Network data management method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a network data management method and device, computer equipment, a readable storage medium and a program product. The method comprises the steps of receiving network data transmitted by a client, analyzing the network data, performing compliance verification on the network data according to label identifiers obtained through analysis, and performing routing addressing according to network label identifiers in the label identifiers under the condition that the compliance verification is passed, and transmitting the network data subjected to label removal to a next-hop route according to an addressing result, generating a management code according to the label identifier, and reporting the management code to a supervision platform so as to indicate the supervision platform to manage a circulation path of the network data according to all the management codes reported by the network data in a transmission process. By adopting the method, the traceability in the data circulation process can be ensured, so that the efficiency and safety of data circulation are improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network data management method, apparatus, computer equipment, readable storage medium and program product. Background Art

[0002] With the widespread application of data and the growing demand for cross-border flow, it is particularly important to ensure the security and compliance of data during the circulation process. However, in actual applications, scenarios such as cross-domain, cross-network, cross-region and cross-border data flow present the characteristics of multiple parties involved, long transmission chains, and complex links. Due to the flow of data among multiple participants and complex links, there is a lack of a unified and efficient data tracking mechanism, which makes it difficult to accurately track the source and destination of data. In addition, in the circulation of data, there are many types of data, and the security attributes and compliance requirements of different data types are different. It is often impossible to accurately identify the data type, which leads to potential data security risks. Summary of the invention

[0003] Based on this, it is necessary to provide a network data management method, device, computer equipment, readable storage medium and program product that can effectively ensure the security of data circulation in response to the above technical problems.

[0004] In a first aspect, the present application provides a network data management method, comprising:

[0005] Receive network data transmitted by a client; the network data carries a tag identifier, the tag identifier includes a data tag identifier and a network tag identifier, the data tag identifier is used to represent the source information of the network data, and the network tag identifier is used to represent the network service information of the network data;

[0006] Analyze the network data and perform compliance check on the network data based on the tag identification obtained from the analysis;

[0007] If the compliance check passes, the routing addressing is performed according to the network label identifier in the label identifier, and the network data after the label is removed is transmitted to the next hop routing according to the addressing result;

[0008] A management code is generated according to the tag identification and reported to the supervision platform to instruct the supervision platform to manage the flow path of network data according to all management codes reported during the transmission of network data; the management code includes the upstream and downstream gateway information of the current supervision gateway.

[0009] In one embodiment, the data tag identifier includes a data source code, a data content code and a regulatory identifier; the data source code is registered based on the identity information of the data sender; the data content code is obtained by identifying the network data through a combination of a large model and a small model; the regulatory identifier is determined based on the sensitive information in the network data.

[0010] In one of the embodiments, the network tag identifier includes a service identifier and a transmission identifier; the service identifier is obtained according to the resource demand level of the network data; the transmission identifier is obtained by consistently marking the data content encoding and the supervision identifier at the network layer.

[0011] In one of the embodiments, the tag identification is obtained by authorization and supervision layer marking, application layer marking, network layer marking and identification network encapsulation in sequence.

[0012] In one embodiment, the step of performing compliance verification on the network data according to the tag identification obtained by parsing includes:

[0013] When the regulatory gateway is online, the parsed tag identifier is checked for consistency. If the consistency check passes, the network data is checked for compliance based on the tag identifier.

[0014] When the regulatory gateway is offline, compliance analysis is performed on network data and label identification based on big data.

[0015] In one embodiment, the method further comprises:

[0016] Capture traffic data of network data during transmission through monitoring probes;

[0017] Get the label identification of traffic data;

[0018] According to the label identification of the flow data and the label identification of the network data, the transmission reliability of the network data is checked.

[0019] In a second aspect, the present application also provides a network data management device, including:

[0020] The receiving module is used to receive the network data transmitted by the client; the network data carries a tag identifier, which includes a data tag identifier and a network tag identifier. The data tag identifier is used to represent the source information of the network data, and the network tag identifier is used to represent the network service information of the network data;

[0021] A verification module is used to parse the network data and perform compliance verification on the network data according to the tag identification obtained by the analysis;

[0022] The transmission module is used to perform routing addressing according to the network label identifier in the label identifier when the compliance check passes, and transmit the network data after de-labeling to the next hop route according to the addressing result;

[0023] The management module is used to generate a management code based on the tag identification and report the management code to the supervision platform to instruct the supervision platform to manage the flow path of the network data according to all management codes reported during the transmission of the network data; the management code includes the upstream and downstream gateway information of the current supervision gateway.

[0024] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method steps of any one of the first aspects are implemented.

[0025] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements any one of the method steps in the first aspect when the computer program is executed by a processor.

[0026] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which implements any one of the method steps in the first aspect when executed by a processor.

[0027] The above-mentioned network data management method, device, computer equipment, readable storage medium and program product, by integrating multi-dimensional information such as data content, sender identity, network requirements, etc., form a multi-layer label identification, and verify the compliance of network data according to the label identification, which can prevent unauthorized data transmission, ensure network security, and realize the full life cycle management of data from generation, transmission to storage and processing. In addition, when the network data passes through the supervision gateway, the upstream and downstream gateway information is reported to the supervision platform through the supervision gateway, so that the supervision platform can trace the flow path of the network data according to all gateway information in the transmission process, ensure the traceability of the data flow process, thereby improving the efficiency and security of data flow. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0029] Figure 1 An application environment diagram of a network data management method in an embodiment;

[0030] Figure 2 A schematic diagram of a flow chart of a network data management method in one embodiment;

[0031] Figure 3 A schematic diagram of a system for generating a label identifier in one embodiment;

[0032] Figure 4 A schematic diagram of a packaging process of a label identification in an embodiment;

[0033] Figure 5 is a schematic diagram of a network data management architecture in one embodiment;

[0034] Figure 6 A schematic diagram of label identification quality assessment in another embodiment;

[0035] Figure 7 is a structural block diagram of a network data management device in one embodiment;

[0036] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0038] With the rapid development of information technology and the widespread application of the Internet, data has become an indispensable and important resource in modern society. Data not only plays a vital role in fields such as business operations and scientific research, but also plays a bridging role in cross-border cooperation and exchanges. However, with the widespread application of data and the increasing demand for cross-border flow, how to ensure the security and compliance of data during the circulation process has become an urgent problem to be solved.

[0039] In scenarios where data flows across domains, networks, regions, and borders, network data governance faces many challenges due to the involvement of multiple parties, long transmission chains, and complex links. Specifically, these challenges include but are not limited to difficulties in tracing data circulation, identifying data types, and verifying compliance. These issues not only pose major challenges to network data supervision, but also restrict the effective use of data and the realization of its value.

[0040] However, the existing network data governance framework and technical means often lack a unified, flexible and efficient standard system and technical architecture, which makes it difficult to accurately identify, quickly trace and efficiently verify compliance of data during data circulation and use. This not only increases the difficulty and complexity of data management, but also reduces the efficiency and security of data circulation.

[0041] In this context, label identification technology, as a technology for implementing identity feature identification and security attribute marking for data resources, can achieve accurate tracking and compliance verification of data by labeling data during data circulation and use, providing new ideas and methods for solving difficult problems in network data governance.

[0042] However, most of the existing tagging technologies can only achieve simple identification and classification of data, and it is difficult to fully capture the multi-dimensional characteristics of data, nor can it fully utilize the data transmission network resources to achieve transmission reliability. Therefore, how to build a new network data flow risk monitoring system to achieve accurate identification of data types, rapid tracing of data circulation, and efficient handling of risk identification has become a key issue that needs to be solved urgently.

[0043] Based on this, the embodiment of the present application provides a method for managing network data. By integrating multi-layer label identification technology and network data governance technology architecture that integrate multi-dimensional information such as data, identity, and network, it solves the problems in existing network data governance, realizes the full life cycle management of data from generation, transmission to storage and processing, and applies label identification technology to data compliance verification to build an automated compliance detection system to reduce management costs and complexity and improve the efficiency and security of data circulation.

[0044] The network data management method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the supervision gateway 102 communicates with the client 104 and the supervision platform 106 through the network respectively. Among them, the supervision gateway 102 is used to receive the network data transmitted by the client 104; the network data carries a tag identifier, the tag identifier includes a data tag identifier and a network tag identifier, the data tag identifier is used to characterize the source information of the network data, and the network tag identifier is used to characterize the network service information of the network data; the network data is parsed, and the network data is checked for compliance according to the tag identifier obtained by the parsing. If the compliance check passes, the routing addressing is performed according to the network tag identifier in the tag identifier, and the network data after the tag is removed is transmitted to the next hop route according to the addressing result, and the management code is generated according to the tag identifier, and the management code is reported to the supervision platform 106 to instruct the supervision platform 106 to manage the circulation path of the network data according to all the management codes reported by the network data during the transmission process; the management code includes the upstream and downstream gateway information of the current supervision gateway.

[0045] In an exemplary embodiment, Figure 2 As shown, a network data management method is provided, which is applied to Figure 1Taking the supervision gateway 102 in FIG. 1 as an example, the method includes the following steps 202 to 208. Among them:

[0046] S202: Receive network data transmitted by the client; the network data carries a tag identifier, which includes a data tag identifier and a network tag identifier. The data tag identifier is used to represent source information of the network data, and the network tag identifier is used to represent network service information of the network data.

[0047] Optionally, before the client transmits network data, the corresponding tag identifier is generated by integrating identity, content and network tag identifier according to a unified tag identifier generation rule. For example, for the identity identifier part, the sender of the data (such as a specific enterprise, department, etc.) is used as part of the source information in the data tag identifier, and for the network tag identifier part, the network tag identifier is generated according to the required network bandwidth, transmission priority and other contents that reflect the network service information. In addition, the tag identifier also includes an identifier prefix, which can be compatible with the industrial Internet identification system through the identifier prefix, ensuring its versatility in a wider network environment. Among them, it should be noted that when the tag identifier is generated, it is generated according to a unified coding specification, such as binary coding, XML coding, database field storage, etc., which can ensure the compatibility and operability of the tag identifier in different storage and transmission scenarios, so that the tag identifier carried by the network data sent by the client can accurately convey the source information and network service information contained therein in a suitable coding form, which is convenient for subsequent processing.

[0048] Optionally, under different network transmission requirements, the tag identifier can be bound to the network data through three modes: embedded, encapsulated, and separated, so that the tag identifier can be firmly combined with the network data and sent to the receiving end (i.e., the regulatory gateway) along with the network data, so that the network data received by the regulatory gateway can carry a complete and rule-compliant tag identifier to accurately reflect its source and network service-related information.

[0049] S204: Analyze the network data, and perform compliance check on the network data according to the tag identification obtained by the analysis.

[0050] Optionally, the supervision network parses the label identifiers carried by the network data, extracts the data label identifiers and the network label identifiers, and verifies the compliance of the network data. During the verification, the parsed label identifiers can be compared with the unified label template provided by the pre-established label identifier standard library covering various data types, sensitivity levels and compliance requirements for compliance verification. For example, the source of the verification data (reflected by the data label identifier) ​​is a legal and compliant source, and whether it meets the management requirements of the corresponding sensitive level data. For network service information (reflected by the network label identifier), check whether its requirements are within the permitted range and whether it meets the relevant standards for network resource allocation and management. At the same time, the label identifier itself has a security protection mechanism, and its integrity and confidentiality are guaranteed by encryption technology and digital signatures, which ensures that the label identifier based on the verification is not tampered with and is authentic and valid, so as to accurately judge whether the network data is compliant.

[0051] S206: When the compliance check passes, perform routing addressing according to the network label identifier in the label identifier, and transmit the network data after de-labeling to the next-hop routing according to the addressing result.

[0052] Optionally, when the compliance check is passed, routing addressing is performed based on the network label identifier in the data label identifier, where the network label identifier can indicate where the data should be forwarded. The regulatory gateway will find the next-hop route based on this information and transmit the de-labeled network data (i.e., network data with the label identifier removed) to the next-hop route.

[0053] S208: Generate a management code based on the tag identifier, and report the management code to the supervision platform to instruct the supervision platform to manage the flow path of the network data based on all management codes reported during the transmission of the network data; the management code includes the upstream and downstream gateway information of the current supervision gateway.

[0054] Optionally, when network data passes through the supervision gateway, the supervision network will generate a management code based on the data tag identifier, where the management code contains the upstream and downstream gateway information of the current supervision gateway. The supervision gateway reports the management code to the supervision platform, and the supervision platform manages the flow path of network data by collecting all management codes reported during the transmission of network data. For example, the supervision platform can track all gateways that network data passes through, thereby achieving comprehensive supervision of the data flow path.

[0055] In the above network data management method, by integrating multi-dimensional information such as data content, sender identity, network requirements, etc., a multi-layer label identification is formed, and the compliance of network data is verified according to the label identification, which can prevent unauthorized data transmission, ensure network security, and realize the full life cycle management of data from generation, transmission to storage and processing. In addition, when network data passes through the supervision gateway, the upstream and downstream gateway information is reported to the supervision platform through the supervision gateway, so that the supervision platform can trace the flow path of network data according to all gateway information in the transmission process, ensure the traceability of data flow, and thus improve the efficiency and security of data flow.

[0056] In an exemplary embodiment, the data tag identification includes a data source code, a data content code and a regulatory identification; the data source code is registered based on the identity information of the data sender; the data content code is obtained by identifying the network data through a combination of a large model and a small model; the regulatory identification is determined based on the sensitive information in the network data.

[0057] Optionally, in the entire data label identification system, the data source code is a key identifier used to clarify where the data comes from. The data source code is generated by the data sender through information registration, and is used to characterize the identity of the data source device and user. For example, in telecommunications services, it may be reflected in specific information such as customer number, equipment number, and service type. The sender registers its own relevant identity information in the corresponding system according to certain rules and procedures. The system generates a unique data source code based on these registration contents, thereby clearly marking the source of the data, providing a basic basis for subsequent data tracing, management, and compliance judgment.

[0058] Specifically, since data often has significant business characteristics, the knowledge formed by the AI ​​big model after learning massive business data can quickly perform preliminary data type identification and determine the business category to which the data belongs. After the big model completes the preliminary identification of the data type, the small AI model can further refine and classify the results of the big model identification according to more detailed rules, simple judgment logic, etc. Among them, when encoding the data content, an automated algorithm is used, and different analysis models can be flexibly selected according to the complexity of the data, such as sensitive word matching, self-training NLP model, and big model analysis. Through these different analysis methods, the use of AI big and small model fusion technology can not only accurately determine the specific type of data, but also further analyze the classification and grading of the data, timeliness characteristics, network service requirements, transmission security level and other aspects, and finally form a comprehensive data content encoding to comprehensively and accurately reflect the actual content characteristics of network data.

[0059] Furthermore, network data may contain sensitive information of varying degrees, and the regulatory identification is determined based on this sensitive information. Through the AI ​​large and small model fusion technology, the regulatory gateway can automatically identify sensitive information and its number. For example, by performing in-depth scanning and analysis of network data, using the semantic understanding ability of the large model and the rule-based troubleshooting ability of the small model, sensitive content involving privacy can be accurately found.

[0060] For example, according to the range of sensitive information quantity set in the current supervision, such as 1 million pieces of sensitive information, 1 million to 100,000 pieces, 100,000 pieces of sensitive information, etc., the required supervision methods of review, filing and certification and licensing are respectively confirmed, and the corresponding supervision requirements are marked as supervision marks. Based on this, the supervision mark can reflect the rules and measures that need to be followed and taken at the supervision level for the network data, and provide clear guidance for the subsequent compliance management of data and the supervision and processing at different links.

[0061] In this embodiment, the data source code is obtained by registering the identity information of the data sender, so that the source of the network data can be clarified, and then the sender of the data can be quickly located through the data source code. By combining the large model and the small model for data identification to obtain the data content code, accurate classification of the data can be achieved, so that the data can be effectively supervised through data label identification to ensure the security of data transmission.

[0062] In an exemplary embodiment, the network tag identifier includes a service identifier and a transmission identifier; the service identifier is obtained according to the resource demand level of the network data; the transmission identifier is obtained by consistently marking the data content encoding and the supervision identifier at the network layer.

[0063] Optionally, the service identifier in the network tag identifier is determined based on the degree of demand for various resources during the transmission of network data. Different network data has different requirements for network resources such as bandwidth, delay, processing power, etc. due to their own characteristics and differences in application scenarios. Through multi-level analysis of device type, service requirements, transmission data, etc., network data is classified according to its degree of demand for different resources and mapped to different service types, thereby obtaining corresponding service identifiers.

[0064] Optionally, the acquisition of the transmission identifier requires reference to the data content coding and regulatory identification in the data domain, where the data content coding is obtained by identifying network data through a combination of a large model and a small model, and includes a characteristic description of the data itself, such as data type, classification and grading information, while the regulatory identification is determined based on sensitive information in the network data, reflecting the requirements and characteristics of the data in terms of supervision.

[0065] Furthermore, at the network layer, the data content encoding and regulatory identification are consistently marked, that is, the accuracy and consistency of these identifications during network transmission are ensured. Through consistent marking, the transmission identification in the network label identification is generated, which is used to more accurately manage and control data during network transmission.

[0066] For example, Figure 3 As shown, Figure 3 It is a label identification generation system, in which, in the data domain, data analysis is performed by combining large models and small models to generate data label identification, and then the data payload is carried and processed at the application layer of the network to ensure that the data can be correctly transmitted and processed at the application layer. Among them, the data label identification includes device object attributes (i.e., the sender device of network data), content resource attributes (i.e., network data resources) and application service attributes (i.e., application service requirements). Among them, the device object attributes include information such as device type, serial number, manufacturer, etc., which are used to uniquely identify the device in the network. The device type determines the function and applicable scenario of the device. The serial number is used to distinguish different devices of the same type, and the manufacturer information is used to characterize the source and quality of the device. Content resource attributes include resource name, resource type, version information, etc., which are used to describe content resources in the network. Resource name and type facilitate classification and search of resources, and version information is used to update and manage resources. Application service attributes include service name, service type, security level, etc., which are used to describe application services in the network. Service name and type help users identify and select services, and security level reflects the degree of protection of services in terms of data protection and privacy.

[0067] Furthermore, in the network domain, resource perception is performed through telemetry technology and device interface interaction to generate network label identification. After that, network label identification is further expanded and applied based on IPv6. Among them, network label identification includes network link status, computing power facility status and storage service status. Among them, network link status includes information such as bandwidth, connected devices, device load, and identification generation, which is used to describe the characteristics of network connection. For example, the bandwidth of the network determines the upper limit of the data transmission speed. The number and type of connected devices affect the topology and management of the network. The device load reflects the busyness of the network device. The identification generation may be related to the identity of the network device. The computing power facility status includes computing power type, computing power location, device load, identification generation, etc. Among them, computing power type and location are crucial to understanding the distribution of computing resources in the network. Different types of computing power facilities (such as CPU, GPU, etc.) are suitable for different computing tasks, and their location affects the efficiency and delay of data processing. Device load also reflects the usage of computing power facilities, and identification generation may be used to uniquely identify these computing power facilities. The storage service status includes device type, read / write speed, remaining space, and identification generation. The device type includes the storage medium and performance characteristics. The read / write speed affects the efficiency of data storage and reading. The remaining space reflects the availability of storage resources. The identification generation is used to identify the storage device.

[0068] In this embodiment, network resources can be reasonably allocated through service identification to ensure the efficiency of network data transmission. Data content encoding and regulatory identification are consistently marked at the network layer. Since data content encoding reflects the characteristics of the data itself, and regulatory identification reflects the sensitivity of the data and regulatory requirements, consistent marking at the network layer can ensure the integrity and security of data during transmission.

[0069] In an exemplary embodiment, the tag identification is obtained by authorization supervision layer marking, application layer marking, network layer marking and identification network encapsulation in sequence.

[0070] For example, Figure 4 As shown, Figure 4The diagram is a schematic diagram of the encapsulation process of the tag identification, in which the authorization and supervision layer marking includes rule identification, standard contract, hash certificate, digital certificate, verification information, reserved code and authorization token, etc. The authorization and supervision layer mainly processes the tag identification from the perspective of supervision and authorization to ensure the legitimacy and security of the data. Among them, these identifications are made at the data content level to ensure the legitimacy, security and integrity of the data, which is also an important part of the data tag identification generation. Among them, the application layer marking is used to map the data content to a higher level of identification, including country code, industry code, enterprise code, supervision code, sender identification, receiver identification, data resource attributes, data business attributes, data security attributes, data application attributes, data reserved code, data content and other identifications. Among them, the result of the network tag identification generation is mapped to the data tag identification at this layer, so that the data can be correctly identified and processed at the application layer. After that, network layer labeling is performed through label identification mapping, where network layer labeling includes source network identity, destination network identity, network layer service attributes, network layer security attributes, network layer transmission identification, network layer verification credentials and reserved coding, payload, etc. These identifications are the key parts of network label identification generation, ensuring that data in the network can be correctly identified, routed and processed. Finally, identity network encapsulation is performed through identity location mapping, where identity network encapsulation includes source network location identification and next hop network location identification, which is the basic part of network domain label identification generation, focusing on location information in the network.

[0071] Depend on Figure 4 It can be seen that network label identification generation is the foundation. It starts from the lowest level network location identification and gradually adds network identity, business attributes, security attributes and other identifications upwards, providing basic identification and protection for data transmission in the network. Data label identification generation is an upper-level application. Based on the results of network label identification generation, it adds data content-related identification at a higher level to ensure the correct identification, processing and security of data at the application layer. Network label identification generation and data label identification generation are interrelated at all levels, from network location to data content, and jointly ensure the correct transmission and processing of data in the network and application.

[0072] In this embodiment, a label identification is obtained through multi-layer encapsulation. During the multi-layer encapsulation process, data can be securely processed at different levels, which can prevent the data from being stolen or tampered with during transmission, thereby improving the security of network data transmission.

[0073] In an exemplary embodiment, the step of performing compliance verification on network data based on the tag identification obtained by parsing includes: when the regulatory gateway is online, performing consistency verification on the tag identification obtained by parsing, and when the consistency verification passes, performing compliance verification on the network data based on the tag identification; when the regulatory gateway is offline, performing compliance analysis on the network data and tag identification based on big data.

[0074] Optionally, when the regulatory gateway is online, it will perform consistency checks on the parsed tag identifiers to determine whether the tag identifiers are consistent in each link. If the consistency check passes, the network data will be checked for compliance based on the tag identifiers, where the compliance check will determine whether the network data complies with regulations based on the relevant information in the tag identifiers. For example, for data tag identifiers, if the data source code does not match the registration information, or the data type in the data content code does not match the actual data, or the regulatory identifier shows that the data involves sensitive information but there are no corresponding processing measures, it will be judged as non-compliant. For network tag identifiers, if the network resources required by the service identifier do not match the actual information provided, or the transmission identifier does not meet the security control requirements of the network layer, it will also be considered non-compliant.

[0075] Optionally, when the regulatory gateway is offline, it is impossible to perform consistency verification on the tag identification in real time. At this time, the compliance analysis of network data and tag identification is performed based on big data. For example, by learning a large amount of historical compliance data, a data model is established. When offline network data arrives, the model is used to analyze whether its tag identification and data content meet the compliance requirements.

[0076] In this embodiment, through consistency verification and compliance verification in an online state, data tampering during transmission can be discovered in a timely manner to ensure data integrity and security. Through compliance analysis based on big data in an offline state, the transmission security of network data can be further guaranteed.

[0077] In an exemplary embodiment, the method further includes: capturing the flow data of the network data during transmission by means of a monitoring probe; obtaining the label identification of the flow data; and performing transmission reliability verification on the network data according to the label identification of the flow data and the label identification of the network data.

[0078] Optionally, monitoring probes are deployed in the network to capture traffic data during the transmission of network data. For example, in an enterprise network, monitoring probes can be set up at key network nodes, such as gateways and core switches, to comprehensively monitor the transmission of network data. The captured traffic data contains various information during the network data transmission process, such as the size of the data packet, transmission time, source IP address, destination IP address, transmission protocol, etc., reflecting the actual transmission status of network data in the network.

[0079] Furthermore, the tag identifier is obtained from the captured traffic data, and the network data is checked for transmission reliability based on the tag identifier of the traffic data and the tag identifier of the network data itself to prevent unauthorized transmission and processing. Among them, the transmission reliability check usually includes data integrity check (such as whether the data has been tampered with during transmission), data transmission path check (such as whether the transmission is carried out according to the path required by the tag identifier), network resource matching check (such as whether the network resources required by the tag identifier, such as bandwidth, delay, etc.) are obtained, etc.

[0080] In this embodiment, by verifying the transmission reliability, it is possible to promptly detect whether the network data has been tampered with during the transmission process, thereby ensuring the security and integrity of the data.

[0081] In an exemplary embodiment, Figure 5 As shown, a network data management architecture is provided, in which business party A and business party B have business servers inside, and the business servers contain important data and personal information. These data are managed and displayed through the data asset map. The data asset map can help understand the distribution and attributes of the data. In addition, business party A and business party B both have data circulation gateways, which are responsible for the inflow and outflow of data to ensure the safe transmission of data within and outside the unit. Each unit is also equipped with a policy management module, which is used to formulate and manage data processing and circulation policies to ensure that data operations comply with the regulations and requirements within the unit. Among them, the data in business party A and business party B flows to the identification network through the data circulation gateway. During the data outflow process, the data will be marked with a "trusted subject label identification flow", which helps the identification network identify the source and reliability of the data.

[0082] After receiving data from business parties A and B, the identification network will mark the data at multiple levels, including data content marking, application layer marking, and network layer marking, and classify, manage, and protect the data through these markings. The data will also be encrypted in the identification network to ensure data security. At the same time, the flow of data in the identification network will also be monitored and managed to prevent data leakage and abuse. Among them, the identification network is connected to the Internet and exchanges data with the outside world through the supervision gateway. The supervision gateway is responsible for compliance inspection and management of data entering and leaving the identification network to ensure that the outflow and inflow of data comply with relevant laws and regulations. In addition, the identification network is also connected to the compliance supervision system, which supervises the operation and circulation of data in the identification network to ensure the compliance of the entire data management process.

[0083] When data flows from the identification network to the Internet, it will go through operations such as de-identification, traffic identification, and identification verification to ensure the security and accuracy of the data during outflow. At the same time, the data will also be monitored by heterogeneous computing power scheduling and DPU traffic probes when it flows out, optimizing data transmission and preventing abnormal data outflow.

[0084] Data flowing into the identification network from the Internet will undergo CA authentication, identification resolution and other operations to ensure the legitimacy and reliability of external data. After flowing into the identification network, external data will also be marked accordingly and undergo compliance inspection and management to ensure that it meets the data management requirements within the identification network.

[0085] The compliance supervision system conducts comprehensive supervision on the data operation and circulation in the identification network, and ensures that the data management process in the identification network complies with relevant laws and regulations through functions such as compliance verification, traffic authorization, traceability management, policy management, and tracking and tracing. Among them, the compliance supervision system also works closely with the supervision gateway to strictly supervise the data entering and leaving the identification network to prevent illegal data operations and leaks.

[0086] For example, Figure 6 As shown, Figure 6 Schematic diagram of label identification quality assessment for regulatory gateways, where label identification quality assessment involves the assessment of accuracy, coverage, consistency and business relevance, and mainly includes three parts: label identification resolution, large-scale identification traffic verification engine and data management.

[0087] Among them, tag identification resolution includes:

[0088] (1) The tag identification and resolution system is the starting point of the entire process and is responsible for registration, resolution and data management. Through this system, basic operations on tag identification can be performed.

[0089] (2) Heterogeneous tag identification interoperability mechanism: It ensures that tags with different structures can interoperate and convert with each other. Through mutual recognition operations, it solves the compatibility issues between different identification systems (such as standard identification system and heterogeneous identification system).

[0090] (3) Complete label identification coding rules: Based on label identification traffic and NIC (DU) and other information, complete label identification coding rules are formulated to ensure the accuracy and completeness of label identification.

[0091] Among them, large-scale identification traffic includes:

[0092] (1) Heterogeneous data label verification model: used to process the original user data and label data content verification model, and verify the label through automatic language understanding, image, speech recognition and other methods.

[0093] (2) Consistency verification: Based on the results generated by the label identification, consistency verification is performed to check whether the label identification remains consistent in different links.

[0094] (3) De-identification and data processing: After the consistency verification is passed, de-identification processing is carried out, the de-identified data is output, and the regulatory side is supported for evidence collection, accountability and big data analysis.

[0095] Data management includes:

[0096] (1) Execution and recording: Recording information such as execution time and whether the execution is successful or not, and managing identity, content depth verification, security level, etc.

[0097] (2) Result storage and analysis: The results are stored in a database and big data analysis is performed. This helps to evaluate the quality and effectiveness of label identification.

[0098] In this embodiment, by integrating multi-dimensional information such as data content, sender identity, network requirements, etc., a multi-layer label identification is formed, and the compliance of network data is verified according to the label identification, which can prevent unauthorized data transmission, ensure network security, and realize the full life cycle management of data from generation, transmission to storage and processing. In addition, when network data passes through the regulatory gateway, the upstream and downstream gateway information is reported to the regulatory platform through the regulatory gateway, so that the regulatory platform can trace the flow path of network data based on all gateway information in the transmission process, ensure the traceability of data flow, and thus improve the efficiency and security of data flow.

[0099] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0100] Based on the same inventive concept, the embodiment of the present application also provides a network data management device for implementing the network data management method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more network data management device embodiments provided below can refer to the limitations of the network data management method above, and will not be repeated here.

[0101] In an exemplary embodiment, Figure 7 As shown, a network data management device is provided, comprising: a receiving module 10, a checking module 20, a transmission module 30 and a management module 40, wherein:

[0102] The receiving module 10 is used to receive network data transmitted by the client; the network data carries a tag identifier, which includes a data tag identifier and a network tag identifier. The data tag identifier is used to represent the source information of the network data, and the network tag identifier is used to represent the network service information of the network data.

[0103] The verification module 20 is used to parse the network data and perform compliance verification on the network data according to the tag identification obtained by the analysis.

[0104] The transmission module 30 is used to perform routing addressing according to the network label identifier in the label identifier when the compliance check passes, and transmit the network data after de-labeling to the next hop router according to the addressing result.

[0105] The management module 40 is used to generate a management code based on the tag identification and report the management code to the supervision platform to instruct the supervision platform to manage the flow path of the network data according to all management codes reported during the transmission of the network data; the management code includes the upstream and downstream gateway information of the current supervision gateway.

[0106] In an exemplary embodiment, the data tag identification involved in the receiving module 10 includes a data source code, a data content code and a regulatory identification; the data source code is obtained by registering the identity information of the data sender; the data content code is obtained by identifying the network data by combining a large model and a small model; the regulatory identification is determined based on the sensitive information in the network data.

[0107] In an exemplary embodiment, the network tag identification involved in the receiving module 10 includes a service identification and a transmission identification; the service identification is obtained according to the resource demand level of the network data; the transmission identification is obtained by consistently marking the data content encoding and the supervision identification at the network layer.

[0108] In an exemplary embodiment, the tag identification involved in the receiving module 10 is obtained through authorization and supervision layer marking, application layer marking, network layer marking and identification network encapsulation in sequence.

[0109] In an exemplary embodiment, the verification module 20 is also used to perform consistency verification on the parsed tag identification when the supervision gateway is online, and if the consistency verification passes, perform compliance verification on the network data according to the tag identification; when the supervision gateway is offline, perform compliance analysis on the network data and tag identification based on big data.

[0110] In an exemplary embodiment, the management module 40 is also used to capture the flow data of the network data during transmission through a monitoring probe; obtain the label identification of the flow data; and verify the transmission reliability of the network data based on the label identification of the flow data and the label identification of the network data.

[0111] Each module in the above network data management device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module.

[0112] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 8As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store network data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network data management method is implemented.

[0113] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0114] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the following steps when executing the computer program: receiving network data transmitted by a client; the network data carries a label identifier, the label identifier includes a data label identifier and a network label identifier, the data label identifier is used to characterize the source information of the network data, and the network label identifier is used to characterize the network service information of the network data; parsing the network data, and performing compliance verification on the network data according to the label identifier obtained by the analysis; when the compliance verification passes, performing routing addressing according to the network label identifier in the label identifier, and transmitting the de-labeled network data to the next hop route according to the addressing result; generating a management code according to the label identifier, and reporting the management code to a supervision platform to instruct the supervision platform to manage the flow path of the network data according to all management codes reported during the transmission of the network data; the management code includes the upstream and downstream gateway information of the current supervision gateway.

[0115] In one embodiment, the data label identification involved when the processor executes a computer program includes a data source code, a data content code and a regulatory identification; the data source code is obtained by registering the identity information of the data sender; the data content code is obtained by identifying the network data by combining a large model and a small model; the regulatory identification is determined based on the sensitive information in the network data.

[0116] In one embodiment, the network label identifiers involved when the processor executes a computer program include a service identifier and a transmission identifier; the service identifier is obtained based on the resource demand level of the network data; the transmission identifier is obtained by consistently marking the data content encoding and the supervision identifier at the network layer.

[0117] In one embodiment, the tag identification involved when the processor executes the computer program is obtained through authorization supervision layer marking, application layer marking, network layer marking and identification network encapsulation in sequence.

[0118] In one embodiment, the compliance check of network data based on the tag identification obtained by parsing is involved when the processor executes a computer program, including: when the regulatory gateway is online, performing a consistency check on the tag identification obtained by parsing, and when the consistency check passes, performing a compliance check on the network data based on the tag identification; when the regulatory gateway is offline, performing a compliance analysis on the network data and the tag identification based on big data.

[0119] In one embodiment, when the processor executes the computer program, the following steps are also implemented: capturing the flow data of the network data during transmission through a monitoring probe; obtaining the label identification of the flow data; and performing transmission reliability verification on the network data based on the label identification of the flow data and the label identification of the network data.

[0120] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and the computer program implements the following steps when executed by a processor: receiving network data transmitted by a client; the network data carries a label identifier, the label identifier includes a data label identifier and a network label identifier, the data label identifier is used to characterize the source information of the network data, and the network label identifier is used to characterize the network service information of the network data; parsing the network data, and performing compliance verification on the network data according to the label identifier obtained by the analysis; when the compliance verification passes, performing routing addressing according to the network label identifier in the label identifier, and transmitting the de-labeled network data to the next-hop routing according to the addressing result; generating a management code according to the label identifier, and reporting the management code to a supervision platform to instruct the supervision platform to manage the flow path of the network data according to all management codes reported by the network data during transmission; the management code includes the upstream and downstream gateway information of the current supervision gateway.

[0121] In one embodiment, the data label identification involved when the computer program is executed by the processor includes a data source code, a data content code and a regulatory identification; the data source code is obtained by registering the identity information of the data sender; the data content code is obtained by identifying the network data by combining the large model and the small model; the regulatory identification is determined based on the sensitive information in the network data.

[0122] In one embodiment, the network label identifiers involved when a computer program is executed by a processor include a service identifier and a transmission identifier; the service identifier is obtained based on the resource demand level of the network data; the transmission identifier is obtained by consistently marking the data content encoding and the supervision identifier at the network layer.

[0123] In one embodiment, the tag identification involved when the computer program is executed by the processor is obtained in sequence through authorization supervision layer marking, application layer marking, network layer marking and identification network encapsulation.

[0124] In one embodiment, when a computer program is executed by a processor, compliance verification of network data is performed based on the tag identification obtained by parsing, including: when the regulatory gateway is online, consistency verification of the tag identification obtained by parsing is performed, and when the consistency verification passes, compliance verification of the network data is performed based on the tag identification; when the regulatory gateway is offline, compliance analysis of the network data and the tag identification is performed based on big data.

[0125] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: capturing the flow data of the network data during transmission through a monitoring probe; obtaining the label identification of the flow data; and performing transmission reliability verification on the network data based on the label identification of the flow data and the label identification of the network data.

[0126] In one embodiment, a computer program product is provided, including a computer program, which implements the following steps when executed by a processor: receiving network data transmitted by a client; the network data carries a label identifier, the label identifier includes a data label identifier and a network label identifier, the data label identifier is used to characterize the source information of the network data, and the network label identifier is used to characterize the network service information of the network data; parsing the network data, and performing compliance verification on the network data according to the label identifier obtained by the analysis; when the compliance verification passes, performing routing addressing according to the network label identifier in the label identifier, and transmitting the de-labeled network data to the next hop route according to the addressing result; generating a management code according to the label identifier, and reporting the management code to a supervision platform to instruct the supervision platform to manage the flow path of the network data according to all management codes reported by the network data during transmission; the management code includes the upstream and downstream gateway information of the current supervision gateway.

[0127] In one embodiment, the data label identification involved when the computer program is executed by the processor includes a data source code, a data content code and a regulatory identification; the data source code is obtained by registering the identity information of the data sender; the data content code is obtained by identifying the network data by combining the large model and the small model; the regulatory identification is determined based on the sensitive information in the network data.

[0128] In one embodiment, the network label identifiers involved when a computer program is executed by a processor include a service identifier and a transmission identifier; the service identifier is obtained based on the resource demand level of the network data; the transmission identifier is obtained by consistently marking the data content encoding and the supervision identifier at the network layer.

[0129] In one embodiment, the tag identification involved when the computer program is executed by the processor is obtained in sequence through authorization supervision layer marking, application layer marking, network layer marking and identification network encapsulation.

[0130] In one embodiment, when a computer program is executed by a processor, compliance verification of network data is performed based on the tag identification obtained by parsing, including: when the regulatory gateway is online, consistency verification of the tag identification obtained by parsing is performed, and when the consistency verification passes, compliance verification of the network data is performed based on the tag identification; when the regulatory gateway is offline, compliance analysis of the network data and the tag identification is performed based on big data.

[0131] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: capturing the flow data of the network data during transmission through a monitoring probe; obtaining the label identification of the flow data; and performing transmission reliability verification on the network data based on the label identification of the flow data and the label identification of the network data.

[0132] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0133] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0134] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0135] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network data management method, characterized in that: Applied to a regulatory gateway; the method comprises: Receive network data transmitted by a client; the network data carries a tag identifier, the tag identifier includes a data tag identifier and a network tag identifier, the data tag identifier is used to represent source information of the network data, and the network tag identifier is used to represent network service information of the network data; Parsing the network data, and performing compliance verification on the network data according to the tag identification obtained by the parsing; If the compliance check passes, routing addressing is performed according to the network label identifier in the label identifier, and the network data after de-labeling is transmitted to the next hop routing according to the addressing result; A management code is generated according to the tag identifier, and the management code is reported to the supervision platform to instruct the supervision platform to manage the circulation path of the network data according to all management codes reported during the transmission of the network data; the management code includes the upstream and downstream gateway information of the current supervision gateway.

2. The method according to claim 1, characterized in that The data tag identifier includes a data source code, a data content code and a supervision identifier; the data source code is obtained by registering based on the identity information of the data sender; the data content code is obtained by identifying the network data through a combination of a large model and a small model; the supervision identifier is determined based on the sensitive information in the network data.

3. The method according to claim 2, characterized in that The network tag identifier includes a service identifier and a transmission identifier; the service identifier is obtained according to the resource demand level of the network data; the transmission identifier is obtained by encoding the data content and the supervision identifier for consistency at the network layer.

4. The method according to claim 1, characterized in that: The tag identification is obtained through authorization and supervision layer marking, application layer marking, network layer marking and identification network encapsulation in sequence.

5. The method according to claim 1, characterized in that The performing compliance verification on the network data according to the tag identification obtained by parsing includes: When the supervision gateway is online, a consistency check is performed on the tag identification obtained by the analysis, and when the consistency check passes, a compliance check is performed on the network data according to the tag identification; When the supervision gateway is in an offline state, compliance analysis is performed on the network data and the tag identification based on big data.

6. The method according to claim 1, characterized in that The method further comprises: Capturing the traffic data of the network data during transmission by means of a monitoring probe; Obtaining a label identification of the flow data; A transmission reliability check is performed on the network data according to the label identifier of the flow data and the label identifier of the network data.

7. A network data management device, characterized in that: The device comprises: A receiving module, used to receive network data transmitted by a client; the network data carries a tag identifier, the tag identifier includes a data tag identifier and a network tag identifier, the data tag identifier is used to represent the source information of the network data, and the network tag identifier is used to represent the network service information of the network data; A verification module, used to parse the network data and perform compliance verification on the network data according to the tag identification obtained by the analysis; A transmission module, used for performing routing addressing according to the network label identifier in the label identifier when the compliance check passes, and transmitting the network data after de-labeling to the next hop route according to the addressing result; A management module is used to generate a management code based on the tag identifier and report the management code to the supervision platform to instruct the supervision platform to manage the circulation path of the network data according to all management codes reported during the transmission of the network data; the management code includes the upstream and downstream gateway information of the current supervision gateway.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images