Data processing method, device and equipment and computer readable storage medium

Abstract

The invention discloses a data processing method, device and equipment and a computer readable storage medium, and belongs to the technical field of communication. The method comprises the steps that a first device obtains first data; determining an attribute label of the first data, wherein the attribute label indicates attribute information of the first data in different dimensions; second data is acquired according to the first data and the attribute tag, the second data comprises the first data and further comprises at least one of the attribute tag and a sending strategy obtained based on the attribute tag, and the sending strategy indicates whether equipment receiving the second data intercepts the second data or not; and transmitting the second data to the second device. Whether the first data needs transmission protection or not is determined according to the attribute information of different dimensions, so that the sending strategy is determined, data leakage caused by release of the data which is not to be sent is avoided, and the data transmission security is high. In addition, the sending strategy can be determined according to the attribute tag, and the sending strategy determination involves few processes, is simple to operate and has high efficiency.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a data processing method, apparatus, device and computer-readable storage medium. Background Art

[0002] With the development of communication technology, the risk of data leakage is inevitable. Data leakage refers to the leakage, loss or theft of sensitive data that needs to be kept confidential without permission. Data leakage includes data theft by ransomware attacks, data theft by external attackers, and data leakage by internal personnel in violation of regulations.

[0003] In the related art, before data is sent, the network equipment used to process data will collect the data to be sent, segment and reassemble the collected data, decrypt the protocol, decode the application protocol and restore the file, match the restored data with sensitive information, match the data leakage prevention (DLP) policy and respond to the DLP policy, so as to determine whether to release the data according to the response result, so as to avoid sending confidential data to the outside and causing data leakage.

[0004] However, the above data processing process involves operations such as file restoration and sensitive information matching. The operations that need to be performed are highly complex and the data processing efficiency is low. Summary of the invention

[0005] The present application provides a data processing method, apparatus, device and computer-readable storage medium to improve the efficiency of preventing data leakage.

[0006] In a first aspect, a data processing method is provided, which is applied to a first device, and the method includes: acquiring first data; determining an attribute tag of the first data, wherein the attribute tag indicates attribute information of the first data in different dimensions; acquiring second data based on the first data and the attribute tag, the second data including the first data, and also including the attribute tag and at least one of a sending strategy obtained based on the attribute tag, the sending strategy indicating whether a device receiving the second data intercepts the second data; and sending the second data to the second device.

[0007] Since the attribute tag indicates the attribute information of the first data in different dimensions, the attribute tag can be used to determine whether the first data needs transmission protection according to the attribute information in different dimensions, and the sending strategy can be determined accordingly, thereby avoiding releasing data that should not be sent, resulting in data leakage, and the data transmission security is high. In addition, the sending strategy can be determined according to the attribute tag, and the determination of the sending strategy involves fewer processes, simple operation, and high efficiency.

[0008] In a possible implementation, determining the attribute label of the first data includes: obtaining at least one classification information of the first data, the classification information indicating the importance of the first data in the corresponding classification, the first data corresponding to at least one classification, and each classification information in the at least one classification information indicating a different classification; determining the attribute label according to the at least one classification information. The classification information can indicate the importance of the first data in the corresponding classification, and the attribute label determined according to the classification information can also indicate the importance of the first data. The subsequent sending strategy determined according to the attribute label refers to the importance of the first data to determine whether the first data can be released, and the security of data transmission is high.

[0009] In a possible implementation, obtaining the second data according to the first data and the attribute tag includes: obtaining an encapsulation result, the encapsulation result including at least one of the attribute tag and the sending strategy and the first data; obtaining the second data according to the encapsulation result. When obtaining the second data, only the attribute tag may be encapsulated, or only the sending strategy may be encapsulated, or both the attribute tag and the sending strategy may be encapsulated, and the method for obtaining the second data is highly flexible.

[0010] In a possible implementation, obtaining the second data according to the encapsulation result includes: filling at least one of the attribute tag and the sending strategy in the protocol field of the encapsulation result to obtain the second data. Filling at least one of the attribute tag and the sending strategy again in the protocol field of the encapsulation result that already carries at least one of the attribute tag and the sending strategy to achieve backup of at least one of the attribute tag and the sending strategy, thereby improving the transmission reliability of the second data.

[0011] In a possible implementation, obtaining the second data according to the first data and the attribute tag includes: filling at least one of the attribute tag and the sending strategy in the protocol field of the first data to obtain the second data. In addition to encapsulating the at least one of the attribute tag and the sending strategy to obtain the second data, the second data can also be obtained by filling at least one of the attribute tag and the sending strategy in the protocol field, which does not limit the method of obtaining the second data and has high versatility.

[0012] In a possible implementation, before obtaining the second data according to the first data and the attribute tag, the method further includes: obtaining a correspondence between the attribute tag and the sending strategy; and determining the sending strategy according to the correspondence and the attribute tag. The sending strategy can be determined according to the correspondence, and the determination process of the sending strategy is simple and efficient.

[0013] In a possible implementation, the attribute label includes at least one of a confidentiality level label, a data type label, and an object identity label, the confidentiality level label indicates the sensitivity level of the first data, the data type label indicates the data type of the first data, and the object identity label indicates the identity level of the object corresponding to the first data. Since the attribute label of the first data can be one or more of the confidentiality level label, the data type label, and the object identity label, the attribute label has high flexibility and wide versatility.

[0014] In a second aspect, a data processing method is provided, which is applied to a second device, and the method includes: receiving second data sent by a first device, wherein the second data includes the first data and also includes an attribute tag of the first data and at least one of a sending strategy obtained based on the attribute tag, and the attribute tag indicates attribute information of the first data in different dimensions; parsing the second data, and determining the sending strategy of the second data according to the parsing result; and determining whether to intercept the second data according to the sending strategy of the second data.

[0015] Since the attribute tag indicates the attribute information of the first data in different dimensions, the attribute tag can be used to determine whether the first data needs transmission protection according to the attribute information in different dimensions, and obtain a sending strategy, thereby avoiding releasing data that should not be sent, resulting in data leakage, and the data transmission security is high. In addition, the sending strategy can be determined by parsing the second data, and the determination of the sending strategy involves fewer processes, simple operation, and high efficiency.

[0016] In a possible implementation, the second data includes an attribute tag, and determining the sending strategy of the second data according to the parsing result includes: determining the attribute tag according to the parsing result; obtaining a correspondence between the attribute tag and the sending strategy, and determining the sending strategy according to the correspondence and the determined attribute tag. In the case where the second data includes the attribute tag, the sending strategy can be determined by the determined attribute tag and the correspondence, and the sending strategy determination process is simple and efficient.

[0017] In a possible implementation, the attribute tag is determined according to the parsing result, including: when the attribute tag is included in the parsed protocol field, the attribute tag is extracted from the protocol field; or, when the attribute tag is not included in the parsed protocol field, the parsing result is restored to extract the attribute tag from the restored result. If the attribute tag is filled in the protocol field, the attribute tag can be extracted by parsing the protocol field, and the extraction process is simple. If the attribute tag is encapsulated in the second data, that is, the attribute tag is not extracted from the protocol field, the file restoration will be further performed to successfully extract the encapsulated attribute tag. Regardless of the method in which the attribute tag is carried by the second data, the second device can extract the attribute tag from the second data, thereby improving the reliability of obtaining the attribute tag.

[0018] In a possible implementation, the second data includes a sending strategy, and the sending strategy of the second data is determined according to the parsing result, including: when the sending strategy is included in the protocol field obtained by parsing, extracting the sending strategy from the protocol field; or, when the sending strategy is not included in the protocol field obtained by parsing, restoring the parsing result to a file, and extracting the sending strategy from the restored result. When the second data includes the sending strategy, the sending strategy in the second data can be directly extracted to achieve the acquisition of the sending strategy, and the acquisition process is simple and efficient. Whether the sending strategy is encapsulated in the second data or filled in the protocol field, there is a corresponding extraction method, which improves the reliability of acquiring the sending strategy.

[0019] In a possible implementation, after determining whether to intercept the second data according to the sending policy of the second data, the method further includes: in the case where it is determined according to the sending policy to release the second data, sending the second data to a first network domain, the first network domain being determined according to the second data, and the first network domain being different from the network domain in which the first device is located. The second data will be transmitted across network domains only when the sending policy indicates release, and the transmission process of the second data has a high degree of security.

[0020] In a possible implementation, the attribute label includes at least one of a confidentiality level label, a data type label, and an object identity label, the confidentiality level label indicates the sensitivity level of the first data, the data type label indicates the data type of the first data, and the object identity label indicates the identity level of the object corresponding to the first data. The attribute label of the first data may be one or more of the confidentiality level label, the data type label, and the object identity label, and the attribute label has high flexibility.

[0021] According to a third aspect, a data processing device is provided, which is applied to a first device, and includes: an acquisition module, which is used to acquire first data; a determination module, which is used to determine an attribute tag of the first data, wherein the attribute tag indicates attribute information of the first data in different dimensions; the acquisition module is also used to acquire second data according to the first data and the attribute tag, wherein the second data includes the first data and also includes the attribute tag and at least one of the sending strategies obtained based on the attribute tag, wherein the sending strategy indicates whether the device receiving the second data intercepts the second data; and a sending module, which sends the second data to the second device.

[0022] In one possible implementation, a determination module is used to obtain at least one classification information of the first data, the classification information indicates the importance of the first data in the corresponding classification, the first data corresponds to at least one classification, and each classification information in the at least one classification information indicates a different classification; and determine an attribute label based on the at least one classification information.

[0023] In a possible implementation, the acquisition module is used to acquire an encapsulation result, where the encapsulation result includes at least one of an attribute tag and a sending strategy and the first data; and obtain the second data according to the encapsulation result.

[0024] In a possible implementation, the acquisition module is used to fill at least one of the attribute tag and the sending strategy in the protocol field of the encapsulation result to obtain the second data.

[0025] In a possible implementation, the acquisition module is used to fill at least one of the attribute tag and the sending strategy in the protocol field of the first data to obtain the second data.

[0026] In a possible implementation, the acquisition module is further used to acquire the correspondence between the attribute tag and the sending strategy; and determine the sending strategy according to the correspondence and the attribute tag.

[0027] In one possible implementation, the attribute label includes at least one of a confidentiality level label, a data type label, and an object identity label, the confidentiality level label indicates a sensitivity level of the first data, the data type label indicates a data type of the first data, and the object identity label indicates an identity level of an object corresponding to the first data.

[0028] In a fourth aspect, a data processing device is provided, which is applied to a second device, and the device includes: a receiving module, which is used to receive second data sent by a first device, and the second data includes the first data, and also includes an attribute tag of the first data and at least one of a sending strategy obtained based on the attribute tag, and the attribute tag indicates attribute information of the first data in different dimensions; a determination module, which is used to parse the second data and determine the sending strategy of the second data according to the parsing result; the determination module is also used to determine whether to intercept the second data according to the sending strategy of the second data.

[0029] In a possible implementation, the second data includes an attribute tag, and a determination module is used to determine the attribute tag according to the parsing result; obtain the correspondence between the attribute tag and the sending strategy, and determine the sending strategy according to the correspondence and the determined attribute tag.

[0030] In one possible implementation, a determination module is used to extract attribute tags from a protocol field when the parsed protocol field includes attribute tags; or to perform file restoration on the parsing result and extract attribute tags from the restored result when the parsed protocol field does not include attribute tags.

[0031] In one possible implementation, the second data includes a sending strategy, and a determination module is used to extract the sending strategy from the protocol field when the parsed protocol field includes the sending strategy; or, when the parsed protocol field does not include the sending strategy, perform file restoration on the parsing result and extract the sending strategy from the restored result.

[0032] In a possible implementation, the device further includes: a forwarding module, configured to send the second data to a first network domain when it is determined to release the second data according to a sending policy, the first network domain being determined according to the second data, and the first network domain being different from a network domain where the first device is located.

[0033] In one possible implementation, the attribute label includes at least one of a confidentiality level label, a data type label, and an object identity label, the confidentiality level label indicates a sensitivity level of the first data, the data type label indicates a data type of the first data, and the object identity label indicates an identity level of an object corresponding to the first data.

[0034] In a fifth aspect, a data processing device is provided, which includes a processor, and the processor is used to load and execute at least one instruction so that the data processing device executes the method in the first aspect or any possible implementation of the first aspect, or executes the method in the second aspect or any possible implementation of the second aspect.

[0035] In a possible implementation, the device includes a memory, which is coupled to a processor, and the memory stores at least one instruction.

[0036] In a sixth aspect, a data processing system is provided, the system comprising a second device and a first device, the first device being used to execute the method in the first aspect or any possible implementation of the first aspect, and the second device being used to execute the method in the second aspect or any possible implementation of the second aspect.

[0037] In the seventh aspect, a computer-readable storage medium is provided, in which at least one instruction is stored, and the instruction is loaded and executed by a processor to implement the data processing method in the first aspect or any possible implementation of the first aspect, or to implement the data processing method in the second aspect or any possible implementation of the second aspect.

[0038] In the eighth aspect, a computer program (product) is provided, which includes a computer program / instructions, and the computer program / instructions are executed by a processor to enable a computer to implement the data processing method in the first aspect or any possible implementation of the first aspect, or to implement the data processing method in the second aspect or any possible implementation of the second aspect.

[0039] In a ninth aspect, a communication device is provided, the device comprising: a transceiver, a memory, and a processor. The transceiver, the memory, and the processor communicate with each other through an internal connection path, the memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to control the transceiver to receive signals and control the transceiver to send signals, and when the processor executes the instructions stored in the memory, the processor executes the method in the first aspect or any possible implementation of the first aspect, or executes the method in the second aspect or any possible implementation of the second aspect.

[0040] Optionally, there are one or more processors and one or more memories.

[0041] Optionally, the memory may be integrated with the processor, or the memory may be provided separately from the processor.

[0042] In the specific implementation process, the memory can be a non-transitory memory, such as a read-only memory (ROM), which can be integrated with the processor on the same chip or can be set on different chips. This application does not limit the type of memory and the setting method of the memory and the processor.

[0043] In a tenth aspect, a chip is provided, comprising a processor for calling and executing program instructions or codes stored in a memory, so that a communication device equipped with the chip executes the methods in the above aspects.

[0044] In the eleventh aspect, another chip is provided, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected through an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the methods in the above aspects.

[0045] It should be understood that the beneficial effects achieved by the technical solutions of the third to eleventh aspects of the present application and the corresponding possible implementation methods can be referred to the above-mentioned technical effects of the first aspect and its corresponding possible implementation methods or the second aspect and its corresponding possible implementation methods, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A schematic diagram of an implementation environment provided for an embodiment of the present application;

[0047] Figure 2 A schematic diagram of another implementation environment provided for an embodiment of the present application;

[0048] Figure 3A schematic diagram of a data transmission scenario provided in an embodiment of the present application;

[0049] Figure 4 A flowchart of a data processing method provided in an embodiment of the present application;

[0050] Figure 5 A schematic diagram of interaction between a first device and a second device provided in an embodiment of the present application;

[0051] Figure 6 A schematic diagram of interaction between a first device and a second device provided in another embodiment of the present application;

[0052] Figure 7 A schematic diagram of interaction between a first device and a second device provided in another embodiment of the present application;

[0053] Figure 8 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application;

[0054] Fig. 9 A schematic diagram of the structure of another data processing device provided in an embodiment of the present application;

[0055] Fig.10 A schematic diagram of the structure of a network device provided in an embodiment of the present application;

[0056] Fig.11 A schematic diagram of the structure of another network device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0057] The terms used in the implementation method of this application are only used to explain the specific embodiments of this application, and are not intended to limit this application. In order to make the purpose, technical solution and advantages of this application clearer, the implementation method of this application will be further described in detail below with reference to the accompanying drawings.

[0058] With the development of communication technology, the data in the network has shown explosive growth. Sensitive data is often transmitted out of the network without permission, causing security issues such as data leakage. Therefore, a data processing method is needed to avoid data leakage and improve security.

[0059] In the related art, for the traffic data to be sent, network traffic monitoring, data restoration and content identification are used to determine whether there is sensitive data in the traffic data, so as to implement response operations such as interception of sensitive data according to the policy. The data processing process includes traffic collection of the traffic data to be sent, segmentation and stream reorganization of the traffic data, protocol decryption, application protocol decoding and file restoration. After the traffic data is restored through the above operations, sensitive information matching is performed on the restored traffic data to determine whether the traffic data is sensitive data that is restricted from sending. And DLP policy matching is performed based on the matching results to determine the sending policy of the traffic data, whether it is interception or release. The above data processing method has low performance and slow efficiency in protocol decryption of encrypted data, such as traffic data transmitted using a secure transmission protocol (transport layer security, TLS). File restoration, sensitive information matching and other operations are required during the data processing process, and matching the traffic data will result in low efficiency of data processing. In addition, if the traffic data sent is compressed, such as encrypted compression, it is impossible to accurately identify whether the traffic data is sensitive data, which is easy to cause data leakage and low security.

[0060] The embodiment of the present application provides a data processing method for determining whether the data needs to be intercepted and whether it can continue to be sent during the process of sending data, so as to avoid releasing data that should not be sent and causing data leakage. Figure 1 , which shows a schematic diagram of an implementation environment of the data processing method provided in an embodiment of the present application, and the implementation environment includes a first device 01 and a second device 02. Among them, a communication connection can be established between the first device 01 and the second device 02 in the form of a wired or wireless network. Exemplarily, the first device 01 generates second data according to the first data and the attribute tag of the first data, and sends the second data to the second device 02. The second device 02 parses the received second data, determines a sending strategy according to the parsing result, and determines whether to intercept the second data according to the sending strategy.

[0061] For example, see Figure 2 The implementation scenario also includes a management device 03. The management device 03 establishes communication connections with the first device 01 and the second device 02 respectively. The management device 03 includes a security management module. The security management module can send configurations / policies involved in the data processing process to the first device 01 or the second device 02. The configuration refers to the configuration information of the first data, such as the attribute tag of the first data, and the policy can refer to the sending policy.

[0062] In a possible implementation, the first device 01, the second device 02 and the management device 03 may be any device with a data transmission function, and the first device 01, the second device 02 and the management device 03 may be terminal devices such as desktop computers, laptop computers or smart phones, or servers, such as central servers, edge servers, or local servers in local data centers. The server may be a physical server or a cloud server that provides cloud computing services. Exemplarily, the second device 02 may also be a forwarding device such as a gateway, a router and a switch. Optionally, the first device 01 and the second device 02 may be independent devices, or they may be applications or network cards configured in the devices. Furthermore, the first device 01 and the second device 02 may be configured in different devices or in the same device.

[0063] The present application does not limit the application scenarios of data processing. Figure 3 A schematic diagram of a data transmission scenario provided in an embodiment of the present application. Figure 3 In DLP, there are many types, including network DLP, terminal DLP, storage DLP and email DLP. The type of DLP is determined by the data transmission scenario. Among them, network DLP refers to the execution of DLP on the data sent between different domains through the network; terminal DLP refers to the execution of DLP on the data sent between different terminals; storage DLP refers to the execution of DLP on the stored data during the data storage process. For example Figure 3 As shown, during the storage process, data will also be transmitted between the file server and the application system, and data leakage needs to be avoided during the data transmission process. Mail DLP refers to the execution of DLP on the data sent during the data transmission process via email. For different types of DLP, the second device 02 can be a terminal in the terminal DLP, or a mail server in the mail DLP, which is not limited in the present embodiment of the application.

[0064] The data processing method provided in the embodiment of the present application can be applied to the above Figure 1 or Figure 2 In the implementation scenario shown in FIG. 1 , the method can be interactively executed by the first device and the second device. The flowchart of the data processing method is as follows: Figure 4 As shown, including S401-S407.

[0065] S401, a first device obtains first data.

[0066] Exemplarily, the first data may be any data with a transmission requirement. Among them, the first data having a transmission requirement means that the first data needs to be transmitted. Exemplarily, in the case where the storage space of the first data changes, the first data has a transmission requirement. For example, the user operates the first device to move the first data from the storage space of the first device to the storage space of the mobile storage device, the storage space of the first data changes, and the first data has a transmission requirement, and the mobile storage device is, for example, a USB flash drive (universal serial bus flash disk). In the process of transmitting the first data, the first data in the original storage space can be retained, for example, the user uses a copy operation in the process of transmitting the first data; the first data in the original storage space can also be deleted, for example, the user uses a cut operation in the process of transmitting the first data, and the embodiment of the present application does not limit this. The transmission requirement of the first data may be currently generated, for example, the first device detects that data A has a transmission requirement based on the interactive operation with the user, and the first device determines that data A is the first data. In addition, the first device can be a source sending device of the first data as shown in the above example, or it can be an intermediate device in the first data transmission process, that is, the first device receives the first data sent by other network devices based on the communication connection with other network devices.

[0067] In one possible case, the first data may also be data acquired by the first device, such as data stored by the first device. Since the first device first stores the first data, the storage space of the first data needs to be adjusted later, which involves the transmission of the first data. Therefore, the first data needs to be processed to achieve transmission protection. Regardless of the above situation of the first data, the embodiment of the present application does not limit the data type of the first data, and the first data may be game data, video data, or other types of data.

[0068] S402, the first device determines an attribute tag of the first data, where the attribute tag indicates attribute information of the first data in different dimensions.

[0069] Exemplarily, the first device may receive an attribute tag set by the operation object to determine the attribute tag of the first data. For example, the first device provides an information input control, and the operation object inputs the attribute tag of the first data based on the information input control. The operation object may be an operation and maintenance personnel or other personnel for managing data security, or may be a user who operates the first device as illustrated in S401.

[0070] In one possible case, the first device can also automatically determine the attribute label of the first data, and the determination process includes but is not limited to: obtaining at least one classification information of the first data, the classification information indicating the importance of the first data in the corresponding classification, the first data corresponds to at least one classification, and each classification information in the at least one classification information indicates a different classification; determining the attribute label based on the at least one classification information.

[0071] The classification information of the first data includes, but is not limited to, data confidentiality information, type information, and object identity information. The data confidentiality information indicates the confidentiality level of the first data, and the data confidentiality information includes core, top secret, confidential, secret, public, and ordinary, etc. The importance of the first data of different confidentiality levels is different. For example, the importance of core data is higher than that of public data. In some cases, the data confidentiality information can also be called data classification information. The type information indicates the type of the first data. Taking an enterprise as an example, the type information includes enterprise application data, financial data, and contract data, etc. The importance of different types of first data is different. The importance of contract data is higher than that of financial data, and the importance of financial data is higher than that of enterprise application data. The object identity information indicates the identity of the object corresponding to the first data. The object corresponding to the first data can be a statistical object for counting the first data, that is, the owner of the first data, or a user object for sending the first data. Taking an enterprise as an example, the object identity information includes director, supervisor, and staff, etc. In this case, the importance of the first data corresponding to the director is higher than the importance of the first data corresponding to the supervisor.

[0072] The embodiments of the present application do not limit the process of the first device acquiring the classification information. The first device can perform data analysis on the first data to determine the classification information of the first data. For example, the data content of the first data is analyzed to determine the type information of the first data, the storage path of the first data is analyzed to determine the data confidentiality information of the first data, or the user identity document (ID) corresponding to the first data is analyzed to determine the object identity information of the first data. Among them, the user ID can be the user ID included in the first data storage path, or it can be the user ID logged in during the first data transmission operation. For example, if user A sends the first data to the outside via email, the first device determines the user ID based on the mailbox of user A, determines the object corresponding to the first data based on the user ID, and determines the object identity information based on the position information of the object in the enterprise.

[0073] The above operations can be performed by the first device or by the management server. Figure 5As shown, the management server includes a security management module, which is responsible for security management related functions. The security management module includes a classification unit, a label management unit and a policy management unit, which are responsible for policy management, label management and data classification management. Among them, the classification unit can determine the classification information of the first data by performing data analysis on the first data, and then send the obtained classification information to the first device, so that the first device obtains the classification information of the first data.

[0074] In addition, the classification information can also be obtained by the operating object of the first device through interaction with the first device, and the first device determines the classification information of the first data according to the classification information input by the operating object. For example, when the first device is storing the first data, an information input control pops up, and the operating object needs to input the classification information of the first data in the information input control before the first data can be stored in the storage space of the first device.

[0075] Regardless of the method by which the first device obtains the classification information of the first data, the attribute label of the first data can be determined according to at least one classification information. In one possible case, the attribute label includes at least one of a confidentiality level label, a data type label, and an object identity label. Among them, the confidentiality level label indicates the sensitivity level of the first data, the data type label indicates the data type of the first data, and the object identity label indicates the identity level of the object corresponding to the first data.

[0076] Exemplarily, the number of attribute labels of the first data may correspond one-to-one to the number of classification information. For example, the classification information includes data confidentiality information as secret, type information as enterprise application data, and object identity information as supervisor. The confidentiality level label is determined as secret data based on the data confidentiality information, the data type label is determined as enterprise application data based on the type information, and the object identity label is determined as supervisor data based on the object identity information. The number of attribute labels of the first attribute may also not correspond one-to-one to the number of classification information. For example, if the type information is enterprise application data, after the first device determines that the data type label is enterprise application data based on the type information, since the enterprise application data is data generated during the communication process between internal members of the enterprise, it may include some commercial secrets within the enterprise. Therefore, the first device may determine that the confidentiality level label of the first data is secret data based on the type information.

[0077] In one possible case, the first device can also adjust the attribute label in combination with different classification information in the process of determining the attribute label according to the classification information. Take the case where the data confidentiality information of the first data is public and the type information of the first data is contract data as an example. Although the contract data needs to be disclosed to both Party A and Party B during the signing process, it also needs to be kept confidential for other objects. In the process of the first device determining the attribute label, the confidentiality level label of the first data is determined to be confidential data, and the data type label is contract data. For another example, the data type of the first data is financial data, the object identity level of the statistical object of the first data is employee, and the data confidentiality information of the first data is top secret. Although the first data is financial data, the first data is a detailed list of household expenses counted by employees, rather than financial information related to the enterprise. Therefore, the first device determines the confidentiality level label of the first data to be public data.

[0078] Similar to the process of determining the classification information, the process of determining the attribute label according to the classification information can also be completed by other devices, such as Figure 5 The management server in the embodiment of the present invention calls the tag management unit to determine the attribute tag of the first data according to the classification information sent by the classification unit. After that, the management server sends the attribute tag of the first data to the first device based on the communication connection with the first device, and the first device thereby obtains the attribute tag of the first data.

[0079] S403, the first device obtains second data according to the first data and the attribute tag, the second data includes the first data, and also includes the attribute tag and at least one of the sending strategies obtained based on the attribute tag, the sending strategy indicates whether the device receiving the second data intercepts the second data.

[0080] In one possible case, after the first device obtains the attribute label, it can also display the attribute label to the operation object, and the operation object can check and adjust the attribute label based on experience. Regardless of whether the operation object adjusts the attribute label, the first device can obtain the second data based on the attribute label and the first data, and the process of obtaining the second data includes but is not limited to the following two acquisition methods.

[0081] Acquisition method 1: Acquire an encapsulation result, where the encapsulation result includes at least one of an attribute tag and a sending strategy and the first data; and obtain the second data according to the encapsulation result.

[0082] Exemplarily, the process of the first device determining the sending strategy includes: obtaining the correspondence between the attribute tag and the sending strategy; determining the sending strategy according to the correspondence and the attribute tag. The correspondence can be set based on experience, and the correspondence can be set directly on the first device, that is, the first device stores the correspondence between the attribute tag and the sending strategy. In this case, the first device can access the storage space and obtain the correspondence between the attribute tag and the sending strategy stored in the storage space. The correspondence can also be set on other devices, such as Figure 6 The management server shown in the figure, the policy management module of the management server is used to store the corresponding relationship between the attribute label and the sending policy, and the first device can be as follows Figure 6 As shown, a correspondence request is sent to the management server, and the management server returns the correspondence before sending the policy and the attribute tag to the first device based on the received request.

[0083] Regardless of the method by which the first device obtains the correspondence between the attribute label and the sending policy, it can search for the correspondence between the attribute label and the sending policy according to the attribute label of the first data, and determine the sending policy that needs to be encapsulated in the second data. For example, the sending policy corresponding to the attribute label of top secret data is restricted sending, the sending policy corresponding to the attribute label of financial data is restricted sending, and the sending policy corresponding to the attribute label of public data is allowed sending. Among them, the sending in restricted sending and allowed sending refers to external sending, that is, there is a difference between the network domain where the first data arrives and the network domain where the first data is sent, for example Figure 5 In the example, the first data in the first device in domain A is sent to domain B. Since domain A and domain B are different network domains, Figure 5 The sending of the first data in is external sending.

[0084] In a possible implementation, when the first data corresponds to multiple attribute tags, the sending policy corresponding to any attribute tag is restricted sending, and the first device determines the sending policy as restricted sending. Alternatively, the first device determines the weight corresponding to each attribute tag, performs weighted calculation on the multiple attribute tags, and determines the sending policy according to the weighted result. Among them, the weight corresponding to each attribute tag is determined according to the importance of the classification information corresponding to each attribute tag in the multiple classification information, and the importance of the classification information corresponding to each attribute tag in the corresponding classification. Continuing to take the classification information including data confidentiality information, type information and object identity information as an example, the importance of data confidentiality information is higher than the importance of type information, and the importance of type information is higher than the importance of object identity information. Therefore, the first device determines that the first weight of data confidentiality information is 0.5, the first weight of type information is 0.3, and the importance of object identity information is 0.2. In the case where the data confidentiality information is secret, the type information is enterprise application data, and the object identity information is supervisor, according to the sensitivity of the secret in the sensitivity level, the second weight is set to 0.5, the second weight of enterprise application data is set to 0.3, and the second weight of supervisor is set to 0.3. Afterwards, the weight of the attribute label is determined according to the first weight and the second weight. For example, the first weight and the second weight are multiplied, and the product is the weight of the attribute label. The weight of the attribute label as secret data is 0.25, the weight of the attribute label as enterprise application data is 0.09, and the weight of the attribute label as supervisor data is 0.06.

[0085] After determining the weight of the attribute tag, the first device may perform weighted calculation according to the weight of the attribute tag. For example, the first device determines that the initial value of the sending policy for limiting sending is negative 1, and the initial value of the sending policy for allowing sending is 1, and the initial value of the sending policy corresponding to each attribute tag is multiplied by the weight of each attribute tag, and the multiple products obtained by adding and multiplying, if the sum value is a positive number, the sending policy is determined to be allowed to send, and if the sum value is a negative number, the sending policy is determined to be restricted to send.

[0086] In addition, the above process of determining the sending strategy based on the attribute tag can be performed by the first device or by the management server. For example, the first device sends the attribute tag to the management server, and the management server determines the sending strategy corresponding to the attribute tag based on the attribute tag and the corresponding relationship through the policy management module, and sends the determined sending strategy to the first device. Since the attribute tag indicates the attribute information of the first data in different dimensions, it can be determined whether the first data is sensitive data that needs transmission protection based on the attribute information in different dimensions, and then the sending strategy of the first data is determined based on whether the first data needs transmission protection, and the determined sending strategy has a high degree of reliability.

[0087] Regardless of the method by which the first device obtains the sending strategy, after obtaining the sending strategy, it can select at least one of the attribute tag and the sending strategy to encapsulate with the first data, and determine the second data according to the encapsulation result. Exemplarily, the first device can choose to encapsulate only the first data and the attribute tag, for example Figure 5 As shown, Figure 5 In the method, the first device includes a label client, which is used to label the first data, encapsulate the first data, etc. The first device encapsulates the attribute label and the first data together through the label client to obtain an encapsulation result including the first data and the attribute label.

[0088] The first device may also choose to encapsulate only the first data and the sending strategy, or may choose to encapsulate the first data, the attribute tag, and the sending strategy, for example Figure 6 As shown, after the tag client generates a sending strategy according to the attribute tag, it encapsulates the sending strategy, the attribute tag and the first data together to obtain an encapsulation result including the first data, the attribute tag and the sending strategy. Figure 5 and Figure 6 Regardless of the method used by the first device to encapsulate the first data, the encapsulated sending strategy or attribute tag is centrally configured at a specific position of the encapsulation result, such as the tail or head of the encapsulation result. Through centralized configuration, when the second device subsequently parses the encapsulation result to extract the attribute tag or sending strategy, it only needs to read the data at the specific position, and the extraction process is simple and efficient.

[0089] In a possible case, the first device may directly determine the packaging result as the second data, for example Figure 6 and Figure 7 As shown, the second device also includes a protocol stack, which is deployed in the operating system (OS) kernel and can also be called a kernel plug-in in some cases. When the first data needs to be sent, the tag client sends the encapsulated result to the protocol stack, and the protocol stack sends the encapsulated result to the second device. The protocol stack can be as follows Figure 6 and Figure 7 As shown, no padding operation is performed on the received encapsulation result, that is, the encapsulation result is used as the second data to be sent.

[0090] Exemplarily, the first device may also fill the encapsulation result to obtain the second data, and the filling process includes but is not limited to: filling at least one of the attribute tag and the sending strategy in the protocol field of the encapsulation result to obtain the second data. Figure 5For example, the first device parses the information carried in the encapsulation result through the protocol stack to determine the information that needs to be filled, and then fills the parsed information into the protocol field. The information refers to the sending strategy or attribute tag encapsulated in the above embodiment. By filling at least one of the attribute tag and the sending strategy in the protocol field of the encapsulation result that has encapsulated at least one of the attribute tag and the sending strategy, a backup of at least one of the attribute tag and the sending strategy is achieved, thereby preventing the second data from being damaged during transmission, resulting in the device receiving the second data failing to parse the protocol field and being unable to extract the attribute tag or the sending strategy filled in the protocol field. In this case, the device receiving the second data can continue to read the encapsulated attribute tag or sending strategy to obtain the sending strategy, thereby improving transmission reliability.

[0091] The process of filling at least one of the attribute tags and sending strategies in the protocol field of the encapsulation result is similar to the process of filling at least one of the attribute tags and sending strategies in the protocol field of the first data. For detailed process, please refer to the relevant description in the second acquisition method, and will not be repeated here.

[0092] Acquisition method 2: Fill at least one of the attribute tag and the sending strategy into the protocol field of the first data to obtain the second data.

[0093] Continue with Figure 5 For example, after obtaining at least one of the attribute tag and the sending strategy, the tag client of the first device can directly send the obtained attribute tag and at least one of the sending strategy and the first data to the protocol stack. The protocol stack performs field analysis on the received first data, and then fills at least one of the attribute tag and the sending strategy in the protocol field. The embodiment of the present application does not limit the protocol field to be filled. In the Internet Protocol Version 4 (internet protocol version 4, IPv4) scenario, the protocol field can be an option field in the transmission control protocol / internet protocol (transmission control protocol / internet protocol, TCP / IP). In the Internet Protocol Version 6 (internet protocol version 6, IPv6) scenario, the protocol field can be a field in the extended message header of the first data. Taking filling the attribute tag as an example, the protocol stack can directly assign the value of the attribute tag to the protocol field, or determine the first value corresponding to the attribute tag, and assign the protocol field to the first value. Taking the attribute tag as top secret as an example, the first value corresponding to top secret is, for example, 1, and taking the attribute tag as core as an example, the first value corresponding to core is, for example, 0.

[0094] S404: The first device sends second data to the second device.

[0095] In a possible implementation, in the case where the first data does not need to be sent immediately, for example, the first data shown in S401 is data stored in the first device, and after the first device generates the second data, it will first store the second data in the storage space or the local disk. In the subsequent process of transmitting the first data, since the second data includes the first data, the transmission of the first data can be achieved by sending the second data to the second device, for example Figure 5-Figure 7 When the first data needs to be transmitted, the generated second data is directly sent to improve the data transmission efficiency.

[0096] Exemplarily, the second device is a device configured at the network boundary, used to transmit data to different network domains. The second device can be independently deployed in the network environment, deployed in series, and used for data monitoring, protocol field parsing, and tag policy execution. Figure 3 Taking the network topology diagram shown in FIG. 1 as an example, the second device may be a mail server configured at the network boundary to manage whether to send mails to other domains, or Figure 3 The gateway device in the network DLP shown. In the case where the first data to be sent needs to be sent to other network domains, the first device sends the second data including the first data to the second device, so that the second device manages the external sending of the second data.

[0097] S405, the second device receives second data sent by the first device, the second data includes the first data, and also includes an attribute tag of the first data and at least one of the sending strategies obtained based on the attribute tag, the attribute tag indicates attribute information of the first data in different dimensions.

[0098] Exemplarily, the second data received by the second device is obtained based on the first data and the attribute tag, the second data includes the first data, and also includes at least one of the attribute tag and the sending strategy, and the attribute tag indicates the attribute information of the first data in different dimensions. For a detailed description of the second data, please refer to the relevant content in S403, which will not be repeated here.

[0099] S406, the second device parses the second data, and determines a sending strategy for the second data according to the parsing result.

[0100] Since the second data is obtained according to the attribute tag, and the attribute tag indicates the attribute information of the first data in different dimensions, the second device can determine whether the first data is sensitive data that needs to be transmitted and protected according to the attribute information by parsing the second data, and then determine the sending strategy of the second data including the first data. In a possible implementation, for the case where the second data includes at least one of the sending strategy and the attribute tag in S403, the second device determines the sending strategy of the second data according to the parsing result, and there are also but not limited to the following multiple determination methods.

[0101] Determination method 1: when the second data includes an attribute tag, the second device parses the second data and determines the attribute tag according to the parsing result; obtains the correspondence between the attribute tag and the sending strategy, and determines the sending strategy according to the correspondence and the determined attribute tag.

[0102] Exemplarily, the second device performs protocol parsing on the message header of the second data, and determines the attribute tag based on the parsing result, wherein the parsing result includes a protocol field. The process of determining the attribute tag based on the parsing result includes but is not limited to: when the parsed protocol field includes the attribute tag, extracting the attribute tag from the protocol field; or, when the parsed protocol field does not include the attribute tag, performing file restoration on the parsing result and extracting the attribute tag from the restored result.

[0103] In the case where the first device fills the attribute tag in the protocol field during the process of acquiring the second data, for example, directly filling the attribute tag or first encapsulating and then filling the attribute tag in S403, the protocol field parsed by the second device will include the attribute tag, and the second device can directly extract the attribute tag included in the protocol field. The process of the second device acquiring the attribute tag is simple and the extraction efficiency is high. Among them, the protocol field includes the attribute tag means that the protocol field is a valued field, and the second device can determine the corresponding attribute tag according to the value of the protocol field.

[0104] In one possible case, the protocol field obtained by the second device parsing does not include the attribute tag, and this situation exists, including but not limited to, two reasons. Reason one is that the first device does not fill the attribute tag in the protocol field during the process of obtaining the second data, such as encapsulating the attribute tag and the first data in S403, and determining the encapsulation result as the second data. Reason two is that the first device first encapsulates the attribute tag and then fills the attribute tag, but because the second data is damaged during the transmission process, the second device fails to parse the protocol field. Regardless of whether the attribute tag is not included in the protocol field obtained by parsing due to reason one or reason two, the second device can determine that the second data is obtained by encapsulating the attribute tag and the first data when the attribute tag is not included in the protocol field, and continue to perform file restoration on the parsing result to achieve decapsulation of the second data. Among them, the protocol field does not include the attribute tag, for example, the protocol field is an unassigned idle field, and the file restoration is, for example, payload parsing of the second data to obtain the attribute tag encapsulated in the payload.

[0105] Regardless of the method by which the second device determines the attribute tag, the sending strategy can be determined according to the extracted attribute tag. The process of the second device determining the sending strategy is similar to the process of the first device determining the sending strategy, which can be referred to the relevant description in S403 and will not be repeated here.

[0106] Determination method two: when the second data includes a sending strategy, parse the second data and extract the sending strategy included in the parsing result.

[0107] In one possible case, after performing protocol parsing on the second data, the process of extracting the sending policy included in the parsing result includes: when the parsed protocol field includes the sending policy, extracting the sending policy from the protocol field; or, when the parsed protocol field does not include the sending policy, performing file restoration on the parsing result and extracting the sending policy from the restored result. The process of extracting the sending policy from the protocol field is similar to the process of extracting the attribute tag from the protocol field. The process of performing file restoration on the parsing result and extracting the sending policy from the restored result is similar to the process of performing file restoration on the parsing result and extracting the sending policy from the restored result. Please refer to the relevant description in the determination method one, which will not be repeated here. Since the second data includes a data-specific sending policy, the second device can extract the sending policy to implement transmission control according to the data-specific sending policy. The granularity of the transmission control is the data granularity, which is fine and accurate.

[0108] In the case where the second data includes both attribute tags and sending policies, the second device can flexibly select determination method 1 or determination method 2 to determine the sending policy. For example, the second device can choose to adopt determination method 2, extract only the sending policy, and perform the operation of S407 according to the extracted sending policy. The second device can also choose to extract the sending policy and attribute tags, determine the sending policy according to the extracted attribute tags, verify the extracted sending policy through the determined sending policy, and when the determined sending policy and the extracted sending policy are consistent, perform the operation of S407 according to the sending policy. When the determined sending policy and the extracted sending policy are inconsistent, the sending of the second data is restricted.

[0109] S407: The second device determines whether to intercept the second data according to the sending strategy of the second data.

[0110] In a possible implementation, the second device may choose to determine whether to intercept the second data only according to the sending policy, and determine to intercept the second data when the sending policy indicates that the sending is restricted, for example Figure 5-Figure 7 As shown, the second data is intercepted, and when the sending policy indicates that the sending is allowed, it is determined to release the second data, for example Figure 5-Figure 7 As shown, the second data is released. Exemplarily, when the second device determines to release the second data according to the sending policy, the second data is sent to the first network domain. The first network domain is determined according to the second data, and the second device can parse the destination address of the second data, and determine the second network domain to which the second data needs to be sent according to the destination address, and the first network domain is different from the network domain where the first device is located.

[0111] In one possible case, the second device may also determine whether the second data needs to be sent across network domains based on the source address and destination address of the second data, and determine whether to intercept the second data based on the determination result and the sending policy. When the sending policy is to allow sending, it can be determined to release the second data regardless of whether the second data needs to be sent across network domains. When the sending policy is to restrict sending and the second data does not belong to cross-domain transmission, it is determined to release the second data. When the sending policy is to restrict sending and the second data belongs to cross-domain transmission, it is determined to intercept the second data. Cross-domain sending means that the network domain to which the second data is sent is different from the network domain where the first device is located. Figure 5 For example, the first network domain is domain B, and the network domain where the first device is located is domain A, then the second data is transmitted across network domains.

[0112] In addition, the second device can directly send the second data during the process of sending the second data, and then the downstream network device can continue to determine whether the second data needs transmission protection based on the received second data to determine the sending strategy of the second data. The second device can also restore the first data based on the second data and send the restored first data. Restoration is, for example, to decapsulate the second data to obtain the first data in the encapsulation, or to delete the information filled in the protocol field of the second data to obtain the first data, and by restoring the first data and sending the first data, the amount of data transmitted is reduced, thereby improving the sending efficiency.

[0113] The above is the process of the second device sending the second data. In a possible case, the second device will also record the transmission information of the second data, and the transmission information includes but is not limited to: the user information of the user who sends the second data, the transmission time of the second data, the transmission mode of the second data, and the transmission strategy of the second data, so as to monitor the data transmission according to the transmission information. In a possible implementation, the second device can trigger the early warning mechanism when it detects that the transmission strategy of the second data is to limit the transmission, for example, send an alarm message to the operation object, and the alarm message includes the transmission information of the second data. The second device can immediately trigger the early warning mechanism when there is intercepted second data, and can also trigger the alarm mechanism when the number of restricted second data reaches the early warning threshold set based on experience. Through the early warning, the operation object is promptly reminded that sensitive data that needs to be protected is being transmitted, so that the operation object can check according to the transmission information to achieve data protection.

[0114] In summary, the data processing method provided by the embodiment of the present application, since the attribute label indicates the attribute information of the first data in different dimensions, the attribute label can be used to determine whether the first data needs transmission protection according to the attribute information of different dimensions to obtain a sending strategy, thereby avoiding sending data that should not be transmitted, resulting in data leakage, and having high security. In addition, since the sending strategy can be determined only based on the attribute label, the process involved in determining the sending strategy is small, the operation is simple, and the efficiency is high. Furthermore, by not limiting the method by which the first device obtains the second data based on the attribute label and the first data, it has high flexibility. And no matter what method the first device uses to obtain the second data, the second device has a corresponding parsing method to smoothly obtain the sending strategy based on the parsing result of the second data, and it has wide versatility.

[0115] The data processing method of the embodiment of the present application is introduced above. Corresponding to the above method, the embodiment of the present application also provides a data processing device. Figure 8 Schematic diagram of a data processing device provided in an embodiment of the present application. Figure 8 As shown in the following multiple modules, the Figure 8 The data processing device shown is capable of executing the above Figure 4 It should be understood that the device may include more additional modules than the modules shown or omit some of the modules shown, and the embodiments of the present application are not limited to this. Figure 8 As shown, the device comprises:

[0116] An acquisition module 801 is used to acquire first data;

[0117] A determination module 802 is used to determine an attribute tag of the first data, where the attribute tag indicates attribute information of the first data in different dimensions;

[0118] The acquisition module 801 is further configured to acquire second data according to the first data and the attribute tag, wherein the second data includes the first data and at least one of the attribute tag and a sending strategy obtained based on the attribute tag, wherein the sending strategy indicates whether a device receiving the second data intercepts the second data;

[0119] The sending module 803 sends the second data to the second device.

[0120] In one possible implementation, the determination module 802 is used to obtain at least one classification information of the first data, the classification information indicates the importance of the first data in the corresponding classification, the first data corresponds to at least one classification, and each classification information in the at least one classification information indicates a different classification; and determine the attribute label according to the at least one classification information.

[0121] In a possible implementation, the acquisition module 801 is used to acquire an encapsulation result, where the encapsulation result includes at least one of an attribute tag and a sending strategy and the first data; and obtain the second data according to the encapsulation result.

[0122] In a possible implementation, the acquisition module 801 is configured to fill at least one of the attribute tag and the sending strategy in the protocol field of the encapsulation result to obtain the second data.

[0123] In a possible implementation, the acquisition module 801 is configured to fill at least one of an attribute tag and a sending strategy in a protocol field of the first data to obtain the second data.

[0124] In a possible implementation, the acquisition module 801 is further configured to acquire a correspondence between an attribute tag and a sending strategy; and determine the sending strategy according to the correspondence and the attribute tag.

[0125] In one possible implementation, the attribute label includes at least one of a confidentiality level label, a data type label, and an object identity label, the confidentiality level label indicates a sensitivity level of the first data, the data type label indicates a data type of the first data, and the object identity label indicates an identity level of an object corresponding to the first data.

[0126] Since the attribute tag indicates the attribute information of the first data in different dimensions, the above device determines whether the first data needs transmission protection according to the attribute information of different dimensions, and determines the sending strategy, thereby avoiding releasing data that should not be sent, avoiding data leakage, and having high data transmission security. The sending strategy can be determined only according to the attribute tag, and the process involved in determining the sending strategy is small, the operation is simple, and the efficiency is high.

[0127] The embodiment of the present application also provides another data processing device. Fig. 9 Schematic diagram of a data processing device provided in an embodiment of the present application. Fig. 9 As shown in the following multiple modules, the Fig. 9 The data processing device shown is capable of executing the above Figure 4 It should be understood that the device may include more additional modules than the modules shown or omit some of the modules shown, and the embodiments of the present application are not limited to this. Fig. 9 As shown, the device comprises:

[0128] A receiving module 901 is configured to receive second data sent by a first device, where the second data includes the first data and at least one of an attribute tag of the first data and a sending strategy obtained based on the attribute tag, where the attribute tag indicates attribute information of the first data in different dimensions;

[0129] A determination module 902, configured to analyze the second data and determine a sending strategy for the second data according to the analysis result;

[0130] The determination module 902 is further configured to determine whether to intercept the second data according to a sending strategy of the second data.

[0131] In a possible implementation, the second data includes an attribute tag, and the determination module 902 is used to determine the attribute tag according to the parsing result; obtain the correspondence between the attribute tag and the sending strategy, and determine the sending strategy according to the correspondence and the determined attribute tag.

[0132] In one possible implementation, the determination module 902 is used to extract the attribute tag from the protocol field when the parsed protocol field includes the attribute tag; or, when the parsed protocol field does not include the attribute tag, perform file restoration on the parsing result and extract the attribute tag from the restored result.

[0133] In one possible implementation, the second data includes a sending strategy, and a determination module 902 is used to extract the sending strategy from the protocol field when the parsed protocol field includes the sending strategy; or, when the parsed protocol field does not include the sending strategy, perform file restoration on the parsing result and extract the sending strategy from the restored result.

[0134] In a possible implementation, the device further includes: a forwarding module, configured to send the second data to a first network domain when it is determined to release the second data according to a sending policy, the first network domain being determined according to the second data, and the first network domain being different from a network domain where the first device is located.

[0135] In one possible implementation, the attribute label includes at least one of a confidentiality level label, a data type label, and an object identity label, the confidentiality level label indicates a sensitivity level of the first data, the data type label indicates a data type of the first data, and the object identity label indicates an identity level of an object corresponding to the first data.

[0136] Since the attribute tag indicates the attribute information of the first data in different dimensions, the above device determines whether the first data needs transmission protection according to the attribute information of different dimensions, and determines the sending strategy, thereby avoiding releasing data that should not be sent, avoiding data leakage, and having high data transmission security. The sending strategy can be determined by only parsing the second data, and the process involved in determining the sending strategy is small, the operation is simple, and the efficiency is high.

[0137] It should be understood that the above Figure 8 or Fig. 9When the device provided realizes its functions, only the division of the above-mentioned functional modules is used as an example for illustration. In practical applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0138] See also Fig.10 , Fig.10 A schematic diagram of the structure of a network device 1000 provided by an exemplary embodiment of the present application is shown. Fig.10 The network device 1000 shown is used to perform the above Figure 4 The operations involved in the data processing method shown. The network device 1000 is, for example, a switch, a router, etc. The network device 1000 can be implemented by a general bus architecture.

[0139] like Fig.10 As shown, the network device 1000 includes at least one processor 1001 , a memory 1003 , and at least one communication interface 1004 .

[0140] Processor 1001 is, for example, a general-purpose central processing unit (CPU), a digital signal processor (DSP), a network processor (NP), a graphics processing unit (GPU), a neural-network processing units (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the solution of the present application. For example, processor 1001 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. It can implement or execute various logic blocks, modules, and circuits described in conjunction with the disclosure of the embodiments of the present application. The processor can also be a combination that implements a computing function, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0141] Optionally, the network device 1000 further includes a bus. The bus is used to transmit information between the components of the network device 1000. The bus may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.10 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0142] The memory 1003 is, for example, a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1003 is, for example, independent and connected to the processor 1001 via a bus. The memory 1003 can also be integrated with the processor 1001.

[0143] The communication interface 1004 uses any transceiver-like device for communicating with other devices or communication networks, and the communication network can be Ethernet, a radio access network (RAN) or a wireless local area network (WLAN), etc. The communication interface 1004 may include a wired communication interface and may also include a wireless communication interface. Specifically, the communication interface 1004 may be an Ethernet interface, a fast Ethernet (FE) interface, a gigabit Ethernet (GE) interface, an asynchronous transfer mode (ATM) interface, a wireless local area network (WLAN) interface, a cellular network communication interface or a combination thereof. The Ethernet interface may be an optical interface, an electrical interface or a combination thereof. In an embodiment of the present application, the communication interface 1004 may be used for the network device 1000 to communicate with other devices.

[0144] In a specific implementation, as an embodiment, the processor 1001 may include one or more CPUs, such as Fig.10 0 and CPU1 shown in FIG. Each of these processors may be a single-CPU processor or a multi-CPU processor. A processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0145] In a specific implementation, as an embodiment, the network device 1000 may include multiple processors, such as Fig.10 1 and 1005. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0146] In a specific implementation, as an embodiment, the network device 1000 may also include an output device and an input device. The output device communicates with the processor 1001 and can display information in a variety of ways. For example, the output device may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device communicates with the processor 1001 and can receive user input in a variety of ways. For example, the input device may be a mouse, a keyboard, a touch screen device, or a sensor device.

[0147] In some embodiments, the memory 1003 is used to store the program code 1010 for executing the solution of the present application, and the processor 1001 can execute the program code 1010 stored in the memory 1003. That is, the network device 1000 can implement the data processing method provided by the method embodiment through the processor 1001 and the program code 1010 in the memory 1003. The program code 1010 may include one or more software modules. Optionally, the processor 1001 itself can also store the program code or instruction for executing the solution of the present application.

[0148] In a specific embodiment, the network device 1000 of the embodiment of the present application may correspond to the computing device in the above-mentioned various method embodiments.

[0149] in, Figure 4 Each step of the data processing method shown is completed by an integrated logic circuit of hardware or software instructions in the processor of the network device 1000. The steps of the method disclosed in conjunction with the embodiment of the present application can be directly embodied as a hardware processor, or a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it is not described in detail here.

[0150] See also Fig.11 , Fig.11 FIG. 1 shows a schematic diagram of the structure of a network device 1100 provided by another exemplary embodiment of the present application. Fig.11 The network device 1100 shown is used to perform the above Figure 4 All or part of the operations involved in the data processing method shown. The network device 1100 is, for example, a switch, a router, etc. The network device 1100 can be implemented by a general bus architecture.

[0151] like Fig.11 As shown, the network device 1100 includes: a main control board 1110 and an interface board 1130 .

[0152] The main control board is also called a main processing unit (MPU) or a route processor card. The main control board 1110 is used to control and manage various components in the network device 1100, including routing calculation, device management, device maintenance, and protocol processing functions. The main control board 1110 includes: a central processing unit 1111 and a memory 1112.

[0153] The interface board 1130 is also called a line processing unit (LPU), a line card (linecard) or a service board. The interface board 1130 is used to provide various service interfaces and realize the forwarding of data packets. The service interface includes but is not limited to an Ethernet interface, a POS (Packet over SONET / SDH) interface, etc., and the Ethernet interface is, for example, a Flexible Ethernet Service Interface (Flexible Ethernet Clients, FlexE Clients). The interface board 1130 includes: a central processing unit 1131, a network processor 1132, a forwarding table entry memory 1134 and a physical interface card (physical interface card, PIC) 1133.

[0154] The central processing unit 1131 on the interface board 1130 is used to control and manage the interface board 1130 and communicate with the central processing unit 1111 on the main control board 1110 .

[0155] The network processor 1132 is used to implement the forwarding processing of the message. The network processor 1132 can be in the form of a forwarding chip. The forwarding chip can be a network processor (NP). In some embodiments, the forwarding chip can be implemented by an application-specific integrated circuit (ASIC) or a field programmable gate array (FPGA). Specifically, the network processor 1132 is used to forward the received message based on the forwarding table stored in the forwarding table entry memory 1134. If the destination address of the message is the address of the network device 1100, the message is sent to the CPU (such as the central processor 1131) for processing; if the destination address of the message is not the address of the network device 1100, the next hop and the output interface corresponding to the destination address are found from the forwarding table according to the destination address, and the message is forwarded to the output interface corresponding to the destination address. Among them, the processing of the uplink message may include: processing of the message input interface, forwarding table search; the processing of the downlink message may include: forwarding table search, etc. In some embodiments, the central processor can also perform the function of the forwarding chip, such as implementing software forwarding based on a general-purpose CPU, so that the forwarding chip is not required in the interface board.

[0156] The physical interface card 1133 is used to implement the physical layer docking function, whereby the original traffic enters the interface board 1130, and the processed message is sent from the physical interface card 1133. The physical interface card 1133, also called a daughter card, can be installed on the interface board 1130, and is responsible for converting the photoelectric signal into a message and forwarding the message to the network processor 1132 for processing after performing a validity check. In some embodiments, the central processor 1131 can also perform the functions of the network processor 1132, such as implementing software forwarding based on a general-purpose CPU, so that the network processor 1132 is not required in the physical interface card 1133.

[0157] Optionally, the network device 1100 includes a plurality of interface boards, for example, the network device 1100 further includes an interface board 1140, and the interface board 1140 includes: a central processor 1141, a network processor 1142, a forwarding table entry memory 1144, and a physical interface card 1143. The functions and implementation methods of the components in the interface board 1140 are the same or similar to those of the interface board 1130, and are not described in detail herein.

[0158] Optionally, the network device 1100 further includes a switching fabric board 1120. The switching fabric board 1120 may also be referred to as a switch fabric unit (SFU). When the network device 1100 has multiple interface boards, the switching fabric board 1120 is used to complete data exchange between the interface boards. For example, the interface board 1130 and the interface board 1140 may communicate through the switching fabric board 1120.

[0159] The main control board 1110 is coupled to the interface board. For example, the main control board 1110, the interface board 1130, the interface board 1140, and the switching network board 1120 are connected to the system backplane through the system bus to achieve intercommunication. In a possible implementation, an inter-process communication (IPC) channel is established between the main control board 1110 and the interface board 1130 and the interface board 1140, and the main control board 1110 and the interface board 1130 and the interface board 1140 communicate through the IPC channel.

[0160] Logically, the network device 1100 includes a control plane and a forwarding plane. The control plane includes a main control board 1110 and a central processing unit 1111. The forwarding plane includes various components for performing forwarding, such as a forwarding table entry memory 1134, a physical interface card 1133, and a network processor 1132. The control plane performs functions such as a router, generating a forwarding table, processing signaling and protocol messages, and configuring and maintaining the status of the network device. The control plane sends the generated forwarding table to the forwarding plane. On the forwarding plane, the network processor 1132 forwards the message received by the physical interface card 1133 based on the forwarding table sent by the control plane. The forwarding table sent by the control plane can be stored in the forwarding table entry memory 1134. In some embodiments, the control plane and the forwarding plane can be completely separated and not on the same network device.

[0161] It is worth noting that there may be one or more main control boards, and when there are multiple boards, they may include a primary main control board and a backup main control board. There may be one or more interface boards. The stronger the data processing capability of the network device, the more interface boards are provided. There may also be one or more physical interface cards on the interface board. There may be no switching network board, or there may be one or more switching network boards. When there are multiple switching network boards, they can jointly realize load sharing and redundant backup. In a centralized forwarding architecture, network devices may not need switching network boards, and the interface board is responsible for processing the service data of the entire system. In a distributed forwarding architecture, network devices may have at least one switching network board, and data exchange between multiple interface boards is realized through the switching network board, providing large-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of network devices with distributed architectures are greater than those of network devices with centralized architectures. Optionally, the network device may have only one board, that is, no switching board, and the functions of the interface board and the main control board are integrated on the board. In this case, the central processor on the interface board and the central processor on the main control board can be combined into one central processor on the board to perform the functions of the two. This type of network device has low data exchange and processing capabilities (for example, low-end switches or routers and other network devices). The specific architecture to be adopted depends on the specific networking deployment scenario, and no limitation is made here.

[0162] In a specific embodiment, the network device 1100 corresponds to the above Figure 8 or Fig. 9 In some embodiments, Figure 8 The determination module 802 in the data processing apparatus shown is equivalent to the central processor 1111 or the network processor 1132 in the network device 1100 .

[0163] The embodiment of the present application also provides a communication device, which includes: a transceiver, a memory, and a processor. The transceiver, the memory, and the processor communicate with each other through an internal connection path, the memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to control the transceiver to receive signals and control the transceiver to send signals, and when the processor executes the instructions stored in the memory, the processor executes the data processing method.

[0164] It should be understood that the processor may be a CPU, or other general-purpose processors, DSPs, ASICs, FPGAs or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor supporting an advanced RISC machines (ARM) architecture.

[0165] Further, in an optional embodiment, the memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. The memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type.

[0166] The memory may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memory. Among them, the nonvolatile memory may be a ROM, a programmable read-only memory (programmable ROM, PROM), an erasable programmable read-only memory (erasable PROM, EPROM), an EEPROM or a flash memory. The volatile memory may be a RAM, which is used as an external cache. By way of example but not limitation, many forms of RAM are available. For example, static random access memory (static RAM, SRAM), dynamic random access memory (dynamic random access memory, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (doubledata rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory (synchlink DRAM, SLDRAM) and direct memory bus random access memory (direct rambus RAM, DR RAM).

[0167] The embodiment of the present application also provides a data processing device, the device includes a processor, the processor is used to load and run at least one instruction, so that the data processing device implements the data processing method provided by the embodiment of the present application. Optionally, the device also includes a memory, the memory is coupled to the processor, and the memory is used to store at least one instruction.

[0168] An embodiment of the present application also provides a data processing system, which includes a first device and a second device, and the first device and the second device are used to interactively execute the data processing method provided by the embodiment of the present application.

[0169] An embodiment of the present application also provides a computer-readable storage medium, in which at least one instruction is stored. The instruction is loaded and executed by a processor so that a computer implements any of the data processing methods described above.

[0170] The embodiments of the present application also provide a computer program (product), which, when executed by a computer, can enable a processor or a computer to execute the corresponding steps and / or processes in the above method embodiments.

[0171] An embodiment of the present application also provides a chip, which includes a processor for calling and executing instructions stored in a memory from the memory, so that a communication device equipped with the chip executes any of the data processing methods described above.

[0172] An embodiment of the present application also provides another chip, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute any of the data processing methods described above.

[0173] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in this application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk), etc.

[0174] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions. For example, the first data involved in this application are all obtained with full authorization.

[0175] Those of ordinary skill in the art will appreciate that, in conjunction with the various method steps and modules described in the embodiments disclosed herein, they can be implemented in software, hardware, firmware, or any combination thereof. In order to clearly illustrate the interchangeability of hardware and software, the steps and components of each embodiment have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0176] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0177] When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer program instructions. As an example, the method of the embodiment of the present application can be described in the context of a machine executable instruction, and the machine executable instruction is such as included in the program module executed in the device on the real or virtual processor of the target. Generally speaking, a program module includes a routine, a program, a library, an object, a class, a component, a data structure, etc., which performs a specific task or realizes a specific abstract data structure. In various embodiments, the function of the program module can be merged or divided between the described program modules. The machine executable instruction for the program module can be executed in a local or distributed device. In a distributed device, the program module can be located in both a local and a remote storage medium.

[0178] The computer program code for realizing the method for the embodiment of the present application can be written in one or more programming languages. These computer program codes can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by a computer or other programmable data processing device, causes the function / operation specified in the flow chart and / or block diagram to be implemented. The program code can be executed completely on a computer, partially on a computer, as an independent software package, partially on a computer and partially on a remote computer or completely on a remote computer or server.

[0179] In the context of the embodiments of the present application, computer program codes or related data may be carried by any appropriate carrier to enable a device, apparatus or processor to perform the various processes and operations described above. Examples of carriers include signals, computer readable media, and the like.

[0180] Examples of signals may include electrical, optical, radio, acoustic or other forms of propagated signals, such as carrier waves, infrared signals, etc.

[0181] A machine-readable medium may be any tangible medium that contains or stores a program for or related to an instruction execution system, apparatus, or device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination thereof. More detailed examples of machine-readable storage media include an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0182] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0183] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the module is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, or it can be an electrical, mechanical or other form of connection.

[0184] The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0185] In addition, each functional module in each embodiment of the present application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.

[0186] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0187] In the present application, the terms "first", "second", etc. are used to distinguish between identical or similar items having substantially the same effects and functions. It should be understood that there is no logical or temporal dependency between "first", "second", and "nth", nor is there a limitation on quantity and execution order. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another. For example, without departing from the scope of the various described examples, a first image may be referred to as a second image, and similarly, a second image may be referred to as a first image. Both the first image and the second image may be images, and in some cases, may be separate and different images.

[0188] It should also be understood that in the various embodiments of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0189] The term "at least one" in this application means one or more, and the term "multiple" in this application means two or more, for example, multiple second messages means two or more second messages. The terms "system" and "network" are often used interchangeably herein.

[0190] It should be understood that the terms used in the description of the various examples herein are only for describing specific examples and are not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0191] It should also be understood that the term "and / or" used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items. The term "and / or" is a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this application generally indicates that the associated objects before and after are in an "or" relationship.

[0192] It should also be understood that the term “comprise” (also known as “includes,” “including,” “comprises” and / or “comprising”) when used in this specification specifies the presence of stated features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0193] It should also be understood that the terms "if" and "if" may be interpreted to mean "when" or "upon" or "in response to determining" or "in response to detecting." Similarly, the phrases "if it is determined that ..." or "if [a stated condition or event] is detected" may be interpreted to mean "upon determining that ..." or "in response to determining that ..." or "upon detecting [a stated condition or event]" or "in response to detecting [a stated condition or event]," depending on the context.

[0194] It should be understood that determining B based on A does not mean determining B only based on A. B can also be determined based on A and / or other information.

[0195] It should also be understood that the references to "one embodiment", "an embodiment", or "a possible implementation" throughout the specification mean that specific features, structures, or characteristics related to the embodiment or implementation are included in at least one embodiment of the present application. Therefore, the references to "in one embodiment" or "in an embodiment", or "a possible implementation" throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

Claims

1. A data processing method, characterized in that: The method is applied to a first device, and the method includes: Acquire first data; Determine an attribute tag of the first data, where the attribute tag indicates attribute information of the first data in different dimensions; acquiring second data according to the first data and the attribute tag, the second data including the first data and at least one of the attribute tag and a sending strategy obtained based on the attribute tag, the sending strategy indicating whether a device receiving the second data intercepts the second data; The second data is sent to a second device.

2. The method according to claim 1, characterized in that: The determining the attribute label of the first data includes: Acquire at least one classification information of the first data, the classification information indicating the importance of the first data in the corresponding classification, the first data corresponding to at least one classification, and each classification information in the at least one classification information indicates a different classification; The attribute label is determined according to the at least one classification information.

3. The method according to claim 1 or 2, characterized in that: The acquiring the second data according to the first data and the attribute tag includes: Acquire an encapsulation result, where the encapsulation result includes at least one of the attribute tag and the sending strategy and the first data; The second data is obtained according to the packaging result.

4. The method according to claim 3, characterized in that The obtaining the second data according to the encapsulation result includes: At least one of the attribute tag and the sending strategy is filled in the protocol field of the encapsulation result to obtain the second data.

5. The method according to claim 1 or 2, characterized in that: The acquiring the second data according to the first data and the attribute tag includes: At least one of the attribute tag and the sending strategy is filled in the protocol field of the first data to obtain the second data.

6. The method according to any one of claims 3 to 5, characterized in that: Before acquiring the second data according to the first data and the attribute tag, the method further includes: Get the correspondence between attribute tags and sending strategies; The sending strategy is determined according to the corresponding relationship and the attribute tag.

7. The method according to any one of claims 1 to 6, characterized in that: The attribute label includes at least one of a confidentiality level label, a data type label and an object identity label, the confidentiality level label indicates a sensitivity level of the first data, the data type label indicates a data type of the first data, and the object identity label indicates an identity level of an object corresponding to the first data.

8. A data processing method, characterized in that: The method is applied to a second device, and the method includes: receiving second data sent by the first device, the second data including the first data and at least one of an attribute tag of the first data and a sending strategy obtained based on the attribute tag, wherein the attribute tag indicates attribute information of the first data in different dimensions; parsing the second data, and determining a sending strategy for the second data according to a parsing result; Determine whether to intercept the second data according to a sending policy of the second data.

9. The method according to claim 8, characterized in that The second data includes the attribute tag, and determining a sending strategy for the second data according to the parsing result includes: Determine the attribute tag according to the parsing result; The corresponding relationship between the attribute tag and the sending strategy is acquired, and the sending strategy is determined according to the corresponding relationship and the determined attribute tag.

10. The method according to claim 9, characterized in that The determining the attribute tag according to the parsing result includes: In a case where the parsed protocol field includes the attribute tag, extracting the attribute tag from the protocol field; Alternatively, when the protocol field obtained by the analysis does not include the attribute tag, the parsing result is restored to a file, and the attribute tag is extracted from the restored result.

11. The method according to claim 8, characterized in that The second data includes the sending strategy, and determining the sending strategy of the second data according to the parsing result includes: In a case where the protocol field obtained by parsing includes the sending policy, extracting the sending policy from the protocol field; Alternatively, when the protocol field obtained by the analysis does not include the sending policy, the parsing result is restored to a file, and the sending policy is extracted from the restored result.

12. The method according to any one of claims 8 to 11, characterized in that: After determining whether to intercept the second data according to the sending strategy of the second data, the method further includes: In case it is determined according to the sending policy to release the second data, the second data is sent to a first network domain, the first network domain is determined according to the second data, and the first network domain is different from the network domain where the first device is located.

13. The method according to any one of claims 8 to 12, characterized in that: The attribute label includes at least one of a confidentiality level label, a data type label and an object identity label, the confidentiality level label indicates a sensitivity level of the first data, the data type label indicates a data type of the first data, and the object identity label indicates an identity level of an object corresponding to the first data.

14. A data processing device, characterized in that: The device comprises: A transceiver module, configured to perform the receiving and / or sending related operations performed by the first device in the method of any one of claims 1 to 7; A processing module, used to perform other operations other than the receiving and / or sending related operations performed by the first device in any one of the methods described in claims 1-7.

15. A data processing device, characterized in that: The device comprises: A transceiver module, configured to perform the reception and / or transmission related operations performed by the second device in the method described in any one of claims 8 to 13; A processing module, used to perform other operations other than the receiving and / or sending related operations performed by the second device in the method described in any one of claims 8-13.

16. A data processing device, characterized in that: The device includes a processor, and the processor is used to load and execute at least one instruction so that the data processing device implements the data processing method as described in any one of claims 1-7, or implements the data processing method as described in any one of claims 8-13.

17. A data processing system, characterized in that: The system includes a first device and a second device, wherein the first device is used to implement the data processing method as described in any one of claims 1 to 7, and the second device is used to implement the data processing method as described in any one of claims 8 to 13.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, and the instruction is loaded and executed by the processor to implement the data processing method as described in any one of claims 1 to 7, or to implement the data processing method as described in any one of claims 8 to 13.

19. A chip, characterized in that: The chip includes a processor, which is used to run program instructions or codes, so that a device including the chip executes the data processing method as described in any one of claims 1-7, or executes the data processing method as described in any one of claims 8-13.

Images