Data transmission method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a data transmission method and device, electronic equipment and a storage medium, a multi-tunnel network comprises a plurality of tunnels and a tunnel matching module, and a tunnel application matching table is deployed in the tunnel matching module. The tunnel application matching table comprises a corresponding relationship between each tunnel application and the data feature of the tunnel traffic data correspondingly processed by each tunnel application; the tunnel matching module receives the target tunnel traffic data and determines target data features of the target tunnel traffic data; querying a corresponding relationship in a tunnel application matching table based on the target data feature, and determining a target tunnel application corresponding to the target data feature; and sending the target tunnel traffic data to the target tunnel application. According to the embodiment of the invention, tunnel messages of other services can be protected, and various tunnel protocols can be flexibly and efficiently supported.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and in particular to a data transmission method, device, electronic equipment and storage medium. Background Art

[0002] With the increasing application of tunnel technology, tunnel protocols are changing, and there are multiple services using the same tunnel protocol in the same network, that is, multi-tunnel networks. In the scenario of multiple tunnels in the same network, such as cloud networks, each tunnel application processes and only processes the tunnel traffic of the expected network. For tunnel traffic from other networks or IP (Internet Protocol), although the protocol is the same, it is not the expected traffic and does not need to be processed. If a large amount of such traffic is received, the application is easily vulnerable to security attacks and resource waste. Summary of the invention

[0003] In view of the above problems, a data transmission method, device, electronic device and storage medium are proposed to overcome the above problems or at least partially solve the above problems, including:

[0004] A data transmission method is applied to a multi-tunnel network, wherein the multi-tunnel network includes multiple tunnels and a tunnel matching module, wherein a tunnel application matching table is deployed in the tunnel matching module, and the tunnel application matching table includes a corresponding relationship between each tunnel application and a data feature of tunnel flow data processed by each tunnel application; the method includes:

[0005] The tunnel matching module receives target tunnel flow data and determines target data features of the target tunnel flow data;

[0006] Based on the target data feature, query the corresponding relationship in the tunnel application matching table to determine the target tunnel application corresponding to the target data feature;

[0007] The target tunnel traffic data is sent to the target tunnel application.

[0008] Optionally, the method further comprises:

[0009] Based on the preset matching fields, construct the tunnel application matching table;

[0010] The tunnel protocol characteristics and network characteristics used by each tunnel application are analyzed, and the tunnel protocol characteristics and network characteristics used by each tunnel application are added to the tunnel application matching table to obtain the corresponding relationship between each tunnel application and the data characteristics of the tunnel traffic data processed by each tunnel application.

[0011] Optionally, the preset matching fields include: source IP, destination IP, protocol, source port number, and destination port number.

[0012] Optionally, analyzing the tunnel protocol features and network features used by each tunnel application, and adding the tunnel protocol features and network features used by each tunnel application to the tunnel application matching table includes:

[0013] Converting the tunnel protocol feature into a first matching rule; and converting the network feature into a second matching rule;

[0014] The first matching rule and the second matching rule are added to the tunnel application matching table.

[0015] Optionally, constructing the tunnel application matching table based on a preset matching field includes:

[0016] Based on the preset matching field, the tunnel application matching table is constructed using the multi-bit prefix tree Lulea algorithm.

[0017] Optionally, the querying, based on the target data feature, the corresponding relationship in the tunnel application matching table to determine the target tunnel application corresponding to the target data feature includes:

[0018] Based on the target data feature, query the corresponding relationship;

[0019] In the corresponding relationship, the tunnel application corresponding to the preset matching field, the tunnel protocol feature and the network feature that matches the target data feature is used as the target tunnel application.

[0020] Optionally, the method further comprises:

[0021] When the target tunnel application corresponding to the target data feature is not determined, the target tunnel traffic data is discarded.

[0022] The embodiment of the present invention further provides a data transmission device, which is applied to a multi-tunnel network, wherein the multi-tunnel network includes multiple tunnels and a tunnel matching module, wherein a tunnel application matching table is deployed in the tunnel matching module, and the tunnel application matching table includes a correspondence between each tunnel application and a data feature of tunnel flow data processed by each tunnel application; the device includes:

[0023] A determination module, used for the tunnel matching module to receive target tunnel flow data and determine target data features of the target tunnel flow data;

[0024] A query module, configured to query the corresponding relationship in the tunnel application matching table based on the target data feature, and determine the target tunnel application corresponding to the target data feature;

[0025] A sending module is used to send the target tunnel traffic data to the target tunnel application.

[0026] Optionally, the device further comprises:

[0027] A construction module is used to construct the tunnel application matching table based on a preset matching field; analyze the tunnel protocol characteristics and network characteristics used by each tunnel application, and add the tunnel protocol characteristics and network characteristics used by each tunnel application to the tunnel application matching table to obtain the corresponding relationship between each tunnel application and the data characteristics of the tunnel traffic data processed by each tunnel application.

[0028] Optionally, the preset matching fields include: source IP, destination IP, protocol, source port number, and destination port number.

[0029] Optionally, the construction module is used to convert the tunnel protocol feature into a first matching rule; and convert the network feature into a second matching rule; and add the first matching rule and the second matching rule to the tunnel application matching table.

[0030] Optionally, the construction module is used to construct the tunnel application matching table based on a preset matching field using a multi-bit prefix tree Lulea algorithm.

[0031] Optionally, the query module is used to query the corresponding relationship based on the target data characteristics; and use the tunnel application corresponding to the preset matching field, the tunnel protocol characteristics and the network characteristics that match the target data characteristics in the corresponding relationship as the target tunnel application.

[0032] Optionally, the device further comprises:

[0033] A discarding module is used to discard the target tunnel traffic data when the target tunnel application corresponding to the target data feature is not determined.

[0034] An embodiment of the present invention further provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the above data transmission method when executed by the processor.

[0035] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the data transmission method described above is implemented.

[0036] The embodiments of the present invention have the following advantages:

[0037] In an embodiment of the present invention, a multi-tunnel network includes multiple tunnels and a tunnel matching module, in which a tunnel application matching table is deployed, and the tunnel application matching table includes a correspondence between each tunnel application and the data characteristics of the tunnel traffic data processed by each tunnel application; the tunnel matching module receives target tunnel traffic data and determines the target data characteristics of the target tunnel traffic data; based on the target data characteristics, queries the correspondence in the tunnel application matching table to determine the target tunnel application corresponding to the target data characteristics; and sends the target tunnel traffic data to the target tunnel application.

[0038] The embodiments of the present invention can protect tunnel messages of other services and support multiple tunnel protocols flexibly and efficiently.

[0039] Moreover, the embodiment of the present invention does not need to parse the outer layer message layer by layer, and can safely receive the tunnel traffic to which the service belongs in the multi-tunnel network. It has the advantages of high security and flexible expansion, and is particularly suitable for a multi-complex tunnel network. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solution of the present invention, the accompanying drawings required for use in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0041] Figure 1 is a flow chart of steps of a data transmission method according to an embodiment of the present invention;

[0042] Figure 2 is a flowchart of another method for transmitting data according to an embodiment of the present invention;

[0043] Figure 3a is a flowchart of the steps of another data transmission method according to an embodiment of the present invention;

[0044] Figure 3b is a flow chart of the steps of transmitting data according to an embodiment of the present invention;

[0045] Figure 4 is another flow chart of the steps of transmitting data according to an embodiment of the present invention;

[0046] Figure 5 It is a structural schematic diagram of a data transmission device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] In a scenario with multiple tunnels in the same network, such as a cloud network, an embodiment of the present invention provides a data transmission method that can protect tunnel messages of other services and can flexibly and efficiently support multiple tunnel protocols. Compared with the prior art, this method does not require layer-by-layer parsing of outer messages, and can safely receive tunnel traffic belonging to the service in a multi-tunnel network. It has the advantages of high security and flexible expansion, and is particularly suitable for much more complex tunnel networks.

[0049] For details, please refer to Figure 1 , Figure 1 A flow chart showing the steps of a data transmission method according to an embodiment of the present invention is shown.

[0050] like Figure 1 As shown, the data transmission method may include the following steps:

[0051] Step 101: The tunnel matching module receives target tunnel flow data and determines target data features of the target tunnel flow data.

[0052] In the embodiment of the present invention, the above method can be applied in a multi-tunnel network; a multi-tunnel network means that there are multiple independent tunnels in the network, each tunnel can transmit different data streams. These tunnels can be different protocols, different network paths or different security levels.

[0053] A multi-tunnel network may include multiple tunnels and a preset tunnel matching module; wherein:

[0054] Multiple tunnels can transmit different data streams. These tunnels can be different protocols, different network paths or different security levels.

[0055] A tunnel application matching table may be deployed in the tunnel matching module, and the tunnel application matching table may include a correspondence between each tunnel application and data features of tunnel traffic data processed by each tunnel application.

[0056] Based on the corresponding relationship, the tunnel matching module can determine which tunnel application expects the current tunnel traffic data, thereby avoiding sending unexpected traffic data to a tunnel application that does not need to be processed.

[0057] The tunnel matching module can prevent tunnel applications from receiving a large amount of unexpected traffic data, thereby protecting tunnel applications from security attacks and waste of resources.

[0058] Specifically, tunnel traffic data passing through a multi-tunnel network may first be matched by a tunnel matching module and then uploaded to a corresponding tunnel application for subsequent processing.

[0059] Exemplarily, the tunnel matching module can first receive the target tunnel traffic data to be sent to the tunnel application; then, the tunnel matching module can analyze the target tunnel traffic data and determine its target data characteristics; the target data characteristics can include the source IP, destination IP, protocol, source port number, target port number, etc. corresponding to the target tunnel traffic data, and can also include the tunnel protocol characteristics and network characteristics of the target tunnel traffic data, etc., which are not limited to the embodiments of the present invention.

[0060] Step 102: Based on the target data feature, query the corresponding relationship in the tunnel application matching table to determine the target tunnel application corresponding to the target data feature.

[0061] After determining the target data feature of the target tunnel traffic data, the tunnel matching module can query the corresponding relationship in the tunnel application matching table and determine the data feature that is the same as the target data feature and the tunnel application corresponding to the data feature in the tunnel application matching table. Next, the tunnel matching module can use the tunnel application as the target tunnel application.

[0062] Step 103: Send the target tunnel traffic data to the target tunnel application.

[0063] After determining the target tunnel application, the tunnel matching module may send the target tunnel traffic data to the determined target tunnel application for subsequent data processing and other operations, which is not limited in this embodiment of the present invention.

[0064] In an embodiment of the present invention, a multi-tunnel network includes multiple tunnels and a tunnel matching module, in which a tunnel application matching table is deployed, and the tunnel application matching table includes a correspondence between each tunnel application and the data characteristics of the tunnel traffic data processed by each tunnel application; the tunnel matching module receives target tunnel traffic data and determines the target data characteristics of the target tunnel traffic data; based on the target data characteristics, queries the correspondence in the tunnel application matching table to determine the target tunnel application corresponding to the target data characteristics; and sends the target tunnel traffic data to the target tunnel application.

[0065] The embodiments of the present invention can protect tunnel messages of other services and support multiple tunnel protocols flexibly and efficiently.

[0066] Moreover, the embodiment of the present invention does not need to parse the outer layer message layer by layer, and can safely receive the tunnel traffic to which the service belongs in the multi-tunnel network. It has the advantages of high security and flexible expansion, and is particularly suitable for a multi-complex tunnel network.

[0067] Reference Figure 2 , shows a flowchart of another data transmission method according to an embodiment of the present invention, which may include the following steps:

[0068] Step 201: construct the tunnel application matching table based on the preset matching fields.

[0069] In one embodiment of the present invention, the preset matching fields include: source IP, destination IP, protocol, source port number, and destination port number.

[0070] The source IP is the IP address of the device that sends the data packet, which can be used to identify the sender of the data packet.

[0071] The destination IP is the IP address of the device that receives the data packet, which can be used to identify the recipient of the data packet.

[0072] A protocol is a network protocol used by data packets, such as TCP (Transmission Control Protocol), UDP (User Datagram Protocol), ICMP (Internet Control Message Protocol), etc. It can be used to identify the transmission method and processing rules of data packets.

[0073] The source port number is the port number of the application or service that sends the data packet, which can be used to identify the application or service that sends the data.

[0074] The destination port number is the port number of the application or service that receives the data packet, which can be used to identify the application or service that receives the data.

[0075] In actual applications, a tunnel application matching table in a tunnel matching module may be preliminarily constructed based on preset matching fields.

[0076] Step 202: Analyze the tunnel protocol characteristics and network characteristics used by each tunnel application, and add the tunnel protocol characteristics and network characteristics used by each tunnel application to the tunnel application matching table to obtain the corresponding relationship between each tunnel application and the data characteristics of the tunnel traffic data processed by each tunnel application.

[0077] In some feasible embodiments, the tunnel matching module can analyze the tunnel protocol characteristics and network characteristics used by each tunnel application, and add the tunnel protocol characteristics and network characteristics used by each tunnel application to the tunnel application matching table as data characteristics to obtain the corresponding relationship between each tunnel application and the data characteristics of the tunnel traffic data processed by each tunnel application.

[0078] Step 203: The tunnel matching module receives the target tunnel flow data and determines the target data features of the target tunnel flow data.

[0079] In some feasible embodiments, after receiving the target tunnel traffic data, the tunnel matching module may first determine the target tunnel traffic data for analysis to determine the target data features of the target tunnel traffic data.

[0080] Step 204: query the corresponding relationship based on the target data feature.

[0081] After determining the target data features of the target tunnel traffic data, the tunnel matching module may query the corresponding relationship in the tunnel application matching table.

[0082] Step 205: The tunnel application corresponding to the preset matching field, the tunnel protocol feature and the network feature that matches the target data feature in the corresponding relationship is used as the target tunnel application.

[0083] Specifically, the tunnel matching module may use the tunnel application corresponding to the preset matching field, the tunnel protocol feature, and the network feature that match the target data feature in the corresponding relationship as the target tunnel application.

[0084] Exemplarily, a match may be first performed on a preset matching field; and then a tunnel application that meets a first matching rule corresponding to the tunnel protocol feature and a second matching rule corresponding to the network feature is used as the target tunnel application.

[0085] Step 206: Send the target tunnel traffic data to the target tunnel application.

[0086] After determining the target tunnel application, the tunnel matching module may send the target tunnel traffic data to the determined target tunnel application for subsequent data processing and other operations, which is not limited in this embodiment of the present invention.

[0087] Step 207: When the target tunnel application corresponding to the target data feature is not determined, discard the target tunnel traffic data.

[0088] In some feasible embodiments, if the tunnel matching module determines that there is no target tunnel application corresponding to the target data feature, the target tunnel flow data can be directly discarded, thereby preventing the tunnel application from receiving and processing unexpected tunnel flow data, and making the tunnel application only receive and process expected tunnel flow data.

[0089] In an embodiment of the present invention, based on a preset matching field, the tunnel application matching table is constructed; the tunnel protocol characteristics and network characteristics used by each tunnel application are analyzed, and the tunnel protocol characteristics and network characteristics used by each tunnel application are added to the tunnel application matching table to obtain a correspondence between each tunnel application and the data characteristics of the tunnel traffic data processed by each tunnel application; the tunnel matching module receives the target tunnel traffic data and determines the target data characteristics of the target tunnel traffic data; based on the target data characteristics, the corresponding relationship is queried; the tunnel application corresponding to the preset matching field, the tunnel protocol characteristics and the network characteristics that match the target data characteristics in the corresponding relationship is taken as the target tunnel application; the target tunnel traffic data is sent to the target tunnel application; when the target tunnel application corresponding to the target data characteristics is not determined, the target tunnel traffic data is discarded.

[0090] The embodiments of the present invention can protect tunnel messages of other services and support multiple tunnel protocols flexibly and efficiently.

[0091] Moreover, the embodiment of the present invention does not need to parse the outer layer message layer by layer, and can safely receive the tunnel traffic to which the service belongs in the multi-tunnel network. It has the advantages of high security and flexible expansion, and is particularly suitable for a multi-complex tunnel network.

[0092] Reference Figure 3a , shows a flowchart of another data transmission method according to an embodiment of the present invention, which may include the following steps:

[0093] Step 301: Based on a preset matching field, the tunnel application matching table is constructed using a multi-bit prefix tree Lulea algorithm.

[0094] In some feasible embodiments, a tunnel application matching table in a tunnel matching module may be constructed based on a preset matching field and using a multi-bit prefix tree Lulea algorithm.

[0095] Step 302: convert the tunnel protocol feature into a first matching rule; and convert the network feature into a second matching rule.

[0096] In some feasible embodiments, the tunnel matching module may convert the tunnel protocol feature used by the tunnel application into the first matching rule.

[0097] Exemplarily, the tunnel matching module may convert one or more tunnel protocol features used by the tunnel application into TCP, UDP, IP and other rules of the ACL; it is also applicable to the IP-in-IP protocol.

[0098] In some feasible embodiments, the tunnel matching module may further convert network protocol features used by the tunnel application into a second matching rule.

[0099] Exemplarily, the tunnel matching module may convert the trusted endpoint IP or network features into the IP network rules of the ACL.

[0100] Step 303: Add the first matching rule and the second matching rule to the tunnel application matching table to obtain a corresponding relationship between each tunnel application and the data features of the tunnel traffic data processed by each tunnel application.

[0101] After the first matching rule and the second matching rule are determined, the obtained first matching rule and the second matching rule may be added to the tunnel application matching table and used as data features for subsequent matching.

[0102] Step 304: The tunnel matching module receives the target tunnel flow data and determines the target data features of the target tunnel flow data.

[0103] In some feasible embodiments, after receiving the target tunnel traffic data, the tunnel matching module may first determine the target tunnel traffic data for analysis to determine the target data features of the target tunnel traffic data.

[0104] Step 305: Query the corresponding relationship based on the target data characteristics.

[0105] After determining the target data features of the target tunnel traffic data, the tunnel matching module may query the corresponding relationship in the tunnel application matching table.

[0106] Step 306: The tunnel application corresponding to the preset matching field, the tunnel protocol feature, and the network feature that matches the target data feature in the corresponding relationship is used as the target tunnel application.

[0107] Specifically, the tunnel matching module may use the tunnel application corresponding to the preset matching field, the tunnel protocol feature, and the network feature that match the target data feature in the corresponding relationship as the target tunnel application.

[0108] Exemplarily, a match may be first performed on a preset matching field; and then a tunnel application that meets a first matching rule corresponding to the tunnel protocol feature and a second matching rule corresponding to the network feature is used as the target tunnel application.

[0109] Step 307: Send the target tunnel traffic data to the target tunnel application.

[0110] After determining the target tunnel application, the tunnel matching module may send the target tunnel traffic data to the determined target tunnel application for subsequent data processing and other operations, which is not limited in this embodiment of the present invention.

[0111] Step 308: When the target tunnel application corresponding to the target data feature is not determined, discard the target tunnel traffic data.

[0112] In some feasible embodiments, if the tunnel matching module determines that there is no target tunnel application corresponding to the target data feature, the target tunnel flow data can be directly discarded, thereby preventing the tunnel application from receiving and processing unexpected tunnel flow data, and making the tunnel application only receive and process expected tunnel flow data.

[0113] For example, Figure 3b As shown: First, based on the preset matching field, a tunnel application matching table is constructed using a multibit-trie Lulea algorithm.

[0114] The matching field is a 5-tuple; illustratively, it may include: source IP, destination IP, protocol, source port number, and destination port number.

[0115] Analyze the tunnel protocol characteristics and network characteristics used by tunnel applications.

[0116] Convert trusted endpoint IP or network features into ACL IP network rules.

[0117] Convert one or more tunnel protocol characteristics used into ACL TCP, UDP, and IP rules, which are also applicable to IP-in-IP protocols.

[0118] Add the above one or more rules to the tunnel application matching table in the tunnel matching module to obtain the tunnel application matching table finally used.

[0119] All received Ethernet traffic data will pass through the tunnel matching module for matching using the tunnel application matching table.

[0120] Specifically, the tunnel application matching table can discard the missed tunnel traffic and send the hit tunnel traffic to the corresponding application.

[0121] Specifically, if there is a target tunnel application matching the received Ethernet traffic data in the tunnel application matching table, the matched Ethernet traffic data is sent to the corresponding tunnel application.

[0122] If not, the missed Ethernet traffic data may be discarded.

[0123] In the embodiment of the present invention, the tunnel application will only receive and process expected tunnel traffic data, and will not receive unexpected tunnel traffic data.

[0124] like Figure 4 As shown, after receiving Ethernet traffic data (Ethernet Packets), the tunnel matching module can first query the tunnel application matching table (i.e. Figure 4 ACL table in ).

[0125] The ACL table stores rules and the actions corresponding to each group of rules.

[0126] Among them, the Rules may store Credible-Network (ie, the second matching rule) and Tunnel-Protocol (ie, the first matching rule).

[0127] Multiple Tunnel-APPs (i.e. tunnel applications) can be stored in an Action.

[0128] For each tunnel traffic data, the Tunnel-APP to which it belongs can be determined based on the Credible-Network and Tunnel-Protocol in the Rulers, and if it is matched, it can be uploaded to the corresponding Tunnel-APP; or it can be discarded (Drop) if it is not matched.

[0129] The embodiment of the present invention proposes to use the efficient ACL multibit-trie algorithm to universally match and detect the tunnel protocol, rather than the traditional layer-by-layer analysis and stripping of the outer protocol message. This increases the scalability of the tunnel protocol while improving the processing performance of the tunnel. It also proposes to use the protection capability of the ACL, so that in a multi-tunnel network, the application can safely receive and process the tunnel traffic that belongs only to it. This improves security, reduces the impact of other traffic on it, and reduces the waste of processing resources.

[0130] In an embodiment of the present invention, based on a preset matching field, the tunnel application matching table is constructed; the tunnel protocol characteristics and network characteristics used by each tunnel application are analyzed, and the tunnel protocol characteristics and network characteristics used by each tunnel application are added to the tunnel application matching table to obtain a correspondence between each tunnel application and the data characteristics of the tunnel traffic data processed by each tunnel application; the tunnel matching module receives the target tunnel traffic data and determines the target data characteristics of the target tunnel traffic data; based on the target data characteristics, the corresponding relationship is queried; the tunnel application corresponding to the preset matching field, the tunnel protocol characteristics and the network characteristics that match the target data characteristics in the corresponding relationship is taken as the target tunnel application; the target tunnel traffic data is sent to the target tunnel application; when the target tunnel application corresponding to the target data characteristics is not determined, the target tunnel traffic data is discarded.

[0131] The embodiments of the present invention can protect tunnel messages of other services and support multiple tunnel protocols flexibly and efficiently.

[0132] Moreover, the embodiment of the present invention does not need to parse the outer layer message layer by layer, and can safely receive the tunnel traffic to which the service belongs in the multi-tunnel network. It has the advantages of high security and flexible expansion, and is particularly suitable for a multi-complex tunnel network.

[0133] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0134] Reference Figure 5 , showing a structural schematic diagram of a data transmission device according to an embodiment of the present invention, which is applied to a multi-tunnel network, wherein the multi-tunnel network includes multiple tunnels and a tunnel matching module, wherein a tunnel application matching table is deployed in the tunnel matching module, and the tunnel application matching table includes a correspondence between each tunnel application and the data features of the tunnel traffic data processed by each tunnel application.

[0135] like Figure 5 As shown, the data transmission device may include the following modules:

[0136] A determination module 501 is used for the tunnel matching module to receive target tunnel flow data and determine target data features of the target tunnel flow data;

[0137] A query module 502, configured to query the corresponding relationship in the tunnel application matching table based on the target data feature, and determine the target tunnel application corresponding to the target data feature;

[0138] The sending module 503 is used to send the target tunnel traffic data to the target tunnel application.

[0139] In an optional embodiment of the present invention, the device further comprises:

[0140] A construction module is used to construct the tunnel application matching table based on a preset matching field; analyze the tunnel protocol characteristics and network characteristics used by each tunnel application, and add the tunnel protocol characteristics and network characteristics used by each tunnel application to the tunnel application matching table to obtain the corresponding relationship between each tunnel application and the data characteristics of the tunnel traffic data processed by each tunnel application.

[0141] In an optional embodiment of the present invention, the preset matching fields include: source IP, destination IP, protocol, source port number, and destination port number.

[0142] In an optional embodiment of the present invention, the construction module is used to convert the tunnel protocol characteristics into a first matching rule; and, convert the network characteristics into a second matching rule; and add the first matching rule and the second matching rule to the tunnel application matching table.

[0143] In an optional embodiment of the present invention, the construction module is used to construct the tunnel application matching table based on a preset matching field using a multi-bit prefix tree Lulea algorithm.

[0144] In an optional embodiment of the present invention, the query module 502 is used to query the corresponding relationship based on the target data characteristics; and use the tunnel application corresponding to the preset matching field, the tunnel protocol characteristics and the network characteristics that match the target data characteristics in the corresponding relationship as the target tunnel application.

[0145] In an optional embodiment of the present invention, the device further comprises:

[0146] A discarding module is used to discard the target tunnel traffic data when the target tunnel application corresponding to the target data feature is not determined.

[0147] In an embodiment of the present invention, a multi-tunnel network includes multiple tunnels and a tunnel matching module, in which a tunnel application matching table is deployed, and the tunnel application matching table includes a correspondence between each tunnel application and the data characteristics of the tunnel traffic data processed by each tunnel application; the tunnel matching module receives target tunnel traffic data and determines the target data characteristics of the target tunnel traffic data; based on the target data characteristics, queries the correspondence in the tunnel application matching table to determine the target tunnel application corresponding to the target data characteristics; and sends the target tunnel traffic data to the target tunnel application.

[0148] The embodiments of the present invention can protect tunnel messages of other services and support multiple tunnel protocols flexibly and efficiently.

[0149] Moreover, the embodiment of the present invention does not need to parse the outer layer message layer by layer, and can safely receive the tunnel traffic to which the service belongs in the multi-tunnel network. It has the advantages of high security and flexible expansion, and is particularly suitable for a multi-complex tunnel network.

[0150] An embodiment of the present invention further provides an electronic device, including a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the above data transmission method when executed by the processor.

[0151] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the above data transmission method is implemented.

[0152] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0153] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0154] Those skilled in the art will appreciate that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0155] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0156] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0157] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0158] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0159] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0160] The above provides a detailed introduction to a data transmission method, device, electronic device and storage medium. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for a person skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A data transmission method, characterized in that: Applied to a multi-tunnel network, the multi-tunnel network includes multiple tunnels and a tunnel matching module, the tunnel matching module is deployed with a tunnel application matching table, the tunnel application matching table includes a correspondence between each tunnel application and data features of tunnel flow data processed by each tunnel application; The method comprises: The tunnel matching module receives target tunnel flow data and determines target data features of the target tunnel flow data; Based on the target data feature, query the corresponding relationship in the tunnel application matching table to determine the target tunnel application corresponding to the target data feature; The target tunnel traffic data is sent to the target tunnel application.

2. The method according to claim 1, characterized in that The method further comprises: Based on the preset matching fields, construct the tunnel application matching table; The tunnel protocol characteristics and network characteristics used by each tunnel application are analyzed, and the tunnel protocol characteristics and network characteristics used by each tunnel application are added to the tunnel application matching table to obtain the corresponding relationship between each tunnel application and the data characteristics of the tunnel traffic data processed by each tunnel application.

3. The method according to claim 2, characterized in that The preset matching fields include: source IP, destination IP, protocol, source port number, and destination port number.

4. The method according to claim 2, characterized in that: The analyzing the tunnel protocol features and network features used by each tunnel application, and adding the tunnel protocol features and network features used by each tunnel application to the tunnel application matching table, includes: Converting the tunnel protocol feature into a first matching rule; and converting the network feature into a second matching rule; The first matching rule and the second matching rule are added to the tunnel application matching table.

5. The method according to claim 2, characterized in that: The step of constructing the tunnel application matching table based on the preset matching field includes: Based on the preset matching field, the tunnel application matching table is constructed using the multi-bit prefix tree Lulea algorithm.

6. The method according to claim 2, characterized in that The querying the corresponding relationship in the tunnel application matching table based on the target data feature to determine the target tunnel application corresponding to the target data feature includes: Based on the target data feature, query the corresponding relationship; In the corresponding relationship, the tunnel application corresponding to the preset matching field, the tunnel protocol feature and the network feature that matches the target data feature is used as the target tunnel application.

7. The method according to claim 1, characterized in that The method further comprises: When the target tunnel application corresponding to the target data feature is not determined, the target tunnel traffic data is discarded.

8. A data transmission device, characterized in that: Applied to a multi-tunnel network, the multi-tunnel network includes multiple tunnels and a tunnel matching module, the tunnel matching module is deployed with a tunnel application matching table, the tunnel application matching table includes a correspondence between each tunnel application and data features of tunnel flow data processed by each tunnel application; The device comprises: A determination module, used for the tunnel matching module to receive target tunnel flow data and determine target data features of the target tunnel flow data; A query module, configured to query the corresponding relationship in the tunnel application matching table based on the target data feature, and determine the target tunnel application corresponding to the target data feature; A sending module is used to send the target tunnel traffic data to the target tunnel application.

9. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the method for transmitting data according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the data transmission method according to any one of claims 1 to 7 is implemented.

Images