Data transmission method, electronic device, storage medium and program product

Abstract

The application discloses a data transmission method, an electronic device, a storage medium and a program product, relates to the technical field of data processing, and comprises the following steps: a first device determines a security tag of target data according to a security level of the target data, an identifier of a second device and a first storage address. In this way, when data transmission is performed on the target data, three granularity security check conditions of data level, device level and storage address level are provided, the security check granularity of the data transmission is refined compared with the security check of the device level, and therefore, the security of the data transmission on the target data is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and particularly relates to a data transmission method, an electronic device, a storage medium and a program product. BACKGROUND

[0002] The Compute Express Link (CXL) protocol is a high-speed interconnection standard for data center and high-performance computing scenarios. In some scenarios, data transmission can be performed based on the CXL protocol.

[0003] In the related art, the receiving end can be authenticated to determine whether the receiving end can perform data transmission based on the CXL protocol with the sending end. In the case that the receiving end passes the security authentication, the sending end sends data to the receiving end based on the CXL protocol. However, the security of the above data transmission method is low. SUMMARY

[0004] The present application provides a data transmission method, an electronic device, a storage medium and a program product, to improve the security of transmitting target data.

[0005] The present application provides a data transmission method applied to a first device, comprising:

[0006] receiving a data transmission request, the data transmission request being used to request to transmit target data from the first device to a second device, and the data transmission request comprising an identifier of the second device and an identifier of a first storage address, the first storage address being a storage address in the second device used to store the target data.

[0007] determining a security level of the target data according to a second storage address of the target data in the first device.

[0008] generating a security tag of the target data according to the security level of the target data, the identifier of the second device and the identifier of the first storage address.

[0009] processing the target data according to the security tag to generate a data packet, wherein a reserved protocol field of the data packet comprises the security tag.

[0010] sending the data packet to the second device.

[0011] The present application also provides a data transmission method applied to a second device, comprising:

[0012] receiving a data packet sent by a first device, wherein a reserved protocol field of the data packet comprises a security tag.

[0013] processing the data packet according to the security tag to obtain target data.

[0014] The target data is checked according to the security label, and a check result of the target data is obtained.

[0015] In a case where the check result is a check pass, the target data is stored.

[0016] The application further provides an electronic device, comprising a memory configured to store a computer program, and a processor configured to execute the computer program to implement the steps of any of the data transmission methods.

[0017] The application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of any of the data transmission methods.

[0018] The application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of any of the data transmission methods.

[0019] The data transmission method, the electronic device, the storage medium and the program product provided by the application provide the security label of the target data according to the security level of the target data, the identifier of the second device and the identifier of the first storage address before the first device sends the target data to the second device, so that the security check conditions of the data level, the device level and the storage address level are provided when the target data is transmitted, the security check granularity of the data transmission is refined compared with the security check of the device level, and the security of the data transmission of the target data is improved. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the application, the drawings needed in the embodiments will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0021] Figure 1 The application scenario schematic diagram provided by the embodiments of the application is shown in the following figure;

[0022] Figure 2 The flowchart of the data transmission method provided by the embodiments of the application is shown in the following figure;

[0023] Figure 3 The flowchart of generating a security label provided by the embodiments of the application is shown in the following figure;

[0024] Figure 4 The processing flowchart of the second device to the data packet provided by the embodiments of the application is shown in the following figure;

[0025] Figure 5A flowchart of a data transmission method based on a hardware acceleration architecture is provided for an embodiment of the present application.

[0026] Figure 6 A structural diagram of a data transmission device is provided for an embodiment of the present application.

[0027] Figure 7 A structural diagram of another data transmission device is provided for an embodiment of the present application.

[0028] Figure 8 A structural diagram of an electronic device is provided for the present application. DETAILED DESCRIPTION

[0029] The technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0030] It should be noted that, in the description of the present application, the terms "comprise", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. The terms "first", "second" and the like in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0031] First, the terms involved in the present application are explained:

[0032] CXL protocol: a core interconnection standard for data centers and high-performance computing, used to realize the sharing of computing and memory between devices. The CXL protocol is based on the physical layer of the peripheral component interconnect express (PCIe) standard, and by adding a transaction layer protocol, the CXL protocol has low latency, cache consistency and memory sharing capabilities. Therefore, the CXL protocol is widely used in heterogeneous computing (Graphics Processing Unit (GPU), Central Processing Unit (CPU), Field-Programmable Gate Array (FPGA) collaboration) and Disaggregated Architecture. In some embodiments, data transmission can be based on the CXL protocol.

[0033] In related technologies, after receiving a data transmission request, the first device performs security authentication on the second device, and in a case where it is determined that data transmission can be performed with the second device based on the CXL protocol, the first device sends data to the second device. It should be noted that after the second device passes the security authentication of the first device, the first device can send any data to the second device, that is, the above-mentioned data transmission method mainly relies on device-level security authentication. In addition, the CXL protocol follows the PCIe Address Translation Services Security (ATSec), and only through device-level security authentication, fine-grained security authentication for data and storage areas cannot be realized, resulting in low security of data transmission.

[0034] The data transmission method provided by the present application generates a security tag of the target data according to the security level of the target data, the identifier of the second device, and the identifier of the first storage address, and provides a data-level security check condition through the security tag. Compared with device-level security check, the security check granularity of data transmission is refined, thereby improving the security of data transmission of the target data.

[0035] In order to enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0036] In combination with the specific application environment architecture or specific hardware architecture on which the data transmission method is executed, the specific application environment architecture or specific hardware architecture is described here. For reference Figure 1 , Figure 1 The application scenario provided by the embodiment of the present application is shown in the figure. As Figure 1As shown, the first device 11 and the second device 12 can be a server or the like, or a GPU, a CPU, an FPGA, a memory, or the like in a server.

[0037] In some embodiments, the first device 11 and the second device 12 can perform data transmission based on the CXL protocol. For example, the first device 11 can send a data packet to the second device 12 based on the CXL protocol.

[0038] It should be noted that the execution subject of each embodiment of the present application can be a processor, a microprocessor, or the like, or a device integrating the above processor or microprocessor, such as a terminal device. The specific execution subject of each embodiment of the present application is not limited, and can be selected and set according to actual needs. In the following embodiments, the execution subject is taken as a terminal device integrating the above processor or microprocessor, which does not limit the actual execution subject.

[0039] It should be noted that, Figure 1 The application scenario is only used as an example and is not limited to the application scenario.

[0040] The technical solutions of the present application and how the technical solutions solve the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described in detail in some embodiments. The embodiments of the present application will be described below with reference to the drawings.

[0041] Figure 2 The flowchart of the data transmission method provided by the embodiments of the present application is shown in FIG. 1. Figure 2 As shown, the data transmission method provided by the embodiments of the present application is described in detail as follows.

[0042] S201: receiving a data transmission request, the data transmission request being used to request to transmit target data from a first device to a second device, and the data transmission request including an identifier of the second device and an identifier of a first storage address, the first storage address being a storage address in the second device for storing the target data.

[0043] The first device can be a server or the like, or a GPU, an FPGA, a CPU, a memory, or the like deployed in a server; and the second device can be a server or the like, or a GPU, an FPGA, a CPU, a memory, or the like deployed in a server. It should be noted that the first device and the second device both support data transmission based on the CXL protocol. The target data is data to be transmitted in the first device.

[0044] In some embodiments, the data transmission request can be sent by a second device. For example, when the second device needs to obtain the target data in the first device, the second device sends the data transmission request to the first device to request the first device to send the target data to the second device.

[0045] In some embodiments, the data transmission request can be sent by a third device other than the second device, where the third device is used to manage the cooperation between multiple devices, and the third device can be a server or a component such as a GPU, FPGA, CPU, etc. in the server. For example, when the third device monitors that the task to be performed by the second device needs the target data in the first device, the third device sends the data transmission request to the first device to request the first device to send the target data to the second device.

[0046] In some embodiments, the data transmission request includes an identifier of the second device and an identifier of the first storage address. For example, the identifier of the second device can be a device serial number of the second device. It should be noted that the second device includes at least one storage address, and the first storage address is a storage address of the at least one storage address for storing the target data. For example, the identifier of the first storage address can be a hash value of the first storage address.

[0047] S202: Determine the security level of the target data according to a second storage address of the target data in the first device.

[0048] The second storage address is a storage address of the target data in the first device. For example, assuming that the storage address of the target data in the first device is 0x01, the second storage address is 0x01.

[0049] The security level of the target data is used to indicate the importance of the target data. In some embodiments, the security level of the target data is proportional to the importance, i.e., the higher the security level, the higher the importance of the target data. For example, assuming that the security level of the target data is 0, the target data is public data, and no security measures need to be taken for the target data; assuming that the security level of the target data is 1, the target data is internal data, which is only accessible to business personnel; assuming that the security level of the target data is 2, the target data is confidential data, and access to the target data needs to be strictly controlled; and assuming that the security level of the target data is 3, the target data is top secret data, and the security protection requirement for the target data is extremely high.

[0050] In some embodiments, the storage addresses of the data in the first device are divided according to the security levels of the data. Therefore, the security level of the target data can be determined according to the security level corresponding to the second storage address.

[0051] S203: generating a security tag of the target data according to a security level of the target data, an identifier of the second device, and an identifier of the first storage address.

[0052] The security tag is used for security verification of the target data, to verify the security of the target data in the data transmission process. In some embodiments, the security tag of the target data can be generated in combination with the data level, the device level, and the storage address level.

[0053] Specifically, the security tag can be generated according to the security level of the target data, the identifier of the second device, and the identifier of the first storage address. For example, the security level of the target data, the identifier of the second device, and the identifier of the first storage address are hashed to generate the security tag of the target data.

[0054] S204: processing the target data according to the security tag to generate a data packet; wherein the security tag is included in a reserved protocol field of the data packet.

[0055] In some embodiments, the first device can encapsulate the target data based on the CXL protocol to obtain a data packet corresponding to the target data. The data packet is a complete transmission unit containing control information and data content. For example, the data packet can include a protocol header, data payload (target data or data processed from the target data), and a tail check.

[0056] In some embodiments, the control information of the data packet includes a reserved protocol field, wherein the reserved protocol field is a free bit reserved for an extension function. The information of the extension function can be stored in the reserved protocol field, so that in the case of adding an extension function in the data transmission process, the basic function of the existing protocol will not be affected.

[0057] Therefore, the target data can be processed according to the security tag, so that the security tag is included in the reserved protocol field of the generated data packet.

[0058] S205: sending the data packet to the second device.

[0059] For example, assuming that the first device is device A and the second device is device B, device A sends the data packet to device B after generating the data packet.

[0060] In Figure 2In the embodiment shown, the first device determines the security label of the target data according to the security level of the target data, the identity of the second device, and the identity of the first storage address. In this way, when data transmission is performed on the target data, security check conditions of three granularities, i.e., data level, device level, and storage address level, are provided, the security check granularity of data transmission is refined compared with security check of the device level, and thus the security of data transmission of the target data is improved. In addition, when the data packet is generated, the security label is placed in the reserved protocol field of the data packet, and the influence of the increase of the security label on the structure of the data packet and the transmission efficiency is reduced.

[0061] In Figure 2 Based on the embodiment shown, the following describes the method for generating the security label of the target data. Figure 3 The method for generating the security label of the target data is further described.

[0062] Figure 3 A flowchart for generating a security label is provided in the embodiment. As shown in the flowchart, the process can include the following flow: Figure 3

[0063] S301: Determine the security level of the target data according to the second storage address.

[0064] The method for determining the security level of the target data can be as follows: determine the storage region to which the second storage address belongs; and determine the security level of the target data according to the security level of the storage region.

[0065] The storage region of the data in the first device is divided according to the security level, and the security level of the storage region is used to indicate the security level of the data stored in the storage region.

[0066] For example, it is assumed that the first device includes data a, data b, and data c. The security level of the data a is 1, the security level of the data b is 2, the security level of the data c is 3, the storage address of the data a in the first device is 0x01, the storage address of the data b in the first device is 0x02, and the storage address of the data c in the first device is 0x03. The security level of the storage region to which the storage address 0x01 belongs is 1, the security level of the storage region to which the storage address 0x02 belongs is 2, and the security level of the storage region to which the storage address 0x03 belongs is 3.

[0067] Therefore, the storage region to which the second storage address belongs can be determined, and the security level of the storage region to which the second storage address belongs is determined as the security level of the target data. For example, it is assumed that the security level of the storage region to which the second storage address belongs is 1, and the security level of the target data is determined as 1.

[0068] ​S302: generate the security tag according to the security level of the target data, the identity of the second device, and the identity of the first storage address.

[0069] In some embodiments, the manner of generating the security tag according to the security level of the target data, the identity of the second device, and the identity of the first storage address can be as follows: determining the first processing manner of the target data according to the security level of the target data; the first processing manner is used to indicate whether to encrypt the target data; determining the secret key of the second device according to the association relationship between the identity of the second device and the secret key of the device; and generating the security tag according to the security level of the target data, the first processing manner, the identity of the second device, the identity of the first storage address, and the secret key of the second device.

[0070] In some embodiments, the security level of the target data is different, and the processing manner of the first device to the target data is different. For example, for target data with a high security level, the first device can encrypt the target data, which can further improve the security of the target data in the data transmission process. For target data with a low security level, the first device does not encrypt the target data, thereby saving the computing resources of the first device. Therefore, the first device can determine the first processing manner of the target data according to the security level of the target data.

[0071] In some embodiments, the first device can also determine the encryption algorithm for encrypting the target data according to the security level of the target data. The encryption algorithm can be, for example, an Advanced Encryption Standard - Galois / Counter Mode (AES-GCM) algorithm, a State Cryptography 4 Block Cipher (SM4) algorithm, etc. The AES-GCM algorithm is widely used in data encryption scenarios due to its high encryption performance and reliable authentication mechanism; and the SM4 effectively ensures the security of data in data encryption scenarios.

[0072] Therefore, in the case where the first processing manner indicates that the target data is encrypted, the first processing manner is also used to indicate the encryption algorithm for encrypting the target data.

[0073] The secret key of the second device is a security credential used by the second device for authentication in data transmission, and the secret key can be, for example, a Hash-based Message Authentication Code (HMAC). In some embodiments, the first device stores an association between the device identifier and the secret key, so that the secret key of the second device can be determined from the identifier of the second device in the association between the device identifier and the secret key.

[0074] For example, assume that the association between the device identifier and the secret key is as shown in Table 1:

[0075] Table 1

[0076]

[0077] In which the identifier of the second device is 00000003, and the secret key of the second device is determined to be AWG5TUS.

[0078] In some embodiments, the manner of generating the security tag according to the security level of the target data, the first processing manner, the identifier of the second device, the identifier of the first storage address, and the secret key of the second device can be as follows: generating a permission code of the second device according to the identifier of the second device and the identifier of the first storage address; performing hash processing on the secret key of the second device to generate a first check code of the target data; and generating the security tag according to the security level of the target data, the first processing manner, the permission code, and the first check code.

[0079] The permission code is used to verify whether the second device and the first storage address have the permission to receive the target data, and the target data is stored in the first storage address when the second device and the first storage address have the permission to receive the target data. In some embodiments, assume that the identifier of the second device is 00000001 and the identifier of the first storage address is FNQW3I, then the permission code is determined to be 00000001FNQW3I.

[0080] The first check code is used to verify whether the target data is tampered with in the data transmission process, and in some embodiments, the secret key of the second device can be subjected to hash processing, and the obtained hash value is determined as the first check code of the target data.

[0081] In some embodiments, the security level identifier of the target data can be determined according to the security level of the target data and the association between the security level and the security level identifier.

[0082] For example, assume that the association between the security level and the security level identifier is as shown in Table 2:

[0083] Table 2

[0084]

[0085] The security level of the target data is 3, and therefore the security level identifier of the target data is determined to be 0011.

[0086] In some embodiments, the encryption identifier of the target data can be determined according to the first processing manner of the target data. Specifically, in a case where the first processing manner indicates that the target data is not encrypted, the encryption identifier is determined to be 0000; in a case where the first processing manner indicates that the target data is encrypted, the encryption identifier of the target data is determined according to the encryption algorithm indicated by the first processing manner and the association relationship between the encryption algorithm and the encryption identifier.

[0087] For example, it is assumed that the association relationship between the encryption algorithm and the encryption identifier is shown in Table 3:

[0088] Table 3

[0089]

[0090] In a case where the encryption algorithm indicated by the first processing manner is SM4, the encryption identifier of the target data is determined to be 0010.

[0091] In some embodiments, the security tag can be generated according to the security level identifier of the target data, the encryption identifier of the target data, the permission code, and the first check code. For example, it is assumed that the security tag is a 64-bit tag field, wherein the security level identifier of the target data occupies 4 bits in the security tag, the encryption identifier of the target data occupies 4 bits in the security tag, the permission code occupies 24 bits in the security tag, the first check code occupies 32 bits in the security tag, and the arrangement order of the security level identifier of the target data in the security tag is 1, the arrangement order of the encryption identifier of the target data in the security tag is 2, the arrangement order of the permission code in the security tag is 3, and the arrangement order of the first check code in the security tag is 4. In summary, the 0th-3rd fields of the security tag are the security level identifier of the target data, the 4th-7th fields are the encryption identifier of the target data, the 8th-31st fields are the permission code, and the 32nd-63rd fields are the first check code.

[0092] In Figure 3In the illustrated embodiment, the security tag is generated according to the security level of the target data, the first processing mode, the permission code of the second device, and the first check code. In this way, whether the target can be received by the second device can be checked according to the security level of the target data and the permission code of the second device in the security tag, the probability of the target data being received by the second device with insufficient permissions is reduced, and the security of the target data in the data transmission process is improved. In addition, the integrity of the target data can also be checked according to the first check code, so that if the target data is tampered with during the data transmission process, the tampered abnormal data can be identified in time, thereby further improving the security of the data transmission. The second device and the first storage address can be checked according to the permission code, reducing the possibility of data transmission of the target data caused by tampering of the second device or the first storage address, and improving the security of the data transmission.

[0093] In some embodiments, the security level of the target data is different, and the way of processing the target data according to the security tag to generate the data packet can be different. Specifically, in the case where the security level of the target data is greater than or equal to a preset level, the target data is encrypted according to the security level of the target data to obtain encrypted data; the encrypted data is encapsulated according to the security tag to obtain the data packet, or in the case where the security level of the target data is less than the preset level, the target data is encapsulated according to the security tag to obtain the data packet.

[0094] The encrypted data is data obtained by encrypting the target data. The security level of the target data is greater than or equal to the preset level, indicating that the security level of the target data is high; the security level of the target data is less than the preset level, indicating that the security level of the target data is low.

[0095] In some embodiments, for data with a high security level, to further improve the security of the target data, the target data can be encrypted to obtain encrypted data. Then the encrypted data is encapsulated according to the security tag to obtain the data packet.

[0096] The encrypted data is obtained by encrypting the target data. The security level of the target data is greater than or equal to the preset level, indicating that the security level of the target data is high; the security level of the target data is less than the preset level, indicating that the security level of the target data is low.

[0097] In some embodiments, the target encryption mode is used to indicate an encryption algorithm for encrypting the target data. For example, the target encryption mode can be, for example, according to SM4 to encrypt the target data.

[0098] For example, the association between the security level and the encryption mode is shown in Table 4:

[0099] Table 4

[0100]

[0101] If the security level of the target data is 3, the target encryption mode is determined as encryption of the target data according to the SM4 algorithm.

[0102] The target data is encrypted according to the encryption algorithm indicated in the target encryption mode, to obtain encrypted data.

[0103] In some embodiments, the first device can encapsulate the encrypted data according to the transmission protocol to obtain an initial data packet, and the initial data packet includes a reserved protocol field. The first device inserts the security tag into the reserved protocol field of the data packet to obtain the data packet.

[0104] For target data with a lower security level, the target data can be directly encapsulated according to the security tag to obtain the data packet.

[0105] Specifically, the first device can encapsulate the target data according to the transmission protocol to obtain an initial data packet, and the initial data packet includes a reserved protocol field. The first device inserts the security tag into the reserved protocol field of the initial data packet to obtain the data packet.

[0106] As shown above, for target data with a higher security level, since the importance of the target data is higher, the target data can be encrypted to further improve the security of the target data in the data transmission process.

[0107] On the basis of the above embodiments, the following will be combined Figure 4 The processing process of the data packet received by the second device from the first device is described in detail.

[0108] Figure 4 A processing flow diagram of the data packet by the second device is provided in the embodiments of the present application. As Figure 4 shown, the process can include the following steps:

[0109] S401: receiving a data packet sent by a first device; the reserved protocol field of the data packet includes a security tag.

[0110] The security tag is generated by the first device according to a security level of the target data, an identifier of the second device, and an identifier of the first storage address, and is used to indicate the security level of the target data, access permission of the target data, and the like. The data packet is obtained by the first device processing the target data according to the security tag. It should be noted that the data packet is a complete transmission unit containing control information and data content, and the control information of the data packet includes a reserved protocol field, wherein the security tag is located in the reserved protocol field of the data packet.

[0111] S402: Processing the data packet according to the security tag to obtain the target data.

[0112] Since the data packet is obtained by the first device processing the target data, after receiving the data packet, the second device needs to process the data packet to obtain the target data.

[0113] In some embodiments, the manner of obtaining the target data can be as follows: performing decapsulation processing on the data packet to obtain decapsulated data; determining a first processing manner according to the security tag; the first processing manner is used to indicate whether the first device encrypts the target data; and obtaining the target data according to the first processing manner and the decapsulated data.

[0114] In some embodiments, the second device can perform decapsulation processing on the data packet based on a data transmission protocol to obtain decapsulated data. For example, assuming that the data transmission protocol is a CXL protocol, the second device performs decapsulation processing on the data packet based on the CXL protocol to obtain decapsulated data.

[0115] Since the security tag includes the encryption identifier of the target data, the encryption identifier of the target data can be used to determine whether the first device encrypts the target data. For example, assuming that the encryption identifier is 0000, it indicates that the first device does not encrypt the target data; and assuming that the encryption identifier is 0001, it indicates that the first device encrypts the target data.

[0116] According to the first processing manner and the decapsulated data, the manner of determining the target data can be as follows: determining a second processing manner of the decapsulated data according to the first processing manner; the second processing manner is used to indicate whether to decrypt the decapsulated data; in a case where the second processing manner indicates not to decrypt the decapsulated data, the decapsulated data is determined as the target data; and in a case where the second processing manner indicates to decrypt the decapsulated data, the decapsulated data is decrypted according to the second processing manner to obtain the target data.

[0117] In a case where the first processing manner indicates that the first device does not encrypt the target data, it is explained that the first device directly performs encapsulation processing on the target data to obtain the data packet. Therefore, when the decapsulated data is obtained, the decapsulated data does not need to be decrypted, and in this case, it is determined that the second processing manner is used to indicate that the decapsulated data is not decrypted.

[0118] In a case where the first processing manner indicates that the first device encrypts the target data, it is explained that the first device performs encapsulation processing on the encrypted data of the target data to obtain the data packet. Therefore, when the decapsulated data is obtained, the decapsulated data needs to be decrypted, and in this case, it is determined that the second processing manner is used to indicate that the decapsulated data is decrypted.

[0119] In some embodiments, in a case where the second processing manner indicates that the decapsulated data is not decrypted, the decapsulated data can be directly determined as the target data. In a case where the second processing manner indicates that the decapsulated data is decrypted, the decapsulated data needs to be decrypted to obtain the target data.

[0120] It should be noted that, in a case where the first processing manner is used to indicate that the first device encrypts the target data, a decryption algorithm corresponding to an encryption algorithm indicated by the first processing manner can also be determined. Therefore, the decryption algorithm for decrypting the decapsulated data can be determined according to the first processing manner, and then the decapsulated data is decrypted according to the decryption algorithm to obtain the target data.

[0121] S403: The target data is verified according to the security label to obtain a verification result of the target data.

[0122] In some embodiments, the second device can perform data security verification on the target data according to the security label. The verification result is that the verification is passed or the verification is not passed.

[0123] In some embodiments, the target data is verified to obtain the verification result of the target data in the following manner: the security level of the target data, the permission code of the second device, and the first verification code are obtained according to the security label; the first verification result is obtained by performing permission verification on the second device according to the security level of the target data and the permission code; the second verification result is obtained by verifying the state of the second device according to the permission code, the identifier of the second device, and the identifier of the first storage address; the third verification result is obtained by performing integrity verification on the target data according to the first verification code and the secret key of the second device; and the verification result of the target data is determined according to the first verification result, the second verification result, and the third verification result.

[0124] The security level of the data is used to indicate the importance of the data, and the permission code is used to verify whether the second device has the permission to receive the target data.

[0125] In some embodiments, the second device or the first storage address in the second device can only store data of a specific security level. Therefore, it is necessary to determine whether the second device and the first storage address in the second device have the permission to receive the target data according to the security level of the target data and the permission code.

[0126] Specifically, the security level of the data that the first storage address can store can be determined according to the permission code of the second device and the association between the permission code and the security level. In a case where the security level of the data that the first storage address can store is less than or equal to the security level of the target data, it is determined that the first storage address has the permission to store the target data. At this time, it can be determined that the first verification result is verified to be passed. In a case where the security level of the data that the first storage address can store is greater than the security level of the target data, it is determined that the first storage address does not have the permission to store the target data. At this time, it can be determined that the first verification result is verified to be failed.

[0127] In some embodiments, the identifier of the second device may, for example, be a serial number of the second device, and the first storage address is a storage address in the second device for storing the target data. The state of the second device is a normal state or an abnormal state. If the state of the second device is the normal state, it indicates that the second device and the first storage address are not replaced or tampered. If the state of the second device is the abnormal state, it indicates that the second device and / or the first storage address are replaced or tampered.

[0128] The second device can determine the first permission code according to the identifier of the second device and the identifier of the first storage address. In a case where the first permission code is the same as the permission code, it indicates that the state of the second device is the normal state. At this time, it is determined that the second verification result is verified to be passed. In a case where the first permission code is not the same as the permission code, it indicates that the state of the second device is the abnormal state. At this time, it is determined that the second verification result is verified to be failed.

[0129] In some embodiments, the third verification result can be determined in the following manner: performing a hash processing on the secret key of the second device to obtain a second verification code; in a case where the first verification code is the same as the second verification code, it is determined that the third verification result is verified to be passed; in a case where the first verification code is not the same as the second verification code, it is determined that the third verification result is verified to be failed.

[0130] The second device can hash the secret key of the second device, and determine the obtained hash value as the second check code. It should be noted that the second device hashes the secret key of the second device in the same manner as the first device hashes the secret key of the second device. For example, if the first device hashes the secret key of the second device by using the hash function 1, the second device also hashes the secret key of the second device by using the hash function 1.

[0131] If the first check code is the same as the second check code, it indicates that the target data is not tampered with in the data transmission process. At this time, it is determined that the third check result is passed. If the first check code is not the same as the second check code, it indicates that the target data is tampered with in the data transmission process. At this time, it is determined that the third check result is not passed.

[0132] In some embodiments, if at least one of the first check result, the second check result, and the third check result is not passed, it is determined that the check result is not passed. If the first check result, the second check result, and the third check result are all passed, it is determined that the check result is passed.

[0133] S404: In the case where the check result is passed, the target data is stored.

[0134] In the case where the check result is passed, it indicates that the target data is trusted and complete, that is, the target data is data from the second storage address of the first device and has not been tampered with or replaced in the data transmission process. In addition, it also indicates that the second device and the first storage address have access rights to the target data. At this time, the second device stores the target data in the first storage address.

[0135] In Figure 4 In the embodiment shown in the figure, the second device performs multiple security checks on the target data from different angles of the permissions of the second device and the first storage address, the state of the second device, and the integrity of the target data, and receives and stores the target data in the case where the check results of the multiple security checks are all passed. In the above manner, the multiple checks cover the possibilities of device permissions, device states, data integrity, and the like that affect data security, reduce the possibility that the target data is accessed by an unauthorized device, data leakage caused by tampering or replacement of the device, and tampering of the target data in the data transmission, and thus improve the security of data transmission.

[0136] In some embodiments, in the case where the check result is not passed, the second device determines the reason for the check not being passed, and sends prompt information to the first device. The prompt information is used to indicate the reason for the check not being passed.

[0137] In some embodiments, in the case that the check result is a check failure, the second device can determine a target check result from the first check result, the second check result and the third check result, which causes the check result to be a check failure, wherein the target check result is the check result that is a check failure from the first check result, the second check result and the third check result. Then, the second device determines the reason for the check failure according to the target check result, and sends prompt information to the first device to prompt the reason for the check failure.

[0138] For example, assuming that the check result is a check failure, the first check result is a check success, the second check result is a check success, and the third check result is a check failure, the target check result is determined to be the third check result from the first check result, the second check result and the third check result. At this time, the second device determines that the reason for the check failure is that the target data is tampered in the data transmission process according to the third check result. Then, the second device sends prompt information to the first device, and the prompt information is used to indicate that the reason for the check failure is that the target data is tampered in the data transmission process.

[0139] On the basis of the above-mentioned embodiments, the embodiments of the present application further provide a hardware acceleration architecture, which comprises a tag injection module, a policy cache module, a check circuit and an interrupt control module. The tag injection module and the policy cache module are deployed in the first device, and the check circuit and the interrupt control module are deployed in the second device. In some embodiments, the data transmission method can be implemented based on the hardware acceleration architecture. Next, the process of implementing the data transmission method based on the hardware acceleration architecture will be described in combination with Figure 5 The process of implementing the data transmission method based on the hardware acceleration architecture will be described.

[0140] Figure 5 A flowchart of the data transmission method implemented based on the hardware acceleration architecture provided by the embodiments of the present application is shown in FIG. 8. As shown in FIG. 8, the process can comprise the following steps: Figure 5

[0141] S501: The first device receives a data transmission request.

[0142] S502: The first device determines the security level of the target data and the first processing mode according to the security level of the storage area to which the second storage address belongs.

[0143] The specific description of how the first device determines the security level of the target data can be referred to S301 in the embodiment shown in FIG. 6, which will not be described here again. Figure 3 The specific description of how the first device determines the first processing mode can be referred to S302 in the embodiment shown in FIG. 6, which will not be described here again.

[0144] Figure 3

[0145] ​​​S503: The first device generates a permission code of the second device according to the identity of the second device and the identity of the first storage address.

[0146] The specific introduction of the first device generating the permission code can be referred to the S302 in the embodiment shown in Figure 3 The specific introduction of the first device generating the permission code can be referred to the S302 in the embodiment shown in

[0147] S504: The first device performs hash processing on the secret key of the second device to generate a first check code.

[0148] The specific introduction of the first device generating the first check code can be referred to the S302 in the embodiment shown in Figure 3 The specific introduction of the first device generating the first check code can be referred to the S302 in the embodiment shown in

[0149] S505: The first device generates a security tag according to the security level of the target data, the first processing mode, the permission code, and the first check code.

[0150] The specific introduction of the first device generating the security tag can be referred to the S302 in the embodiment shown in Figure 3 The specific introduction of the first device generating the security tag can be referred to the S302 in the embodiment shown in

[0151] It should be noted that the first device can store the security tag in the policy storage module after generating the security tag, and the policy storage module is also used to store the association relationship between the identity of the device and the secret key and other information.

[0152] It should be noted that the policy storage module is connected with the first device through an out-of-band channel, and the out-of-band channel is a special communication link independent of the main data transmission channel. Therefore, the independence of the out-of-band channel enables the first device to update the information in the policy storage module in real time, such as the security tag, the association relationship between the identity of the second device and the secret key, and the association relationship between the security level and the encryption mode.

[0153] S506: The tag injection module determines whether the security level of the target data is greater than or equal to a preset level.

[0154] If yes, S507 is executed;

[0155] If no, S509 is executed.

[0156] It should be noted that the tag injection module is deployed in the first device. After the first device determines the security tag of the target data, the tag injection module can determine whether the security level of the target data is greater than or equal to a preset level.

[0157] S507: The tag injection module calls the encryption engine to perform encryption processing on the target data to obtain encrypted data.

[0158] If the security level of the target data is greater than or equal to the preset level, it indicates that the security level of the target data is high. Therefore, the tag injection module calls the encryption engine to perform encryption processing on the target data, to obtain encrypted data. In this way, the security of the target data with a high security level in the data transmission process can be further protected.

[0159] S508: The tag injection module performs encapsulation processing on the encrypted data according to the security tag, to obtain a data packet.

[0160] The tag injection module can perform encapsulation processing on the encrypted data according to the transmission protocol, to obtain an initial data packet. The initial data packet includes a reserved protocol field. The tag injection module inserts the security tag into the reserved protocol field of the data packet, to obtain the data packet.

[0161] S509: The tag injection module performs encapsulation processing on the target data according to the security tag, to obtain a data packet.

[0162] If the security level of the target data is less than the preset level, it indicates that the security level of the target data is low. Therefore, the tag injection module can directly obtain the security tag from the policy cache unit, and perform encapsulation processing on the target data according to the security tag, to obtain a data packet. Specifically, the tag injection module can perform encapsulation processing on the target data according to the transmission protocol, to obtain an initial data packet. The initial data packet includes a reserved protocol field. The tag injection module inserts the security tag into the reserved protocol field of the initial data packet, to obtain the data packet.

[0163] S510: The first device sends the data packet to the second device.

[0164] S511: The verification circuit performs decapsulation processing on the data packet, to obtain decapsulated data.

[0165] For details of how the verification circuit obtains the decapsulated data, refer to S402 in the embodiment shown in Figure 4 The details are not described herein again.

[0166] It should be noted that, since the verification circuit is deployed in the second device, after the second device receives the data packet, the verification circuit in the second device can perform decapsulation processing on the data packet, to obtain decapsulated data.

[0167] S512: The verification circuit determines whether to perform decryption on the decapsulated data according to the security tag.

[0168] If yes, S513 is performed;

[0169] If no, S514 is performed.

[0170] S513: The verification circuit decrypts the decapsulated data based on the security tag to obtain the target data.

[0171] For a detailed explanation of how the verification circuit decrypts the decapsulated data based on the security tag, please refer to [link to relevant documentation]. Figure 4 The diagram shows S402 in the embodiment, which will not be described in detail here.

[0172] S514: The verification circuit determines the decapsulated data as the target data.

[0173] S515: The verification circuit performs permission verification on the second device based on the security level and permission code of the target data, and obtains the first verification result.

[0174] For a detailed explanation of how the verification circuit obtains the first verification result, please refer to [link / reference]. Figure 4 S403 in the illustrated embodiment will not be described in detail here.

[0175] S516: The verification circuit verifies the status of the second device based on the permission code of the second device, the identifier of the second device, and the identifier of the first storage address, and obtains the second verification result.

[0176] For a detailed explanation of how the verification circuit obtains the second verification result, please refer to [link / reference]. Figure 4 S403 in the illustrated embodiment will not be described in detail here.

[0177] S517: The verification circuit performs integrity verification on the target data based on the first verification code and the key of the second device, and obtains the third verification result.

[0178] For a detailed explanation of how the verification circuit obtains the third verification result, please refer to [link / reference]. Figure 4 S403 in the illustrated embodiment will not be described in detail here.

[0179] S518: The verification circuit determines the verification result based on the first verification result, the second verification result, and the third verification result.

[0180] For a detailed explanation of how the verification circuit determines the verification result, please refer to [link / reference needed]. Figure 4 S403 in the illustrated embodiment will not be described in detail here.

[0181] S519: The verification circuit determines whether the verification result is a successful verification.

[0182] If so, then execute S520;

[0183] If not, then execute S521.

[0184] S520: The second device stores the target data.

[0185] In a case where the check result is a check pass, it is indicated that the target data is reliable and complete, and the second device and the first storage address have access rights to the target data. Therefore, the second device stores the target data in the first storage address.

[0186] S521: The interrupt control module determines a reason for the check failure and sends prompt information to the first device.

[0187] In some embodiments, the interrupt control module can also generate an event log of the target data according to the reason for the check failure, and the event log is used to record information such as the target data, the identifier of the second device, and the reason for the check failure. Then the event log is sent to the first device. After receiving the event log sent by the interrupt control module, the first device can update the policy storage module according to the reason for the check failure in the event log.

[0188] For example, assuming that the reason for the check failure is that the target data is tampered with during transmission, the first device updates the association between the security level and the encryption mode of the data in the policy storage module after receiving the event log, thereby reducing the probability of tampering with the target data during the next data transmission process.

[0189] In Figure 5 In the embodiment shown, the hardware acceleration architecture provided by the embodiments of the present application performs encryption, decryption and other processes on the target data at the hardware level. Compared with the mode of performing encryption, decryption and other processes on the target data at the software level, the efficiency of performing encryption, decryption and other processes on the target data is improved, thereby reducing the time delay of processing the target data, and improving the matching degree of the time delay of processing the target data and the transmission rate of CXL hardware level high-speed transmission.

[0190] In some embodiments, for a second device that does not support the data transmission method provided by the present application, the second device can automatically ignore the field in which the security tag is placed in the data packet after receiving the data packet with the security tag, and then process the data packet, thereby improving the compatibility of the data transmission method. In some embodiments, for the same first device and second device, when the first device continuously sends multiple data packets to the second device, if there are some protocol fields that are the same in the multiple data packets, only the difference fields of the multiple data packets need to be transmitted. After receiving the multiple data packets, the second device can automatically complete the omitted same protocol fields through context connection. In this way, the accuracy of data transmission is ensured, and bandwidth resources can also be saved during data transmission.

[0191] Figure 6 A structural schematic diagram of a data transmission device provided by the embodiments of the present application is shown in FIG. 5. As shown in FIG. 5, the data transmission device includes a first device 501, a second device 502, and a third device 503. Figure 6As shown, the embodiments of the present application also provide a data transmission apparatus 60, which comprises a first receiving module 61, a determining module 62, a first generating module 63, a second generating module 64 and a first sending module 65, wherein:

[0192] The first receiving module 61 is used for receiving a data transmission request, the data transmission request is used for requesting to transmit target data from a first device to a second device, and the data transmission request comprises an identity of the second device and an identity of a first storage address, the first storage address being a storage address in the second device used for storing the target data.

[0193] The determining module 62 is used for determining a security level of the target data according to a second storage address of the target data in the first device.

[0194] The first generating module 63 is used for generating a security tag of the target data according to the security level of the target data, the identity of the second device and the identity of the first storage address.

[0195] The second generating module 64 is used for processing the target data according to the security tag to generate a data packet; wherein the security tag is comprised in a reserved protocol field of the data packet.

[0196] The first sending module 65 is used for sending the data packet to the second device.

[0197] In a possible implementation, the first generating module 63 is specifically used for:

[0198] determining a first processing mode of the target data according to the security level of the target data; the first processing mode is used for indicating whether the target data is encrypted.

[0199] determining a secret key of the second device according to an association relationship between the identity of the second device and the identity of the device and the secret key.

[0200] generating the security tag according to the security level of the target data, the first processing mode, the identity of the second device, the identity of the first storage address and the secret key of the second device.

[0201] In a possible implementation, the first generating module 63 is specifically used for:

[0202] generating a permission code of the second device according to the identity of the second device and the identity of the first storage address.

[0203] performing hash processing on the secret key of the second device to generate a first check code of the target data.

[0204] generating the security tag according to the security level of the target data, the first processing mode, the permission code and the first check code.

[0205] In one possible implementation, the second generation module 64 is specifically used for:

[0206] If the security level of the target data is greater than or equal to the preset level, the target data is encrypted according to the security level to obtain encrypted data; the encrypted data is then encapsulated according to the security label to obtain a data packet.

[0207] Alternatively, if the security level of the target data is lower than the preset level, the target data can be encapsulated based on the security label to obtain a data packet.

[0208] In one possible implementation, the second generation module 64 is specifically used for:

[0209] The target encryption method is determined based on the security level of the target data and the correlation between the security level and the encryption method.

[0210] The target data is encrypted according to the target encryption method to obtain encrypted data.

[0211] In one possible implementation, the determining module 62 is specifically used for:

[0212] Determine the storage region to which the second storage address belongs.

[0213] Determine the security level of the target data based on the security level of the storage area.

[0214] The specific implementation process of the data transmission device 60 can be found in the above method embodiment, which describes the implementation process of the data transmission method with the first device as the execution subject. The implementation principle and technical effect are similar, and will not be repeated in this embodiment.

[0215] Figure 7 This is a schematic diagram of another data transmission device provided in an embodiment of this application. Figure 7 As shown, embodiments of this application also provide a data transmission device 70, which includes a second receiving module 71, an acquiring module 72, a processing module 73, and a storage module 74, wherein:

[0216] The second receiving module 71 is used to receive data packets sent by the first device; the reserved protocol field of the data packet includes a security tag.

[0217] The acquisition module 72 is used to process data packets based on security tags to acquire target data.

[0218] The processing module 73 is used to verify the target data based on the security label and obtain the verification result of the target data.

[0219] The storage module 74 is configured to store the target data when the check result is a check pass.

[0220] In a possible implementation, the acquisition module 72 is specifically configured to:

[0221] The data packet is unpacked to obtain unpacked data.

[0222] According to the security label, a first processing mode is determined; the first processing mode is used to indicate whether the target data is encrypted by the first device.

[0223] According to the first processing mode and the unpacked data, the target data is determined.

[0224] In a possible implementation, the acquisition module 72 is specifically configured to:

[0225] According to the first processing mode, a second processing mode of the unpacked data is determined; the second processing mode is used to indicate whether the unpacked data is decrypted.

[0226] In a case where the second processing mode indicates that the unpacked data is not decrypted, the unpacked data is determined as the target data.

[0227] In a case where the second processing mode indicates that the unpacked data is decrypted, the unpacked data is decrypted according to the second processing mode to obtain the target data.

[0228] In a possible implementation, the processing module 73 is specifically configured to:

[0229] According to the security label, a security level, a permission code, and a first check code of the target data are acquired.

[0230] According to the security level and the permission code of the target data, a permission check is performed on the second device to obtain a first check result.

[0231] According to the permission code, an identifier of the second device, and an identifier of a first storage address, a state of the second device is checked to obtain a second check result; the first storage address is a storage address of the second device used to store the target data.

[0232] According to the first check code and a secret key of the second device, an integrity check is performed on the target data to obtain a third check result.

[0233] According to the first check result, the second check result, and the third check result, a check result of the target data is determined.

[0234] In a possible implementation, the processing module 73 is specifically configured to:

[0235] hash the secret key of the second device to obtain a second check code;

[0236] In a case where the first check code is identical to the second check code, it is determined that the third check result is a check pass.

[0237] In a case where the first check code is not identical to the second check code, it is determined that the third check result is a check fail.

[0238] In a possible implementation, the data transmission apparatus 70 further includes a second sending module, which is specifically configured to:

[0239] In a case where the check result is a check fail, a reason for the check fail is determined.

[0240] The first device is sent prompt information, and the prompt information is used to indicate the reason for the check fail.

[0241] The specific implementation process of the data transmission apparatus 70 can refer to the implementation process of the data transmission method with the second device as the execution subject in the method embodiments, which has similar implementation principles and technical effects, and will not be described here.

[0242] Figure 8 The structure of the electronic device provided in the present application is shown in the schematic diagram. As shown in the figure, the electronic device 80 provided in the present application includes at least one processor 801 and a memory 802. Optionally, the electronic device 80 further includes a communication component 803. The processor 801, the memory 802 and the communication component 803 are connected through a bus. Figure 8

[0243] In the specific implementation process, the at least one processor 801 executes the computer execution instructions stored in the memory 802, so that the at least one processor 801 executes the data transmission method embodiments described above.

[0244] The specific implementation process of the processor 801 can refer to the method embodiments described above, which has similar implementation principles and technical effects, and will not be described here.

[0245] ​In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the application can be directly embodied as hardware processor execution, or executed by a combination of hardware and software modules in the processor.

[0246] The memory can include a random access memory (RAM), and can also include a non-volatile memory (NVM), such as at least one disk memory.

[0247] The bus can be an industry standard architecture (ISA) bus, a peripheral component (PCI) bus, an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application does not limit to only one bus or one type of bus.

[0248] The embodiments of the present application also provide a computer readable storage medium, which stores a computer program, and the computer program is configured to execute the steps in any of the above data transmission method embodiments when running.

[0249] In an example embodiment, the above computer readable storage medium can include, but is not limited to, a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store computer programs.

[0250] The embodiments of the present application also provide a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the steps in any of the above data transmission method embodiments.

[0251] The embodiment of the present application further provides another computer program product, comprising a nonvolatile computer readable storage medium, the nonvolatile computer readable storage medium stores a computer program, the computer program is executed by a processor to implement the steps in any of the above data transmission method embodiments.

[0252] Those skilled in the art can further understand that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized in electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been described in the above description in general terms. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for a specific application, but such implementation should not be considered beyond the scope of the present application.

[0253] The above provides a data transmission method, an electronic device, a storage medium and a program product. The principles and implementation modes of the present application are described by applying specific examples. The above description of the examples is only applicable to help understand the method and its core idea. It should be pointed out that for those skilled in the art, without departing from the principles of the present application, some improvements and modifications can be made to the present application, and these improvements and modifications also fall within the protection scope of the claims of the present application.

Claims

1. A data transmission method, characterized in that, Applied to a first device, the data transmission method includes: A data transmission request is received, the data transmission request being used to request the transmission of target data from the first device to the second device, and the data transmission request includes the identifier of the second device and the identifier of a first storage address, the first storage address being the storage address in the second device used to store the target data; The security level of the target data is determined based on the second storage address of the target data in the first device; A security tag for the target data is generated based on the security level of the target data, the identifier of the second device, and the identifier of the first storage address. The target data is processed according to the security label to generate a data packet; wherein the reserved protocol field of the data packet includes the security label; The data packet is sent to the second device.

2. The method according to claim 1, characterized in that, The step of generating a security tag for the target data based on the security level of the target data, the identifier of the second device, and the identifier of the first storage address includes: Based on the security level of the target data, a first processing method for the target data is determined; the first processing method is used to indicate whether the target data should be encrypted. The key of the second device is determined based on the identifier of the second device and the association between the device identifier and the key; The security tag is generated based on the security level of the target data, the first processing method, the identifier of the second device, the identifier of the first storage address, and the key of the second device.

3. The method according to claim 2, characterized in that, The step of generating the security tag based on the security level of the target data, the first processing method, the identifier of the second device, the identifier of the first storage address, and the key of the second device includes: Generate the permission code for the second device based on the identifier of the second device and the identifier of the first storage address; The key of the second device is hashed to generate the first verification code of the target data; The security label is generated based on the security level of the target data, the first processing method, the permission code, and the first verification code.

4. The method according to any one of claims 1-3, characterized in that, The step of processing the target data according to the security tag to generate a data packet includes: If the security level of the target data is greater than or equal to a preset level, the target data is encrypted according to the security level to obtain encrypted data; the encrypted data is then encapsulated according to the security tag to obtain the data packet. or, If the security level of the target data is lower than the preset level, the target data is encapsulated according to the security tag to obtain the data packet.

5. The method according to claim 4, characterized in that, The step of encrypting the target data according to the security level of the target data to obtain encrypted data includes: Based on the security level of the target data and the correlation between the security level and the encryption method, the target encryption method is determined; The target data is encrypted according to the target encryption method to obtain the encrypted data.

6. The method according to any one of claims 1-3, characterized in that, Determining the security level of the target data based on its second storage address in the first device includes: Determine the storage region to which the second storage address belongs; The security level of the target data is determined based on the security level of the storage area.

7. A data transmission method, characterized in that, Applied to a second device, the data transmission method includes: Receive data packets sent by a first device; the reserved protocol field of the data packets includes a security tag; the security tag is generated in accordance with the manner described in claim 2 or 3; The data packet is processed according to the security label to obtain the target data; The target data is verified based on the security label to obtain the verification result of the target data. If the verification result is successful, the target data is stored.

8. The method according to claim 7, characterized in that, The step of processing the data packet according to the security label to obtain the target data includes: The data packet is decapsulated to obtain the decapsulated data; Based on the security tag, a first processing method is determined; the first processing method is used to indicate whether the first device encrypts the target data. The target data is determined based on the first processing method and the decapsulated data.

9. The method according to claim 8, characterized in that, Determining the target data based on the first processing method and the decapsulated data includes: Based on the first processing method, a second processing method for the decapsulated data is determined; the second processing method is used to indicate whether to decrypt the decapsulated data. If the second processing method indicates that the decapsulated data should not be decrypted, the decapsulated data will be identified as the target data. When the second processing method instructs that the decapsulated data be decrypted, the decapsulated data is decrypted according to the second processing method to obtain the target data.

10. The method according to any one of claims 7-9, characterized in that, The step of verifying the target data based on the security label to obtain the verification result of the target data includes: Based on the security label, obtain the security level of the target data, the permission code of the second device, and the first verification code; Based on the security level of the target data and the permission code, the second device is subjected to permission verification to obtain a first verification result; The status of the second device is verified based on the permission code, the identifier of the second device, and the identifier of the first storage address to obtain a second verification result; the first storage address is the storage address in the second device used to store the target data. Based on the first verification code and the key of the second device, the integrity of the target data is verified to obtain a third verification result; The verification result of the target data is determined based on the first verification result, the second verification result, and the third verification result.

11. The method according to claim 10, characterized in that, The step of performing integrity verification on the target data based on the first verification code and the key of the second device to obtain a third verification result includes: The key of the second device is hashed to obtain the second verification code; If the first verification code is the same as the second verification code, the third verification result is determined to be a successful verification. If the first verification code and the second verification code are different, the third verification result is determined to be a verification failure.

12. The method according to any one of claims 7-9, characterized in that, The method further includes: If the verification result is that the verification fails, determine the reason for the verification failure; Send a prompt message to the first device; the prompt message is used to indicate the reason for the verification failure.

13. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the data transmission method as described in any one of claims 1 to 6 when executing the computer program, or to implement the steps of the data transmission method as described in any one of claims 7 to 12.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, it implements the steps of the data transmission method as described in any one of claims 1 to 6, or implements the steps of the data transmission method as described in any one of claims 7 to 12.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the data transmission method as described in any one of claims 1 to 6, or implements the steps of the data transmission method as described in any one of claims 7 to 12.

Images