risk impact level of the data to be transmitted obtained, and the corresponding data protection strategy can be matched for different types of data and corresponding data protection processing can be performed, and data transmission between the data sending end and the data receiving end can be performed based on the processed data to be transmitted, which can not only improve the security of the data transmission process, but also improve the efficiency of data processing and data transmission.

[0016] In the above step S102, the risk impact level of the data to be transmitted between the data sending end and the data receiving end is obtained. The risk impact level is calculated by performing a risk assessment on the data and further combining it with other relevant data. It can be used to indicate the security level of the data protection, and indirectly reflects the degree to which the data may be subject to risks such as leakage or attack. The risk impact level can include 5 levels, namely level 1, level 2, level 3, level 4 and level 5. In practical applications, most of the data stored in the server or cloud server are sensitive privacy data of users. Taking medical institutions as an example, the database or server of the medical institution usually stores sensitive data such as the patient's personal information, medical records, transaction records and financial details of the medical institution. These sensitive data are prone to leakage and intrusion, and require a higher security protection strategy. In one example, the data sending end can be a data storage node in a cloud server, and the data receiving end can be a client device used by a user (such as a computer, mobile phone, or tablet), or a device in the local network where the user is located (such as a proxy server or gateway). Based on the user's access to data, the data stored in the cloud server will be sent from the corresponding storage node (data sending end) to the user end (data receiving end). This process is the data transmission process, and the data that needs to be accessed by the user or the data transmitted in this process is the data to be transmitted.

[0017] In one embodiment, obtaining the risk impact level of data to be transmitted between a data sending end and a data receiving end includes: Obtaining risk impact values ​​associated with the data to be transmitted; the risk impact values ​​include data threat values, data vulnerability values, and likelihood data threat values; Determine the risk impact level of the data to be transmitted based on the risk impact value.

[0018] When obtaining the risk impact level of the data to be transmitted between the data sending end and the data receiving end, the data threat value, data vulnerability value, and likely data threat value related to the data to be transmitted can be obtained first. Then, the risk impact level of the data to be transmitted is determined based on the obtained data threat value, data vulnerability value, and likely data threat value related to the data to be transmitted.

[0019] The data threat value of the data to be transmitted can be obtained by performing risk assessment on the data to be transmitted, etc. The data threat value can be used to indicate the degree of damage caused by the threat event to the server node or system, and can specifically include the following levels: when the threat value is between 0-1, the threat level is considered to be a negligible threat; when the threat value is between 1-2, the threat level is considered to be a low-risk threat; when the threat value is between 2-3, the threat level is considered to be a medium-level threat; when the threat value is between 3-4, the threat level is considered to be a medium-to-high-level threat; and when the threat value is between 4-5, the threat level is considered to be a high-level threat.

[0020] The data vulnerability value of the data to be transmitted can be quantified and evaluated through a security vulnerability scoring system. The score range of the data vulnerability value is usually 0-10. The severity of the data vulnerability can be classified according to the data vulnerability value. Specifically, a data vulnerability value between 0-4 is considered a low-level vulnerability; a data vulnerability value between 4-7 is considered a medium-level vulnerability; a data vulnerability value between 7-10 is considered a high-level vulnerability, which is usually considered to be a more serious vulnerability.

[0021] The likelihood data threat value can be used to represent the probability of a threat event occurring, as well as a quantitative value of the potential damage caused by the threat event to the data storage system or data transmission network. The likelihood data threat value can be regarded as a combination of the data threat value and the likelihood value of the corresponding threat event occurring. For example, assuming that the threat value of a data threat T is T(t), and the likelihood value of the threat event occurring is L(t) (obtained based on likelihood estimation), then the likelihood data threat value can be expressed as T(t) * L(t) or some similar combination.

[0022] After obtaining the data threat value and data vulnerability value related to the data to be transmitted, the data threat value and the data vulnerability value can be combined to obtain a combined value. Then, the risk impact level of the data to be transmitted is determined based on the combined value and the likely data threat value. When combining the data threat value and the data vulnerability value, the data threat value and the data vulnerability value can be added together, or the data threat value and the data vulnerability value can be added together in a corresponding proportion. When determining the risk impact level of the data to be transmitted, a sensitivity value used to represent the sensitivity or privacy of the data to be transmitted can also be introduced, and the sensitivity value, data threat value, data vulnerability value and likely data threat value of the data to be transmitted can be multiplied together, and the risk impact level of the data to be transmitted can be determined based on the value obtained after the multiplication. It can be understood that the larger the value obtained after the multiplication, the higher the risk impact level of the data to be transmitted.

[0023] In one embodiment, the data to be transmitted is classified according to the risk impact level to obtain the classification result of the data to be transmitted, including: Determine the classification level value corresponding to the data to be transmitted according to the risk impact level and the correspondence between the preset risk impact level range and the classification level value; According to the classification level value, the classification result of the data to be transmitted is determined.

[0024] When classifying the data to be transmitted according to the risk impact level and obtaining the classification result of the data to be transmitted, the classification level value corresponding to the data to be transmitted can be determined first according to the correspondence between the risk impact level and the preset risk impact level range and different classification level values. Then, the classification result of the data to be transmitted is determined according to the classification level value corresponding to the data to be transmitted.

[0025] In one example, the correspondence between the preset risk impact level range and different classification level values ​​is:

[0026] Among them, AMD is the classification level value, ILR is the risk impact level, when the risk impact level range is [0-1], the classification level value is 0; when the risk impact level range is (1-5], the classification level value is 1; when the risk impact level range is greater than 5, the classification level value is 5. Assuming that the risk impact level of the data to be transmitted is 3, then the classification level value corresponding to the data to be transmitted is 1.

[0027] After determining the classification level value corresponding to the data to be transmitted, the classification result of the data to be transmitted can be determined according to the classification level value. The data to be transmitted can be divided into asset data and non-asset data. The asset data may include private data and special data, etc., and the non-asset data may include public data, etc. In one example, the asset data and non-asset data can be classified based on the classification level value. When the value of AMD is 1 and the risk impact level of the data to be transmitted is in the range of (1-5], the data to be transmitted can be considered private data. When the value of AMD is 0 and the risk impact level of the data to be transmitted is in the range of [0-1], the data to be transmitted can be considered public data with low data sensitivity. When the value of AMD is 5 and the risk impact level of the data to be transmitted is greater than 5, the data to be transmitted can be considered special data with a higher sensitivity than private data. Assuming that the risk impact level of the data to be transmitted is 3, then the classification level value corresponding to the data to be transmitted is 1, and the classification result of the data to be transmitted is private data in the asset data.

[0028] Private data includes user private and sensitive data. The protection policy of this type of data has a high protection strength or can only be accessed by authorized users. This type of data can include sensitive data related to a specific business organization, customer personal data or financial data. The leakage of such data can cause huge losses to the company or individuals, or some intruders may abuse personal data, which will bring negative feedback to the company. The metadata of private data does not have sensitive information, but provides additional information about the data files related to the modification permissions. These metadata help administrators obtain additional information in the directory. The metadata attributes of private data are used to prevent security risks of sensitive data.

[0029] Public data can be considered general data, which has a less strong protection policy imposed on it and usually contains general information that can be viewed by any user without access restrictions.

[0030] Special data is more sensitive than private data, and its protection strategy is extremely strong, or it can only be accessed by specific users. In the metadata of special data, only the corresponding file type is sensitive.

[0031] Figure 2 A schematic diagram of a classification process of data to be transmitted provided by an embodiment of the present invention, in an example, as Figure 2 As shown, when classifying data in the cloud server, HDFS (Hadoop Distributed File System) first divides the data to be transmitted into multiple partitions. The file types of the data to be transmitted may include text files and non-text files.

[0032] For text files, HDFS in the cloud server further splits the data to be transmitted in each partition through the HDFS formatter. The size of each data can be 128 MB to ensure that it does not exceed the available memory. For each split data, HDFS will start one or more Mapper tasks. Each Mapper reads the data assigned to it and applies a mapping function to process the data. The output of the Mapper is usually a list of key-value pairs, where the key is used for classification and sorting, and the value is the data to be aggregated. Between the Mapper and the Reducer, HDFS performs a stage called Shuffle and Sort. The main task of this stage is to sort the output of the Mapper by key and send the key-value pairs with the same key to the same Reducer. Reducer receives key-value pairs from Mapper, which have the same key. Reducer performs specific business logic or transformation on values ​​with the same key, such as calculating the sum, average, maximum, minimum, etc., and provides a single-level classification output, that is, the classification level value is 0, 1, 5. The classification level value in each partition is used to identify the data to be transmitted as private data, public data, or special data.

[0033] The classification level value may be a file security value in an HDFS partition, and the file security value may be obtained by comprehensively judging the security status of a file by evaluating various security policies and mechanisms implemented in HDFS. If the classification level value of the data to be transmitted is 1, the data to be transmitted is classified as private data; if the classification level value of the data to be transmitted is 5, the data to be transmitted is classified as special data; and if the classification level value of the data to be transmitted is 0, the data to be transmitted is classified as public data.

[0034] For non-text files, such as audio, video, PDF or image files, you need to set their classification level and set the corresponding classification level value. For non-text files such as audio, video, PDF or image files, setting the classification level usually includes the following steps: Step 1: Type identification. First, you need to determine the type of data, such as audio, video, PDF or image. This can be achieved through file extensions, file header information or using specific file type identification tools. Step 2: Determine the sensitivity. Determine the sensitivity of the data, which depends on the nature of the information contained in the data. For example, a PDF file containing personal identity information may be more sensitive than an ordinary image file. Step 3: Access control or matching protection policy. According to the sensitivity of the file, set appropriate access control or protection policy. For example, you can set who can access the file, under what circumstances, and the level of access permission. You can also match the corresponding data protection policy, such as encryption using encryption algorithms. Step 4: Data classification. Divide the data into different categories so that it can be effectively identified and processed when stored and managed. You can set simple tags for the data or classify the data using a classification system to ensure that the files are properly protected and managed. Step 5: Metadata recording. Maintaining metadata records of data, including information such as the type of data, creation date, last modification date, owner, etc., helps track and manage data. Step 6: Backup and recovery. According to the importance and sensitivity level of the data, formulate appropriate backup and recovery strategies to ensure the security and availability of the data. Step 7: Audit and monitoring. For highly sensitive data, establish an audit and monitoring mechanism to monitor data access and operations, as well as detect potential security threats. After setting the corresponding classification level for the non-text file type of data to be transmitted, set the corresponding classification level value according to the category of the data to be transmitted to determine whether the data to be transmitted is private data, public data or special data.

[0035] In one embodiment, determining a data protection policy that matches the data to be transmitted based on the classification result includes: If the data to be transmitted is asset data to be transmitted between a data transmitting end and a data receiving end, then the corresponding data protection strategy is determined to be to encrypt the data to be transmitted using a first-level encryption algorithm; If the data to be transmitted is non-asset data to be transmitted between a data sender and a data receiver, the corresponding data protection strategy is to encrypt the data to be transmitted using a second-level encryption algorithm; the encryption strength of the first-level encryption algorithm is greater than the encryption strength of the second-level encryption algorithm.

[0036] After determining the classification result of the data to be transmitted, determine a data protection strategy that matches the data to be transmitted based on the classification result of the data to be transmitted to protect the data to be transmitted. If the data to be transmitted is asset data to be transmitted between the data transmitter and the data receiver, then determine the corresponding data protection strategy to encrypt the data to be transmitted using the first-level encryption algorithm. If the data to be transmitted is non-asset data to be transmitted between the data transmitter and the data receiver, then determine the corresponding data protection strategy to encrypt the data to be transmitted using the second-level encryption algorithm, wherein the encryption strength of the first-level encryption algorithm is greater than the encryption strength of the second-level encryption algorithm, that is, the protection strategy for asset data is stronger than the protection strategy for non-asset data. Asset data includes private users, special data, etc., and non-asset data includes public data, etc.

[0037] For asset data and non-assets, the data protection strategies that match different asset data or different non-asset data may also be different. In practical applications, appropriate protection strategies can be matched to the data based on the sensitivity of the data and the size of the data.

[0038] In one example, taking a medical institution as an example, asset data includes sensitive data such as the personal information of patients, medical records, transaction records, and financial details of medical institutions. Since there are many patients in medical institutions, the volume of sensitive data such as personal information, medical records, transaction records, and financial details of patients is large and relatively sensitive. For this type of medical data, an encryption algorithm with a higher degree of encryption can be used to protect this type of data. While encrypting and protecting the data, it will not generate a lot of redundant data.

[0039] In another example, enterprises usually formulate corresponding enterprise development strategies, marketing strategies, and asset data such as R&D materials and customer data for new products. Although these data are small in size, they are highly confidential. For such asset data, encryption algorithms with a particularly high degree of encryption can be used. Since such data are small in size, even redundant data can be tolerated. For internal corporate promotional graphics or videos, although they can be publicly displayed, in order to prevent malicious tampering that affects the corporate image, encryption algorithms with a relatively moderate degree of encryption can be used for protection.

[0040] In another example, non-asset data such as daily operation data, human resources data, and research and development data within the enterprise may be protected by an encryption algorithm with a weaker encryption level, or such data may not be protected at all.

[0041] In another embodiment, the access rights of the data to be transmitted can be set according to the classification results of the data to be transmitted to improve the security of the data to be transmitted. For example, sensitive data such as the financial details of a medical institution, because it involves fund management and business management, can be set with access rights for this part of the data, for example, only the staff of the financial department or the staff at the leadership level are allowed to access. For sensitive information such as the patient's personal information, medical records, transaction records, etc., in order to facilitate the service to the patient, nurses, doctors, pharmacists and nursing staff at all levels can be allowed to access such data.

[0042] In one embodiment, the data to be transmitted is asset data to be transmitted between a data transmitting end and a data receiving end; performing data protection processing on the data to be transmitted according to a data protection strategy, and performing data transmission between the data transmitting end and the data receiving end based on the processed data to be transmitted, including: The first level encryption algorithm is used to encrypt the data to be transmitted, and a data transmission key is set between the data sending end and the data receiving end; the data transmission key is used to encrypt and decrypt the relevant information of the data to be transmitted between the data sending end and the data receiving end; In response to the data receiving end decrypting the relevant information of the data to be transmitted using the data transmission key, a corresponding data access request is generated, and the data access request is sent to the data sending end; the data access request includes the data access key generated by the data receiving end; the data access key includes the public key generated by the data receiving end and the identity identification information of the data receiving end, and is used for the encrypted transmission of the data to be transmitted between the data sending end and the data receiving end and the identity identification of the data receiving end; When the data receiving end passes the identity authentication, data transmission between the data sending end and the data receiving end is performed based on the encrypted data to be transmitted.

[0043] In the case where the data to be transmitted is asset data to be transmitted between a data transmitting end and a data receiving end, the data to be transmitted is encrypted using a first-level encryption algorithm, and an encrypted transmission strategy is also adopted during the data transmission process.

[0044] Figure 3 A flow chart of a data security transmission strategy provided by an embodiment of the present invention, such as Figure 3As shown, the user accesses the data stored in the cloud server. The node storing the corresponding data in the cloud server is the data sender, and the user-side device is the data receiver. During the data transmission process, first, the user logs in to the cloud server through the symmetric access key, and the cloud server uses the key to authenticate the user, the data sender, and the data receiver. A symmetric access key is generated between the user and the cloud server in a secure manner (such as a secure key exchange protocol). This key needs to be securely distributed between the user and the cloud server to ensure that only both parties can know and use this key. The user sends a login request to the cloud server, which contains the user name and an identifier requesting authentication using the symmetric access key. After receiving the login request, the cloud server will look for the symmetric access key associated with the user name. The cloud server prompts the user to enter the symmetric access key (or part of it). The user sends the symmetric access key (or part of it) as a login credential to the cloud server. The cloud server uses the stored key to verify the key sent by the user to complete the user's identity authentication.

[0045] Then, a data transmission key is set between the data sending end and the data receiving end. The data transmission key can be randomly generated and can be shared between the data sending end and the data receiving end to encrypt and decrypt the relevant information of the data to be transmitted between the data sending end and the data receiving end. The relevant information of the data to be transmitted includes the detailed information of the node where the data to be transmitted is located and the ID of the data to be transmitted.

[0046] Next, the data receiving end uses the data transmission key to decrypt the relevant information of the data to be transmitted, generates a corresponding data access request based on the relevant information of the data to be transmitted, and sends the data access request to the data sending end. The data access request includes the data access key generated by the data receiving end, and the data access key includes the public key generated by the data receiving end and the identity information of the data receiving end, which is used for the encrypted transmission of the data to be transmitted between the data sending end and the data receiving end and the identity verification of the data receiving end.

[0047] Finally, the data sending end receives the data access request sent by the data receiving end, and uses the data access key to authenticate the data receiving end. If the data receiving end passes the identity authentication, the data encryption transmission between the data sending end and the data receiving end is performed based on the encrypted data to be transmitted.

[0048] In one embodiment, it further includes: When the data receiving end receives the data to be transmitted and has confirmed the integrity of the received data to be transmitted, the data receiving end sends a data reception confirmation message generated by the data receiving end to the data sending end; the data reception confirmation message is used by the data sending end to stop repeatedly sending the data to be transmitted to the data receiving end.

[0049] When the data receiving end receives the data, it checks the hash value of the received data packet to confirm the integrity of the data. Once the hash value of the data packet is confirmed by the receiving end, the encrypted data reception confirmation message will be sent to the data sending end. The data sending end receives the data reception confirmation message and stops sending duplicate data to the data receiving end. If the data sending end does not receive the data sending end, the data sending end will send a duplicate copy of the data to the data receiving end. If the data reception confirmation message is received later, the duplicated data will be deleted.

[0050] It can be seen from the technical solution provided by the above embodiments of the present invention that, in the embodiments of the present invention, first, the risk impact level of the data to be transmitted between the data sending end and the data receiving end is obtained; then, according to the risk impact level, the data to be transmitted is classified and processed to obtain the classification result of the data to be transmitted; then, according to the classification result, a data protection strategy matching the data to be transmitted is determined; finally, data protection processing is performed on the data to be transmitted according to the data protection strategy, and data transmission is performed between the data sending end and the data receiving end based on the processed data to be transmitted. It can be seen that through the embodiments of the present invention, the data to be transmitted can be classified according to the risk impact level of the data to be transmitted obtained, and the corresponding data protection strategy can be matched for different types of data and corresponding data protection processing can be performed, and data transmission between the data sending end and the data receiving end can be performed based on the processed data to be transmitted, which can not only improve the security of the data transmission process, but also improve the efficiency of data processing and data transmission.

[0051] Corresponding to the data transmission method provided in the above embodiment, based on the same technical concept, the embodiment of the present invention also provides a data transmission device, Figure 4 A schematic diagram of the module composition of a data transmission device provided in an embodiment of the present invention, wherein the data transmission device is used to execute Figures 1 to 3 Describes the data transmission method, such as Figure 4 As shown, the data transmission device includes: An acquisition module 41 is used to acquire a risk impact level of data to be transmitted between a data sending end and a data receiving end; A classification module 42, configured to classify the data to be transmitted according to the impact level to obtain a classification result of the data to be transmitted; A determination module 43, configured to determine a data protection policy that matches the data to be transmitted according to the classification result; The transmission module 44 is used to perform data protection processing on the data to be transmitted according to the data protection strategy, and perform data transmission between the data sending end and the data receiving end based on the processed data to be transmitted.

[0052] Optionally, the acquisition module 41 is specifically used to acquire a risk impact value related to the data to be transmitted; the risk impact value includes a data threat value, a data vulnerability value and a likelihood data threat value; A risk impact level of the data to be transmitted is determined according to the risk impact value.

[0053] Optionally, the classification module 42 is specifically used to determine the classification level value corresponding to the data to be transmitted according to the risk impact level and the corresponding relationship between the preset risk impact level range and the classification level value; A classification result of the data to be transmitted is determined according to the classification level value.

[0054] Optionally, the determination module 43 is specifically configured to determine, if the data to be transmitted is asset data to be transmitted between the data transmitting end and the data receiving end, that the corresponding data protection strategy is to encrypt the data to be transmitted using a first-level encryption algorithm; If the data to be transmitted is non-asset data to be transmitted between the data sending end and the data receiving end, the corresponding data protection strategy is determined to encrypt the data to be transmitted using a second-level encryption algorithm; the encryption strength of the first-level encryption algorithm is greater than the encryption strength of the second-level encryption algorithm.

[0055] Optionally, the data to be transmitted is asset data to be transmitted between the data sending end and the data receiving end; the transmission module 44 is specifically used to encrypt the data to be transmitted using the first level encryption algorithm, and set a data transmission key between the data sending end and the data receiving end; the data transmission key is used to encrypt and decrypt relevant information of the data to be transmitted between the data sending end and the data receiving end; In response to the data receiving end decrypting the relevant information of the data to be transmitted using the data transmission key, a corresponding data access request is generated, and the data access request is sent to the data sending end; the data access request includes the data access key generated by the data receiving end; the data access key includes the public key generated by the data receiving end and the identity identification information of the data receiving end, and is used for encrypted transmission of the data to be transmitted between the data sending end and the data receiving end and identity verification of the data receiving end; In a case where the data receiving end passes the identity authentication, data transmission between the data sending end and the data receiving end is performed based on the encrypted data to be transmitted.

[0056] Optionally, the above device further includes: A confirmation module is used to send a data reception confirmation message generated by the data receiving end to the data sending end when the data receiving end has received the data to be transmitted and has confirmed the integrity of the received data to be transmitted; the data reception confirmation message is used by the data sending end to stop repeatedly sending the data to be transmitted to the data receiving end.

[0057] It can be seen from the technical solution provided by the above embodiments of the present invention that, in the embodiments of the present invention, first, the risk impact level of the data to be transmitted between the data sending end and the data receiving end is obtained; then, according to the risk impact level, the data to be transmitted is classified and processed to obtain the classification result of the data to be transmitted; then, according to the classification result, a data protection strategy matching the data to be transmitted is determined; finally, data protection processing is performed on the data to be transmitted according to the data protection strategy, and data transmission is performed between the data sending end and the data receiving end based on the processed data to be transmitted. It can be seen that through the embodiments of the present invention, the data to be transmitted can be classified according to the risk impact level of the data to be transmitted obtained, and the corresponding data protection strategy can be matched for different types of data and corresponding data protection processing can be performed, and data transmission between the data sending end and the data receiving end can be performed based on the processed data to be transmitted, which can not only improve the security of the data transmission process, but also improve the efficiency of data processing and data transmission.

[0058] The data transmission device provided in the embodiment of the present invention can implement each process in the embodiment corresponding to the above-mentioned data transmission method, and will not be described again here to avoid repetition.

[0059] It should be noted that the data transmission device provided in the embodiment of the present invention and the data transmission method provided in the embodiment of the present invention are based on the same inventive concept, so the specific implementation of this embodiment can refer to the implementation of the aforementioned data transmission method, and the repeated parts will not be repeated.

[0060] Corresponding to the data transmission method provided in the above embodiment, based on the same technical concept, an embodiment of the present invention further provides an electronic device, which is used to execute the above data transmission method. Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention is shown in FIG. Figure 5As shown, the electronic device may have relatively large differences due to different configurations or performances, and may include one or more processors 501 and memory 502, and the memory 502 may store one or more storage applications or data. Among them, the memory 502 may be a temporary storage or a permanent storage. The application stored in the memory 502 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the electronic device. Furthermore, the processor 501 may be configured to communicate with the memory 502 to execute a series of computer executable instructions in the memory 502 on the electronic device. The electronic device may also include one or more power supplies 503, one or more wired or wireless network interfaces 504, one or more input and output interfaces 505, and one or more keyboards 506.

[0061] Specifically in this embodiment, the electronic device includes a processor, a communication interface, a memory and a communication bus; wherein the processor, the communication interface and the memory communicate with each other through the bus; the memory is used to store a computer program; the processor is used to execute the program stored in the memory to implement the following method steps: Obtaining the risk impact level of data to be transmitted between a data sending end and a data receiving end; Classify the data to be transmitted according to the risk impact level to obtain a classification result of the data to be transmitted; Determining, based on the classification result, a data protection strategy that matches the data to be transmitted; The data to be transmitted is processed for data protection according to the data protection strategy, and data transmission between the data sending end and the data receiving end is performed based on the processed data to be transmitted.

[0062] It can be seen from the technical solution provided by the above embodiments of the present invention that, in the embodiments of the present invention, first, the risk impact level of the data to be transmitted between the data sending end and the data receiving end is obtained; then, according to the risk impact level, the data to be transmitted is classified and processed to obtain the classification result of the data to be transmitted; then, according to the classification result, a data protection strategy matching the data to be transmitted is determined; finally, data protection processing is performed on the data to be transmitted according to the data protection strategy, and data transmission is performed between the data sending end and the data receiving end based on the processed data to be transmitted. It can be seen that through the embodiments of the present invention, the data to be transmitted can be classified according to the risk impact level of the data to be transmitted obtained, and the corresponding data protection strategy can be matched for different types of data and corresponding data protection processing can be performed, and data transmission between the data sending end and the data receiving end can be performed based on the processed data to be transmitted, which can not only improve the security of the data transmission process, but also improve the efficiency of data processing and data transmission.

[0063] The embodiment of the present invention further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the following method steps are implemented: Obtaining the risk impact level of data to be transmitted between a data sending end and a data receiving end; Classify the data to be transmitted according to the risk impact level to obtain a classification result of the data to be transmitted; Determining, based on the classification result, a data protection strategy that matches the data to be transmitted; The data to be transmitted is processed for data protection according to the data protection strategy, and data transmission between the data sending end and the data receiving end is performed based on the processed data to be transmitted.

[0064] It can be seen from the technical solution provided by the above embodiments of the present invention that, in the embodiments of the present invention, first, the risk impact level of the data to be transmitted between the data sending end and the data receiving end is obtained; then, according to the risk impact level, the data to be transmitted is classified and processed to obtain the classification result of the data to be transmitted; then, according to the classification result, a data protection strategy matching the data to be transmitted is determined; finally, data protection processing is performed on the data to be transmitted according to the data protection strategy, and data transmission is performed between the data sending end and the data receiving end based on the processed data to be transmitted. It can be seen that through the embodiments of the present invention, the data to be transmitted can be classified according to the risk impact level of the data to be transmitted obtained, and the corresponding data protection strategy can be matched for different types of data and corresponding data protection processing can be performed, and data transmission between the data sending end and the data receiving end can be performed based on the processed data to be transmitted, which can not only improve the security of the data transmission process, but also improve the efficiency of data processing and data transmission.

[0065] An embodiment of the present invention further provides a computer program product. When the computer program is executed by a processor, each process of the above-mentioned data transmission method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0066] It should be understood by those skilled in the art that embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0067] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0068] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0069] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0070] In a typical configuration, an electronic device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0071] Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0072] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0073] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0074] It should be understood by those skilled in the art that the embodiments of the present invention may be provided as methods, devices or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0075] The above description is only an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A data transmission method, characterized in that: The method comprises: Obtaining the risk impact level of data to be transmitted between a data sending end and a data receiving end; Classify the data to be transmitted according to the risk impact level to obtain a classification result of the data to be transmitted; Determining, based on the classification result, a data protection strategy that matches the data to be transmitted; The data to be transmitted is processed for data protection according to the data protection strategy, and data transmission between the data sending end and the data receiving end is performed based on the processed data to be transmitted.

2. The method according to claim 1, characterized in that The obtaining of the risk impact level of the data to be transmitted between the data sending end and the data receiving end includes: Acquire a risk impact value associated with the data to be transmitted; the risk impact value includes a data threat value, a data vulnerability value, and a likelihood data threat value; A risk impact level of the data to be transmitted is determined according to the risk impact value.

3. The method according to claim 1, characterized in that The classifying the data to be transmitted according to the risk impact level to obtain the classification result of the data to be transmitted includes: Determine the classification level value corresponding to the data to be transmitted according to the risk impact level and the correspondence between the preset risk impact level range and the classification level value; A classification result of the data to be transmitted is determined according to the classification level value.

4. The method according to claim 1, characterized in that: The step of determining a data protection strategy that matches the data to be transmitted according to the classification result includes: If the data to be transmitted is asset data to be transmitted between the data transmitting end and the data receiving end, determining the corresponding data protection strategy is to encrypt the data to be transmitted using a first-level encryption algorithm; If the data to be transmitted is non-asset data to be transmitted between the data sending end and the data receiving end, the corresponding data protection strategy is determined to encrypt the data to be transmitted using a second-level encryption algorithm; the encryption strength of the first-level encryption algorithm is greater than the encryption strength of the second-level encryption algorithm.

5. The method according to claim 4, characterized in that The data to be transmitted is asset data to be transmitted between the data transmitting end and the data receiving end; performing data protection processing on the data to be transmitted according to the data protection strategy, and performing data transmission between the data transmitting end and the data receiving end based on the processed data to be transmitted, including: The data to be transmitted is encrypted using the encryption algorithm of the first level, and a data transmission key is set between the data sending end and the data receiving end; the data transmission key is used to encrypt and decrypt relevant information of the data to be transmitted between the data sending end and the data receiving end; In response to the data receiving end decrypting the relevant information of the data to be transmitted using the data transmission key, a corresponding data access request is generated, and the data access request is sent to the data sending end; the data access request includes the data access key generated by the data receiving end; the data access key includes the public key generated by the data receiving end and the identity identification information of the data receiving end, and is used for encrypted transmission of the data to be transmitted between the data sending end and the data receiving end and identity verification of the data receiving end; In a case where the data receiving end passes the identity authentication, data transmission between the data sending end and the data receiving end is performed based on the encrypted data to be transmitted.

6. The method according to claim 5, characterized in that Also includes: When the data receiving end receives the data to be transmitted and has confirmed the integrity of the received data to be transmitted, the data reception confirmation message generated by the data receiving end is sent to the data sending end; the data reception confirmation message is used by the data sending end to stop repeatedly sending the data to be transmitted to the data receiving end.

7. A data transmission device, characterized in that: The device comprises: An acquisition module, used to acquire the risk impact level of data to be transmitted between a data sending end and a data receiving end; A classification module, used for classifying the data to be transmitted according to the impact level to obtain a classification result of the data to be transmitted; A determination module, used to determine a data protection policy that matches the data to be transmitted according to the classification result; The transmission module is used to perform data protection processing on the data to be transmitted according to the data protection strategy, and perform data transmission between the data sending end and the data receiving end based on the processed data to be transmitted.

8. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus; wherein the processor, the communication interface and the memory communicate with each other through the bus; the memory is used to store computer programs; the processor is used to execute the programs stored in the memory to implement the steps of the data transmission method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data transmission method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that It comprises a computer program, which, when executed by a processor, implements the steps of the data transmission method according to any one of claims 1 to 6.

Images