Data transmission method and data transmission encryption and decryption system

Abstract

The embodiment of the invention provides a data transmission method and a data transmission encryption and decryption system, and relates to the technical field of data security transmission. The method comprises the following steps: a data sender determines classification and grading information of data to be transmitted; the data sender determines a target encryption mode corresponding to the to-be-transmitted data according to the classification and grading information of the to-be-transmitted data, and sends the target encryption mode to the data receiver; the data sender encrypts the to-be-transmitted data based on the target encryption mode to obtain encrypted data, and sends the encrypted data to the data receiver; and the data receiver decrypts the encrypted data based on a target decryption mode corresponding to the target encryption mode to obtain decrypted data. According to the data transmission method provided by the embodiment of the invention, classified and graded secure transmission of data can be realized based on different encryption modes, and the security and transmission efficiency of data transmission are better considered.

Description

Technical Field

[0001] The embodiments of the present invention relate to the technical field of secure data transmission, and in particular to a data transmission method and a data transmission encryption and decryption system. Background Art

[0002] Currently, for secure communication and data transmission between data senders and receivers, after the encryption policy is configured, all data between the data senders and receivers are usually encrypted using the same encryption method before transmission.

[0003] However, the current and future trend is the development of data diversity. If data transmission is still based on the same encryption method, it is obviously unable to meet the security and confidentiality of data diversity, which is not conducive to the circulation, sharing, development and utilization of data. Summary of the invention

[0004] The embodiments of the present invention provide a data transmission method and a data transmission encryption and decryption system to achieve secure transmission of data in a classified and graded manner based on different encryption methods, thereby better balancing the security and efficiency of data transmission.

[0005] A first aspect of an embodiment of the present invention provides a data transmission method, the method comprising:

[0006] The data sender determines the classification and grading information of the data to be transmitted, wherein the classification and grading information at least represents the category and importance of the data to be transmitted;

[0007] The data sender determines the target encryption method corresponding to the data to be transmitted according to the classification and grading information of the data to be transmitted, and sends the target encryption method to the data receiver;

[0008] The data sender encrypts the data to be transmitted based on the target encryption method to obtain encrypted data, and sends the encrypted data to the data receiver;

[0009] The data recipient decrypts the encrypted data based on a target decryption method corresponding to the target encryption method to obtain decrypted data.

[0010] A second aspect of an embodiment of the present invention provides a data transmission encryption and decryption system, the system at least comprising:

[0011] A classification and grading determination module, used to determine classification and grading information of the data to be transmitted, wherein the classification and grading information at least represents the category and importance of the data to be transmitted;

[0012] An encryption mode determination module is used to determine a target encryption mode corresponding to the data to be transmitted according to the classification and grading information of the data to be transmitted, and send the target encryption mode to a data receiver;

[0013] The data encryption module is used to encrypt the data to be transmitted based on the target encryption method to obtain encrypted data.

[0014] In the data transmission method provided in the embodiment of the present invention, the data sender determines the classification and grading information of the data to be transmitted; determines the target encryption method corresponding to the data to be transmitted based on the classification and grading information of the data to be transmitted, and sends the target encryption method to the data receiver; encrypts the data to be transmitted based on the target encryption method to obtain encrypted data, and sends the encrypted data to the data receiver; the data receiver decrypts the encrypted data based on the target decryption method corresponding to the target encryption method to obtain decrypted data. Through the data transmission method of this embodiment, based on the classification and grading information of the data to be transmitted, the encryption method corresponding to the classification and grading information can be selected to encrypt the data to be transmitted. In this way, data of different classifications and gradings are encrypted and transmitted using different encryption methods, thereby realizing classified and graded secure transmission of data, and better balancing security and transmission efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0016] Figure 1 is a flow chart of a data transmission method shown in one embodiment of the present invention;

[0017] Figure 2 It is a deployment diagram of bypass deployment of a data transmission encryption and decryption system shown in an embodiment of the present invention;

[0018] Figure 3 It is a deployment diagram of a data transmission encryption and decryption system deployed in series according to an embodiment of the present invention;

[0019] Figure 4 is a schematic diagram of a data transmission encryption method shown in an embodiment of the present invention;

[0020] Figure 5 It is a structural block diagram of a data transmission encryption and decryption system provided by an embodiment of the present invention;

[0021] Figure 6The present invention is a schematic diagram of a data transmission encryption and decryption system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0022] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] Currently, data transmission is usually done by encrypting all data using the same encryption algorithm and key length after configuring the encryption strategy. The most popular solution is to build an encryption tunnel on the Internet using VPN devices to achieve secure data transmission on the public network, especially the Internet. Or, in the relevant data transmission field, mature conventional cryptographic machine solutions are used to achieve data encryption transmission and local data security storage. The quantum cryptographic machine solution is a solution that has emerged in recent years, with the aim of enhancing the security of data encryption key exchange.

[0024] However, the current solution has at least the following shortcomings:

[0025] (1) The granularity of data transmission encryption is relatively coarse. Different data can only be selected based on the network address and port number to determine whether to encrypt the transmission. Data classification and classification for secure transmission cannot be performed.

[0026] (2) All data that needs to be encrypted is encrypted using the same encryption method. Different encryption methods cannot be selected for encrypted transmission, making it impossible to achieve secure transmission of data by classification and grading, making it difficult to better balance security and transmission efficiency.

[0027] Therefore, in order to at least partially solve the above-mentioned problems and one or more of other potential problems, an embodiment of the present invention proposes a data transmission method, which selects an encryption method corresponding to the classification and grading information of the data to be transmitted to encrypt the data to be transmitted. Specifically, different encryption methods can be selected to encrypt data from different sources (such as different servers, desktop hosts, business application systems and databases, etc.), different business application platforms or systems, different data categories, different file types, and different degrees (levels) of importance. In this way, data of different classifications and gradings are encrypted and transmitted using different encryption methods, thereby realizing the secure transmission and protection of data classification and grading, which is conducive to the circulation, sharing, development and utilization of data, and better balances security and transmission efficiency.

[0028] Hereinafter, specific examples of the present solution will be described in more detail with reference to the accompanying drawings.

[0029] refer to Figure 1 , Figure 1 FIG. 1 is a flow chart of a data transmission method according to an embodiment of the present invention. Figure 1 As shown, the data transmission method of this embodiment may include the following steps:

[0030] Step S11: The data sender determines the classification and grading information of the data to be transmitted, where the classification and grading information at least represents the category and importance of the data to be transmitted.

[0031] In this embodiment, when transmitting data to a data receiver, the data sender may first determine the classification and grading information of the data to be transmitted. The data to be transmitted is data transmitted to the data sender, and may be any data. The classification and grading information of the data to be transmitted at least represents the category and importance of the data to be transmitted. In this embodiment, the classification and grading information represents the encryption granularity of the data to be transmitted.

[0032] Step S12: The data sender determines the target encryption method corresponding to the data to be transmitted according to the classification and grading information of the data to be transmitted, and sends the target encryption method to the data receiver.

[0033] In this embodiment, different data encryption methods are set in advance for different classification and grading information to achieve fine-grained data classification and grading secure transmission. After the data sender determines the classification and grading information of the data to be transmitted, it can determine the target encryption method corresponding to the data to be transmitted from multiple different encryption methods based on the classification and grading information of the data to be transmitted, and send the target encryption method to the data receiver. Among them, the target encryption method in this embodiment refers to the encryption method corresponding to the classification and grading information of the data to be transmitted.

[0034] Step S13: The data sender encrypts the data to be transmitted based on the target encryption method to obtain encrypted data, and sends the encrypted data to the data receiver.

[0035] In this embodiment, after determining the target encryption method, the data sender may encrypt the data to be transmitted based on the target encryption method to obtain encrypted data after the data to be transmitted is encrypted, and send the encrypted data to the data receiver.

[0036] Step S14: The data recipient decrypts the encrypted data based on the target decryption method corresponding to the target encryption method to obtain decrypted data.

[0037] In this embodiment, after the data recipient receives the target encryption method sent by the data sender, it can determine the corresponding decryption method based on the target encryption method as the target decryption method. After receiving the encrypted data sent by the data sender, the encrypted data is decrypted based on the target decryption method to obtain decrypted data. The decrypted data is the data to be transmitted, thereby realizing the classified and graded secure transmission of the data to be transmitted from the data sender to the data recipient.

[0038] In this embodiment, based on the classification and grading information of the data to be transmitted, an encryption method corresponding to the classification and grading information is selected to encrypt the data to be transmitted. In this way, data of different classifications and gradings are encrypted and transmitted using different encryption methods, thereby improving data transmission efficiency while ensuring sufficient security. At the same time, it also enhances the overall security of data transmission and prevents a certain algorithm from being cracked and only affecting local areas. By realizing secure transmission of data classified and graded, better balance is achieved between security and transmission efficiency.

[0039] In combination with the above embodiments, in one implementation, an embodiment of the present invention further provides a data transmission method. Specifically, in this embodiment, the classification and grading information includes multiple information; in addition to the above steps, step S21 may also be included, and the "the data sender determines the target encryption method corresponding to the data to be transmitted based on the classification and grading information of the data to be transmitted" in the above step S12 may specifically include step S22:

[0040] Step S21: The data sender establishes a mapping relationship between any one piece of information or a combination of multiple pieces of information in the classified and graded information and different encryption methods.

[0041] In this embodiment, the data sender is provided with an encryption strategy corresponding to the classification and grading information, and the encryption strategy represents the mapping relationship between different classification and grading information and different encryption methods. The classification and grading information of this embodiment includes multiple information, each of which represents an attribute of the data to be transmitted. Specifically, the data sender of this embodiment can establish a mapping relationship between any one or a combination of multiple information in the classification and grading information and different encryption methods.

[0042] For example, if the classification and grading information includes at least two types of information: category and importance, then a mapping relationship can be established between any information in the classification and grading information and the encryption method, and / or a mapping relationship can be established between a combination of multiple information in the classification and grading information and the encryption method.

[0043] For example, the data sender can establish a mapping relationship between different categories and different encryption methods (such as data belonging to the first category corresponds to the first encryption method, data belonging to the second category corresponds to the second encryption method, and so on); it can also establish a mapping relationship between different importance levels and different encryption methods (such as data with a first degree of importance corresponds to the first encryption method, data with a second degree of importance corresponds to the second encryption method, and so on); it can also establish a mapping relationship between combinations of different categories and different degrees of importance and different encryption methods (such as data belonging to the first category and a first degree of importance corresponds to the first encryption method, data belonging to the second category and a first degree of importance corresponds to the second encryption method, data belonging to the first category and a second degree of importance corresponds to the third encryption method, data belonging to the second category and a second degree of importance corresponds to the fourth encryption method, and so on).

[0044] It should be noted that the above is only an example proposed in this embodiment. The multiple information included in the classification and grading information of this embodiment is not limited to this, and the combination of multiple information is not limited to this. This embodiment can determine the classification and grading information according to project requirements and determine the mapping relationship between different classification and grading information (that is, any one information or a combination of multiple information) and different encryption methods.

[0045] Step S22: The data sender determines the target encryption method corresponding to the data to be transmitted according to the classification and grading information of the data to be transmitted and the mapping relationship.

[0046] In this embodiment, after determining the classification and grading information of the data to be transmitted, the data sender can determine the target encryption method corresponding to the data to be transmitted based on the mapping relationship between the classification and grading information of the data to be transmitted and any one or a combination of multiple information in the established classification and grading information and different encryption methods.

[0047] In combination with the above embodiments, in one implementation, the present invention also provides a data transmission method. Specifically, in this method, the above step S21 may include steps S31 to S34:

[0048] Step S31: the data sender establishes a first mapping relationship between different importance levels and different encryption methods when the data source is a server.

[0049] In this embodiment, the classification and grading information at least includes: data source, business system, data category, file type and importance level; wherein, the importance level in the classification and grading information represents the importance of the data to be transmitted, and the data category in the classification and grading information represents the category to which the data to be transmitted belongs. In this embodiment, different encryption methods can be set for data of different data sources, different business application platforms or systems, different data categories, different file types, and different importance levels (most important level) to encrypt data. The encryption method of this embodiment at least includes: encryption algorithm and key length (i.e., encryption strength).

[0050] In this embodiment, the corresponding encryption strategy can be set according to different combinations of data sources and importance levels, and a first mapping relationship between different importance levels and different encryption methods can be established when the data source is a server. For example, the first mapping relationship may include: when the data source of the data to be transmitted is a server and the importance level of the data to be transmitted is core data, the first encryption method corresponds to the data source of the data to be transmitted and the importance level of the data to be transmitted is important data, the second encryption method corresponds to the data source of the data to be transmitted and the importance level of the data to be transmitted is general data, and the third encryption method corresponds to the data source of the data to be transmitted and the importance level of the data to be transmitted is general data. Among them, the core data, important data and general data of this embodiment are data classified and graded in accordance with GB / T43697-2024 "Data Security Technology Data Classification and Grading Rules".

[0051] Step S32: the data sender establishes a second mapping relationship between different file types and different encryption methods when the data source is a terminal.

[0052] In this embodiment, the corresponding encryption strategy can be set according to different combinations of data sources and file types, and a second mapping relationship between different file types and different encryption methods can be established when the data source is a terminal. For example, the second mapping relationship may include: when the data source of the data to be transmitted is a terminal and the file type of the data to be transmitted is a document type, the fourth encryption method corresponds to the data source of the data to be transmitted and the fifth encryption method corresponds to the data source of the data to be transmitted is a terminal and the file type of the data to be transmitted is a type other than a document type.

[0053] Step S33: When the data source is a business platform, the data sender establishes a third mapping relationship between different business systems and different encryption methods.

[0054] In this embodiment, the corresponding encryption strategy can be set based on the combination of the data source and the business system to which it belongs, and a third mapping relationship between different business systems and different encryption methods can be established when the data source is a business platform. For example, the third mapping relationship may include: when the data source of the data to be transmitted is a business platform and the business system of the data to be transmitted is a business platform, the sixth encryption method corresponds to

[0055] Step S34: the data sender establishes a fourth mapping relationship between different data categories and different encryption methods when the data source is a database.

[0056] In this embodiment, the corresponding encryption strategy can be set according to different combinations of data sources and data categories, and a fourth mapping relationship between different data categories and different encryption methods can be established when the data source is a database. For example, the fourth mapping relationship may include: when the data source of the data to be transmitted is a database and the data category of the data to be transmitted is a critical business class, the seventh encryption method corresponds to the data source of the data to be transmitted and the eighth encryption method corresponds to the data source of the data to be transmitted and the data category of the data to be transmitted is a business class other than the critical business class. Among them, the first to eighth encryption methods are different.

[0057] In combination with the above embodiments, in another implementation, an embodiment of the present invention further provides a data transmission method. Specifically, in this embodiment, the data sender at least includes: a data generation end, a first data transmission encryption and decryption system; the data receiver at least includes: a data receiving end and a second data transmission encryption and decryption system; in addition to the above steps, step S41 may also be included, and the "data sender determines the classification and grading information of the data to be transmitted" in the above step S11 may specifically include step S42, the above step S12 may specifically include step S43 and step S44, the above step S13 may specifically include step S45, and the above step S14 may specifically include step S46 and step S47:

[0058] Step S41: the data generation end classifies and grades the data to be transmitted, obtains classification and grading information of the data to be transmitted, adds classification and grading labels to the data to be transmitted, and sends the data to be transmitted to the first data transmission encryption and decryption system.

[0059] In this embodiment, the data generation end is used to generate data to be transmitted, and the data generation end needs to classify and grade the data to be transmitted, obtain classification and grading information of the data to be transmitted, and add classification and grading labels to the data to be transmitted, and send the data to be transmitted with the classification and grading labels to the first data transmission encryption and decryption system. The classification and grading labels at least include: a grading label and a category label.

[0060] In this embodiment, the first data transmission encryption and decryption system is the data transmission encryption and decryption system of the data sender, and the second data transmission encryption and decryption system is the data transmission encryption and decryption system of the data receiver. The two data transmission encryption and decryption systems are the same and can deploy the same or different encryption strategies. The data transmission encryption and decryption system can encrypt and decrypt data. For example, during this transmission, organization A is the data sender, and the data can be encrypted and sent through the data transmission encryption and decryption system in organization A. Organization B is the data receiver, and the encrypted data can be decrypted through the data transmission encryption and decryption system in organization B. During the next transmission, organization B is the data sender, and the data can be encrypted and sent through the data transmission encryption and decryption system in organization B. Organization A is the data receiver, and the encrypted data can be decrypted through the data transmission encryption and decryption system in organization A.

[0061] In an optional implementation, when the data sender and the data receiver transmit data, the specific encryption method (encryption algorithm and key length) to be used is based on the data to be transmitted, that is, the encryption policy deployed by the data source (data sender). For example: if terminal A of organization A accesses the key business data of database B of organization B, the encryption method of the key business data of database B is used; if terminal B of organization B obtains important data of server A of organization A, the encryption method of the important data of server A of organization A is used.

[0062] Step S42: The first data transmission encryption and decryption system determines the classification and grading information of the data to be transmitted based on the data to be transmitted and the classification and grading label.

[0063] In this embodiment, the first data transmission encryption and decryption system may determine the classification and grading information of the data to be transmitted based on the received data to be transmitted and the classification and grading label carried by the data to be transmitted.

[0064] Step S43: The first data transmission encryption and decryption system determines the target encryption method corresponding to the data to be transmitted according to the classification and grading information of the data to be transmitted.

[0065] In this embodiment, after the first data transmission encryption and decryption system determines the classification and grading information of the data to be transmitted, it can determine the target encryption method corresponding to the data to be transmitted according to the classification and grading information of the data to be transmitted.

[0066] Step S44: the first data transmission encryption and decryption system establishes an encrypted transmission channel with the second data transmission encryption and decryption system, and sends the target encryption method to the second data transmission encryption and decryption system based on the encrypted transmission channel.

[0067] In this embodiment, the first data transmission encryption and decryption system can negotiate data encryption keys and establish an encrypted transmission channel with the second data transmission encryption and decryption system, and based on the encrypted transmission channel, send the determined target encryption method (including at least the encryption algorithm and key length) to the second data transmission encryption and decryption system.

[0068] Step S45: the first data transmission encryption and decryption system encrypts the data to be transmitted based on the target encryption method to obtain encrypted data, and sends the encrypted data to the second data transmission encryption and decryption system.

[0069] In this embodiment, the first data transmission encryption and decryption system may encrypt the received data to be transmitted based on the target encryption method to obtain encrypted data, and send the encrypted data to the second data transmission encryption and decryption system.

[0070] Step S46: the second data transmission encryption and decryption system decrypts the encrypted data based on the target decryption method corresponding to the target encryption method to obtain the decrypted data.

[0071] In this embodiment, after the second data transmission encryption and decryption system receives the target encryption method, it can determine the corresponding target decryption method based on the target encryption method. After receiving the encrypted data, it decrypts the encrypted data based on the target decryption method to obtain decrypted data, which is the data to be transmitted.

[0072] Step S47: the second data transmission encryption and decryption system sends the decrypted data to the data receiving end.

[0073] In this embodiment, after the second data transmission encryption and decryption system obtains the decrypted data, it can send the decrypted data to the data receiving end, thereby realizing classified and graded secure transmission of the data to be transmitted from the data generating end to the data receiving end.

[0074] In this embodiment, the classified and graded secure transmission of data is mainly completed through the first data transmission encryption and decryption system and the second data transmission encryption and decryption system. The data transmission encryption and decryption system in this embodiment (i.e., the first data transmission encryption and decryption system and the second data transmission encryption and decryption system) supports classified and graded secure transmission of data, and an encryption strategy is set on it, the purpose of which is to perform different strengths of data encryption on different data entering the data transmission encryption and decryption system. The encryption strategy supports the selection of corresponding encryption algorithms and key lengths (i.e., different encryption methods, i.e., encryption strengths) for encryption of data from different sources, different business systems, different data categories, different file types, and different importance levels.

[0075] In an optional implementation manner, the data transmission encryption and decryption system (ie, the first data transmission encryption and decryption system and the second data transmission encryption and decryption system) of this embodiment may be a cipher machine.

[0076] In a specific implementation example, encryption policies can be set on the data transmission encryption and decryption systems of the data sender and receiver (such as institution A and institution B). The encryption policy is set on the data transmission encryption and decryption system of institution A, as shown in Table 1 below:

[0077] Table 1 Encryption strategy table set in the data transmission encryption and decryption system of organization A

[0078]

[0079]

[0080] In Table 1, data from server A is securely transmitted in different levels. Important data and core data use A2 algorithm and 128-bit key length, and general data use A1 algorithm and 56-bit key length. Data from terminal A is securely transmitted according to file type. Document data such as .doc and .wps use A2 algorithm and 128-bit key length, and other types of file data use A1 algorithm and 56-bit key length. Data from business platform A uses A3 algorithm and default key length. Data from database A is securely transmitted according to data type. Data belonging to key business category uses A4 algorithm and default key length, and data not belonging to key business category uses A2 algorithm and 128-bit key length. Data not involved in the encryption strategy is not encrypted.

[0081] And, the same encryption strategy as that of the data transmission encryption and decryption system of institution A is set on the data transmission encryption and decryption system of institution B, as shown in Table 2 below:

[0082] Table 2 Encryption strategy table set in the data transmission encryption and decryption system of organization B

[0083]

[0084]

[0085] Among them, in Table 2, data from server B is transmitted securely in a hierarchical manner, with important data and core data using the A2 algorithm and 128-bit key length, and general data using the A1 algorithm and 56-bit key length; data from terminal B is transmitted securely according to file type, with document data such as .doc and .wps using the A2 algorithm and 128-bit key length, and other types of file data using the A1 algorithm and 56-bit key length; data from business platform B uses the A3 algorithm and the default key length of the algorithm; data from database B is transmitted securely according to data type, with data belonging to the key business category using the A4 algorithm and the default key length, and data not belonging to the key business category using the A2 algorithm and 128-bit key length. Data not involved in the encryption strategy is not encrypted.

[0086] In combination with the above embodiments, in another implementation, an embodiment of the present invention further provides a data transmission method. In this embodiment, the data sender also includes: a first network access routing device, and the first data transmission encryption and decryption system is connected to the first network access routing device in a bypass deployment; the data receiver also includes: a second network access routing device, and the second data transmission encryption and decryption system is connected to the second network access routing device in a bypass deployment; wherein, the "sending the data to be transmitted to the first data transmission encryption and decryption system" in the above step S41 may specifically include steps S51 and S52, and the "sending the encrypted data to the second data transmission encryption and decryption system" in the above step S45 may specifically include steps S53 to S55, and the above step S47 may specifically include steps S56 to S57:

[0087] Step S51: the data generation end sends the data to be transmitted to the first network access routing device.

[0088] In this embodiment, the data generation end sends the data to be transmitted to the first network access routing device, and the first network access routing device is a network access routing device in the data sender.

[0089] Step S52: the first network access routing device sends the data to be transmitted to the first data transmission encryption and decryption system.

[0090] In this embodiment, after receiving the data to be transmitted, the first network access routing device may forward the data to be transmitted to the first data transmission encryption and decryption system.

[0091] Step S53: the first data transmission encryption and decryption system sends the encrypted data to the first network access routing device.

[0092] In this embodiment, after the first data transmission encryption and decryption system obtains the encrypted data, it needs to send the encrypted data to the first network access routing device.

[0093] Step S54: the first network access routing device sends the encrypted data to the second network access routing device.

[0094] In this embodiment, after receiving the encrypted data, the first network access routing device sends the encrypted data to the second network access routing device, and the second network access routing device is a network access routing device in the data receiving party.

[0095] Step S55: the second network access routing device sends the encrypted data to the second data transmission encryption and decryption system.

[0096] In this embodiment, after receiving the encrypted data, the second network access routing device sends the encrypted data to the second data transmission encryption and decryption system.

[0097] Step S56: the second data transmission encryption and decryption system sends the decrypted data to the second network access routing device.

[0098] In this embodiment, after obtaining the decrypted data, the second data transmission encryption and decryption system sends the decrypted data to the second network access routing device.

[0099] Step S57: the second network access routing device sends the decrypted data to the data receiving end.

[0100] In this embodiment, the second network access routing device then sends the received decrypted data to the data receiving end, thereby completing the classified and graded secure transmission of the data.

[0101] In this embodiment, when the data transmission network between the data sender and the data receiver is established, the first data transmission encryption and decryption system and the second data transmission encryption and decryption system can be respectively set at the data sender and the data receiver based on a bypass deployment method, thereby achieving classified and graded secure transmission of data without changing the network-related parameter configuration of the data transmission network or with less changes to the network-related parameter configuration of the data transmission network.

[0102] In combination with the above embodiments, in one implementation, an embodiment of the present invention further provides a data transmission method. Specifically, in this method, the data sender also includes: a first network access routing device, and the first data transmission encryption and decryption system is connected in series between the data generation end and the first network access routing device; the data receiver also includes: a second network access routing device, and the second data transmission encryption and decryption system is connected in series between the data receiving end and the second network access routing device; the "sending the encrypted data to the second data transmission encryption and decryption system" in the above step S45 can specifically include steps S61 to S63:

[0103] Step S61: the first data transmission encryption and decryption system sends the encrypted data to the first network access routing device.

[0104] In this embodiment, after obtaining the encrypted data, the first data transmission encryption and decryption system may send the encrypted data to the first network access routing device.

[0105] Step S62: The first network access routing device sends the encrypted data to the second network access routing device.

[0106] In this embodiment, after obtaining the encrypted data, the first network access routing device may forward the encrypted data to the second network access routing device.

[0107] Step S63: the second network access routing device sends the encrypted data to the second data transmission encryption and decryption system.

[0108] In this embodiment, after receiving the encrypted data, the second network access routing device may send the encrypted data to the second data transmission encryption and decryption system for corresponding decryption.

[0109] In one embodiment, if Figure 2 As shown, Figure 2 It is a deployment diagram of bypass deployment of a data transmission encryption and decryption system shown in an embodiment of the present invention.

[0110] exist Figure 2 In the example, organization A is the data sender and organization B is the data receiver. The first network access routing device of organization A is R a The first data transmission encryption and decryption system deployed is E a , bypass deployment and R a The data generation end of organization A (server A, terminal A, business platform A and database A) is connected to R a Connect. In R a Set up policy routing on the server A, terminal A, business platform A, and database A to route data to Ea Encryption is performed.

[0111] The second network access routing device of organization B is R b The second data transmission encryption and decryption system deployed is E b , bypass deployment and R b The data receiving end of organization B (server B, terminal B, business platform B and database B) is connected to R b Connect. In R b By setting policy routing on E, data from server B, terminal B, service platform B, and database B can be routed to E. b Here, Ea and Eb are the same data transmission encryption and decryption system.

[0112] Combination Figure 2 When the data transmission encryption and decryption device is deployed in bypass mode, the specific data transmission method process is as follows:

[0113] S101: Server A of organization A sends to-be-transmitted data classified as important data to server B of organization B;

[0114] S102: The first network of institution A accesses routing device R a Receive the data to be transmitted and forward the data to be transmitted to the first data transmission encryption and decryption device E a ;

[0115] S103: First data transmission encryption and decryption device E a According to the set encryption strategy, the target encryption method (using A3 encryption algorithm and 128-bit key length) is determined based on the classification and grading of the data to be transmitted, and the second data transmission encryption and decryption device E of institution B is used. b Negotiate data encryption keys and establish an encrypted transmission channel, and send the target encryption method to the second data transmission encryption and decryption device E based on the encrypted transmission channel. b ; Then use the negotiated key to encrypt the data to be transmitted, and send the encrypted data back to the first network access routing device R a ;

[0116] S104: The first network accesses the routing device R a Forward the encrypted data to the second network access routing device R of organization B via the network b ;

[0117] S105: The second network accesses the routing device R b According to the header information of the encrypted data, the encrypted data is forwarded to the second data transmission encryption and decryption device E of organization B. b ;

[0118] S106: Second data transmission encryption and decryption device E b Decrypt the encrypted data based on the target decryption method corresponding to the target encryption method to obtain decrypted data, and send the decrypted data back to the second network access routing device R b ;

[0119] S107: The second network accesses the routing device R b The decrypted data is forwarded to server B, thus completing the secure transmission of data from organization A to organization B.

[0120] In one embodiment, if Figure 3 As shown, Figure 3 It is a deployment diagram of a data transmission encryption and decryption system deployed in series according to an embodiment of the present invention.

[0121] exist Figure 3 In the example, organization A is the data sender and organization B is the data receiver. The first network access routing device of organization A is R a The first data transmission encryption and decryption system deployed is E a , which is connected in series to the first network access routing device R a Between the switch and the E a Connect to E a After encryption, R a Sent to institution B.

[0122] The second network access routing device of organization B is R b The second data transmission encryption and decryption system deployed is E b , which is connected in series to the second network access routing device R b Between the switch and the data receiving end of organization B (server B, terminal B, business platform B and database B) b Connect. b By R b After receiving the encrypted data, it can be decrypted and then routed through the switch to server B, terminal B, business platform B and database B. Here, Ea and Eb are the same data transmission encryption and decryption system.

[0123] Combination Figure 3 When the data transmission encryption and decryption devices are deployed in series, the specific data transmission method process is as follows:

[0124] S201: Database A of organization A sends key business data to be transmitted to database B of organization B;

[0125] S202: First data transmission encryption and decryption device E of institution Aa After receiving the data to be transmitted, according to the set encryption strategy, the target encryption method is determined based on the classification and grading of the data to be transmitted (using the A4 encryption algorithm and its default key length), and the second data transmission encryption and decryption device E of institution B is transmitted. b Negotiate data encryption keys and establish an encrypted transmission channel, and send the target encryption method to the second data transmission encryption and decryption device E based on the encrypted transmission channel. b ; Then encrypt the data with the negotiated key and send the encrypted data to the first network access routing device R a ;

[0126] S203: The first network accesses the routing device R a Forward the encrypted data to the second network access routing device R of organization B via the network b ;

[0127] S204: The second network accesses the routing device R b According to the header information of the encrypted data, the encrypted data is forwarded to the second data transmission encryption and decryption device E of organization B. b ;

[0128] S205: Second data transmission encryption and decryption device E b The encrypted data is decrypted to obtain the decrypted data, and the decrypted data is sent to database B, thereby completing the secure transmission of data from organization A to organization B.

[0129] In combination with the above embodiments, in one implementation, an embodiment of the present invention further provides a data transmission method. Specifically, in this method, the classification and grading information at least includes: data source, business system, data category, file type and importance level; the "data generation end classifies and grades the data to be transmitted, obtains the classification and grading information of the data to be transmitted, and labels the data to be transmitted with classification and grading labels" in the above step S41 may specifically include steps S71 to S75:

[0130] Step S71: the data generation end determines the data source of the data to be transmitted according to the source destination network address and / or source destination port of the data to be transmitted.

[0131] In this embodiment, when the data generation end classifies and grades the data to be transmitted, it can determine the data source of the data to be transmitted based on the source and destination network addresses and / or source and destination ports of the data to be transmitted. The source and destination network addresses may include: source IP addresses and / or destination IP addresses, and different servers, business application platforms or systems, and terminals have different IP addresses; the source and destination ports may include: source ports and / or destination ports, and the ports used by network services, business application platforms or systems are different.

[0132] Step S72: The data generation end determines the business system to which the data to be transmitted belongs according to the network address, port number and transport layer protocol type of the data to be transmitted.

[0133] In this embodiment, the data generation end can determine the business system to which the data to be transmitted belongs based on the network address, port number and transport layer protocol type of the data to be transmitted. Different business systems support differentiation based on network address, port number and transport layer protocol type, for example, different business systems have different network ports for data transmission.

[0134] Step S73: the data generation end determines the data category of the data to be transmitted according to the industry business attributes of the data to be transmitted, and tags the data to be transmitted with a data category label.

[0135] In this embodiment, the data generation end may determine the data category of the data to be transmitted according to the industry business attributes of the data to be transmitted, and add a data category label to the data to be transmitted.

[0136] Step S74: the data generation end determines the file type of the data to be transmitted according to the file type corresponding to the data to be transmitted, and tags the data to be transmitted with a file type label.

[0137] In this embodiment, the data generation end can determine the file type of the data to be transmitted according to the file type corresponding to the data to be transmitted, and add a file type label to the data to be transmitted. The file types include but are not limited to: video files, document files, and database files.

[0138] Step S75: the data generation end classifies the data to be transmitted according to the importance of the data to be transmitted, determines the importance level of the data to be transmitted, and tags the data to be transmitted with the importance level.

[0139] In this embodiment, the data generation end can classify the data to be transmitted according to the importance of the data to be transmitted (data is attacked, destroyed, leaked, etc., who is affected, and how much the impact is), determine the importance level of the data to be transmitted, and label the data to be transmitted with an importance level. The importance levels include but are not limited to: core data, important data and general data, and general data can be further divided into 2 to 4 levels.

[0140] In an optional embodiment, when data is sent, the data category tag, file type tag and importance level tag will be set in the option field of the packet header of the network data packet. In the 32-bit option field, the first 8 bits are used to set the data category tag, the second 8 bits are used to set the file type tag, and the third 8 bits are used to set the importance level tag.

[0141] Based on this, in an optional implementation, when the first data transmission encryption and decryption system determines the classification and grading information of the data to be transmitted based on the data to be transmitted and the classification and grading label, the data is encrypted and transmitted according to the encryption policy based on the data processing of the transmission encryption and decryption system in units of network data packets. The encryption policies are executed sequentially, from the first encryption policy to the last encryption policy, and data encryption transmission is performed after the network data packet matches the encryption policy. In each policy, the fields are checked from left to right, that is, the data source encryption policy, business system encryption policy, data category encryption policy, file type encryption policy, and data level encryption policy are checked in turn, so as to determine the data source, business system, data category, file type, and importance level of the data to be transmitted in turn, and then the encryption policy is matched.

[0142] Specifically, the data source encryption strategy can determine where the data comes from, such as from server A or terminal A, by checking the source network address of the network data packet, such as the source IP address. The business system encryption strategy can determine that the network data packet comes from database A by checking the source and destination ports of the network data packet, such as port 6001 of the DAMO database, or port 6026 of a certain business system. The data category encryption strategy can determine that the network data packet belongs to the security operation category data by checking the data category label in the network data packet option field, such as the label value 00001011 of "security operation category". The file type encryption strategy can determine that the network data packet belongs to the document DOC category file data by checking the file type label in the network data packet option field, such as the label value 00001001 of "document DOC category". The data level encryption strategy can determine that the network data packet belongs to important data by checking the importance level label in the network data packet option field, such as the label value 00001000 of "important data". After determining the classification and grading information corresponding to the network data packet, the corresponding encryption method (encryption algorithm and key length) can be matched. In this embodiment, selecting the corresponding encryption algorithm and key length (i.e., different encryption methods) means that for the aforementioned different data, both the same encryption algorithm and / or key length and different encryption algorithms and / or key lengths are supported; the key length is fixed for some encryption algorithms, so in this case the data transmission encryption system does not provide a key length selection option.

[0143] In combination with the above embodiments, in one implementation, the embodiment of the present invention further provides a data transmission method. Specifically, in this embodiment, the data sender and the data receiver include at least any one of the following:

[0144] Two companies or organizations, such as two different institutions with a data partnership;

[0145] The headquarters of the group company and its branches;

[0146] Two branches of the group company.

[0147] Taking into account the global office application scenarios, secure communication and data transmission between the group company headquarters and domestic and overseas branches, between domestic and overseas branches, and between institutions and mobile terminals, need to be based on the attributes of different branches, the attributes and sensitivity of different business platforms or systems, and the types and importance of different data. This embodiment automatically configures different encryption measures and encryption strengths to encrypt the transmitted data, thereby achieving adaptive data security transmission and achieving unity in security and efficiency.

[0148] Through the method of this embodiment, different encryption algorithms and key lengths can be selected according to factors such as data source, data type and data level to perform encrypted data transmission respectively. Fine-grained data classification and grading security transmission can be achieved between two entities (two enterprises or organizations, group company headquarters and branches, two branches of a group company), and different transmission encryption levels are used for different data according to parameters such as IP address, port, business application platform or system, data type, file type, data level, etc., so as to ensure sufficient security while improving data transmission efficiency, and also enhancing the overall security of data transmission, and preventing a certain algorithm from being cracked and only affecting a part.

[0149] In this embodiment, different data transmission encryption algorithms and key lengths are selected to encrypt the transmitted data according to factors such as IP address, port, business application platform or system, data category, file type, data level, etc., so as to achieve data classification and classification security transmission. In particular, combined with the current popular global group company layout, unified management and secure operation of the group company's global networking are achieved, bypass deployment and serial deployment of data transmission encryption systems are supported, and policy-based data classification and classification security and confidentiality transmission is achieved.

[0150] In one embodiment, if Figure 4 As shown, Figure 4 FIG. 1 is a schematic diagram of a data transmission encryption method according to an embodiment of the present invention. Figure 4 In the present invention, the data transmission encryption method is applied to the data sender, and the method includes: first, classifying and grading the data; then, setting the encryption strategy on the data transmission encryption and decryption system, and selecting the corresponding encryption algorithm and encryption strength for the data from different sources, different business systems, different data categories, different file types, and different data levels; finally, classifying and grading the data for encrypted transmission through the data transmission encryption and decryption system.

[0151] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0152] Based on the same inventive concept, an embodiment of the present invention provides a data transmission encryption and decryption system, which is the first data transmission encryption and decryption system or the second data transmission encryption and decryption system mentioned above. Figure 5 , Figure 5 FIG. 1 is a block diagram of a data transmission encryption and decryption system provided by an embodiment of the present invention. Figure 5 As shown, the data transmission encryption and decryption system includes:

[0153] A classification and grading determination module, used to determine classification and grading information of the data to be transmitted, wherein the classification and grading information at least represents the category and importance of the data to be transmitted;

[0154] An encryption mode determination module is used to determine a target encryption mode corresponding to the data to be transmitted according to the classification and grading information of the data to be transmitted, and send the target encryption mode to a data receiver;

[0155] The data encryption module is used to encrypt the data to be transmitted based on the target encryption method to obtain encrypted data.

[0156] Optionally, the system further comprises:

[0157] A key negotiation module, configured to receive the target encryption method based on an encrypted transmission channel between the data sender and the data sender;

[0158] The data decryption module is used to decrypt the encrypted data based on the target decryption method corresponding to the target encryption method to obtain decrypted data.

[0159] Optionally, the system further comprises:

[0160] A mapping relationship establishing module, used to establish a mapping relationship between any one or a combination of multiple information in the classified and graded information and different encryption methods;

[0161] The encryption mode determination module includes:

[0162] The encryption method determination submodule is used to determine the target encryption method corresponding to the data to be transmitted based on the classification and grading information of the data to be transmitted and the mapping relationship.

[0163] Optionally, the classification and grading information includes at least: data source, business system, data category, file type and importance level;

[0164] The mapping relationship establishing module includes:

[0165] A first establishing module, used for establishing a first mapping relationship between different importance levels and different encryption methods when the data source is a server;

[0166] A second establishing module, used to establish a second mapping relationship between different file types and different encryption methods when the data source is a terminal;

[0167] A third establishing module, used to establish a third mapping relationship between different business systems and different encryption methods when the data source is a business platform;

[0168] The fourth establishing module is used to establish a fourth mapping relationship between different data categories and different encryption methods when the data source is a database.

[0169] Optionally, the classification and grading determination module includes:

[0170] A classification and grading determination submodule, used to determine the classification and grading information of the data to be transmitted based on the data to be transmitted and the classification and grading labels;

[0171] The encryption mode determination module includes:

[0172] A first determination module, used to determine a target encryption method corresponding to the data to be transmitted according to the classification and grading information of the data to be transmitted;

[0173] a channel establishing module, used to establish an encrypted transmission channel with the second data transmission encryption and decryption system, and send the target encryption mode to the second data transmission encryption and decryption system based on the encrypted transmission channel;

[0174] The data decryption module comprises:

[0175] A first decryption module, used to decrypt the encrypted data based on a target decryption method corresponding to the target encryption method to obtain the decrypted data;

[0176] The first sending module is used to send the decrypted data to the data receiving end.

[0177] In one embodiment, if Figure 6 As shown, Figure 6 FIG. 1 is a schematic diagram of a data transmission encryption and decryption system according to an embodiment of the present invention. Figure 6The data transmission encryption and decryption system is used for classified and graded secure and confidential data transmission, and includes: an encryption strategy module, a data encryption and decryption module, and a network transmission module.

[0178] Among them, the encryption policy module supports setting encryption policies including data source, business system, data category, file type and data level for data from different sources, different business systems, different data categories, different file types and different data levels, and selecting corresponding encryption algorithms and key lengths for their secure and confidential transmission;

[0179] The data encryption and decryption module supports selecting the corresponding encryption algorithm and key length to encrypt data according to the encryption strategy; or decrypting the encrypted data; supports two or more different data encryption algorithms, and can use different encryption algorithms and / or key lengths for different data.

[0180] The network transmission module supports the sending and receiving of data and encrypted data, including: receiving data, handing it over to the data encryption and decryption module for encryption, and then sending the encrypted data; receiving encrypted data, handing it over to the data encryption and decryption module for decryption, and then sending the decrypted data.

[0181] As for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0182] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0183] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, embodiments of the present invention may take the form of complete hardware embodiments, complete software embodiments, or embodiments combining software and hardware. Furthermore, embodiments of the present invention may take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0184] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0185] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0186] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0187] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0188] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0189] The above is a detailed introduction to a data transmission method and a data transmission encryption and decryption system provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A data transmission method, characterized in that: The method comprises: The data sender determines the classification and grading information of the data to be transmitted, wherein the classification and grading information at least represents the category and importance of the data to be transmitted; The data sender determines the target encryption method corresponding to the data to be transmitted according to the classification and grading information of the data to be transmitted, and sends the target encryption method to the data receiver; The data sender encrypts the data to be transmitted based on the target encryption method to obtain encrypted data, and sends the encrypted data to the data receiver; The data recipient decrypts the encrypted data based on a target decryption method corresponding to the target encryption method to obtain decrypted data.

2. The data transmission method according to claim 1, characterized in that: The classification and grading information includes a plurality of information; the method further includes: The data sender establishes a mapping relationship between any one or a combination of multiple pieces of information in the classified and graded information and different encryption methods; The data sender determines the target encryption method corresponding to the data to be transmitted according to the classification and grading information of the data to be transmitted, including: The data sender determines the target encryption method corresponding to the data to be transmitted according to the classification and grading information of the data to be transmitted and the mapping relationship.

3. The data transmission method according to claim 2, characterized in that: The classification and grading information at least includes: data source, business system, data category, file type and importance level; The data sender establishes a mapping relationship between any one or a combination of multiple information in the classified and graded information and different encryption methods, including: The data sender establishes a first mapping relationship between different importance levels and different encryption methods when the data source is a server; The data sender establishes a second mapping relationship between different file types and different encryption methods when the data source is a terminal; The data sender establishes a third mapping relationship between different business systems and different encryption methods when the data source is a business platform; The data sender establishes a fourth mapping relationship between different data categories and different encryption methods when the data source is a database.

4. The data transmission method according to claim 1, characterized in that: The data sender at least includes: a data generation end and a first data transmission encryption and decryption system; the data receiver at least includes: a data receiving end and a second data transmission encryption and decryption system; the method further includes: The data generation end classifies and grades the data to be transmitted, obtains classification and grading information of the data to be transmitted, adds classification and grading labels to the data to be transmitted, and sends the data to be transmitted to the first data transmission encryption and decryption system; The data sender determines the classification and grading information of the data to be transmitted, including: The first data transmission encryption and decryption system determines the classification and grading information of the data to be transmitted based on the data to be transmitted and the classification and grading label; The data sender determines the target encryption method corresponding to the data to be transmitted according to the classification and grading information of the data to be transmitted, and sends the target encryption method to the data receiver, including: The first data transmission encryption and decryption system determines a target encryption method corresponding to the data to be transmitted according to the classification and grading information of the data to be transmitted; The first data transmission encryption and decryption system establishes an encrypted transmission channel with the second data transmission encryption and decryption system, and sends the target encryption method to the second data transmission encryption and decryption system based on the encrypted transmission channel; The data sender encrypts the data to be transmitted based on the target encryption method to obtain encrypted data, and sends the encrypted data to the data receiver, including: The first data transmission encryption and decryption system encrypts the data to be transmitted based on the target encryption method to obtain encrypted data, and sends the encrypted data to the second data transmission encryption and decryption system; The data receiving party decrypts the encrypted data based on the target decryption method corresponding to the target encryption method to obtain decrypted data, including: The second data transmission encryption and decryption system decrypts the encrypted data based on a target decryption method corresponding to the target encryption method to obtain the decrypted data; The second data transmission encryption and decryption system sends the decrypted data to the data receiving end.

5. The data transmission method according to claim 4, characterized in that: The data sender also includes: a first network access routing device, and the first data transmission encryption and decryption system is connected to the first network access routing device in a bypass deployment; the data receiver also includes: a second network access routing device, and the second data transmission encryption and decryption system is connected to the second network access routing device in a bypass deployment; Sending the data to be transmitted to the first data transmission encryption and decryption system includes: The data generating end sends the data to be transmitted to the first network access routing device; The first network access routing device sends the data to be transmitted to the first data transmission encryption and decryption system; Sending the encrypted data to the second data transmission encryption and decryption system comprises: The first data transmission encryption and decryption system sends the encrypted data to the first network access routing device; The first network access routing device sends the encrypted data to the second network access routing device; The second network access routing device sends the encrypted data to the second data transmission encryption and decryption system; The second data transmission encryption and decryption system sends the decrypted data to the data receiving end, including: The second data transmission encryption and decryption system sends the decrypted data to the second network access routing device; The second network access routing device sends the decrypted data to the data receiving end.

6. The data transmission method according to claim 4, characterized in that: The data sender also includes: a first network access routing device, the first data transmission encryption and decryption system is connected in series between the data generation end and the first network access routing device; the data receiver also includes: a second network access routing device, the second data transmission encryption and decryption system is connected in series between the data receiving end and the second network access routing device; Sending the encrypted data to the second data transmission encryption and decryption system comprises: The first data transmission encryption and decryption system sends the encrypted data to the first network access routing device; The first network access routing device sends the encrypted data to the second network access routing device; The second network access routing device sends the encrypted data to the second data transmission encryption and decryption system.

7. The data transmission method according to claim 4, characterized in that: The classification and grading information at least includes: data source, business system, data category, file type and importance level; The data generation end classifies and grades the data to be transmitted, obtains classification and grading information of the data to be transmitted, and labels the data to be transmitted with classification and grading labels, including: The data generating end determines the data source of the data to be transmitted according to the source destination network address and / or source destination port of the data to be transmitted; The data generation end determines the business system to which the data to be transmitted belongs according to the network address, port number and transport layer protocol type of the data to be transmitted; The data generation end determines the data category of the data to be transmitted according to the industry business attributes of the data to be transmitted, and tags the data category for the data to be transmitted; The data generating end determines the file type of the data to be transmitted according to the file type corresponding to the data to be transmitted, and tags the data to be transmitted with a file type tag; The data generating end classifies the data to be transmitted according to the importance of the data to be transmitted, determines the importance level of the data to be transmitted, and tags the data to be transmitted with the importance level.

8. The data transmission method according to any one of claims 1 to 7, characterized in that: The data sender and the data receiver include at least one of the following: two businesses or organizations; The headquarters of the group company and its branches; Two branches of the group company.

9. A data transmission encryption and decryption system, characterized in that: The system comprises at least: A classification and grading determination module, used to determine classification and grading information of the data to be transmitted, wherein the classification and grading information at least represents the category and importance of the data to be transmitted; An encryption mode determination module is used to determine a target encryption mode corresponding to the data to be transmitted according to the classification and grading information of the data to be transmitted, and send the target encryption mode to a data receiver; The data encryption module is used to encrypt the data to be transmitted based on the target encryption method to obtain encrypted data.

10. The data transmission encryption and decryption system according to claim 9, characterized in that: The system further comprises: A key negotiation module, configured to receive the target encryption method based on an encrypted transmission channel between the data sender and the data sender; The data decryption module is used to decrypt the encrypted data based on the target decryption method corresponding to the target encryption method to obtain decrypted data.

Images