A data security exchange method under a cross-network environment

Abstract

The application discloses a data security exchange method in a cross-network environment and belongs to the technical field of network communication. The method comprises the following steps: S1, encapsulating a data packet according to a receiving address; S2, transmitting the data packet according to a data routing distribution strategy; and S3, replying to a sending address with a state data packet by the receiving address. The data routing distribution strategy comprises the following steps: S2.1, checking the information security level of the data packet and the receiving address; S2.2, judging the network belonging of the receiving address and a current network; S2.3, inquiring a routing table to find a forwarding path; S2.4, checking the information security level of the data packet and a forwarding network; and S2.5, judging the transmission mode of the forwarding network. The application solves the problem of data security exchange in cross-enterprise, cross-service system and cross-network, and effectively reduces the complexity of data distribution and exchange between multiple subjects and multiple service systems in various network environments.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network communication, in particular to a data security exchange method in a cross-network environment. BACKGROUND

[0002] In the prior art, there are few data security exchange methods based on data packets, and there are even fewer methods for realizing secure data exchange in different networks through data routing distribution strategies. In addition, the combination of data transmission methods such as in-network direct connection, data ferrying, and one-way import is not good, and the practicability in various network environments is low. If data distribution and exchange are performed among different enterprises, different business systems, different types of networks, and users in various fields, the problem of cross-enterprise, cross-network, and cross-system data exchange must be solved to unblock the data flow and information interaction channel, and to provide technical support for business data exchange and sharing of different information security levels.

[0003] 1. Traditional routing protocol: The traditional routing protocol mainly includes the border gateway protocol (BGP) and the internal gateway protocol (IGP). The border gateway protocol is mainly used for routing between autonomous systems (AS), and realizes strategic routing selection through path attributes (such as AS path, MED, and local priority). The current mainstream version is BGP-4, and end-to-end traffic isolation is realized through label switching. Although BGP is widely used, it has complex configuration and long convergence time. The internal gateway protocol such as the link state protocol (OSPF) is used for internal routing, reduces the routing table size through area division, and supports MPLS traffic engineering (TE) and fast convergence. When the IGP protocol such as OSPF is used in a large network, a large number of routing entries are generated, resulting in a large routing table and low processing speed and efficiency of the router.

[0004] 2. Software-defined network (SDN): The network is managed by a centralized controller to realize flexible routing strategy and global scheduling of network resources. In the SDN architecture, the communication between the controller and the forwarder is realized through the OpenFlow network communication protocol. The forwarder guides the forwarding of data packets through the flow table, and the controller deploys the corresponding flow table on the forwarder through the interface provided by OpenFlow to realize the control of the forwarding plane. SDN provides dynamic adjustment of routing, but relies on the reliability of the centralized controller.

[0005] 3. Network virtualization technology: such as VPN virtual private network and VLAN virtual local area network. VPN realizes cross-network communication through IPsec VPN encryption tunnel technology, supports site-to-site and remote access, focuses on remote encryption, and the disadvantages focus on performance loss and configuration complexity; VLAN realizes cross-network segment communication through layer 2 isolation, focuses on internal network isolation, and the disadvantages focus on configuration efficiency, security depth, and cross-network performance.

[0006] 4. Data exchange technology: Multi-Protocol Label Switching (MPLS) enables fast forwarding through label stack, supports traffic engineering and VPN. In the Seamless MPLS architecture, MPLS is extended to the access layer to build end-to-end Label Switched Path (LSP) for optimizing data transmission. MPLS performs well in terms of quality of service, but requires dedicated equipment support.

[0007] 5. Cross-network file exchange system: such as gateways, file exchange systems, etc. The gateway realizes high information security level data exchange through physical isolation, which is suitable for military, financial industry, etc., but does not support multi-to-multi exchange. The file security exchange system adopts virtualized isolation, encryption design and sensitive file detection, supports multi-network file ferry, but requires network connection. For completely isolated networks, security measures such as gateways are still needed.

[0008] The invention patent with publication number CN120090846A and the invention name of data cross-network exchange method, device and system discloses: through the cooperation between the application data receiving module, the first public buffer, the safety detection module, the data routing configuration library, the first data exchange processing module, the data security encryption module, the sending cache library, the first message queue, the exchange data sending module, the first exchange equipment integration module, the second exchange equipment integration module, the exchange data receiving module, the second public buffer, the data format conversion module, the second data exchange processing module, the data security decryption module, the distribution cache library, the second message queue, the application data distribution module, it can be compatible with multiple hardware devices, realize unified cross-network data exchange service, improve flexibility and scalability, ensure safe, efficient and reliable transmission of data between different networks. Although it helps to reduce the maintenance cost of networks with different information security levels under physical isolation, and further enhances the security protection ability of high information security level network, but it depends on the pre-set routing configuration library, lacks the mechanism of automatically adjusting the path according to the real-time network state, and is difficult to cope with complex network topology changes; without merging data packets, small data packets need to be transmitted multiple times during ferry, resulting in low offline transmission efficiency.

[0009] For example, the patent with the publication number CN100433652C and the invention name of multi-data communication network system and its data transmission method discloses that the data communication networks corresponding to different applications are connected through the same physical link between adjacent data communication networks, and each data communication network is separated from each other at the network layer and shares the physical bandwidth at the physical layer and the link layer. The patent also discloses a data transmission method of the multi-data communication network system, which sets the data communication network identifier for the protocol packet sent by each network layer protocol instance on each network node to other network nodes, transmits the protocol packet with the identifier through the same physical link, distributes the protocol packet received from the physical link to all instances of the network layer protocol to which the protocol packet belongs by each network node, and processes the protocol packet according to the data communication network identifier of the received protocol packet by each network layer protocol instance. Although the data communication networks corresponding to different applications can share the physical bandwidth and ensure the information isolation between networks to enhance the security, the network layer separation is only achieved by the DCN identifier, the information security level of data and the information security level of the forwarding network are not checked, the high information security level data cannot be prevented from being leaked, and the dynamic routing strategy is not designed, so the data transmission path is fixed and it is difficult to adapt to the complex interaction requirements of multi-network domain and multi-node.

[0010] For example, the patent with the publication number CN116938562A and the invention name of data transmission system and implementation method discloses that in the data transceiving from the application layer to the channel layer, a data transmission hub layer with a global data space is virtually output, a publish / subscribe mechanism is adopted, and a control strategy is constructed; the data transmission requirements of multiple nodes under the distributed architecture are matched through the control strategy, the data transmission requirements are configured, the multiple node connection is established, the network parameters are automatically discovered and configured; the network parameters discovered and configured are protected in the interactive data security by the remote checking, access control and data encryption. Although the connection complexity of multiple nodes under the distributed framework is effectively coped with, the matching rules of the information security level of data and the information security level of the network are not explicitly defined, the network with low information security level cannot prevent the data with high information security level from being received, and the data packet merging or ferry mechanism is not designed, so the support for offline transmission scene only depends on the channel layer configuration, and the practicality is limited.

[0011] Therefore, it is very important to construct a systematic information security level checking system in cross-network data exchange, improve the data transmission efficiency in the network physical isolation scene, and realize the dynamic intelligent routing strategy. SUMMARY

[0012] Therefore, the main purpose of the present application is to provide a data security exchange method in a cross-network environment, so as to at least partially solve the above technical problems.

[0013] In order to achieve the above object, the present application provides a data security exchange method in cross-network environment, comprising the following steps:

[0014] S1: encapsulating the data packet according to the receiving address;

[0015] S2: transmitting the data packet according to the data routing distribution strategy;

[0016] S3: the receiving address replies a status data packet to the sending address;

[0017] The data routing distribution strategy in S2 comprises the following steps:

[0018] S2.1: information security level check of the data packet and the receiving address;

[0019] S2.2: network belonging judgment of the receiving address and the current network;

[0020] S2.3: searching the forwarding path by querying the routing table;

[0021] S2.4: information security level check of the data packet and the forwarding network;

[0022] S2.5: transmission mode judgment of the forwarding network.

[0023] S2.1 specifically comprises: comparing the information security level of the data packet with the information security level of the receiving address, judging whether the information security level of the data packet is not higher than the information security level of the receiving address, if yes, proceeding to S2.2; otherwise, returning the data packet.

[0024] The information security level is classified according to the importance of system and data and the damage degree after being destroyed, and should cover two systems of level protection and hierarchical protection. Each enterprise should formulate specific grading rules according to its own characteristics and security needs, and determine its information security level according to relevant national regulations and rules. The comparison rule of information security level is based on the partial order relation of information security level label, and the information security level adopts hierarchical label system (such as "first level", "second level", "third level", "fourth level", "fifth level"), and the hierarchical order follows the industry general standard (such as the division of information security protection 2.0 standard), forming a strict partial order relation: first level < second level < third level < fourth level < fifth level. The information security level of "third level" is not higher than that of "fourth level", that is, "third level" data is allowed to flow into "fourth level" network, but reverse transmission is prohibited.

[0025] The system presets a hierarchical mapping table of information security levels, each label corresponds to a unique hierarchical value (such as "first level = 10", "second level = 20", etc.), and the "not higher than" judgment is converted into a "<=" comparison of hierarchical values, but there is an essential difference from numerical comparison. The label represents the security protection level, not just the numerical value (such as the hierarchical value of "second level" is higher than "first level", but it does not mean that the two are in a linear numerical relationship); the hierarchical order is not reversible, and strictly follows the security specifications, such as a network with a high information security level can receive data with a low information security level, and vice versa is prohibited.

[0026] When it comes to label systems of different enterprises or industries, such as A enterprise using "L1 / L2 / L3", the following method is used: In the data routing configuration library, the hierarchical correspondence of different label systems is predefined: "L1"→"first level", "L2"→"second level", "L3"→"third level". After mapping, compare according to the partial order relationship of the unified label system.

[0027] When it cannot be completely mapped, that is, a label system contains a special level, then take the minimum information security level in the cross-system as the reference. For example, the information security level of the data packet is "A enterprise-fourth level", and the information security level of the receiving address is "B enterprise-L5", if "L5" is not defined, then the data packet is returned by default.

[0028] Step S2.2 is specifically: judging whether the network ID of the receiving address is the same as the network ID of the current network object, if yes, then directly sending to the receiving address; otherwise, proceed to step S2.3.

[0029] The comparison rule of the network ID in this step is strict string exact match, that is, only when the network ID of the receiving address is completely consistent with the network ID of the current network object, it is determined that "the network is directly reachable".

[0030] Step S2.3 is specifically: accessing the routing table to query the next network; judging whether a transmissible network is found, if yes, proceed to step S2.4; otherwise, return the data packet.

[0031] The routing table is stored in a key-value pair (Key-Value) or relational database table structure, each record contains:

[0032] Source network ID (Current_Net_ID): unique identifier of the current network (such as NET_A);

[0033] Target network ID (Target_Net_ID): unique identifier of the network where the receiving address is located (such as NET_C);

[0034] Forward_Net_ID: the network ID of the next forwarding node (e.g. NET_B);

[0035] Forward_Sec_Level: the information security level label of the forwarding network (e.g. "third level");

[0036] Transmission_Method: direct connection, relay, single guide, etc. (e.g. "relay");

[0037] Protocol: TCP, UDP, HTTP, etc. (e.g. "TCP / IP");

[0038] Interface: physical or logical interface identification (e.g. ETH0 / 1).

[0039] For example, when enterprise A (network 1) transmits data to enterprise C (network 3), network 1 and network 3 are physically isolated, and need to be forwarded through network 2 (relay node),

[0040] According to the storage entries preset in the routing table configuration, the system obtains the current network ID = NET_1 from the current network object, and parses the target network ID = NET_3 from the receiving address. Through the primary key index (NET_1, NET_3), the routing table record is quickly located, and if there is a matching entry, the forwarding network ID = NET_2 and related parameters are obtained; if not, the "not found" process is entered. Verify the validity of the forwarding network ID (e.g. whether it is registered in the routing table, whether it is disabled), if valid, enter S2.4; otherwise, mark "not found". If there is no record of (NET_1, NET_3) in the routing table (e.g. network 3 of enterprise C is a newly connected network and no routing rule is configured), the system returns a "routing unreachable" status data packet to the sending address, and terminates the transmission.

[0041] Step S2.4 is specifically: judging whether the information security level of the data packet is not higher than the information security level of the forwarding network. If yes, first execute the forwarding of the next network, and then perform step S2.5; otherwise, return to step S2.3.

[0042] Step S2.5 is specifically: judging whether the transmission method of the forwarding network is relay. If yes, put the data packet into the waiting relay area and merge the data packet relay; otherwise, transmit according to the corresponding transmission method and protocol of the forwarding network, and return to step S2.2.

[0043] The data packet ID used as the unique identifier during step S1 encapsulation corresponds to one data packet, and the information security level of the data packet is used as the highest information security level.

[0044] Step S2.5 merges multiple data packets in the to-be-bridged area according to a strategy to form a data packet cluster, and then transmits the data packet cluster to the forwarding network through bridging; the forwarding network verifies the data packet cluster and extracts data packets therefrom after receiving the data packet cluster.

[0045] A multi-level queue is established in the to-be-bridged area, and independent groups are divided according to information security levels (such as "second level" and "third level") of the data packets, so as to ensure that the information security levels of the data packets in the same group are consistent. For example:

[0046] High information security level queue (third level): only stores data packets with an information security level of "third level";

[0047] Medium information security level queue (second level): stores data packets with an information security level of "second level", and is physically isolated from the high information security level queue (such as different storage partitions).

[0048] In the same information security level queue, further subdivision is performed according to the receiving network ID. For example, the "second level" queue is divided into "target network A" and "target network B" sub-queues to avoid mixing and merging of data packets of different target networks.

[0049] The to-be-bridged area adopts a composite structure of hash table + priority queue:

[0050] The key is (information security level, target network ID), and the value is the data packet queue of the group;

[0051] The queue is sorted according to the priority of the data packets (such as emergency instructions and ordinary data), and the data packets with high priority are located at the head of the queue.

[0052] The trigger condition of the merging strategy is based on the capacity threshold, that is, when the total amount of data in a group exceeds a preset value (such as 100 MB), the merging is automatically triggered. The system monitors the byte size of each group in real time, and performs merging immediately when the threshold is exceeded.

[0053] High information security level groups (such as "third level") are preferentially merged, and low information security level groups (such as "second level") wait for the completion of the processing of high information security level groups to avoid delays in high information security level data due to waiting for information security level.

[0054] The system can use a timing task (such as every 30 seconds) to scan the hash table structure (key is (information security level, target network ID)) of the to-be-bridged area to obtain real-time state data of each group and store it in a monitoring database, thereby realizing real-time monitoring of data to prevent data accumulation or loss.

[0055] The data packet cluster includes a data packet cluster identifier, a sending network ID, a receiving network ID, and security attributes, and is used for bridging transmission of data packets between physically isolated networks.

[0056] The routing table is used for storing network ID, forwarding network ID, information security level of forwarding network, transmission mode and protocol of forwarding network and forwarding network interface.

[0057] Based on the above technical solution, the data security exchange method in the cross-network environment has at least one of the following beneficial effects compared with the prior art:

[0058] 1. The triple verification mechanism of the information security level of the data packet, the information security level of the receiving address and the information security level of the forwarding network ensures that the data is only transmitted between the networks with matching information security levels. When the data flow with high information security level flows to the network with low information security level, the system automatically intercepts the data packet with unmatched information security level, thereby avoiding the leakage of sensitive information.

[0059] 2. The optimal path is automatically selected through real-time query and transmission mode judgment of the routing table. For example, when the direct link between network A and network B fails, the system automatically switches to the forwarding path through the ferry node, and the transmission integrity is confirmed through the status data packet.

[0060] 3. For the network physical isolation scene, a plurality of to-be-ferry data packets are merged into a data packet cluster, and batch transmission is completed through one ferry. BRIEF DESCRIPTION OF DRAWINGS

[0061] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0062] Figure 1 is a flowchart of the data security exchange method in the cross-network environment of the present application;

[0063] Figure 2 is a flowchart of the data routing distribution strategy of the data security exchange method in the cross-network environment of the present application;

[0064] Figure 3 is a specific process diagram of the data security exchange method in the cross-network environment of the present application. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical solutions and advantages of the present application more clear and obvious, the present application will be further described in detail below in combination with specific embodiments and with reference to the drawings.

[0066] The terminology used in the present application is for the purpose of describing particular embodiments only and is not intended to limit the embodiments of the present application. The singular forms "a," "said," and "the" as used in the embodiments of the present application are also intended to encompass the plural forms unless the context clearly indicates otherwise.

[0067] In actual business scenarios, there are various networks such as the Internet, a local area network, a group wide area network, etc. The information security levels of various networks are different, and the security protection levels of various information systems, services, applications, etc. deployed on the networks are also different. Data security exchange in a cross-network environment covers two types of exchange subjects, a sending party and a receiving party. The sending party can send data to multiple receiving parties according to the data demand of the business system of the enterprise, and the receiving party can receive data from multiple sending parties of enterprises, departments, organizations, etc. that have data exchange demand. The sending party and the receiving party can transmit data between different enterprises and different business systems, and data exchange needs to receive data from different sending parties and transmit the data to different receiving parties. In the data transmission process, the data needs to be distributed and processed to meet the efficient and accurate exchange of data between various network environments, multiple subjects, and different business systems.

[0068] The present inventors found that the prior art has the problem that there are few data security exchange methods based on data packets, and the data transmission modes such as direct connection in the same network, data ferry, and one-way import are not effectively combined, which has low practicability in various network environments. After in-depth research, it was found that by adopting a data routing distribution strategy of "information security level of data packet→ information security level of receiving address→ information security level of forwarding network" threefold verification, "direct connection in the same network" and "cross-network forwarding" are distinguished, multi-hop routing is realized by using a routing table, and offline transmission requirements of physically isolated networks are adapted by "data packet merging + ferry", data security exchange can be performed in various network environments, multiple participants, and multiple business systems, efficient circulation and accurate interaction of data are realized, and the complexity of cross-network data exchange is reduced.

[0069] Address: used to identify the network location of the business system of the enterprise, is a string of characters composed of "enterprise identifier + business system identifier + network ID", the information security level of the address is the highest data information security level that the enterprise can handle, and is an important attribute of the address. The sending address refers to the address of the data packet, and the receiving address refers to the address of the data packet.

[0070] The information security level adopts an industry common hierarchical label system, such as "first level", "second level", "third level", "fourth level", and "fifth level", forming a strict partial order relationship (first level < second level < third level < fourth level < fifth level). The label represents the security protection level of the data or network, rather than a simple numerical value or complex attribute set.

[0071] The system presets a hierarchical mapping table of information security levels, each label corresponds to a unique hierarchical value (such as "first level = 10", "second level = 20", etc.), and the "not higher than" judgment is converted into a "<=" comparison of the hierarchical value, but there is an essential difference from the numerical comparison, the label represents the security protection level, not just the numerical value (such as the hierarchical value of "third level" is higher than "second level", but it does not mean that the two are in a linear numerical relationship); the hierarchical order is not reversible, and strictly follows the safety specifications, such as a network with a high information security level can receive data with a low information security level, and vice versa is prohibited.

[0072] When the label system involves different enterprises or industries, such as A enterprise using "L1 / L2 / L3", the following method is used: in the data routing configuration library, the hierarchical correspondence of different label systems is predefined: "L1"→"first level", "L2"→"second level", "L3"→"third level". After mapping, compare according to the partial order relationship of the unified label system.

[0073] When it cannot be completely mapped, that is, a certain label system contains a special level, then take the minimum information security level in the cross-system as the reference. For example, the information security level of the data packet is "A enterprise-fourth level", and the information security level of the receiving address is "B enterprise-L5", if "L5" is not defined, then the data packet is returned by default.

[0074] The information security level of the data packet adopts the assignment principle of "not high but not low", and the information security level of the data packet is the highest information security level of the business data it carries. If the data packet contains "second level" and "third level" data, the information security level is marked as "third level".

[0075] Routing table: a data structure for storing data forwarding paths, each record of the routing table contains network ID, forwarding network ID, information security level of the forwarding network, transmission mode and protocol of the forwarding network, interface of the forwarding network, etc.

[0076] Therefore, as shown in Figure 1 The present inventors propose a data security exchange method in a cross-network environment, which solves the problem of data exchange and distribution in multiple network environments, and reduces the complexity of cross-network data exchange between multiple subjects and multiple business systems. At the same time, a data routing and distribution strategy is provided, so that the business data of each enterprise can effectively pass through in multiple network scenarios, multiple source heterogeneous systems, and different enterprises, including the following steps:

[0077] S1: encapsulate the data packet according to the receiving address;

[0078] S2: transmit the data packet according to the data routing and distribution strategy;

[0079] S3: the receiving address replies a status data packet to the sending address;

[0080] As Figure 2 shown, the data routing distribution strategy in S2 includes the following steps:

[0081] S2.1: information security level check of the data packet and the receiving address;

[0082] S2.2: network home judgment of the receiving address and the current network;

[0083] S2.3: query routing table to find the forwarding path;

[0084] S2.4: information security level check of the data packet and the forwarding network;

[0085] S2.5: transmission mode judgment of the forwarding network.

[0086] The present application proposes a data security exchange method in a cross-network environment. In the data transmission process, when an enterprise sends business system data to multiple different enterprises, the enterprise's business system data is encapsulated into data packets of different receiving addresses according to the receiving addresses, and each data packet adopts a data routing distribution strategy of "information security level of data packet→ information security level of receiving address→ information security level of forwarding network" threefold check, so that the data packet can be efficiently and securely transmitted to the receiving address. At the same time, in various network environments, "direct connection in the same network" and "forwarding in cross-network" are distinguished, and routing table is used to realize multi-hop routing. For physically isolated networks, "data packet merging + ferrying" is used to adapt to offline transmission requirements.

[0087] Data packet: data in the business system is encapsulated in a specific structure according to a certain format. The data packet is divided into two parts: packet header and packet body. The packet header mainly contains data packet ID (unique identification of a data packet), information security level of the data packet, sending address, receiving address, data packet type, etc. The data packet type is divided into content data packet and state data packet. The content data packet is used to transmit business system data, and the packet body refers to the business system data to be transmitted. The state data packet is used to update the sending state of the content data packet, and the state data packet has no packet body. The packet header of the state data packet additionally contains content data packet ID, content data packet state, etc.

[0088] As Figure 3 shown, step S2.1 specifically includes comparing the information security level of the data packet with the information security level of the receiving address, and judging whether the information security level of the data packet is not higher than the information security level of the receiving address. If yes, proceed to step S2.2; otherwise, return the data packet.

[0089] Step S2.2 specifically includes judging whether the network ID of the receiving address is the same as the network ID of the current network object. If yes, it is directly sent to the receiving address; otherwise, proceed to step S2.3.

[0090] Wherein, the network object (hereinafter referred to as network): is an entity concept abstracted in a complex network, is an important information for managing multiple networks. The network object can be a LAN, WAN or Internet, etc. The main attributes of the network object include network ID (unique identification of a network object), network information security level, etc.

[0091] The comparison rule of network ID in this step is strict string accurate matching, that is, only when the network ID of the receiving address is completely consistent with the network ID of the current network object, it is determined that the network is directly reachable.

[0092] For example, the current network object is the intranet of a company headquarters, and the network ID is CORP_HQ_LAN.

[0093] The network ID of the receiving address is:

[0094] If it is CORP_HQ_LAN→match, directly send the data packet, and the R&D department of the headquarters transmits data to the finance department in the same intranet.

[0095] If it is CORP_BRANCH_LAN (branch company intranet) or INTERNET→not match, enter the routing table query, for example, when the headquarters needs to transmit data to the branch company, it needs to be forwarded through the WAN.

[0096] Step S2.3 is specifically: accessing the routing table to query the next network; determining whether a transferable network is found, yes, then performing step S2.4; otherwise, returning the data packet.

[0097] Step S2.4 is specifically: determining whether the information security level of the data packet is not higher than the information security level of the forwarding network, yes, then performing step S2.5 after forwarding the next network; otherwise, returning to step S2.3.

[0098] Step S2.5 is specifically: determining whether the transmission mode of the forwarding network is ferry, yes, then putting the data packet into the waiting ferry area and ferry after merging the data packet; otherwise, transmitting according to the corresponding transmission mode and protocol of the forwarding network, and returning to step S2.2.

[0099] The data packet ID as the unique identifier during step S1 encapsulation corresponds to a data packet, and the information security level of the data packet is taken as the highest information security level of the data.

[0100] Step S2.5 is specifically: merging multiple data packets in the waiting ferry area into a data packet cluster according to the strategy, and then transmitting to the forwarding network through the ferry mode; the forwarding network receives the data packet cluster, verifies the data packet cluster, and extracts the data packet from it.

[0101] Data packet cluster: refers to the result of merging multiple data packets. When ferrying data between two physically isolated networks, multiple data packets to be ferried are merged into a data packet cluster. The data packet cluster includes a data packet cluster identifier, a sending network ID, a receiving network ID, and security attributes, for data packet ferry transmission between physically isolated networks.

[0102] The routing table is used to store the network ID, forwarding network ID, information security level of the forwarding network, forwarding network transmission mode and protocol, and forwarding network interface.

[0103] The application will be further described and illustrated by specific examples. It should be noted that the following examples are only illustrative and are not intended to limit the application. Based on the examples of the application shown below, all other examples obtained by those of ordinary skill in the art without creative labor are within the scope of the embodiments of the application.

[0104] Example 1

[0105] In this embodiment, further, Figure 1 is a flowchart of the application; as can be seen from the figure, in this embodiment, a data security exchange method in a cross-network environment includes the following steps:

[0106] Step S1: encapsulating data packets according to receiving addresses

[0107] According to different receiving addresses, data packets conforming to the format are generated separately to ensure that data can be correctly parsed, while meeting the requirements of efficiency and security. The generation of data packets should meet the following requirements:

[0108] (1) A unique data packet should be generated.

[0109] (2) The information security level of the data packet is the highest information security level of the data of the business system carried by the data packet.

[0110] The reason for considering that the data packet generation meets the above two conditions is that by assigning a unique data packet ID (such as UUID, timestamp + serial number combination), a "digital identity" is established for each data packet, ensuring that the data packet can be accurately identified and tracked in multiple network environments and multi-subject interactions, avoiding data processing errors caused by repetition and confusion.

[0111] In combination with the state data packet, the sender and the receiver ensure the integrity and reliability of data packet transmission through bidirectional confirmation (which can be achieved through the ACK / NACK mechanism). The receiver replies with a state data packet after receiving the data packet, and the sender updates the sending state accordingly, avoiding data retransmission or loss.

[0112] The unique identifier can serve as an anchor point for data integrity verification (e.g., combined with a hash value). If the data packet is tampered with during transmission, the consistency between the identifier and the content will be destroyed, thereby achieving anomaly detection. At the same time, the unique identifier facilitates tracing the data source and transmission path, meeting the data compliance requirements.

[0113] In a cross-network scenario, the same business data may be split into multiple data packets (e.g., file fragments). The unique identifier can ensure that the fragments are reassembled in order, avoiding out-of-order or duplicate processing.

[0114] Step S2: Transmit the data packet according to the data routing distribution strategy

[0115] Compare the information security level of the data packet with the information security level of the receiving address to determine whether the data packet can be sent or returned. Match the receiving address network with the current network, and the matching result determines the forwarding path of the data packet. If it matches, it is directly sent to the receiving address. The receiving address replies a status data packet to the sending address after receiving the data packet. If it does not match, find the next reachable forwarding path. If the forwarding network transmission method is ferrying, put the data packet into the waiting ferry area, merge the data packets and ferry them. In the ferry transmission, the data packet cluster is merged and split through the unique identifier to ensure the accuracy of offline transmission, realizing the distribution and exchange of data in various network environments.

[0116] Step S2.1: Information security level verification (data packet → receiving address)

[0117] If the data is of high information security level, it cannot be sent to a receiving address of low information security level, so the first re-judgment needs to be performed on each data packet.

[0118] Determine whether the information security level of the data packet is not higher than the information security level allowed by the receiving address.

[0119] Otherwise, the information security level of the data packet exceeds the carrying capacity of the receiving party, and the data packet is returned (terminate the processing flow of the receiving address).

[0120] Yes, go to the next network home judgment.

[0121] Step S2.2: Network home judgment (receiving address → current network)

[0122] Perform the second re-judgment:

[0123] Determine whether the network ID of the receiving address is equal to the network ID of the current network object.

[0124] Yes, the network is directly reachable, and the data packet is directly sent to the receiving address (terminate the processing flow of the receiving address).

[0125] Otherwise, it needs to be forwarded across the network, and enters the routing table query phase.

[0126] Step S2.3: Routing table query (finding a forwarding path)

[0127] The routing table is queried to find a "next network node" that can forward to the network where the receiving address is located. If no valid forwarding path is found, the data packet is returned (the processing flow for the receiving address is terminated).

[0128] If a valid forwarding path is found, the next step is to check the information security level of the forwarding network.

[0129] Step S2.4: Information security level check of the forwarding network (data packet→forwarding network)

[0130] A third judgment is performed:

[0131] Whether the information security level of the data packet is not higher than the information security level of the forwarding network.

[0132] If yes, the data packet is allowed to be transmitted through the forwarding network, and the forwarding to the next network is performed.

[0133] Otherwise, the routing table is queried again to find the next available forwarding network.

[0134] Step S2.5: Forwarding network transmission mode judgment

[0135] For forwarding to the next network, a fourth judgment is performed:

[0136] Whether the forwarding network transmission mode is ferrying.

[0137] If yes, the data packet is placed in the waiting-to-ferry area and waits for ferrying. When ferrying, multiple data packets in the waiting-to-ferry area are merged into a data packet cluster according to a strategy, and then transmitted to the forwarding network through the ferrying mode. After receiving the data packet cluster, the forwarding network verifies the data packet cluster and extracts the data packet therefrom.

[0138] Otherwise, the corresponding forwarding network transmission mode and protocol in the routing table are used to transmit to the forwarding network.

[0139] S2.5 is merged into a data packet cluster according to a strategy, wherein the waiting-to-ferry area includes data packets of different information security levels. By dividing the data packets into different data packet clusters according to different information security levels, when the capacity (including the number and size of data packets, etc.) of the data packet cluster reaches a certain threshold, the data packet cluster is forwarded to the forwarding network. Hash algorithm and other technologies are used to verify the integrity of the data packet cluster to prevent data packet tampering. After verifying the integrity of the data packet cluster, the data packet is extracted therefrom, and the transmission continues in units of data packets.

[0140] Repeat steps S2.2-S2.5 (query next forwarding network→check information security level→judge transmission mode of forwarding network) until the data packet reaches the network where the receiving address is located, and finally execute "directly send to receiving address".

[0141] Step S3: receiving address replies status data packet

[0142] After receiving the data packet, the receiving address sends a status data packet to the sending address, and the status data packet is transmitted to the sending address according to step S2. After receiving the status data packet, the sending address updates the sending status of the content data packet.

[0143] When an enterprise sends business system data to multiple enterprises (such as suppliers, service providers, etc.), the business system data of the enterprise is encapsulated into data packets of different receiving addresses according to the receiving address, and each data packet is transmitted to the receiving address according to the data routing distribution strategy.

[0144] The present application provides a data security exchange method in a cross-network environment, and provides a data routing distribution strategy. According to the data routing distribution strategy of triple verification of "information security level of data packet→information security level of receiving address→information security level of forwarding network", the data is transmitted to the receiving address, and the connectivity of the receiving address network can be automatically detected. According to the connectivity of the current network and the receiving address network, the data routing distribution strategy is used to dynamically select a routing path for forwarding. The problem of routing flexibility of multiple subjects and multiple business system data in a collaborative scenario is solved, and the efficiency and reliability of data transmission are improved. It is suitable for data exchange scenarios in various network environments and has high practical value. It solves the problem of cross-enterprise, cross-business system and cross-network data security exchange. The data routing distribution strategy effectively reduces the complexity of data distribution and exchange between multiple subjects and multiple business systems in various network environments.

[0145] The above describes specific embodiments of the embodiments of the present application. In some cases, the described actions or steps can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are possible or can be advantageous.

[0146] In the description of the embodiments of the present application, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the embodiments of the present application. The illustrative representation of the above terms does not necessarily refer to the same embodiment or example in the embodiments of the present application. Moreover, the specific features, structures, materials or characteristics described can be combined in any suitable manner in one or more embodiments or examples. In addition, the person skilled in the art can combine and combine the different embodiments or examples described in the embodiments of the present application and the features of the different embodiments or examples, without contradiction.

[0147] In addition, the terms "first", "second" are only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the embodiments of the present application, the meaning of "multiple" is at least two, for example, two, three, etc., unless otherwise specifically limited.

[0148] Any process or method descriptions or descriptions of the flow diagrams described herein or otherwise described in the present application can be understood as representing the modules, segments or portions of code that include executable instructions for implementing custom logic or processes that are combined to perform the processes described in the flow diagrams and / or portions thereof. The scope of the preferred embodiments of the present application includes additional implementation in which the processes described in the flow diagrams and / or portions thereof are performed in a different order, including substantially simultaneously, or in reverse order, depending on the functionality involved, which should be understood by those skilled in the art of the embodiments of the present application.

[0149] The above only describes the preferred embodiments of the present application and does not limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for secure data exchange in a cross-network environment, characterized in that, Includes the following steps: S1: Encapsulate data packets according to the receiving address; S2: Transmit data packets according to the data routing distribution strategy; S3: The receiving address replies with a status data packet to the sending address; The data routing and distribution strategy includes the following steps: S2.1: Information security level verification of data packets and receiving addresses; S2.2: Determine the network affiliation of the receiving address and the current network; S2.3: Query the routing table to find the forwarding path; S2.4: Information security level verification of data packets and forwarding networks; S2.5: Determine the transmission mode of the forwarding network; Step S2.1 specifically involves comparing the information security level of the data packet with the information security level of the receiving address, determining whether the information security level of the data packet is not higher than the information security level of the receiving address, and proceeding to step S2.2 if yes; otherwise, returning the data packet. Step S2.3 specifically involves: accessing the routing table to query the next network; determining whether a forwardable network has been found; if so, proceeding to step S2.4; otherwise, returning the data packet. Step S2.5 specifically involves: determining whether the transmission mode of the forwarding network is ferrying; if so, placing the data packet into the ferrying area and merging the data packets for ferrying; otherwise, transmitting according to the corresponding forwarding network transmission mode and protocol, and returning to step S2.

2. In step S2.5, during the ferrying process, multiple data packets in the area to be ferryed are merged into a data packet cluster according to a strategy, and then transmitted to the forwarding network via the ferrying method. After receiving the data packet cluster, the forwarding network verifies the data packet cluster and extracts the data packets from it.

2. The data security exchange method in a cross-network environment according to claim 1, characterized in that, Step S2.2 specifically involves determining whether the network ID of the receiving address is the same as the network ID of the current network object. If so, the data is sent directly to the receiving address; otherwise, proceed to step S2.

3.

3. The data security exchange method in a cross-network environment according to claim 1, characterized in that, Step S2.4 specifically involves determining whether the information security level of the data packet is not higher than the information security level of the forwarding network. If yes, forward the data packet to the next network first, and then proceed to step S2.5; otherwise, return to step S2.

3.

4. The data security exchange method in a cross-network environment according to claim 1, characterized in that, The data packet cluster includes a data packet cluster identifier, a sending network ID, a receiving network ID, and security attributes, and is used for data packet transfer between physically isolated networks.

5. A method for secure data exchange in a cross-network environment according to claim 1, characterized in that, In step S1, the data packet ID used as a unique identifier corresponds to one data packet, and the information security level of the data packet is taken as the highest information security level of the data.

6. The data security exchange method in a cross-network environment according to claim 1, characterized in that, The routing table is used to store network ID, forwarding network ID, information security level of the forwarding network, transmission method and protocol of the forwarding network, and forwarding network interface.

Images