Data transmission method and device, electronic equipment, storage medium and program product

Abstract

The embodiment of the invention provides a data transmission method and device, electronic equipment, a storage medium and a program product. According to the specific technical scheme, the method comprises the steps of obtaining transmission data; identifying data source information of the transmission data; identifying data flow direction information under the condition that the data source information is utilized to verify the transmission data successfully; under the condition that the data flow direction information is utilized to verify the transmission data, respectively identifying data type information and request permission information; and sending the transmission data to the terminal under the condition that the verification of the transmission data by using the identification data type information and the request permission information is passed. Therefore, the security of data transmission can be improved.

Description

Technical Field

[0001] This invention belongs to the field of data transmission technology, and particularly relates to a data transmission method, apparatus, electronic device, storage medium, and program product. Background Technology

[0002] With the rapid development of internet technology, information transmission and presentation have broken through traditional time and space limitations, exhibiting high timeliness and diversity. In daily office work and information interaction scenarios, user terminals can obtain large amounts of data in real time from multiple information streams, but they also face problems such as information overload and omission of key content. Especially in scenarios such as remote work and remote system login, when users need to access the enterprise intranet platform through public networks or uncontrolled terminals, there may be security weaknesses in the data transmission and authentication process, leading to the possibility of information leakage and resulting in low information security. Summary of the Invention

[0003] This invention provides a method, apparatus, electronic device, storage medium, and program product for data transmission, which can improve the security of data transmission.

[0004] In a first aspect, embodiments of the present invention provide a method for data transmission, comprising: Acquire transmitted data; Identify the data source information of the transmitted data; If the transmitted data passes verification using the data source information, the data flow direction information is identified. If the transmitted data passes the verification using the data flow information, the data type information and the request permission information are identified respectively. If the transmitted data passes the verification using the identified data type information and the requested permission information, the transmitted data is sent to the terminal.

[0005] In one possible implementation, after identifying the data source information of the transmitted data, the method further includes: Search the data source information in the preset trusted source database; If the data source information is found in the preset trusted source database, the verification of the transmitted data is deemed successful.

[0006] One possible implementation also includes: If the data source information is not found in the preset trusted source database, the transmitted data is intercepted.

[0007] In one possible implementation, the method further includes: If the data flow information is not identified, or if either the data type information or the request permission information is not identified, the transmitted data shall be marked as regulatory data. Identify the permission information in the regulatory data; If the regulatory data contains secondary access information, the regulatory data is sent to the terminal. If the regulatory data does not contain secondary access information, the regulatory data will be deleted.

[0008] One possible implementation also includes: Obtain the address existence duration and preset standard duration of the source address of the transmitted data; The rate of change of the data volume of the source address is calculated based on the duration of the address's existence and the preset standard duration. The security index of the source address is calculated based on the duration of the address's existence and the rate of change of the data volume. If the security index is less than or equal to a preset security threshold, the transmission data is sent to the terminal.

[0009] In one possible implementation, before sending the transmitted data to the terminal if the security index is less than or equal to a preset security threshold, the method further includes: In the absence of identifying the data source information of the transmitted data, obtain the traffic information, permission request identification ratio, virtual machine running status score, and flow identification ratio of the transmitted data; The request permission identification ratio is the ratio of the number of target permissions to the number of request permissions for the transmitted data, where the number of target permissions is the number of permissions in the preset security permission database that are the same as the request permissions for the transmitted data; the virtual machine operation status score is determined based on the correspondence between the virtual machine's processing actions and preset scores; and the flow identification ratio is the ratio of the number of terminals connecting to servers to the number of servers requesting the transmitted data. The preset security threshold is obtained by weighted summing of the traffic information, permission request recognition ratio, virtual machine running status score, and flow direction recognition ratio of the transmitted data; In one possible implementation, calculating the data volume change rate of the source address based on the address's existence duration and the preset standard duration includes: If the duration of the address is greater than or equal to the preset standard duration, calculate the first average data volume of the source address within the preset time period; Calculate the second average data volume of the source address within the preset standard time period; The rate of change of the data volume is calculated based on the first average data volume and the second average data volume.

[0010] In one possible implementation, the step of calculating the data volume change rate of the source address based on the address existence duration and the preset standard duration further includes: If the duration of the address is less than the preset standard duration, the initial data volume of the source address is obtained, where the initial data volume is the data volume of the source address in the first complete measurement cycle; Obtain the latest data volume within the latest measurement period; The rate of change of the data volume is calculated based on the initial data volume and the latest data volume.

[0011] In one possible implementation, calculating the security index of the source address based on the address's duration of existence and the data volume change rate includes: Obtain the duration of the transmitted data and the number of data accesses to the source address; The information duration score is obtained by multiplying the transmission duration and the time compensation value. The access score is obtained by multiplying the data access volume and the access volume compensation value. Calculate the product of the rate of change of the data volume and the rate of change compensation value to obtain the rate of change score; The security index is obtained by weighting and summing the information duration score, the access volume score, and the change rate score.

[0012] Secondly, embodiments of this application provide a data transmission apparatus, comprising: The acquisition module is used to acquire transmitted data; The identification module is used to identify the data source information of the transmitted data; The identification module is further configured to identify the data flow direction information when the transmitted data passes the verification using the data source information; The identification module is also used to identify data type information and request permission information respectively when the data flow information is used to verify the transmitted data. The sending module is used to send the transmission data to the terminal if the transmission data passes the verification using the identified data type information and the request permission information.

[0013] Thirdly, embodiments of the present invention provide a data transmission device, the device comprising: a processor, and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement the data transmission method as described in the first aspect.

[0014] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the data transmission method as described in the first aspect.

[0015] Fifthly, embodiments of the present invention provide a computer program product, including a computer program, wherein when the computer program is processed to execute, it implements the data transmission method as described in the first aspect.

[0016] This invention discloses a data transmission method, apparatus, device, medium, and program product. After acquiring the transmitted data, the method first identifies the data source. If the data source is identified, it is verified. If the source is trustworthy, the method further acquires data flow information. Then, the data flow is verified. If the verification passes, the method further identifies data type information and request permission information. The transmitted data is then verified a third time based on both data type and request permission. If the verification passes, the security of the transmitted data is verified through this three-stage verification method, thereby improving the security of data transmission. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments of the present invention will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating a data transmission method provided in an embodiment of the present invention; Figure 2 This is a flowchart illustrating a method for calculating a preset security threshold provided in an embodiment of the present invention; Figure 3 This is a flowchart illustrating a method for determining the security of data from unknown sources provided in an embodiment of the present invention; Figure 4 This is a flowchart illustrating a safety index calculation method provided in an embodiment of the present invention; Figure 5 This is an exemplary schematic diagram of a data transmission method provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of a data transmission device provided in an embodiment of the present invention; Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0019] The features and exemplary embodiments of various aspects of the present invention will now be described in detail. To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely intended to explain the present invention and not to limit the present invention. For those skilled in the art, the present invention can be practiced without some of these specific details. The following description of the embodiments is merely to provide a better understanding of the present invention by illustrating examples of the invention.

[0020] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0021] It should be noted that the acquisition, storage, use, and processing of data in this application embodiment all comply with the relevant provisions of national laws and regulations.

[0022] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0023] To address the problems of the prior art, embodiments of the present invention provide a method, apparatus, device, medium, and program product for data transmission.

[0024] The data transmission method provided in this embodiment of the invention will be described below. This method is applied to a security authentication system. The security authentication system includes a terminal, a receiving unit, a terminal processing center, a monitoring unit, a virtual machine processing unit, and a security assessment unit. The units other than the terminal can be deployed in a server or base station. The security authentication system can also be integrated and deployed on the terminal.

[0025] The receiving unit is used to transmit data; The terminal processing center is used to authenticate the received data. The terminal processing center includes an authentication unit and a processing program. The authentication unit is used to authenticate the transmitted data and mark the data that has passed the authentication. The processing program is used to process the marked data.

[0026] The monitoring unit is used to perform secondary authentication on data that failed authentication at the terminal processing center; The virtual machine processing unit is used to calculate security thresholds for data from unknown sources; The security assessment unit is used to evaluate the security of the data to be transmitted and calculate the security index.

[0027] Figure 1 A flowchart illustrating a data transmission method according to an embodiment of the present invention is shown. Figure 1 As shown, the method includes S101-S105: S101, Obtain transmission data.

[0028] S102. Identify the data source information of the transmitted data.

[0029] The terminal processing center includes an authentication unit that can identify the source information of the data.

[0030] Specifically, the authentication unit can obtain data source information from the transmitted data according to a preset strategy. This application embodiment does not impose specific limitations on the preset strategy.

[0031] In one example, the authentication unit can obtain data origin information from the source Internet Protocol (IP) field in the transmitted data.

[0032] S103. If the data transmission is verified using the data source information, identify the data flow information.

[0033] The authentication unit uses data source information to determine whether the source of the transmitted data is reliable. If it is determined to be reliable, the verification is passed and the data is marked as Level 1 authentication data.

[0034] Specifically, the authentication unit can verify the transmitted data based on a preset database of trusted sources.

[0035] Data flow information is used to indicate the target receiving device for the transmitted data. For example, data flow information can be the destination IP address.

[0036] S104. If the data flow information is used to verify the transmitted data, identify the data type information and the request permission information respectively.

[0037] The authentication unit can pre-obtain the addresses of multiple servers connected to the terminal. By comparing data flow information with the server addresses, if the data flow information and server addresses match, the unit determines that the transmitted data has passed verification. Data that has passed verification for new data flow messages is marked as secondary authentication data.

[0038] The authentication unit obtains data type information and request permission information from the transmitted data according to a preset strategy. This embodiment does not impose specific limitations on the preset strategy.

[0039] In one example, the authentication unit can obtain data type information from the data type field in the transmitted data and request permission information from the request permission field.

[0040] S105. If the data transmission is verified using the data type identification information and the permission request information, the data transmission is sent to the terminal.

[0041] In this process, the authentication unit identifies the data type information and the request permission information, compares them with the preset security permission database, and if the permission carried in the request permission information is found in the preset security permission database, it determines that the transmitted data has passed the verification. Transmitted data that has passed the verification is marked as Level 3 authentication data.

[0042] Using the above method, after acquiring the transmitted data, the data source is first identified. If the data source is identified, it is verified. If the source is trustworthy, the data flow information is further obtained. Then, the data flow is verified. If the verification passes, the data type information and request permission information are further identified. The transmitted data is then verified a third time based on the data type and request permissions. If the verification passes, the security of the transmitted data is verified through this three-stage verification method, thereby improving the security of data transmission.

[0043] After identifying the data source information as described above, the transmitted data is verified using a preset trusted source database. Specifically, after identifying the data source information of the transmitted data in S102, the method includes: Search for data source information in the preset trusted source database; if data source information is found in the preset trusted source database, confirm that the transmitted data has passed verification.

[0044] The preset trust source database is pre-configured based on business requirements.

[0045] Accordingly, if no data source information is found in the preset trusted source database, the transmitted data will be intercepted.

[0046] Understandably, if the data source information is not found in the preset trusted source database, it means that the source of the transmitted data is untrustworthy and poses a security risk. Therefore, the transmitted data is intercepted.

[0047] In this way, by using a preset trusted source database to store trusted source addresses, and by using the data source information of the transmitted data to search in the preset trusted source database, the reliability of the data source of the transmitted data can be quickly and accurately determined, thereby improving the accuracy of the verification.

[0048] In some embodiments of this application, transmitted data is marked as regulatory data when the data flow information is not identified, or when neither the data type information nor the request permission information is identified.

[0049] After marking the transmitted data as regulatory data, the regulatory data undergoes secondary identification to determine the access control information within it. If secondary access control information exists in the regulatory data, the data is sent to the terminal. If no secondary access control information exists, the regulatory data is deleted.

[0050] In this embodiment, the supervisory unit obtains secondary access information from the transmitted data according to a preset strategy. This application does not impose specific limitations on the preset strategy.

[0051] In one example, the supervisory unit can obtain secondary permission information from the secondary permission field in the transmitted data.

[0052] It should be noted that the regulatory unit can identify regulatory data and determine its security based on preset identification rules. Thus, after obtaining a preset number of identification results, a neural network model is trained using these results to obtain a trained security identification model. This model is then used to assess the security of the regulatory data.

[0053] In addition, after identifying secondary permission information, the permission information in the preset security permission identification database is updated so that the preset security permission identification database updates and stores access habits from unknown source addresses.

[0054] Using the method provided in this application, if the data flow direction, data type information, and request permission information cannot be identified, it indicates that the data transmission has failed and the verification has not been completed. However, if the data source is trustworthy, the transmitted data can be re-identified to obtain secondary permission information from the monitoring data. If the secondary permission information can be obtained, the verification has passed, and the transmitted data can be sent to the terminal, avoiding data packet loss and improving the security of data transmission.

[0055] For transmitted data whose source information is not identified, the following methods are adopted: Figure 2 The method shown calculates the preset safety threshold, such as Figure 2 As shown, the method includes: S201. In the absence of identifying the data source information of the transmitted data, obtain the traffic information of the transmitted data, the permission request identification ratio, the virtual machine running status score, and the flow identification ratio.

[0056] Among them, the request permission identification ratio is the ratio of the number of target permissions to the number of request permissions for transmitting data, and the number of target permissions is the number of permissions in the preset security permission database that are the same as the request permissions for transmitting data; the virtual machine operation status score is determined based on the correspondence between the virtual machine's processing actions and preset scores, and the flow identification ratio is the ratio of the number of terminal connections to servers to the number of servers requesting data transmission.

[0057] Specifically, for data transmitted from unknown sources, the traffic at the source address is normalized. S_norm = S / S_max, where S is the collected traffic and S_max is the preset maximum traffic. The larger S_norm is, the higher the potential risk.

[0058] The request permission identification ratio reflects the degree of abnormal permission requests from unknown source addresses. This ratio ranges from 0 to 1. The higher the value of this ratio, the higher the risk.

[0059] The virtual machine (VM) health score is determined by the VM processing unit based on the VM's operating status while processing the transmitted data. In one example, the operating status could be resource exhaustion, system error, or suspicious behavior. Different scores are assigned to different operating statuses. For example, 0 represents normal operation, 0.5 represents minor anomalies, and 1 represents severe anomalies. A higher score indicates a higher risk.

[0060] Regarding the flow identification ratio, the virtual machine processing unit matches the IP address of the device requesting the data transmission with the device address of the terminal connected to calculate the flow identification ratio. A higher flow identification ratio indicates a higher risk.

[0061] S202. The traffic information of the transmitted data, the permission recognition ratio, the virtual machine running status score and the flow recognition ratio are weighted and summed to obtain the preset security threshold.

[0062] Specifically, the preset safety threshold can be calculated using the following formula: Fz = W_S × S_norm + W_P × P + W_V × V_score + W_F × F; where Fz represents the preset security threshold, W_S represents the weight of traffic information, S_norm is the normalized traffic information, W_P represents the weight of the permission request recognition ratio, P is the permission request recognition ratio, W_V represents the weight of the virtual machine running status score, V_score is the virtual machine running status score, W_F represents the weight of the flow direction recognition ratio, and F is the flow direction recognition ratio.

[0063] In one example, assume W_S = 0.1, W_P = 0.4, W_V = 0.2, and W_F = 0.3. The preset maximum traffic S_max is 1000MB, and the data transmission traffic is 500MB. S_norm = 500MB / 1000MB = 0.5. The permission request recognition rate is 0.7, indicating that 70% of permission requests are unrecognized or abnormal. The virtual machine health score is 0.8, indicating that the virtual machine is experiencing a serious abnormal condition. The flow recognition rate is 0.6, indicating that 60% of the data flow is unrecognized or abnormal.

[0064] The preset safety threshold Fz is calculated according to the above formula: Fz = (0.1 × 0.5) + (0.4 × 0.7) + (0.2 × 0.8) + (0.3 × 0.6) = 0.05 + 0.28 + 0.16 + 0.18 = 0.67.

[0065] The method provided in this application, without identifying the data source information, acquires the traffic information, permission request identification ratio, virtual machine running status score, and flow direction identification ratio of the transmitted data. A preset security threshold can be calculated using the traffic information, permission request identification ratio, virtual machine running status score, and flow direction identification ratio. Thus, by integrating multiple dimensions, the preset security threshold is calculated, improving the accuracy of the calculation results.

[0066] Given a preset security threshold calculated above, the security assessment unit further calculates the security index of the source address, and then determines whether to send transmission data to the terminal based on the security index and the security threshold. For example... Figure 3 As shown, the method includes: S301. Obtain the address existence duration and preset standard duration of the source address of the transmitted data.

[0067] The preset standard duration is set based on experience. In one example, the preset standard duration can be 7 days or 30 days.

[0068] Address duration is the time elapsed from the moment the authentication unit first receives data transmitted from that source address to the current moment.

[0069] S302. Calculate the data volume change rate of the source address based on the address existence duration and the preset standard duration.

[0070] The security assessment unit calculates the average data volume of the source address within the address's existence duration and the average data volume of the source address within a preset standard duration. By comparing the average data volume, the data volume change rate is determined.

[0071] S303. The security index of the source address is calculated based on the address existence duration and the data volume change rate.

[0072] S304. If the security index is less than or equal to the preset security threshold, send transmission data to the terminal.

[0073] If the security index is lower than the preset security threshold, the transmitted data will be deleted.

[0074] The method provided in this application calculates the data volume change rate of the source address by using the address existence duration of the transmitted data and a preset standard duration. Then, a security index is calculated using the data volume change rate and the address existence duration. Thus, a preset security threshold is calculated by integrating information from multiple dimensions. The security index is then calculated using the data volume change rate. The security index reflects whether there are any abrupt changes in data transmission at the source address. If the security index is less than or equal to the preset security threshold, it is determined that the data transmission at the source address is not abnormal, and the transmitted data is sent to the terminal. This improves the security of data transmission.

[0075] Regarding S304 above, the rate of change of the data volume of the source address is calculated based on the address existence duration and the preset standard duration, specifically divided into two cases: Scenario 1: If the address duration is greater than or equal to a preset standard duration, calculate the first average data volume of the source address within the preset time period. Calculate the second average data volume of the source address within the preset standard duration. Based on the first and second average data volumes, calculate the data volume change rate.

[0076] The preset time period is the time period corresponding to the preset duration before the current time. In one example, the preset time period is the time period one hour or one day before the current time.

[0077] After obtaining the first average data volume, the safety assessment unit continues to work backward from the preset time period to calculate the second average data volume within the preset standard time period. The difference between the first and second average data volumes is calculated to obtain the first difference. The ratio of the first difference to the second average data volume is then calculated to obtain the data volume change rate.

[0078] In one example, the security assessment unit calculates the first average data volume Avg_Volume_Current for the previous day at the current time, then calculates the second average data volume Avg_Volume_Historical_Std for the previous 30 days, and then calculates the data volume change rate K = (Avg_Volume_Current - Avg_Volume_Historical_Std) / Avg_Volume_Historical_Std.

[0079] Regarding scenario 1 above, when the address duration is greater than or equal to the preset standard duration, the first average data volume within the preset time period is calculated based on the data volume of the source address within that preset time period. Then, the second average data volume of the source address within the preset standard duration is calculated. Thus, by comparing the first and second average data volumes, the change in the data volume of the source address from the preset standard duration to the preset time period can be accurately determined, i.e., the data volume change rate.

[0080] Scenario 2: If the duration of the address existence is less than the preset standard duration, obtain the initial data volume of the source address, which is the data volume of the source address in the first complete measurement cycle; obtain the latest data volume in the latest measurement cycle; calculate the data volume change rate based on the initial data volume and the latest data volume.

[0081] The measurement cycle can be preset according to actual business needs. For example, the measurement cycle can be 1 day.

[0082] Specifically, the safety assessment unit calculates the difference between the latest data volume and the initial data volume to obtain the second difference, and then calculates the ratio of the second difference to the initial data volume to obtain the data volume change rate.

[0083] In one example, the security assessment unit counts the initial data volume (Volume_Initial) of the first complete measurement cycle when the source address is first monitored, and then obtains the latest data volume (Volume_Current) in the current latest measurement cycle. The data volume change rate is then calculated as: K = (Volume_Current - Volume_Initial) / Volume_Initial.

[0084] It should be noted that when the initial data volume is 0, K should be set to the preset maximum value, or the initial data volume should be modified to avoid the initial data volume being 0.

[0085] In response to scenario 2 above, where the address duration is less than the preset standard duration, historical data is insufficient to form a complete preset standard duration. Therefore, the data volume change rate is calculated using the data volume within the first complete measurement cycle and the latest data volume within the latest measurement cycle, ensuring the accuracy of the calculation results.

[0086] In some embodiments of this application, the security index of the source address is calculated based on the address existence duration and data volume change rate in S303 above, specifically implemented as S3051-S3055. Figure 4 As shown: S3031. Obtain the duration of the transmitted data and the number of data accesses from the source address.

[0087] S3032. Calculate the product of the existence duration and the time compensation value to obtain the information duration score.

[0088] The time compensation value is linearly related to the duration of existence; that is, the longer the duration of existence, the larger the time compensation value. The specific linear ratio can be set according to actual business needs.

[0089] S3033. Calculate the product of the data access volume and the access volume compensation value to obtain the access volume score.

[0090] The visitor compensation value is linearly correlated with the data access volume; that is, the greater the data access volume, the greater the visitor compensation value. The specific linear ratio can be set according to actual business needs.

[0091] S3034. Calculate the product of the data change rate and the change rate compensation value to obtain the change rate score.

[0092] The change rate compensation value is linearly correlated with the data volume change rate; that is, the greater the data volume change rate, the greater the change rate compensation value. The specific linear ratio can be set according to actual business needs.

[0093] S3035. The security index is obtained by weighting and summing the information duration score, access volume score, and change rate score.

[0094] The weights for the above information duration score, visit volume score, and change rate score are determined according to the following method: The weight of the information duration score is determined by the value of the information duration score.

[0095] This weight corresponds to the first, second, and third preset weight values ​​for the duration, while the information duration score corresponds to the first and second base duration values. If the information duration score is less than the first base duration value, the weight of the information duration score is set to the third preset weight value. If the information duration score is greater than the second base duration value, the weight of the information duration score is set to the first preset weight value. If the information duration score is greater than or equal to the first base duration value and less than or equal to the second base duration value, the weight of the information duration score is set to the second preset weight value.

[0096] The weight of the visit volume score is determined by the value of the visit volume score.

[0097] This weighting corresponds to three preset values: a first preset value for visit volume weighting, a second preset value for visit volume weighting, and a third preset value for visit volume weighting. The visit volume score corresponds to a first base visit volume value and a second base visit volume value. If the visit volume score is less than the first base visit volume value, the weight of the information duration score is set to the third preset value for visit volume weighting. If the information duration score is greater than the second base visit volume value, the weight of the information duration score is set to the first preset value for visit volume weighting. If the information duration score is greater than or equal to the first base visit volume value and less than or equal to the second base visit volume value, the weight of the information duration score is set to the second preset value for visit volume weighting.

[0098] The weight of the rate of change score is determined by the value of the rate of change score.

[0099] This weight corresponds to three preset values: a first preset value for the rate of change weight, a second preset value for the rate of change weight, and a third preset value for the rate of change weight. The rate of change score corresponds to the first base value and the second base value for the rate of change. If the rate of change score is less than the first base value, the weight of the rate of change score is set to the third preset value. If the rate of change score is greater than the second base value, the weight of the rate of change score is set to the first preset value. If the rate of change score is greater than or equal to the first base value and less than or equal to the second base value, the weight of the rate of change score is set to the second preset value.

[0100] The method provided in this application embodiment calculates the product of transmission duration and time compensation value, the product of data access volume and access volume compensation value, and the product of data volume change rate and change rate compensation value. Transmission duration and data access volume are compensated by the data volume change rate, thereby improving the accuracy of the calculation results.

[0101] The following combination Figure 5 This application describes a data transmission method provided in its embodiments, such as... Figure 5As shown, the method includes: S501. Make a preliminary determination of the URL of the information source.

[0102] In this context, the information refers to the transmitted data in the above embodiments, and the source URL refers to the data source information in the above embodiments. The authentication unit in the terminal processing center reads the data source information of the transmitted data. The transmitted data with identified data source information is marked as Level 1 authentication data.

[0103] S502. Determine the source of unknown data.

[0104] S503, use a virtual machine for virtual operation.

[0105] The virtual machine processing unit calculates security thresholds for data from unknown sources.

[0106] S504. Store in the dangerous database.

[0107] In cases where transmitted data fails to pass authentication by the authentication unit, it is stored in a dangerous database and marked as regulatory data.

[0108] S505, Interception complete.

[0109] S506, Store in the trust database.

[0110] Specifically, if the transmitted data is authenticated by the authentication unit, it is stored in the trust database and marked as secondary authentication data.

[0111] S507. Confirm that the permissions are satisfied.

[0112] The authentication unit identifies the request permission information of the data in the trust database. If the request permission information can be identified, it determines that the permission of the transmitted data is satisfied and marks it as Level 3 authentication data.

[0113] S508. Perform data processing on the transmitted data.

[0114] After authorization, the authentication unit determines that the transmitted data is secure and then sends it to the terminal.

[0115] S509. Permissions not satisfied.

[0116] The authentication unit identifies the request permission information of data in the trust database. If the request permission information cannot be identified, it determines that the permission for transmitting data is not met and marks it as regulatory data.

[0117] S510, Conduct manual intervention.

[0118] Specifically, transmitted data that has not passed authorization authentication is treated as regulatory data and undergoes secondary authentication to identify secondary authorization information, thereby determining whether to send the transmitted data to the terminal.

[0119] S511, Pause ends.

[0120] The method provided in this application embodiment performs security authentication on the information received by the terminal and processes the data information according to the authentication level, increasing the targeting of data processing and the security of received information. For information that cannot be identified, it is extracted through virtual machine simulation, and a preset security threshold is calculated. The preset security threshold and security index are used to determine whether to transmit the information to the terminal, thus enhancing the security of the information received by the terminal and reducing the impact of unknown viruses carried by the data during transmission. Furthermore, by setting authentication levels in the authentication unit, the received data is identified and marked, and stored according to the data markings, ensuring the accuracy of the identification information during data processing.

[0121] Based on the same concept, embodiments of this application provide a data transmission apparatus, such as... Figure 6 As shown, the device includes: Acquisition module 601 is used to acquire transmitted data; The identification module 602 is used to identify the data source information of the transmitted data; The identification module 602 is further configured to identify the data flow direction information when the data source information is used to verify the transmitted data. The identification module 602 is further configured to identify data type information and request permission information respectively when the data flow information is used to verify the transmitted data. The sending module 603 is used to send the transmission data to the terminal when the transmission data is verified using the identified data type information and the request permission information.

[0122] In one possible implementation, the device further includes: The search module is used to search for the data source information in a preset trusted source database; The determination module is used to determine that the verification of the transmitted data has passed when the data source information is found in the preset trusted source database.

[0123] In one possible implementation, the device further includes: The interception module is used to intercept the transmitted data when the data source information is not found in the preset trusted source database.

[0124] In one possible implementation, the device further includes: The marking module is used to mark the transmitted data as regulatory data when the data flow direction information is not identified, or when neither the data type information nor the request permission information is identified. The identification module 602 is also used to identify the permission information in the regulatory data; The sending module 603 is also used to send the regulatory data to the terminal when the regulatory data contains secondary permission information; The deletion module is used to delete the regulatory data if the regulatory data does not contain secondary permission information.

[0125] In one possible implementation, the device further includes: The acquisition module 601 is used to acquire the address existence duration and preset standard duration of the source address of the transmitted data; The calculation module is used to calculate the data volume change rate of the source address based on the address existence duration and the preset standard duration; The calculation module is used to calculate the security index of the source address based on the duration of the address's existence and the rate of change of the data volume; The sending module 603 is also used to send the transmission data to the terminal when the security index is less than or equal to a preset security threshold.

[0126] In one possible implementation, the acquisition module 601 is further configured to acquire traffic information, request permission identification ratio, virtual machine running status score, and flow direction identification ratio of the transmitted data when the data source information of the transmitted data is not identified. The request permission identification ratio is the ratio of the number of target permissions to the number of request permissions for the transmitted data, where the number of target permissions is the number of permissions in the preset security permission database that are the same as the request permissions for the transmitted data; the virtual machine operation status score is determined based on the correspondence between the virtual machine's processing actions and preset scores; and the flow identification ratio is the ratio of the number of terminals connecting to servers to the number of servers requesting the transmitted data. The calculation module is also used to perform a weighted summation of the traffic information, request permission recognition ratio, virtual machine running status score and flow direction recognition ratio of the transmitted data to obtain the preset security threshold. In one possible implementation, the computation module is specifically used for: If the duration of the address is greater than or equal to the preset standard duration, calculate the first average data volume of the source address within the preset time period; Calculate the second average data volume of the source address within the preset standard time period; The rate of change of the data volume is calculated based on the first average data volume and the second average data volume.

[0127] In one possible implementation, the computation module is specifically used for: If the duration of the address is less than the preset standard duration, the initial data volume of the source address is obtained, where the initial data volume is the data volume of the source address in the first complete measurement cycle; Obtain the latest data volume within the latest measurement period; The rate of change of the data volume is calculated based on the initial data volume and the latest data volume.

[0128] In one possible implementation, the computation module is specifically used for: Obtain the duration of the transmitted data and the number of data accesses to the source address; The information duration score is obtained by multiplying the existence duration and the time compensation value. The access score is obtained by multiplying the data access volume and the access volume compensation value. Calculate the product of the rate of change of the data volume and the rate of change compensation value to obtain the rate of change score; The security index is obtained by weighting and summing the information duration score, the access volume score, and the change rate score.

[0129] Figure 7 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention is shown.

[0130] An electronic device may include a processor 701 and a memory 702 storing computer program instructions.

[0131] Specifically, the processor 701 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of the present invention.

[0132] Memory 702 may include mass storage for data or instructions. For example, and not limitingly, memory 702 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. In one instance, memory 702 may include removable or non-removable (or fixed) media, or memory 702 may be a non-volatile solid-state memory. Memory 702 may be internal or external to an electronic device.

[0133] In one instance, memory 702 may be read-only memory (ROM). In one instance, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or flash memory, or a combination of two or more of these.

[0134] Memory 702 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Therefore, generally, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this disclosure.

[0135] The processor 701 reads and executes computer program instructions stored in the memory 702 to achieve... Figure 1 The data transmission method in the illustrated embodiment.

[0136] In one example, the electronic device may also include a communication interface 703 and a bus 704. Wherein, as... Figure 7 As shown, the processor 701, memory 702, and communication interface 703 are connected through bus 704 and complete communication with each other.

[0137] The communication interface 703 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of the present invention.

[0138] Bus 704 includes hardware, software, or both, that couples components of an electronic device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 704 may include one or more buses. While specific buses are described and illustrated in embodiments of the invention, the invention contemplates any suitable bus or interconnect.

[0139] Furthermore, in conjunction with the data transmission methods described in the above embodiments, this invention can be implemented using a computer storage medium. This computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the data transmission methods described in the above embodiments.

[0140] This application also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the data transmission methods described in the above embodiments.

[0141] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0142] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, read-only memory (ROM), flash memory, erasable read-only memory (EROM), floppy disks, compact disc read-only memory (CD-ROM), optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0143] It should also be noted that the exemplary embodiments mentioned in this invention describe methods or systems based on a series of steps or apparatus. However, this invention is not limited to the order of the steps described above; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0144] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0145] The above description is merely a specific embodiment of the present invention. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the protection scope of the present invention.

Claims

1. A method for data transmission, characterized in that, include: Acquire transmitted data; Identify the data source information of the transmitted data; If the transmitted data passes verification using the data source information, the data flow direction information is identified. If the transmitted data passes the verification using the data flow information, the data type information and the request permission information are identified respectively. If the transmitted data passes the verification using the identified data type information and the requested permission information, the transmitted data is sent to the terminal.

2. The method according to claim 1, characterized in that, After identifying the data source information of the transmitted data, the method further includes: Search the data source information in the preset trusted source database; If the data source information is found in the preset trusted source database, the verification of the transmitted data is deemed successful.

3. The method according to claim 2, characterized in that, Also includes: If the data source information is not found in the preset trusted source database, the transmitted data is intercepted.

4. The method according to claim 1, characterized in that, The method further includes: If the data flow information is not identified, or if either the data type information or the request permission information is not identified, the transmitted data shall be marked as regulatory data. Identify the permission information in the regulatory data; If the regulatory data contains secondary access information, the regulatory data is sent to the terminal. If the regulatory data does not contain secondary access information, the regulatory data will be deleted.

5. The method according to claim 1, characterized in that, Also includes: Obtain the address existence duration and preset standard duration of the source address of the transmitted data; The rate of change of the data volume of the source address is calculated based on the duration of the address's existence and the preset standard duration. The security index of the source address is calculated based on the duration of the address's existence and the rate of change of the data volume. If the security index is less than or equal to a preset security threshold, the transmission data is sent to the terminal.

6. The method according to claim 5, characterized in that, Before sending the transmitted data to the terminal when the security index is less than or equal to a preset security threshold, the method further includes: In the absence of identifying the data source information of the transmitted data, obtain the traffic information, permission request identification ratio, virtual machine running status score, and flow identification ratio of the transmitted data; The request permission identification ratio is the ratio of the number of target permissions to the number of request permissions for the transmitted data, where the number of target permissions is the number of permissions in the preset security permission database that are the same as the request permissions for the transmitted data; the virtual machine operation status score is determined based on the correspondence between the virtual machine's processing actions and preset scores; and the flow identification ratio is the ratio of the number of terminals connecting to servers to the number of servers requesting the transmitted data. The preset security threshold is obtained by weighted summing of the traffic information, permission request recognition ratio, virtual machine running status score, and flow direction recognition ratio of the transmitted data.

7. The method according to claim 5, characterized in that, The step of calculating the data volume change rate of the source address based on the address existence duration and the preset standard duration includes: If the duration of the address is greater than or equal to the preset standard duration, calculate the first average data volume of the source address within the preset time period; Calculate the second average data volume of the source address within the preset standard time period; The rate of change of the data volume is calculated based on the first average data volume and the second average data volume.

8. The method according to claim 5, characterized in that, The step of calculating the data volume change rate of the source address based on the address existence duration and the preset standard duration further includes: If the duration of the address is less than the preset standard duration, the initial data volume of the source address is obtained, where the initial data volume is the data volume of the source address in the first complete measurement cycle; Obtain the latest data volume within the latest measurement period; The rate of change of the data volume is calculated based on the initial data volume and the latest data volume.

9. The method according to claim 5, characterized in that, The calculation of the security index of the source address based on the duration of the address's existence and the rate of change of the data volume includes: Obtain the duration of the transmitted data and the number of data accesses to the source address; The information duration score is obtained by multiplying the existence duration and the time compensation value. The access score is obtained by multiplying the data access volume and the access volume compensation value. Calculate the product of the rate of change of the data volume and the rate of change compensation value to obtain the rate of change score; The security index is obtained by weighting and summing the information duration score, the access volume score, and the change rate score.

10. A data transmission apparatus, characterized in that, include: The acquisition module is used to acquire transmitted data; The identification module is used to identify the data source information of the transmitted data; The identification module is also used to identify data flow information when the transmitted data passes the verification using the data source information; The identification module is also used to identify data type information and request permission information respectively when the data flow information is used to verify the transmitted data. The sending module is used to send the transmission data to the terminal if the transmission data passes the verification using the identified data type information and the request permission information.

11. A data transmission device, characterized in that, The device includes: a processor, and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement the data transmission method as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, The computer storage medium stores computer program instructions, which, when executed by a processor, implement the data transmission method as described in any one of claims 1 to 9.

13. A computer program product, characterized in that, Includes a computer program, which, when processed, implements the method of data transmission as described in any one of claims 1 to 9.

Images