Data transmission method and system based on DPU

Abstract

The invention provides a data transmission method and system based on a DPU, and the method comprises the steps: an application layer generates original data, generates a label of the original data, and transmits the original data and the label to the DPU; the DPU determines a secondary mapping table corresponding to the industry type in the label from the primary mapping table; the DPU determines a target transmission strategy corresponding to the service type, the security level and the priority in the label from the determined secondary mapping table; the DPU determines an execution instruction corresponding to the target transmission strategy from the three-level mapping table; and the DPU encapsulates the original data based on the determined execution instruction, and transmits the encapsulated data by adopting the determined transmission tunnel. By setting the independent DPU, when the application layer outputs the original data, the label containing the industry type, the service type, the security level and the priority of the original data is output, the queue and the transmission tunnel which accord with the actual content of the original data are adapted to carry out data transmission, and the flexibility of data transmission is improved.

Description

Technical Field

[0001] This application relates to the field of data transmission technology, and in particular to a data transmission method based on a DPU, a data transmission system based on a DPU, a computer device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] In modern computing systems, efficient and secure data transmission is the cornerstone supporting various mission-critical applications. With the widespread adoption of cloud computing, big data, and the Internet of Things (IoT) technologies, data traffic in networks is not only surging in scale, but its inherent business semantics are also becoming increasingly complex, placing higher demands on data transmission efficiency, security isolation, and intelligent processing.

[0003] In traditional data transmission architectures, data follows a fixed path from generation to transmission. That is, after the application layer generates the payload data, it is handed over to the host operating system kernel for processing via system calls. The network protocol stack within the kernel (such as the Transmission Control Protocol (TCP) / Internet Protocol (IP) stack) is responsible for data encapsulation, addressing, and scheduling, ultimately sending the data packets into the physical network via the network interface card (NIC). During this process, network devices (such as switches and routers) make forwarding decisions based on network layer information such as the IP address and port number of the data packets.

[0004] However, traditional data transmission architectures have a fundamental flaw: the semantics of application-layer data cannot be directly transmitted to the network layer. This is due to the inherent characteristic of the core idea of ​​the TCP / IP model, "layered transmission." As data is transmitted downwards, the data in the application layer is encapsulated layer by layer, and the semantics of the application-layer data are ultimately hidden within the network load. This causes network devices to mechanically forward data based solely on fixed IP addresses and port numbers. This "ignorance" of the data's meaning prevents the network from dynamically selecting transmission channels for different types of data streams based on real-time business needs, ultimately leading to rigid transmission strategies and reduced data transmission flexibility. Summary of the Invention

[0005] The purpose of this application is to provide a DPU-based data transmission method, a DPU-based data transmission system, a computer device, a computer-readable storage medium, and a computer program product to improve the flexibility of data transmission.

[0006] To address the aforementioned technical problems, this application provides the following technical solutions: The first aspect of this application provides a data transmission method based on a Data Processing Unit (DPU). This method is applied to a data transmission system comprising an application layer and a Data Processing Unit (DPU). The DPU is independently configured relative to the kernel network stack corresponding to the application layer. The data transmission method includes: the application layer generating raw data, generating tags for the raw data, and sending the raw data and tags to the DPU. The tags include industry type, business category, security level, and priority. The DPU determines a second-level mapping table corresponding to the industry type in the tags from a first-level mapping table. The first-level mapping table includes multiple industry types and their corresponding second-level mapping tables. The DPU determines a target transmission strategy corresponding to the business category, security level, and priority in the tags from the determined second-level mapping table. The second-level mapping table includes multiple business categories, security levels, and priorities and their corresponding transmission strategies. The transmission strategy includes a transmission tunnel, encryption type, and priority queue. The DPU determines the execution instruction corresponding to the target transmission strategy from a third-level mapping table. The third-level mapping table includes multiple transmission strategies and their corresponding execution instructions. The DPU encapsulates the raw data based on the determined execution instructions and transmits the encapsulated data using a determined transmission tunnel.

[0007] Compared to existing technologies, the DPU-based data transmission method provided in the first aspect of this application, by setting up an independent DPU and enabling the application layer to output tags containing the industry type, business category, security level, and priority of the original data along with the original data, allows the independent DPU to directly encapsulate the original data at a level below the application layer based on the transmission strategy found in a multi-level mapping table using the tags. This encapsulates the data and adapts it to queues and transmission tunnels that match the actual content of the original data, thereby improving the flexibility of data transmission. Furthermore, by transferring some tasks during data transmission to the independent DPU, the workload of the CPU in the system can be reduced, improving the efficiency of the CPU in processing actual business operations.

[0008] In other embodiments provided in this application, generating labels for raw data includes: extracting first context information from the raw data and extracting second context information from the object that generated the raw data; searching for the industry type, business category, security level, and priority corresponding to the first and second context information in a preset rule, wherein the preset rule includes multiple context information and their corresponding industry type, business category, security level, and priority; and determining the found industry type, business category, security level, and priority as labels for the raw data.

[0009] By extracting contextual information from the original data itself and the external system that generated the original data, the richness and accuracy of the information in the generated tags can be improved, thereby enhancing the adaptability of data transmission.

[0010] In other embodiments provided in this application, the first context information includes an IP address, an application layer protocol, a protocol type identifier, and keywords, and the second context information includes user information and system time. Searching for the industry type, business category, security level, and priority corresponding to the first and second context information in preset rules includes: searching for the industry type corresponding to the IP address and application layer protocol in preset rules, wherein the preset rules include multiple IP addresses, application layer protocols, and their corresponding industry types; searching for the business category corresponding to the application layer protocol and protocol type identifier in preset rules, wherein the preset rules include multiple application layer protocols, protocol type identifiers, and their corresponding business categories; searching for the security level corresponding to the business category, user information, system time, and keywords in preset rules, wherein the preset rules include multiple business categories, user information, system time, keywords, and their corresponding security levels; and searching for the priority corresponding to the business category in preset rules, wherein the preset rules include multiple business categories and their corresponding priorities.

[0011] By using different contextual information to generate different content in tags, and the generation of one type of content in a tag depends on another type of content in the tag, the information content used in the tag generation process can be maximized, thereby improving the accuracy of tag generation.

[0012] In other embodiments provided in this application, before sending the raw data and tags to the DPU, the method further includes: describing the tags using a Type-Length-Value structure and inserting it between the Layer 2 Ethernet header and the Layer 3 IP header of the raw data to obtain target data; sending the raw data and tags to the DPU includes: sending the target data to the DPU.

[0013] During the process of sending raw data from the application layer to the DPU, the tag is written into the raw data, specifically between the Layer 2 Ethernet header and the Layer 3 IP header. This not only does not affect the subsequent parsing of the raw data, but also allows the tag to be obtained as soon as possible, thereby enabling earlier security processing of the raw data based on the tag and improving data processing efficiency.

[0014] In other embodiments provided in this application, before determining the secondary mapping table corresponding to the industry type in the tag from the primary mapping table, the method further includes: extracting the tag from the target data after the Ethernet header using a fixed offset positioning algorithm; storing the tag in the DPU cache according to the Tag Metadata Object structure, so as to process the raw data through the tag in the cache.

[0015] After parsing the Ethernet header from the data, the subsequent parsed content, obtained using a fixed offset positioning algorithm, is identified as the tag. This reduces the number of steps involved in data parsing and thus improves tag extraction efficiency.

[0016] In other embodiments provided in this application, the method further includes: the application layer generating raw data and sending the raw data to the DPU; the DPU obtaining the source IP address, application layer protocol, and protocol type identifier from the raw data; the DPU determining the industry type of the raw data based on the source IP address, determining the service category of the raw data based on the application layer protocol, determining the security level of the raw data based on the source IP address, application layer protocol, and protocol type identifier, and determining the priority of the raw data based on the application layer protocol, the determined service category, and the determined security level.

[0017] For cases where it is impossible to add tags to the raw data at the application layer, the DPU analyzes the raw data layer by layer to generate tags for the raw data. Then, based on the generated tags, the corresponding transmission strategy is executed for the raw data, realizing flexible data transmission with a wider range of applicability.

[0018] A second aspect of this application provides a data transmission system based on a Data Processing Unit (DPU). The data transmission system includes an application layer and a DPU, with the DPU being independently configured relative to the kernel network stack corresponding to the application layer. The application layer generates raw data, generates tags for the raw data, and sends the raw data and tags to the DPU. The tags include industry type, business category, security level, and priority. The DPU determines a secondary mapping table corresponding to the industry type in the tags from a primary mapping table, where the primary mapping table includes multiple industry types and their corresponding secondary mapping tables. The DPU also determines a target transmission policy corresponding to the business category, security level, and priority in the tags from the determined secondary mapping table, where the secondary mapping table includes multiple business categories, security levels, and priorities and their corresponding transmission policies. The transmission policy includes a transmission tunnel, encryption type, and priority queue. The DPU further determines the execution instruction corresponding to the target transmission policy from a tertiary mapping table, where the tertiary mapping table includes multiple transmission policies and their corresponding execution instructions. The DPU also encapsulates the raw data based on the determined execution instructions and transmits the encapsulated data using a determined transmission tunnel.

[0019] A third aspect of this application provides a computer device including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the method of the first aspect.

[0020] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method of the first aspect.

[0021] The fifth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the method of the first aspect.

[0022] The DPU-based data transmission system provided in the second aspect of this application, the computer device provided in the third aspect, the computer-readable storage medium provided in the fourth aspect, and the computer program product provided in the fifth aspect have the same or similar beneficial effects as the DPU-based data transmission method provided in the first aspect. Attached Figure Description

[0023] The above and other objects, features, and advantages of exemplary embodiments of this application will become readily understood by reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of this application are illustrated by way of example and not limitation, with the same or corresponding reference numerals denoteing the same or corresponding parts, wherein: Figure 1 This is a schematic diagram of the architecture of the DPU-based data transmission method in the embodiments of this application. Figure 2 This is a flowchart illustrating the DPU-based data transmission method in the embodiments of this application. Figure 1 ; Figure 3 This is a flowchart illustrating the DPU-based data transmission method in the embodiments of this application. Figure 2 ; Figure 4 This is a flowchart illustrating the DPU-based data transmission method in the embodiments of this application. Figure 3 ; Figure 5 This is a schematic diagram of the structure of the DPU-based data transmission system in the embodiments of this application; Figure 6 This is a schematic diagram of the structure of the computer device in the embodiments of this application. Detailed Implementation

[0024] Exemplary embodiments of this application will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of this application are shown in the drawings, it should be understood that this application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of this application and to fully convey the scope of this application to those skilled in the art.

[0025] It should be noted that, unless otherwise stated, the technical or scientific terms used in this application shall have the ordinary meaning as understood by one of ordinary skill in the art to which this application pertains.

[0026] Currently, data transmission follows fixed strategies. For example, data sent to a specific target is always transmitted via a standard channel. That is, regardless of whether the data is confidential or urgent, a pre-defined channel is used. This reduces the security or efficiency of transmission for confidential or urgent data. Furthermore, using high-speed encrypted channels for all data transmission would waste transmission resources for ordinary data.

[0027] In view of this, embodiments of this application provide a DPU-based data transmission method, a DPU-based data transmission system, a computer device, a computer-readable storage medium, and a computer program product. A separate DPU is set up relative to the application layer's kernel network stack, and the application layer adds tags to the raw data it sends. In this way, the independently set up DPU acquires the raw data, and by analyzing the tags on the raw data, it can determine the industry type, business category, security level, priority, etc., of the raw data. Then, based on a multi-level mapping table, a corresponding transmission strategy is determined, and the raw data is transmitted using this determined transmission strategy. This enables flexible data transmission.

[0028] It should be noted that all components, data, and related processing methods involved in this application are authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0029] First, the application scenarios of the DPU-based data transmission method provided in the embodiments of this application will be described.

[0030] Figure 1 This is a schematic diagram illustrating the architecture of the DPU-based data transmission method in an embodiment of this application. See [link / reference]. Figure 1 As shown, the architecture may include: host 11.

[0031] In host 11, there are application layer and kernel network stack.

[0032] Previously, raw data generated by the application layer needed to be sent to the kernel network stack for layer-by-layer encapsulation before being transmitted outwards through physical channels. The kernel network stack is a complete set of network protocol processing software implemented in the operating system kernel, located as a strictly rule-based processing center between the application and the network card hardware. Applications must pass through this "processing center" when they need to send or receive network data. The kernel network stack is responsible for packaging and encapsulating the raw data that the application wants to send, layer by layer, according to network protocols (such as TCP / IP), ultimately transforming it into a signal that can be transmitted over the network cable. The kernel network stack can include transport, network, and link layers, etc. The specific layers involved in the kernel network stack need to be determined based on the host's transmission mechanism.

[0033] At this point, a dedicated DPU is configured on host 11. The application layer adds tags about the data content to the generated data before transmitting it to the DPU. This allows the DPU to select appropriate transmission channels based on the tags and multi-layer mapping tables. Essentially, the DPU replaces part of the kernel network stack's work and also improves the CPU's normal business processing efficiency.

[0034] The application layer and the DPU together constitute the data transmission system of the data transmission method executed on the DPU in this embodiment of the application.

[0035] Next, the DPU-based data transmission method provided in the embodiments of this application will be described in detail.

[0036] Figure 2 This is a flowchart illustrating the DPU-based data transmission method in the embodiments of this application. Figure 1 See Figure 2 As shown, the method may include: S21: The application layer generates raw data, generates labels for the raw data, and sends the raw data and labels to the DPU.

[0037] The application in the host machine generates the raw data; that is, the application layer generates the raw data. Then, the engine deployed in the application layer generates the tags for the raw data.

[0038] The tags include industry type, business category, security level, and priority.

[0039] Industry type is used to specify the specific business area, industry, or organizational category to which the data is generated or belongs, such as: power and energy, healthcare, intelligent transportation, etc.

[0040] The business category is used to identify the specific business operation or application scenario served by the data packet, such as control commands, measurement data, alarm events, etc.

[0041] Security levels are used to quantify the sensitivity and confidentiality requirements of data assets, such as: ordinary, sensitive, confidential, top secret, etc.

[0042] Priority is a quantified or hierarchical label used to identify the relative urgency and resource usage rights that a data stream should enjoy during transmission, such as: urgent, high, normal, low, etc.

[0043] Tags for the raw data can be generated by identifying the content of the raw data. The specific method for generating the tags is not specified here.

[0044] After generating tags for the raw data, the tags can be written into the raw data, or the tags can be packaged as separate data with the raw data and then sent to the DPU. The specific combination of tags and raw data is not limited here.

[0045] S22: The DPU determines the secondary mapping table corresponding to the industry type in the label from the primary mapping table.

[0046] The primary mapping table includes multiple industry types and their corresponding secondary mapping tables.

[0047] Different industry types employ diverse transmission strategies under varying business categories, security levels, and priorities. Configuring all of these in a single table is inconvenient for searching and subsequent maintenance. Therefore, a mapping table is maintained for each industry type. The corresponding industry mapping table is then located first through the top-level category of industry type.

[0048] The first-level mapping table contains the correspondence between the names or storage locations of various industries and their corresponding second-level mapping tables.

[0049] For example: The first-level mapping table is: Match the industry type in the tag with the key in the first-level mapping table. The value corresponding to the matched key is the second-level mapping table needed for this task.

[0050] S23: The DPU determines the target transmission strategy corresponding to the service category, security level, and priority in the tag from the determined secondary mapping table.

[0051] The secondary mapping table includes multiple service categories, security levels, priorities, and their corresponding transmission policies. Transmission policies include transmission tunnels, encryption types, and priority queues.

[0052] In the secondary mapping table, different service categories have corresponding adapted transmission tunnels, different security levels have corresponding adapted encryption types, and different priorities have corresponding adapted priority queues. Specifically, different service categories, security levels, and priorities can be combined to configure corresponding transmission strategies. Alternatively, transmission strategies can be configured separately for different service categories, security levels, and priorities, and then combined after querying to obtain the final transmission strategy.

[0053] For example, the secondary mapping table for the power industry is as follows: The secondary mapping table for the healthcare industry is as follows: In the secondary mapping table, find the row that matches the business category, security level, and priority in the label. The transmission tunnel, encryption type, and priority queue in that row represent the transmission strategy for this operation.

[0054] S24: The DPU determines the execution instruction corresponding to the target transmission strategy from the three-level mapping table.

[0055] The three-level mapping table includes multiple transmission strategies and their corresponding execution instructions.

[0056] The transmission strategy determined from the secondary mapping table is merely a textual strategy, which the computer cannot understand or execute. Therefore, it is necessary to convert the determined transmission strategy into execution instructions that the computer can recognize. This requires the use of a tertiary mapping table that maps transmission strategies to execution instructions. This is also the key to the DPU's ability to separate strategy from execution and abstract configuration.

[0057] The third-level mapping table, serving as the connection between transmission strategies and execution instructions, can be a global table. That is, multiple second-level mapping tables can share a single third-level mapping table.

[0058] For example, a three-level mapping table can be: Based on the name, transmission tunnel, encryption type, priority queue, etc. of the transmission strategy, the execution instructions corresponding to the transmission strategy found in the three-level mapping table are the transmission strategies for the original data that the computer needs to execute this time.

[0059] S25: The DPU encapsulates the raw data based on the defined execution instructions and transmits the encapsulated data using a defined transport tunnel.

[0060] Once the DPU receives the execution instructions, it can perform a series of processing steps on the raw data. First, it parses metadata (such as security level, target tunnel ID, etc.) from the raw data for subsequent processing. Then, it performs transport layer encapsulation: creating TCP or UDP headers. Next, it performs network layer encapsulation and routing: creating IP headers and determining the next hop. Then, it performs tunnel encapsulation (such as VXLAN, IPsec) according to the instructions. Finally, it performs data link layer processing: encapsulating new Ethernet headers. Encryption is then performed, if required by the instructions, using line-rate encryption. Finally, it performs queue scheduling and transmission: sending processed data packets to designated physical ports according to priority.

[0061] The encapsulation, encryption, and queue sending processes all use conventional techniques, which will not be elaborated here.

[0062] As described above, the DPU-based data transmission method provided in this application, by setting up an independent DPU and enabling the application layer to output tags containing the industry type, business category, security level, and priority of the original data along with the original data, allows the independent DPU to directly encapsulate the original data at a level below the application layer based on the transmission strategy found in a multi-level mapping table using the tags. This encapsulates the data using queues and transmission tunnels that match the actual content of the original data, thereby improving the flexibility of data transmission. Furthermore, by transferring some tasks during data transmission to the independent DPU, the workload of the CPU in the system can be reduced, improving the efficiency of the CPU in processing actual business operations.

[0063] Furthermore, as Figure 2 In a refinement and extension of the method shown, this application also provides a data transmission method based on a DPU.

[0064] Figure 3 This is a flowchart illustrating the DPU-based data transmission method in the embodiments of this application. Figure 2 See Figure 3 As shown, the method may include: S31: The application layer generates raw data.

[0065] Step S31 here is implemented in the same way as step S21 in the previous embodiment. Please refer to the relevant description in the previous embodiment. It will not be repeated here.

[0066] S32: Labels for raw data generated by the application layer.

[0067] In addition to parsing all the content in the original data and analyzing and summarizing the information needed for the tags, it is also possible to obtain relevant information from the environment of the original data to obtain the information needed for the tags.

[0068] Specifically, step S32 above may include: S321: Extract first context information from the raw data, and extract second context information from the object that generated the raw data.

[0069] Specifically, the first context information can be extracted from the raw data itself, including IP address, application layer protocol, protocol type identifier, and keywords. The second context information can be extracted from the object (environment) that generated the raw data, including user information (which user / service initiated it) and system time. Here, the object (environment) can refer to the application that generated the raw data or the device system on which the application resides.

[0070] For example, a smart meter in the power grid uploads a data entry. The first context information extracted from the data may include: target IP address: 192.168.1.10 (this is the address of the regional substation controller), application layer protocol: IEC61850 (an international standard protocol specific to power systems), protocol type identifier: MMS (Manufacturing Message Specification, part of IEC 61850), and keywords: words such as "circuit breaker" and "opening" are parsed from the data load.

[0071] The second contextual information extracted from the production data environment may include: User information: User identity is "Protection Relay_Unit A" (an automated device user, not a real person), system time: 2023-10-27 14:05:30.

[0072] S322: Search for the industry type, business category, security level, and priority corresponding to the first and second context information in the preset rules.

[0073] The preset rules include various contextual information and their corresponding industry type, business category, security level, and priority.

[0074] Different types of context information, along with their corresponding industry types, business categories, security levels, and priorities, can be placed under a large preset rule. Smaller preset rules can include various industry types and their corresponding context information, various business categories and their corresponding context information, various security levels and their corresponding context information, and various priorities and their corresponding context information. The specific context information for industry types, business categories, security levels, and priorities can be configured based on actual circumstances and historical experience; no restrictions are imposed here.

[0075] For example, a preset rule for finding industry type can be: IF (target IP belongs to substation network segment) AND (application layer protocol == IEC 61850) THEN industry type = "power".

[0076] Preset rules for finding service categories may include: IF (Application Layer Protocol == IEC 61850) AND (Protocol Type Identifier == MMS) THEN Service Category = "Control Instruction".

[0077] Preset rules for determining security levels can include: IF (Business Category == "Control Command") THEN Security Level Base Value = "High", IF (Keywords include "Circuit Breaker" or "Trip") THEN Security Level Increased to "Highest", IF (System Time is during peak electricity consumption period 14:00-16:00) THEN Security Level Increased to "Highest", IF (User Information == "Protection Relay") THEN Security Level = "Highest".

[0078] Preset rules for finding priorities can include: IF (Business Category == "Control Instruction") THEN Priority = "Highest".

[0079] By using the corresponding context information for matching within each preset rule, it is possible to match the corresponding industry type, business category, security level, and priority.

[0080] In practical applications, in order to improve the accuracy and efficiency of searching for industry type, business category, security level and priority, the first context information includes IP address, application layer protocol, protocol type identifier and keywords, and the second context information includes user information and system time.

[0081] Step S322 above may include: S322a: Search for the industry type corresponding to the IP address and application layer protocol in the preset rules.

[0082] The preset rules include multiple IP addresses, application layer protocols, and their corresponding industry types. For example: Assume the system runs in a data center with the IP address 192.168.10.100. Now, at 10:05 AM (system time), a chief physician (Zhang San) retrieves (manipulates) a patient's "brain tumor MRI image" (data) through a medical imaging system (application). Using IP address = 192.168.10.100, application layer protocol = DICOM, and query rules, a match is found at (192.168.10.100, DICOM) -> Medical. Output / Label Field 1: Industry Type: Medical.

[0083] S322b: Search for the business category corresponding to the application layer protocol and protocol type identifier in the preset rules.

[0084] The preset rules include multiple application layer protocols, protocol type identifiers, and their corresponding business categories. For example: Continuing with the example above, using the application layer protocol = DICOM, protocol type identifier = C-GET (which is a command in the DICOM protocol used to retrieve images), and querying the rules, we find (DICOM, C-GET) -> image retrieval, and output / tag field 2: business category: image retrieval.

[0085] S322c: Search for the security level corresponding to the business category, user information, system time, and keywords in the preset rules.

[0086] The preset rules include multiple business categories, user information, system time, keywords, and their corresponding security levels. For example: Continuing with the example above, using the business category = image retrieval (derived from the previous step), user information = chief physician, system time = 10:05 (belonging to "working hours"), and keyword = "brain tumor" (extracted from the retrieved image file name or metadata), the query rule first matches the rule (image retrieval, chief physician, any time, ...). Then, checking the keywords reveals the inclusion of "tumor," meaning this keyword list matches the "tumor" rule. Output / Label Field 3: Security Level: Confidential.

[0087] S322d: Find the priority corresponding to the business category in the preset rules.

[0088] The preset rules include multiple business categories and their corresponding priorities. For example: Continuing with the example above, by using the business category = image retrieval, the query rule matches (image retrieval) -> high, and the output / tag field 4: priority: high.

[0089] S323: Determine the industry type, business category, security level, and priority found as labels for the raw data.

[0090] Continuing with the example above, we finally arrive at the tag {Medical, Image Retrieval, Confidential, High}.

[0091] Specifically, tags can be generated in any format based on industry type, business category, security level, and priority. For example, information such as industry type, security level, business category, and priority can be encapsulated into TLV (Type-Length-Value) format tags. The TLV structure allows for easy addition, modification, or deletion of tag fields without changing the overall parsing logic or protocol structure. When new business requirements arise, only a new Type needs to be defined, providing excellent flexibility and scalability.

[0092] S33: The application layer describes the tag using a Type-Length-Value structure and inserts it between the Layer 2 Ethernet header and the Layer 3 IP header of the original data to obtain the target data.

[0093] First, the application allocates one or more message buffers (struct rte_mbuf) from the memory pool using the rte_pktmbuf_alloc() function of the DataPlane Development Kit (DPDK). This buffer will be used to store the entire "data" to be sent.

[0094] Next, a standard Ethernet header is constructed. The Layer 2 Ethernet header is written at the beginning of the `rte_mbuf` buffer. Specifically, the destination MAC address is the MAC address of the next-hop device (i.e., the DPU). The source MAC address is the MAC address of the local network interface card (NIC). The Ethernet type is typically set to 0x0800, indicating that it is followed by an IPv4 packet.

[0095] Next, insert a custom TLV tag. Immediately following the Ethernet header, write the custom tag data. Type: A unique identifier used to define the semantics of this tag. For example, 0x01 represents "Security Data Tag". Length: The total length (in bytes) of the following Value field. Value: The specific content of the tag, i.e., a structured encoding of information such as industry type, business category, security level, and priority.

[0096] Inserting tags here allows the DPU to obtain semantic information about the data at the earliest possible moment, without parsing the entire IP header, TCP header, or even delving into the application layer load. This is crucial for achieving sub-microsecond-level policy decisions and traffic classification. Because the tags are located between L2 and L3, independent of the upper network and transport layer protocols, this tagging mechanism works correctly regardless of whether the upper layer is running IPv4 or IPv6, TCP or UDP, or even any other L3 / L4 protocol, making it highly versatile. This location is an unused "blank area" in the standard protocol stack. Unlike VLAN tags, it won't be modified or stripped by some switches, nor will it be processed by some routers like IPoptments, leading to performance degradation or being discarded. It is securely preserved in the trusted channel between the local host and the DPU. The DPU's hardware parser can be easily programmed to recognize this fixed-offset metadata. Like recognizing VLAN tags, it can quickly extract tag content through hardware logic and use it as a key basis for flow classification, thereby directing different traffic to different hardware processing pipelines (such as different encryption / decryption engines, different queues).

[0097] Finally, construct the standard IP header and other headers. Following the TLV tag, continue constructing the Layer 3 IP header. Set standard fields such as source IP, destination IP, protocol type (e.g., TCP / UDP), and TTL. Afterward, construct the transport layer header (e.g., TCP / UDP header) and the actual application layer raw data to obtain the target data.

[0098] S34: The application layer sends the target data to the DPU.

[0099] The constructed complete rte_mbuf (structure: [Ethernet header][TLV tag][IP header][TCP / UDP header][raw data]) is placed into the DPDK's send queue. DPDK sends this packet directly from the network card to the DPU via a polling mode driver, achieving zero copying in user space and improving data transmission efficiency.

[0100] S35: The DPU uses a fixed offset positioning algorithm to extract tags from the target data after the Ethernet header; the tags are stored in the DPU's cache according to the Tag Metadata Object structure so that the raw data can be processed through the tags in the cache.

[0101] The DPU's parsing engine first identifies the start of the data frame and then parses the standard Ethernet header (usually 14 bytes, containing the destination / source MAC address and EtherType).

[0102] Because the tag is fixed after the Layer 2 header and before the Layer 3 IP header, its starting position is deterministic for the DPU's parsing logic. Tag starting position = Ethernet header starting position + Ethernet header length (14 bytes). The parsing engine jumps directly to the tag's starting position based on the calculated offset. Since the tag is a TLV structure, the engine will: read the Type field (e.g., 1-2 bytes) to determine the tag type; read the Length field (e.g., 1-2 bytes) to determine the length of the Value portion; and extract the corresponding length of Value data based on the Length field value. In this way, the tag is extracted from the target data.

[0103] The created Tag Metadata Object is written to the DPU's cache. This cache is typically tightly coupled with subsequent processing pipelines (such as policy matching engines and encryption / decryption engines). This metadata object is associated with its original data packet (or data stream) through an identifier (such as a queue pointer or stream ID), thereby achieving efficient connection between tag extraction and subsequent policy determination and improving data transmission efficiency.

[0104] S36: The DPU determines the secondary mapping table corresponding to the industry type in the label from the primary mapping table.

[0105] S37: The DPU determines the target transmission strategy corresponding to the service category, security level, and priority in the tag from the determined secondary mapping table.

[0106] S38: The DPU determines the execution instruction corresponding to the target transmission strategy from the three-level mapping table.

[0107] S39: The DPU encapsulates the raw data based on the defined execution instructions and transmits the encapsulated data using a defined transport tunnel.

[0108] Steps S36-S39 here are implemented in the same way as steps S22-S25 in the aforementioned embodiments, and can be found in the relevant descriptions in the aforementioned embodiments, which will not be repeated here.

[0109] The above describes the implementation method for personalized data transmission based on tags when the application layer in the host can generate data tags. However, if the application layer cannot be improved, i.e., it cannot generate data tags, personalized data transmission can still be performed as long as the DPU can obtain the data sent by the application layer (by intercepting and redirecting traffic originally destined for the kernel protocol stack and physical network card to the DPU through the operating system and underlying drivers).

[0110] Figure 4 This is a flowchart illustrating the DPU-based data transmission method in the embodiments of this application. Figure 3 See Figure 4As shown, the method may include: S41: The application layer generates raw data and sends it to the DPU.

[0111] Step S41 here is the same as the method of generating and sending the original data in step S21 of the aforementioned embodiment. Please refer to the relevant description in the aforementioned embodiment, which will not be repeated here.

[0112] S42: The DPU obtains the source IP address, application layer protocol, and protocol type identifier from the raw data.

[0113] S43: The DPU determines the industry type of the raw data based on the source IP address, the service category of the raw data based on the application layer protocol, the security level of the raw data based on the source IP address, the application layer protocol, and the protocol type identifier, and the priority of the raw data based on the application layer protocol, the determined service category, and the determined security level.

[0114] Here, the DPU obtains the source IP address, application layer protocol, and protocol type identifier from the raw data, and determines the industry type, business category, security level, and priority based on the obtained information. This is the same as the method of obtaining the IP address, application layer protocol, and protocol type identifier in step S321 of the aforementioned embodiments, and determining the industry type, business category, security level, and priority in steps S322a-S322d. Please refer to the relevant descriptions in the aforementioned embodiments, which will not be repeated here.

[0115] S44: The DPU determines the secondary mapping table corresponding to the industry type in the label from the primary mapping table.

[0116] S45: The DPU determines the target transmission strategy corresponding to the service category, security level, and priority in the tag from the determined secondary mapping table.

[0117] S46: The DPU determines the execution instruction corresponding to the target transmission strategy from the three-level mapping table.

[0118] S47: The DPU encapsulates the raw data based on deterministic execution instructions and transmits the encapsulated data using a deterministic transport tunnel.

[0119] Steps S44-S47 here are implemented in the same way as steps S22-S25 in the previous embodiments, and can be found in the relevant descriptions in the previous embodiments, which will not be repeated here.

[0120] Furthermore, for management and control, a set of "standard vocabularies" that all systems recognize is defined and maintained. For example, what exactly does "confidential" mean, and what is the code for "electricity industry"? This ensures that all DPUs and applications have a consistent understanding of tags. "Tag -> Action" rules (e.g., Electricity + Control Command -> Use IPsec Tunnel A) are compiled and distributed to every DPU in the network. Administrators configure this once, and the policy is synchronized to all nodes.

[0121] Monitor the CPU load, memory, temperature and other health indicators of each DPU to ensure normal operation and issue alarms for abnormalities.

[0122] Continuously monitor the connectivity, latency, and bandwidth of each "private channel" (tunnel, physical link). It can immediately detect channel problems. If the primary channel is abnormal, it can automatically switch to a backup channel.

[0123] When the DPU identifies an unresolved, invalid, or security policy-violating tag, it immediately alerts the control plane. (This could be an attack or a configuration error.) Record all policy changes, channel allocations, and abnormal events to meet industry compliance requirements and facilitate post-event traceability.

[0124] This concludes the description of the DPU-based data transmission method provided in the embodiments of this application.

[0125] Based on the same inventive concept, embodiments of this application also provide a data transmission system based on a DPU.

[0126] Figure 5 This is a schematic diagram of the structure of the DPU-based data transmission system in an embodiment of this application. See also... Figure 5 As shown, the data transmission system includes an application layer 51 and a DPU 52. The DPU 52 is configured independently of the kernel network stack corresponding to the application layer 51.

[0127] Application layer 51 is used to generate raw data, generate tags for the raw data, and send the raw data and tags to DPU. The tags include industry type, business category, security level, and priority.

[0128] DPU 52 is used to determine the secondary mapping table corresponding to the industry type in the label from the primary mapping table. The primary mapping table includes multiple industry types and their corresponding secondary mapping tables.

[0129] DPU 52 is also used to determine the target transmission policy corresponding to the service category, security level and priority in the tag from the determined secondary mapping table. The secondary mapping table includes multiple service categories, security levels and priorities and their corresponding transmission policies. The transmission policies include transmission tunnels, encryption types and priority queues.

[0130] DPU 52 is also used to determine the execution instructions corresponding to the target transmission strategy from a three-level mapping table, which includes multiple transmission strategies and their corresponding execution instructions.

[0131] The DPU 52 is also used to encapsulate raw data based on deterministic execution instructions and transmit the encapsulated data using deterministic transport tunnels.

[0132] Furthermore, as Figure 5 In addition to refining and expanding the system shown, this application also provides a data transmission system based on a DPU.

[0133] Application layer 51 is used to generate raw data, generate tags for the raw data, and send the raw data and tags to DPU. The tags include industry type, business category, security level, and priority.

[0134] Application layer 51 is specifically used to extract first context information from the original data and second context information from the object that generated the original data; to search for the industry type, business category, security level and priority corresponding to the first context information and the second context information in preset rules, wherein the preset rules include multiple context information and their corresponding industry type, business category, security level and priority; and to determine the found industry type, business category, security level and priority as the label of the original data.

[0135] When the first context information includes IP address, application layer protocol, protocol type identifier, and keywords, and the second context information includes user information and system time, application layer 51 is specifically used to: search for the industry type corresponding to the IP address and application layer protocol in preset rules, wherein the preset rules include multiple IP addresses, application layer protocols, and their corresponding industry types; search for the business category corresponding to the application layer protocol and protocol type identifier in preset rules, wherein the preset rules include multiple application layer protocols, protocol type identifiers, and their corresponding business categories; search for the security level corresponding to the business category, user information, system time, and keywords in preset rules, wherein the preset rules include multiple business categories, user information, system time, keywords, and their corresponding security levels; and search for the priority corresponding to the business category in preset rules, wherein the preset rules include multiple business categories and their corresponding priorities.

[0136] Application layer 51 is also used to describe the tag using a Type-Length-Value structure and insert it between the Layer 2 Ethernet header and the Layer 3 IP header of the original data to obtain the target data; and send the target data to the DPU.

[0137] DPU 52 is used to extract tags from the Ethernet header of the target data using a fixed offset positioning algorithm; the tags are stored in the DPU's cache according to the Tag Metadata Object structure so that the raw data can be processed using the tags in the cache.

[0138] DPU 52 is used to determine the secondary mapping table corresponding to the industry type in the label from the primary mapping table. The primary mapping table includes multiple industry types and their corresponding secondary mapping tables.

[0139] DPU 52 is also used to determine the target transmission policy corresponding to the service category, security level and priority in the tag from the determined secondary mapping table. The secondary mapping table includes multiple service categories, security levels and priorities and their corresponding transmission policies. The transmission policies include transmission tunnels, encryption types and priority queues.

[0140] DPU 52 is also used to determine the execution instructions corresponding to the target transmission strategy from a three-level mapping table, which includes multiple transmission strategies and their corresponding execution instructions.

[0141] The DPU 52 is also used to encapsulate raw data based on deterministic execution instructions and transmit the encapsulated data using deterministic transport tunnels.

[0142] In addition, the application layer 51 is also used to generate raw data and send the raw data to the DPU.

[0143] DPU 52 is also used to extract source IP address, application layer protocol, and protocol type identifier from raw data.

[0144] DPU 52 is also used to determine the industry type of the raw data based on the source IP address, the business category of the raw data based on the application layer protocol, the security level of the raw data based on the source IP address, the application layer protocol and the protocol type identifier, and the priority of the raw data based on the application layer protocol, the determined business category and the determined security level.

[0145] It should be noted that the description of the system embodiments above is similar to the description of the method embodiments above, and has similar beneficial effects. For technical details not disclosed in the system embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0146] Based on the same inventive concept, this application also provides a computer device.

[0147] Figure 6 This is a schematic diagram of the structure of the computer device in an embodiment of this application. See also... Figure 6 As shown, the computer device may include: a memory 61, a processor 62, and a computer program stored on the memory 61, wherein the processor 62 executes the computer program to implement the methods described in the foregoing embodiments.

[0148] It should be noted that the description of the above computer device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects. For technical details not disclosed in the computer device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0149] Based on the same inventive concept, embodiments of this application also provide a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the methods described in the foregoing embodiments.

[0150] It should be noted that the description of the above computer-readable storage medium embodiments is similar to the description of the above method embodiments, and has similar beneficial effects. For technical details not disclosed in the computer-readable storage medium embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0151] Based on the same inventive concept, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the methods described in the foregoing embodiments.

[0152] It should be noted that the descriptions of the above computer program product embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the computer program product embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0153] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data transmission method based on a DPU, characterized in that, The data transmission method is applied to a data transmission system, which includes an application layer and a data processing unit (DPU). The DPU is independently configured relative to the kernel network stack corresponding to the application layer. The data transmission method includes: The application layer generates raw data, generates tags for the raw data, and sends the raw data and the tags to the DPU. The tags include industry type, business category, security level, and priority. The DPU determines the secondary mapping table corresponding to the industry type in the label from the primary mapping table, wherein the primary mapping table includes multiple industry types and their corresponding secondary mapping tables; The DPU determines the target transmission strategy corresponding to the service category, security level and priority in the tag from the determined secondary mapping table. The secondary mapping table includes multiple service categories, security levels and priorities and their corresponding transmission strategies. The transmission strategy includes transmission tunnel, encryption type and priority queue. The DPU determines the execution instruction corresponding to the target transmission strategy from a three-level mapping table, wherein the three-level mapping table includes multiple transmission strategies and their corresponding execution instructions; The DPU encapsulates the original data based on determined execution instructions and transmits the encapsulated data using a determined transmission tunnel.

2. The method according to claim 1, characterized in that, The tags used to generate the original data include: Extract first context information from the original data, and extract second context information from the object that generated the original data; The industry type, business category, security level, and priority corresponding to the first context information and the second context information are searched in the preset rules. The preset rules include multiple context information and their corresponding industry type, business category, security level, and priority. The industry type, business category, security level, and priority found are used as tags for the original data.

3. The method according to claim 2, characterized in that, The first context information includes IP address, application layer protocol, protocol type identifier and keywords; the second context information includes user information and system time. The step of searching for the industry type, business category, security level, and priority corresponding to the first context information and the second context information in the preset rules includes: The preset rules are used to find the industry type corresponding to the IP address and the application layer protocol. The preset rules include multiple IP addresses, application layer protocols and their corresponding industry types. The application layer protocol and the corresponding service category are searched in the preset rules, wherein the preset rules include multiple application layer protocols, protocol type identifiers and their corresponding service categories; The system searches for the security level corresponding to the business category, user information, system time, and keyword in the preset rules. The preset rules include multiple business categories, user information, system time, keywords, and their corresponding security levels. The priority corresponding to the business category is found in the preset rules, wherein the preset rules include multiple business categories and their corresponding priorities.

4. The method according to any one of claims 1 to 3, characterized in that, Before sending the raw data and the tag to the DPU, the method further includes: The tag is described using a Type-Length-Value structure and inserted between the Layer 2 Ethernet header and the Layer 3 IP header of the original data to obtain the target data; Sending the raw data and the tag to the DPU includes: The target data is sent to the DPU.

5. The method according to claim 4, characterized in that, Before determining the secondary mapping table corresponding to the industry type in the label from the primary mapping table, the method further includes: The tag is extracted from the target data after the Ethernet header using a fixed offset positioning algorithm; The tags are stored in the DPU's cache according to the Tag Metadata Object structure, so that the raw data can be processed through the tags in the cache.

6. The method according to any one of claims 1 to 3, characterized in that, The method further includes: The application layer generates raw data and sends the raw data to the DPU; The DPU obtains the source IP address, application layer protocol, and protocol type identifier from the raw data; The DPU determines the industry type of the raw data based on the source IP address, the service category of the raw data based on the application layer protocol, the security level of the raw data based on the source IP address, the application layer protocol, and the protocol type identifier, and determines the priority of the raw data based on the application layer protocol, the determined service category, and the determined security level.

7. A data transmission system based on a DPU, characterized in that, The data transmission system includes an application layer and a data processing unit (DPU), and the DPU is set independently relative to the kernel network stack corresponding to the application layer. The application layer is used to generate raw data, generate tags for the raw data, and send the raw data and the tags to the DPU, wherein the tags include industry type, business category, security level, and priority; The DPU is used to determine the secondary mapping table corresponding to the industry type in the tag from the primary mapping table, wherein the primary mapping table includes multiple industry types and their corresponding secondary mapping tables; The DPU is also used to determine the target transmission strategy corresponding to the service category, security level and priority in the tag from the determined secondary mapping table. The secondary mapping table includes multiple service categories, security levels and priorities and their corresponding transmission strategies. The transmission strategy includes transmission tunnel, encryption type and priority queue. The DPU is also used to determine the execution instruction corresponding to the target transmission strategy from a three-level mapping table, wherein the three-level mapping table includes multiple transmission strategies and their corresponding execution instructions; The DPU is also used to encapsulate the original data based on determined execution instructions, and to transmit the encapsulated data using a determined transmission tunnel.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images