Data transmission method and device, medium and equipment

Abstract

The invention discloses a data transmission method and device, a medium and equipment, and the method comprises the steps: selecting a target tunnel from an IPV4 tunnel and an IPV6 tunnel through the obtained network states of the IPV4 tunnel and the IPV6 tunnel; and then determining to-be-transmitted message data and a destination address of the message data, and determining an encapsulation protocol of the message data according to the destination address. And judging whether the target tunnel is matched with the encapsulation protocol of the message data, if so, transmitting the message data to a zero-trust gateway through the target tunnel, and if not, determining disguised message data, and transmitting the disguised message data to the zero-trust gateway through the target tunnel. According to the technical scheme, the tunnel adopted during data transmission is determined according to the network state of each tunnel, and then the transmission of the IPV6 message through the IPV4 tunnel and the transmission of the IPV4 message data through the IPV6 tunnel are realized through the dual-stack technology, so that the network anti-interference capability when a user uses a zero-trust system is improved, and the data transmission efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data transmission method, device, medium and equipment. Background Art

[0002] At present, with the development of computer technology, zero-trust architecture has gradually become an important concept of the new generation of network security protection. In the existing zero-trust system built on the zero-trust architecture, the user sends verification information to the zero-trust platform through the client installed on the terminal, so that the zero-trust platform returns the gateway address to the client and sends the verification instruction to the corresponding zero-trust gateway after the user's verification information is passed. Then, based on the gateway address received by the client, the user uses the zero-trust gateway as an intermediary to access the storage address of the target data, realizes communication with the storage address of the target data, and thus obtains the target data. Among them, in order to ensure the security and privacy of the target data during transmission, the system usually uses tunnel technology to realize the transmission of the target data.

[0003] In the prior art, in order to further improve the security of data, especially the security of sensitive data, the zero-trust system usually establishes a single tunnel between the client and the zero-trust gateway to realize data transmission. For example, the client encapsulates the data through the most widely used Internet Protocol version, namely Internet Protocol version 4 (IPV4), and transmits the encapsulated data through the IPV4 tunnel, or encapsulates the data through the latest Internet Protocol version, namely Internet Protocol version 6 (IPV6), and transmits the encapsulated data through the IPV6 tunnel.

[0004] However, a single IPV4 / IPV6 tunnel often relies on a fixed route. If a node in the route is congested or fails, it will cause packet loss or even interruption during data transmission, and the anti-interference ability is poor. Based on this, the present application discloses a data transmission method, device, medium and equipment. Summary of the invention

[0005] This specification provides a data transmission method, device, medium and equipment to partially solve the above-mentioned problems existing in the prior art.

[0006] This manual adopts the following technical solutions:

[0007] The method is applied to a terminal in a zero-trust system, wherein the zero-trust system at least includes the terminal and a zero-trust gateway, wherein the terminal and the zero-trust gateway at least include an Internet Communication Protocol Version 4 IPv4 tunnel and an Internet Communication Protocol Version 6 IPv6 tunnel, including

[0008] Determine the message data to be transmitted and the destination address of the message data, and determine the encapsulation protocol of the message data according to the destination address;

[0009] Acquire the network status of the IPV4 tunnel and the IPV6 tunnel, and select a target tunnel from the IPV4 tunnel and the IPV6 tunnel according to the network status;

[0010] Determining whether the target tunnel matches the encapsulation protocol of the message data;

[0011] If so, the message data is transmitted to the zero-trust gateway through the target tunnel, so that the zero-trust gateway forwards the message data to the destination address after receiving the terminal identity authentication pass instruction;

[0012] If not, determine the encapsulation protocol corresponding to the target tunnel, encapsulate the message data again according to the encapsulation protocol corresponding to the target tunnel, determine the disguised message data, and transmit the disguised message data to the zero trust gateway through the target tunnel, so that the zero trust gateway forwards the disguised message data to the destination address after receiving the terminal identity authentication passed instruction.

[0013] Optionally, the zero-trust system further includes a zero-trust platform, and before determining the message data to be transmitted, the method further includes:

[0014] In response to an operation of a user, determining verification information according to the operation;

[0015] The identity authentication information is sent to the zero trust platform, so that the zero trust platform performs verification according to the verification information. When the verification passes, a verification pass instruction is returned and sent to the zero trust gateway.

[0016] Optionally, the method further includes:

[0017] Send a detection signal to the zero-trust gateway through the IPV4 tunnel and the IPV6 tunnel at a preset frequency, and accept the detection result returned by the zero-trust gateway;

[0018] The network status of the IPv4 tunnel and the IPv6 tunnel are determined respectively according to at least the most recent detection result.

[0019] Optionally, the network status includes at least one of the connectivity status, delay, packet loss rate, and bandwidth utilization of the IPV4 tunnel and the IPV6 tunnel.

[0020] Optionally, selecting a target tunnel from the IPv4 tunnel and the IPv6 tunnel according to the network state specifically includes:

[0021] Scoring the IPV4 tunnel and the IPV6 tunnel according to the most recently acquired network status of the IPV4 tunnel and the IPV6 tunnel;

[0022] Based on the score, a target tunnel is selected.

[0023] Optionally, determining whether the target tunnel matches the encapsulation protocol of the message data specifically includes:

[0024] When the encapsulation protocol of the message data is IPV4, determining whether the target tunnel is an IPV4 tunnel, if so, it means that the target tunnel matches the encapsulation protocol of the message data, if not, it means that the target tunnel does not match the encapsulation protocol of the message data;

[0025] When the encapsulation protocol of the message data is IPV6, it is determined whether the target tunnel is an IPV6 tunnel. If so, it means that the target tunnel matches the encapsulation protocol of the message data. If not, it means that the target tunnel does not match the encapsulation protocol of the message data.

[0026] Optionally, encapsulating the message data again according to the encapsulation protocol corresponding to the target tunnel to determine disguised message data specifically includes:

[0027] When the encapsulation protocol corresponding to the target tunnel is IPV4, the message data is encapsulated and encrypted through the user datagram protocol to determine the encrypted message, and the encrypted message is re-encapsulated through the IPV4 protocol to determine the disguised message of the message data;

[0028] When the encapsulation protocol corresponding to the target tunnel is IPV6, the message data is encapsulated and encrypted through the User Datagram Protocol to determine the encrypted message, and the encrypted message is re-encapsulated through the IPV6 protocol to determine the disguised message of the message data.

[0029] This specification provides a data transmission device, which is used to implement a terminal in a zero-trust system. The zero-trust system at least includes the terminal and a zero-trust gateway. The terminal and the zero-trust gateway at least include an Internet Communication Protocol Version 4 IPv4 tunnel and an Internet Communication Protocol Version 6 IPv6 tunnel, including:

[0030] A determination module, used to determine the message data to be transmitted and the destination address of the message data, and determine the encapsulation protocol of the message data according to the destination address;

[0031] An acquisition module, used for acquiring the network status of the IPV4 tunnel and the IPV6 tunnel, and selecting a target tunnel from the IPV4 tunnel and the IPV6 tunnel according to the network status;

[0032] A transmission module is used to determine whether the target tunnel matches the encapsulation protocol of the message data; if so, the message data is transmitted to the zero-trust gateway through the target tunnel, so that the zero-trust gateway forwards the message data to the destination address after receiving the terminal identity authentication passed instruction; if not, the encapsulation protocol corresponding to the target tunnel is determined, and the message data is encapsulated again according to the encapsulation protocol corresponding to the target tunnel to determine the disguised message data, and the disguised message data is transmitted to the zero-trust gateway through the target tunnel, so that the zero-trust gateway forwards the disguised message data to the destination address after receiving the terminal identity authentication passed instruction.

[0033] This specification provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned data transmission method is implemented.

[0034] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned data transmission method when executing the program.

[0035] At least one of the above technical solutions adopted in this specification can achieve the following beneficial effects:

[0036] In a data transmission method provided in this specification, a target tunnel is selected from the IPV4 tunnel and the IPV6 tunnel by obtaining the network status of the IPV4 tunnel and the IPV6 tunnel. Then the message data to be transmitted and the destination address of the message data are determined, and then the encapsulation protocol of the message data is determined according to the destination address. It is judged whether the encapsulation protocol of the target tunnel matches the encapsulation protocol of the message data. If so, the message data is transmitted to the zero-trust gateway through the target tunnel, so that the zero-trust gateway forwards the message data to the destination address after receiving the terminal identity authentication instruction. If not, the encapsulation protocol corresponding to the target tunnel is determined, and the message data is encapsulated again according to the encapsulation protocol corresponding to the target tunnel, and the disguised message data is determined. The disguised message data is transmitted to the zero-trust gateway through the target tunnel, so that the zero-trust gateway forwards the disguised message data to the destination address after receiving the terminal identity authentication instruction.

[0037] In the above data transmission method, the tunnel used for data transmission is determined according to the network status of each tunnel, and then the dual stack technology is used to realize the transmission of IPV6 messages through the IPV4 tunnel and the transmission of IPV4 message data through the IPV6 tunnel, thereby improving the user's network anti-interference ability when using the zero trust system and improving data transmission efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The drawings described herein are used to provide a further understanding of this specification and constitute a part of this specification. The illustrative embodiments and descriptions of this specification are used to explain this specification and do not constitute an improper limitation on this specification. In the drawings:

[0039] Figure 1 A schematic diagram of a zero trust system built on a zero trust architecture provided for this specification;

[0040] Figure 2 A flowchart of a data transmission method provided in this specification;

[0041] Figure 3 A schematic diagram of data transmission provided in this manual;

[0042] Figure 4 A schematic diagram of a data transmission device provided in this specification;

[0043] Figure 5 A method corresponding to the Figure 2 Schematic diagram of the structure of an electronic device. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0045] With the development of computer technology, zero-trust architecture has gradually become an important concept for the new generation of network security protection. Zero-trust architecture adheres to the principle of "continuous verification, never trust", thereby ensuring terminal security, link security and access control security, and is gradually being applied to various scenarios that require high security and high flexibility, such as remote office and hybrid work environments, cloud-native applications and microservice architectures, the Internet of Things and edge computing.

[0046] like Figure 1 As shown, Figure 1 A schematic diagram of a zero-trust system based on a zero-trust architecture provided in this specification, wherein a user operates a zero-trust client in a terminal, and sends verification information to a zero-trust platform through a zero-trust client, so that the zero-trust platform authenticates the zero-trust client and the terminal operated by the user based on the verification information. When the zero-trust platform passes the authentication of the zero-trust client and the terminal, it returns an authentication pass instruction to the zero-trust client in the terminal, and sends the authentication pass instruction of the terminal and the client to the zero-trust gateway, so that the zero-trust gateway determines the accessible scope of the client according to the authentication pass instruction. Then, the zero-trust gateway displays the resource directory accessible to the client to the client, so that the user can determine the address to be accessed according to the accessible resource directory. Then, the client generates an access instruction, and uses the address to be accessed as the destination address of the access instruction. According to the access instruction and the destination address, the access instruction is encapsulated as a network layer protocol data unit (Internet Protocol Packet, IP Packet), that is, IP message data, and the IP message data is sent to the zero-trust gateway through a tunnel corresponding to the IP protocol of the IP message data, and the zero-trust gateway monitors and reviews the access instruction in the IP message data, and forwards it to the destination address.

[0047] However, when the terminal transmits the IP message data through the corresponding tunnel, a single tunnel is usually established between the client and the zero-trust gateway to realize data transmission, so as to further improve the security of data transmission. For example, the client encapsulates the data through the most widely used Internet Protocol version, that is, the fourth version of the Internet Protocol (Internet Protocol version 4, IPV4), and transmits the encapsulated data through the IPV4 tunnel, or encapsulates the data through the latest Internet Protocol version, that is, the sixth version of the Internet Protocol (Internet Protocol version 6, IPV6), and transmits the encapsulated data through the IPV6 tunnel. However, a single IPV4 / IPV6 tunnel often relies on a fixed route. If the nodes in the route are congested, faulty, etc., it will cause packet loss or even interruption during data transmission, and the anti-interference ability is poor. In order to solve the above problems, this specification provides a data transmission method.

[0048] It should be noted that in a data transmission method provided in this specification, the data transmission method is applied to a terminal in a zero-trust system, and the zero-trust system includes at least a terminal and a zero-trust gateway, and at least an IPV4 tunnel and an IPV6 tunnel are included between the terminal and the zero-trust gateway. Among them, in one or more embodiments of this specification, it is not limited to what kind of device the terminal is, for example, a mobile terminal, a computer, and a server, etc., wherein the server can be a single device, or composed of multiple devices, for example, a distributed server, which is not limited in this specification, and can also refer to a server for cloud services. In addition, in one or more embodiments of this specification, the above-mentioned terminal can be used as both a sender of message data and a receiver of message data, which is not limited in this specification. Among them, whether it is an IPV4 tunnel or an IPV6 tunnel, it refers to a technology that encapsulates another protocol data packet on the network layer. Of course, in one or more embodiments of this specification, in order to protect the security of data transmission, an Internet Protocol security (IPsec) tunnel is generally used. Of course, other tunnels can also be used and can be set according to actual needs. This specification does not limit this. For the convenience of description, the data transmission method will be explained later using the IPsec tunnel as an example.

[0049] The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0050] Figure 2 A flowchart of a data transmission method provided in an embodiment of this specification includes the following steps:

[0051] S200: Determine message data to be transmitted and a destination address of the message data, and determine an encapsulation protocol of the message data according to the destination address.

[0052] In order to achieve correct data transmission, the terminal should first determine the message data to be transmitted and the destination address of the message data, and then determine the corresponding encapsulation protocol, so as to subsequently determine the encapsulation strategy when transmitting through the tunnel according to the encapsulation protocol.

[0053] Specifically, the terminal obtains the message data to be transmitted and the destination address of the message data. It should be noted that in one or more embodiments of this specification, it is not limited how the terminal specifically obtains the message data to be transmitted. It can be directly obtaining the data frame to be transmitted from the network card, and then decapsulating the data frame to determine the message data to be transmitted and the destination address. The terminal can also respond to the user's operation on the terminal to determine the data to be transmitted. For example, in the scenario of resource acquisition, the user can determine the directory of the available resources through the zero-trust client installed on the terminal after passing the identity authentication, and then the terminal can generate a resource acquisition instruction according to the user's operation, encapsulate the resource acquisition instruction, and thus determine the IP message data corresponding to the resource acquisition instruction. Or if the terminal is a terminal that receives a resource acquisition instruction in a resource acquisition scenario and needs to return the corresponding resource, the terminal can encapsulate the resource to be transmitted as IP message data when determining the message data to be transmitted. Since there are many methods for obtaining the message data to be transmitted, they will not be repeated here. This specification does not limit this and can be set according to actual needs.

[0054] In addition, in one or more embodiments of the present specification, the content of the message data to be transmitted is not limited, and it can be a string of instructions, resource data, etc., and can be set according to actual needs.

[0055] Furthermore, when determining the encapsulation protocol of the message data, the terminal may determine the encapsulation protocol based on the protocol supported by the destination address of the message data, or may analyze the encapsulation protocol of the message data based on the data header of the message data. Of course, the encapsulation protocol of the message data may also be determined according to other methods. This manual does not impose any restrictions on this and may be set according to actual needs. The encapsulation protocols generally determined are IPV4 and IPV6.

[0056] S202: Acquire the network status of the IPV4 tunnel and the IPV6 tunnel, and select a target tunnel from the IPV4 tunnel and the IPV6 tunnel according to the network status.

[0057] Since both IPV4 tunnels and IPV6 tunnels often rely on fixed routes when transmitting data, if there is network congestion, insufficient bandwidth, etc. in the route, it may cause high data transmission delay or packet loss, affecting the user experience. Therefore, in order to achieve efficient data transmission, the terminal can first determine the network status of the tunnel between the target gateway before data transmission, so as to select the target tunnel, wherein, in one or more embodiments of the present specification, the network status of the IPV4 tunnel and the IPV6 tunnel refers to the tunnel's connectivity status, delay, packet loss rate, bandwidth utilization, etc., which can be used to evaluate at least one of the indicators of the data transmission efficiency of the tunnel.

[0058] Specifically, the terminal may first obtain the network status of the IPV4 tunnel and the IPV6 tunnel, and then select the tunnel with the fastest data transmission as the target tunnel according to the network status of the IPV4 tunnel and the IPV6 tunnel.

[0059] It should be noted that in one or more embodiments of this specification, the terminal is not limited to the specific method used to determine the network status of the tunnel. The network status of each tunnel can be determined by heartbeat response, that is, the terminal sends a detection signal to the zero-trust gateway through the IPV4 tunnel and the IPV6 tunnel at a preset frequency, and then receives the detection result returned by the zero-trust gateway. Determine the network status of the IPV4 tunnel and the IPV6 tunnel according to the detection results. Of course, the operating status of the tunnel can also be determined by analyzing the log. Other methods can also be used to determine the network status of the IPV4 tunnel and the IPV6 tunnel, which can be set according to actual needs, and this specification does not limit this.

[0060] Therefore, when selecting the target tunnel according to the network status of the IPV4 tunnel and the IPV6 tunnel, the network status of the IPV6 tunnel can be determined first. If the network status of the IPV6 tunnel can reach the preset state, the IPV6 tunnel is preferably used as the target tunnel, otherwise, the IPV4 tunnel is selected as the target tunnel. Of course, other methods can also be used to determine the target tunnel. Since there are many methods that can be used, this manual will be described later and will not be repeated here.

[0061] S204: Determine whether the target tunnel matches the encapsulation protocol of the message data, if so, execute step S206, if not, execute step S208.

[0062] Since the IPV4 tunnel lacks a mechanism to process and understand the message header of the IPV6 message data, the IPV4 tunnel cannot understand the IPV6 message data. Similarly, the IPV6 tunnel cannot understand the IPV4 message data. Therefore, before transmitting the message data to be transmitted through the target tunnel, it should be determined whether the encapsulation protocol of the message data matches the target tunnel, so as to determine what encapsulation strategy should be used to encapsulate the message data to be transmitted.

[0063] Specifically, if the target tunnel is an IPV4 tunnel, it is determined whether the encapsulation protocol of the message data to be transmitted is IPV4. If so, it means that the target tunnel matches the encapsulation protocol of the message data to be transmitted. If not, it means that the target tunnel does not match the encapsulation protocol of the message data to be transmitted.

[0064] If the target tunnel is an IPV6 tunnel, determine whether the encapsulation protocol of the message data to be transmitted is IPV6. If so, it means that the target tunnel matches the encapsulation protocol of the message data to be transmitted. If not, it means that the target tunnel does not match the encapsulation protocol of the message data to be transmitted.

[0065] S206: Transmit the message data to the zero-trust gateway through the target tunnel, so that the zero-trust gateway forwards the message data to the destination address after receiving the terminal identity authentication passed instruction.

[0066] Since the target tunnel matches the encapsulation protocol of the message data to be transmitted, the target tunnel can be used directly to transmit the message data. Therefore, the terminal can send the message data to the zero-trust gateway through the target tunnel. After receiving the terminal identity authentication instruction, the zero-trust gateway decapsulates the message data, determines the destination address of the message data, and then re-capsulates and forwards it to the destination address.

[0067] It should be noted that in one or more embodiments of this specification, there is no restriction on how the terminal determines the address of the zero-trust gateway. In the zero-trust system, at least one zero-trust gateway may be included. When only one zero-trust gateway is included, it means that the address of the zero-trust gateway is pre-configured, and the terminal can directly obtain the address of the zero-trust gateway. If the zero-trust system includes multiple zero-trust gateways, the terminal can obtain the address of the corresponding zero-trust gateway when performing identity authentication, and this specification does not limit this.

[0068] Of course, in one or more embodiments of this specification, it is not limited to which tunnel the zero-trust gateway uses to transmit the message data to the destination address when forwarding the message data to the destination address. The message data can be forwarded using a preset tunnel, or the tunnel selection method as described above can be used to determine the tunnel for transmitting the message data. It can be set according to actual needs.

[0069] S208: Determine the encapsulation protocol corresponding to the target tunnel, encapsulate the message data again according to the encapsulation protocol corresponding to the target tunnel, determine the disguised message data, and transmit the disguised message data to the zero-trust gateway through the target tunnel, so that the zero-trust gateway forwards the disguised message data to the destination address after receiving the terminal identity authentication passed instruction.

[0070] Since the target tunnel does not match the encapsulation protocol of the message data to be transmitted, in order to achieve the transmission of the message data, the terminal may disguise the message data to be transmitted, thereby determining the disguised message so that the target tunnel can understand and process the message data to be transmitted.

[0071] Specifically, when the terminal is disguising the message data, if the message data to be transmitted is IPV4 message data and the target tunnel is an IPV6 tunnel, the terminal can encapsulate the IPV4 message data into the IPV6 message data, and then transmit the message data through the IPV6 tunnel. Similarly, if the IPV6 message data is to be transmitted through the IPV4 tunnel, the terminal can encapsulate the IPV6 message into the IPV4 message data, and then transmit it through the IPV4 message data.

[0072] based on Figure 2 A data transmission method is shown, by obtaining the network status of the IPV4 tunnel and the IPV6 tunnel, selecting the target tunnel in the IPV4 tunnel and the IPV6 tunnel. Then determine the message data to be transmitted and the destination address of the message data, and then determine the encapsulation protocol of the message data according to the destination address. Determine whether the encapsulation protocol of the target tunnel matches the encapsulation protocol of the message data. If so, transmit the message data to the zero-trust gateway through the target tunnel, so that the zero-trust gateway forwards the message data to the destination address after receiving the terminal identity authentication instruction. If not, determine the encapsulation protocol corresponding to the target tunnel, encapsulate the message data again according to the encapsulation protocol corresponding to the target tunnel, determine the disguised message data, and transmit the disguised message data to the zero-trust gateway through the target tunnel, so that the zero-trust gateway forwards the disguised message data to the destination address after receiving the terminal identity authentication instruction.

[0073] In the above data transmission method, the tunnel used for data transmission is determined according to the network status of each tunnel, and then the dual stack technology is used to realize the transmission of IPV6 messages through the IPV4 tunnel and the transmission of IPV4 message data through the IPV6 tunnel, thereby improving the user's network anti-interference ability when using the zero trust system and improving data transmission efficiency.

[0074] Since this solution is applied to the scenario of zero-trust system, the zero-trust gateway will not receive and forward message data before receiving the identity authentication instruction. Therefore, before the terminal transmits the message data through the tunnel, the terminal should also perform identity authentication first. Identity authentication is generally completed by the zero-trust platform in the zero-trust system. Of course, it can also be completed by the zero-trust gateway. This manual does not restrict this and it can be set according to actual needs.

[0075] Specifically, if the zero-trust system includes a zero-trust platform, the terminal can also respond to the user's operation before determining the message data to be transmitted, thereby determining the verification information, which is used to indicate the identity of the user and may include at least one of an account password, biometric information, and a secret key, so that the zero-trust platform verifies the user's identity based on the received verification information. The verification result is sent to the zero-trust gateway, so that the zero-trust gateway determines whether to accept the message data sent by the client based on the verification result, further ensuring data security.

[0076] In addition, in step S202, when selecting a target tunnel, the terminal can also determine the score of each tunnel according to the determined network status. The better the network status, the higher the score. Then, according to the score, the target tunnel is comprehensively selected to further improve the transmission efficiency of the message data. For example, various parameters in the obtained network status are weighted to obtain the score of each tunnel. The tunnel scoring can also be achieved through the trained model. Of course, in one or more embodiments of this specification, the terminal is not limited to the specific method used to calculate the score. Since there are many methods for calculating the score, this specification does not limit this and can be set according to actual needs.

[0077] In addition, in step S208, when determining the disguised message, in order to further improve the security of data transmission, the terminal can also encapsulate the message data to be transmitted into a new User Datagram Protocol (UDP) data packet, and then encrypt the new UDP data packet to determine the encrypted message to improve the confidentiality and integrity of the data, and then generate the header of the new UDP data packet according to the destination address of the data to be transmitted, and then re-encapsulate the UDP data packet containing the header into an IP message data. When re-encapsulating the new IP message data, the encapsulation protocol depends on the encapsulation protocol of the target tunnel. For example, when the encapsulation protocol corresponding to the target tunnel is IPV4, the encrypted message is re-encapsulated by the IPV4 protocol to determine the disguised message of the message data. Similarly, when the encapsulation protocol corresponding to the target tunnel is IPV6, the encrypted message is re-encapsulated by the IP,6 protocol to determine the disguised message of the message data.

[0078] This specification also provides an embodiment of a zero-trust system resource acquisition process. Among them, the zero-trust system includes a first terminal, a network card, a zero-trust platform, a zero-trust gateway and a second terminal. A zero-trust client is installed in the terminal. When a user wants to obtain resource data in the destination address, the user first operates the zero-trust client to send verification information to the zero-trust platform, which is used for the zero-trust platform to verify the identity of the client. When the identity authentication is passed, the zero-trust platform sends a verification pass instruction to the zero-trust gateway, and returns the verification pass instruction to the client at the same time. Then, when the client sends a resource acquisition instruction to the zero-trust gateway, it determines the encapsulation protocol according to the target address of the resource, and then encapsulates the resource acquisition instruction into message data. Then, according to the network status of each tunnel, the target tunnel is selected, and the message data is encapsulated into message data that can be understood by the target tunnel, and the message data is sent to the zero-trust gateway through the target tunnel. The zero-trust gateway decapsulates the message data, determines the destination address of the message data, and re-encapsulates the message data and sends it to the second terminal. The second terminal decapsulates the message data, obtains the resource acquisition instruction, determines the resource data to be transmitted according to the resource acquisition instruction, encapsulates the resource data to be transmitted, and sends the encapsulated resource data to the zero-trust gateway, so that the zero-trust gateway forwards the encapsulated resource data to the first terminal. After performing the decapsulation operation, the first terminal obtains the resource data.

[0079] like Figure 3 As shown, Figure 3 A schematic diagram of data transmission provided in this specification, wherein there are two tunnels between a terminal and a gateway, and the message data transmitted in each tunnel are protocol-matched message data and disguised message data.

[0080] Based on the same idea of ​​a data transmission method provided in one or more embodiments of this specification, this specification also provides a corresponding data transmission device, such as Figure 4 shown.

[0081] Figure 4 A schematic diagram of a data transmission device provided in this specification specifically includes:

[0082] A determination module 400, configured to determine the message data to be transmitted and the destination address of the message data, and determine the encapsulation protocol of the message data according to the destination address;

[0083] An acquisition module 401 is used to acquire the network status of the IPV4 tunnel and the IPV6 tunnel, and select a target tunnel from the IPV4 tunnel and the IPV6 tunnel according to the network status;

[0084] The transmission module 402 is used to determine whether the encapsulation protocol of the target tunnel matches the message data; if so, the message data is transmitted to the zero-trust gateway through the target tunnel, so that the zero-trust gateway forwards the message data to the destination address after receiving the terminal identity authentication passed instruction; if not, the encapsulation protocol corresponding to the target tunnel is determined, and the message data is encapsulated again according to the encapsulation protocol corresponding to the target tunnel to determine the disguised message data, and the disguised message data is transmitted to the zero-trust gateway through the target tunnel, so that the zero-trust gateway forwards the disguised message data to the destination address after receiving the terminal identity authentication passed instruction.

[0085] Optionally, the device also includes a verification module 403, which responds to the user's operation and determines verification information according to the operation; sends the identity authentication information to the zero trust platform, so that the zero trust platform performs verification according to the verification information, and when the verification passes, returns a verification pass instruction and sends it to the zero trust gateway.

[0086] Optionally, the acquisition module 401 is specifically used to send a detection signal to the zero trust gateway through the IPV4 tunnel and the IPV6 tunnel at a preset frequency, and accept the detection results returned by the zero trust gateway; determine the network status of the IPV4 tunnel and the IPV6 tunnel respectively according to at least the most recent detection results.

[0087] Optionally, the acquisition module 401 is used to score the IPV4 tunnel and the IPV6 tunnel according to the most recently acquired network status of the IPV4 tunnel and the IPV6 tunnel; and select a target tunnel according to the score.

[0088] Optionally, the acquisition module 401 is used to determine whether the target tunnel is an IPV4 tunnel when the encapsulation protocol of the message data is IPV4. If so, it means that the target tunnel matches the encapsulation protocol of the message data; if not, it means that the target tunnel does not match the encapsulation protocol of the message data; when the encapsulation protocol of the message data is IPV6, it is used to determine whether the target tunnel is an IPV6 tunnel. If so, it means that the target tunnel matches the encapsulation protocol of the message data; if not, it means that the target tunnel does not match the encapsulation protocol of the message data.

[0089] Optionally, the acquisition module 401 is used to, when the encapsulation protocol corresponding to the target tunnel is IPV4, encrypt the message data after encapsulating it through the user datagram protocol, determine the encrypted message, re-encapsulate the encrypted message through the IPV4 protocol, and determine the disguised message of the message data;

[0090] When the encapsulation protocol corresponding to the target tunnel is IPV6, the message data is encapsulated and encrypted through the User Datagram Protocol to determine the encrypted message, and the encrypted message is re-encapsulated through the IPV6 protocol to determine the disguised message of the message data.

[0091] This specification also provides a computer-readable storage medium, which stores a computer program, which can be used to execute the above Figure 2 A data transmission method is provided.

[0092] This manual also provides Figure 5 The schematic structure diagram of the electronic device shown in FIG. Figure 5 As shown, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1 A data transmission method.

[0093] Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the executor of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0094] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0095] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0096] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0097] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0098] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0099] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0100] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0101] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0102] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0103] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0104] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0105] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0106] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0107] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0108] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0109] The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

Claims

1. A data transmission method, characterized in that: The method is applied to a terminal in a zero-trust system, wherein the zero-trust system at least includes the terminal and a zero-trust gateway, wherein the terminal and the zero-trust gateway at least include an Internet Communication Protocol Version 4 IPv4 tunnel and an Internet Communication Protocol Version 6 IPv6 tunnel, including Determine the message data to be transmitted and the destination address of the message data, and determine the encapsulation protocol of the message data according to the destination address; Acquire the network status of the IPV4 tunnel and the IPV6 tunnel, and select a target tunnel from the IPV4 tunnel and the IPV6 tunnel according to the network status; Determining whether the target tunnel matches the encapsulation protocol of the message data; If so, the message data is transmitted to the zero-trust gateway through the target tunnel, so that the zero-trust gateway forwards the message data to the destination address after receiving the terminal identity authentication pass instruction; If not, determine the encapsulation protocol corresponding to the target tunnel, encapsulate the message data again according to the encapsulation protocol corresponding to the target tunnel, determine the disguised message data, and transmit the disguised message data to the zero trust gateway through the target tunnel, so that the zero trust gateway forwards the disguised message data to the destination address after receiving the terminal identity authentication passed instruction.

2. The method according to claim 1, characterized in that The zero-trust system further includes a zero-trust platform. Before determining the message data to be transmitted, the method further includes: In response to an operation of a user, determining verification information according to the operation; The identity authentication information is sent to the zero trust platform, so that the zero trust platform performs verification according to the verification information. When the verification passes, a verification pass instruction is returned and sent to the zero trust gateway.

3. The method according to claim 1, characterized in that The method further comprises: Send a detection signal to the zero-trust gateway through the IPV4 tunnel and the IPV6 tunnel at a preset frequency, and accept the detection result returned by the zero-trust gateway; The network status of the IPv4 tunnel and the IPv6 tunnel are determined respectively according to at least the most recent detection result.

4. The method according to claim 1, characterized in that The network status includes at least one of the connectivity status, delay, packet loss rate, and bandwidth utilization rate of the IPv4 tunnel and the IPv6 tunnel.

5. The method according to claim 4, characterized in that Selecting a target tunnel from the IPv4 tunnel and the IPv6 tunnel according to the network state specifically includes: Scoring the IPV4 tunnel and the IPV6 tunnel according to the most recently acquired network status of the IPV4 tunnel and the IPV6 tunnel; Based on the score, a target tunnel is selected.

6. The method according to claim 1, characterized in that Determining whether the target tunnel matches the encapsulation protocol of the message data specifically includes: When the encapsulation protocol of the message data is IPV4, determining whether the target tunnel is an IPV4 tunnel, if so, it means that the target tunnel matches the encapsulation protocol of the message data, if not, it means that the target tunnel does not match the encapsulation protocol of the message data; When the encapsulation protocol of the message data is IPV6, it is determined whether the target tunnel is an IPV6 tunnel. If so, it means that the target tunnel matches the encapsulation protocol of the message data. If not, it means that the target tunnel does not match the encapsulation protocol of the message data.

7. The method according to claim 1, characterized in that Encapsulating the message data again according to the encapsulation protocol corresponding to the target tunnel to determine disguised message data, specifically including: When the encapsulation protocol corresponding to the target tunnel is IPV4, the message data is encapsulated and encrypted through the user datagram protocol to determine the encrypted message, and the encrypted message is re-encapsulated through the IPV4 protocol to determine the disguised message of the message data; When the encapsulation protocol corresponding to the target tunnel is IPV6, the message data is encapsulated and encrypted through the User Datagram Protocol to determine the encrypted message, and the encrypted message is re-encapsulated through the IPV6 protocol to determine the disguised message of the message data.

8. A data transmission device, characterized in that: The device is used to implement a terminal in a zero-trust system, the zero-trust system at least includes the terminal and a zero-trust gateway, and at least an Internet Communication Protocol Version 4 IPv4 tunnel and an Internet Communication Protocol Version 6 IPv6 tunnel are included between the terminal and the zero-trust gateway, including: A determination module, used to determine the message data to be transmitted and the destination address of the message data, and determine the encapsulation protocol of the message data according to the destination address; An acquisition module, used for acquiring the network status of the IPV4 tunnel and the IPV6 tunnel, and selecting a target tunnel from the IPV4 tunnel and the IPV6 tunnel according to the network status; A transmission module is used to determine whether the target tunnel matches the encapsulation protocol of the message data; if so, the message data is transmitted to the zero-trust gateway through the target tunnel, so that the zero-trust gateway forwards the message data to the destination address after receiving the terminal identity authentication passed instruction; if not, the encapsulation protocol corresponding to the target tunnel is determined, and the message data is encapsulated again according to the encapsulation protocol corresponding to the target tunnel to determine the disguised message data, and the disguised message data is transmitted to the zero-trust gateway through the target tunnel, so that the zero-trust gateway forwards the disguised message data to the destination address after receiving the terminal identity authentication passed instruction.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 7 when executing the computer program.

Images