Data transmission method and device, computer device, storage medium and program product

Abstract

The application relates to a data transmission method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: a control plane device generates a transmission configuration parameter according to a target network address and a security level identifier of to-be-transmitted data; the transmission configuration parameter is issued to a sending end device of the to-be-transmitted data, so that the sending end device transmits the to-be-transmitted data based on the transmission configuration parameter. A server device analyzes a data packet transmitted by the sending end device, obtains the to-be-transmitted data and the transmission configuration parameter, extracts the security level identifier of the to-be-transmitted data from the transmission configuration parameter, and performs routing processing on the to-be-transmitted data according to a preset routing strategy corresponding to the security level identifier. The security level attribute of the data is embedded into the transmission configuration, the problem that high-security-level data and low-security-level data share the same transmission path and permission in a VPN is effectively avoided, and the data security risk is reduced from the source.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a data transmission method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] VPNs (Virtual Private Networks) established between clients can ensure the security and compliance of data during transmission. For example, clients can use PPPoE over IPv6 (Point-to-Point Protocol over Ethernet over IPv6) technology to quickly establish a VPN via dial-up.

[0003] However, in complex data flow scenarios, different data may have different security levels, but current data transmission solutions do not restrict the scope of data access. This will lead to high-security data being transmitted without restriction within the VPN, posing a security risk of data leakage. Summary of the Invention

[0004] Therefore, it is necessary to provide a data transmission method, apparatus, computer equipment, computer-readable storage medium, and computer program product to address the aforementioned technical problems, so as to prevent high-security data from being transmitted without restriction within a VPN and reduce the risk of data leakage.

[0005] In a first aspect, this application provides a data transmission method applied to a control plane device, wherein: Generate transmission configuration parameters based on the target network address and security level identifier of the data to be transmitted; The transmission configuration parameters are sent to the sending device of the data to be transmitted, so that the sending device can transmit the data to be transmitted based on the transmission configuration parameters.

[0006] In one embodiment, the target network address includes a functional parameter address; the step of generating transmission configuration parameters based on the target network address and security level identifier of the data to be transmitted includes: The security level identifier of the data to be transmitted is encoded and written into the function parameter address, and the encoded target network address is used as the transmission configuration parameter.

[0007] Secondly, this application also provides a data transmission method applied to a server device, comprising: The data packets transmitted by the sending device are parsed to obtain the data to be transmitted and the transmission configuration parameters; the transmission configuration parameters are generated by the control plane device based on the target network address and security level identifier of the data to be transmitted, and then sent to the sending device. The security level identifier of the data to be transmitted is extracted from the transmission configuration parameters, and the data to be transmitted is routed according to the pre-set routing policy corresponding to the security level identifier.

[0008] In one embodiment, extracting the security level identifier of the data to be transmitted from the transmission configuration parameters includes: The address of the function parameter in the transmission configuration parameters is parsed to obtain the security level identifier of the data to be transmitted.

[0009] In one embodiment, the routing policy includes forwarding or blocking behavior; the routing process for the data to be transmitted according to the pre-set routing policy corresponding to the security level identifier includes: If the routing policy corresponding to the security level identifier is forwarding behavior, then the target network address of the data to be transmitted is extracted from the transmission configuration parameters, and the data to be transmitted is forwarded to the target network address; If the routing policy corresponding to the security level identifier is a blocking action, then a blocking response is returned to the sending device.

[0010] Thirdly, this application also provides a data transmission device for use in a control plane device, the device comprising: The generation module is used to generate transmission configuration parameters based on the target network address and security level identifier of the data to be transmitted; The sending module is used to send the transmission configuration parameters to the sending device of the data to be transmitted, so that the sending device can transmit the data to be transmitted based on the transmission configuration parameters.

[0011] Fourthly, this application also provides a data transmission apparatus for use in a server-side device, the apparatus comprising: The parsing module is used to parse the data packets transmitted by the sending device to obtain the data to be transmitted and the transmission configuration parameters; the transmission configuration parameters are generated by the control plane device based on the target network address and security level identifier of the data to be transmitted, and then sent to the sending device. The routing module is used to extract the security level identifier of the data to be transmitted from the transmission configuration parameters, and to perform routing processing on the data to be transmitted according to a pre-set routing strategy corresponding to the security level identifier.

[0012] Fifthly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps described in any of the above method embodiments.

[0013] Sixthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps described in any of the above method embodiments.

[0014] In a seventh aspect, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps described in any of the above method embodiments.

[0015] The aforementioned data transmission methods, apparatus, computer equipment, computer-readable storage media, and computer program products generate dedicated transmission configuration parameters based on the security level identifier of the data to be transmitted and the target network address through the control plane device and send them to the sending device. This constrains the subsequent data transmission behavior of the sending device by the parameters, which is equivalent to embedding the security level attribute of the data into the transmission configuration at the beginning of network communication. This allows for differentiated access control at the transmission layer for data with different security levels, effectively avoiding the problem of high-security-level data and low-security-level data sharing the same transmission path and permissions within the VPN. This reduces the security risk of sensitive data being spread without restriction within the VPN from the source. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart of a data transmission method applied to a control plane device in one embodiment; Figure 2 This is a flowchart of a data transmission method applied to a server device in one embodiment; Figure 3 This is a structural block diagram of a data transmission device applied to a control plane device in one embodiment; Figure 4 This is a structural block diagram of a data transmission device applied to a server-side device in one embodiment; Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0019] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0020] In complex data flow scenarios, different data may have different security levels, but current data transmission solutions do not restrict the scope of data access. This could lead to high-security data being transmitted without restriction within a VPN, posing a data leakage security risk.

[0021] Based on this, this application provides a data transmission method, such as... Figure 1 As shown, this data transmission method can be applied to control plane devices to implement the following process: Step 101: Generate transmission configuration parameters based on the target network address and security level identifier of the data to be transmitted.

[0022] The target network address specifies the logical location or network node to which the data to be transmitted is intended to arrive, serving as the basis for routing and forwarding. The security level identifier reflects the importance or confidentiality level of the data to be transmitted. When generating transmission configuration parameters, the control plane device incorporates the security level identifier into a unified encoding logic, ensuring that the generated transmission configuration parameters themselves carry semantic information about the security level, providing a basis for subsequent differentiated processing.

[0023] Step 102: Send transmission configuration parameters to the sending device of the data to be transmitted, so that the sending device can transmit the data to be transmitted based on the transmission configuration parameters.

[0024] The sending device is the network element that actually holds and prepares to send the data to be transmitted. It does not parse or recognize the security level identifier in the transmission configuration parameters; it only executes data transmission actions based on the received transmission configuration parameters. Since the security level identifier is already incorporated into the transmission configuration parameters during the generation phase, the transmission behavior initiated by the sending device based on these parameters is essentially constrained by the security level identifier. The purpose of this step is to pass the transmission configuration parameters carrying the security level semantics to the sending device executing the data transmission, ensuring that the constraint effect of the security level identifier takes effect from the beginning of data transmission. This prevents high-security-level data from being transmitted without restriction to nodes that should not be reached within the VPN, thereby reducing the security risk of data leakage at the source.

[0025] Then, the sending device receives and parses the transmission configuration parameters sent by the control plane device, initiates a PPPoE overIPv6 dialing request, establishes a connection with the designated PPPoE server device, and forms an overlay tunnel.

[0026] As can be seen from the above, the solution provided in this application generates dedicated transmission configuration parameters by the control plane device based on the security level identifier of the data to be transmitted and the target network address, and then sends them to the sending device. This causes the subsequent data transmission behavior of the sending device to be constrained by these parameters. This is equivalent to embedding the security level attribute of the data into the transmission configuration at the beginning of network communication, thereby applying differentiated access control to data with different security levels at the transmission layer. This effectively avoids the problem of high-security-level data and low-security-level data sharing the same transmission path and permissions within the VPN, and reduces the security risk of sensitive data being spread without restriction within the VPN from the source.

[0027] In an exemplary embodiment, the target network address includes a functional parameter address; step 101 includes: The security level identifier of the data to be transmitted is encoded and written into the function parameter address, and the encoded target network address is used as the transmission configuration parameter.

[0028] Specifically, the transmission configuration parameters can be an IPv6 address, which consists of two parts: The first 64 bits are the Locator address, used for network routing. This address is usually a PD (Prefix Delegation) address assigned by the operator, and its core function is to determine the location of the PPPoE server device to which the PPPoE dial-up connection is anchored, so as to achieve interconnection and interoperability across networks, domains, and borders.

[0029] The last 64 bits are the address of the Function and Arguments, used for data mapping. Security level identifiers can be embedded programmatically in these last 64 bits; for example, specific fields can be used to represent different levels such as "Top Secret," "Confidential," and "Internal Public."

[0030] It can be understood that the function parameter address, as a specific field within the address structure, is used to carry custom information related to data attributes. When generating transmission configuration parameters, the control plane device first obtains the security level identifier corresponding to the data to be transmitted, and then encodes this security level identifier into the function parameter address contained in the target network address. This encoding is embedded into a reserved programmable area within the address structure, making the security level information an integral part of the target network address itself. After encoding, the control plane device uses the encoded and modified target network address as a whole as the transmission configuration parameter.

[0031] In this way, when the control plane device sends the transmission configuration parameters to the sending device, it sends a complete target network address that has already been written with the security level code. After receiving the transmission configuration parameters, the sending device directly uses the target network address indicated by the parameters for data transmission, without needing to identify or extract the embedded security level information. Since the security level identifier has been written into the function parameter address on the control plane side, during data transmission, the network-side device can read the security level code from the function parameter address when parsing the target network address, and can know the security attributes of the data without relying on additional signaling interaction or policy query.

[0032] like Figure 2 As shown, this data transmission method can be applied to server-side devices to implement the following process: Step 201: Parse the data packets transmitted by the sending device to obtain the data to be transmitted and the transmission configuration parameters; the transmission configuration parameters are generated by the control plane device based on the target network address and security level identifier of the data to be transmitted and sent to the sending device.

[0033] The server device parses the data packets transmitted by the sending device, stripping away the outer IPv6 tunnel header, PPPoE header, and PPP (Point-to-Point Protocol) header to obtain the data to be transmitted and the transmission configuration parameters. As a forwarding node on the network side, the server device is responsible for parsing the data to be transmitted and the transmission configuration parameters carrying security level semantics from the received data packets, providing the necessary data foundation for subsequent security policy execution.

[0034] The transmission configuration parameters are generated by the control plane device based on the target network address and security level identifier of the data to be transmitted, and then sent to the sending device. After receiving the transmission configuration parameters, the sending device sends them along with the data packet to the server device.

[0035] Step 202: Extract the security level identifier of the data to be transmitted from the transmission configuration parameters, and perform routing processing on the data to be transmitted according to the pre-set routing policy corresponding to the security level identifier.

[0036] The server device extracts the security level identifier of the data to be transmitted from the transmission configuration parameters and performs routing processing on the data according to a pre-set routing policy corresponding to the security level identifier. This routing policy configures corresponding forwarding behaviors for different security level identifiers, such as allowing forwarding to a specified network, forcing routing to a security audit node, or directly discarding and blocking the data. The server device queries the matching routing policy based on the extracted security level identifier and performs the corresponding routing processing operation on the data to be transmitted based on the matching result.

[0037] As can be seen from the above, the solution provided in this application, by introducing a routing policy enforcement mechanism based on security level identifiers on the server-side device, eliminates the reliance on external independent policy systems for data access control. Instead, it embeds mandatory security decision-making capabilities at key nodes along the data transmission path. Since the security level identifier is encoded in the transmission configuration parameters, the server-side device can determine the data's security attributes simply by parsing these parameters, without additional signaling interaction or external queries, thus ensuring both security and processing efficiency. This mechanism decentralizes security policy enforcement to the network forwarding layer, enabling high-security-level data to be identified and subject to differentiated routing constraints before entering the core network. This prevents sensitive data from being forwarded indiscriminately to nodes it should not reach, effectively reducing the security risk of data leakage.

[0038] In an exemplary embodiment, step 202, extracting the security level identifier of the data to be transmitted from the transmission configuration parameters, includes: The address of the function parameter in the transmission configuration parameters is parsed to obtain the security level identifier of the data to be transmitted.

[0039] Specifically, after obtaining the transmission configuration parameters from the data packet, the server device first identifies the structure of these parameters to determine the functional parameter address field. This functional parameter address is the address field where the control plane device writes the security level code when generating the transmission configuration parameters. The server device then parses this functional parameter address, reading the security level identifier from the address field according to the encoding rules agreed upon with the control plane device. This parsing process does not involve interpreting the data packet content; it only operates on the address field itself. After parsing, the server obtains the security level identifier corresponding to the data to be transmitted, which is then used for subsequent routing policy matching.

[0040] Security level identifiers are extracted by parsing the function parameter addresses in the transmission configuration parameters on the server-side device. Both the carrying and extraction of security level information are confined to the address field. Since the security level identifier and the target network address are both located in the transmission configuration parameters, the extraction process can reuse existing address resolution procedures without introducing additional signaling interactions or protocol extensions, resulting in good compatibility and deployment efficiency. The security level identifier can be extracted and the corresponding routing policy triggered when the data packet arrives at the server-side device, without waiting for complete packet reassembly or business layer parsing. This reduces the time window for unauthorized data forwarding, thereby further enhancing the security protection capability for highly sensitive data.

[0041] In an exemplary embodiment, the routing policy includes forwarding behavior or blocking behavior; in step 202, the data to be transmitted is routed according to a pre-set routing policy corresponding to the security level identifier, including: If the routing policy corresponding to the security level identifier is forwarding behavior, then the target network address of the data to be transmitted is extracted from the transmission configuration parameters, and the data to be transmitted is forwarded to the target network address. If the routing policy corresponding to the security level identifier is blocking, a blocking response is returned to the sending device.

[0042] Specifically, the aforementioned routing strategy includes either forwarding or blocking actions. When the routing strategy matched by the security level identifier extracted from the transmission configuration parameters by the server device is forwarding, the server device further extracts the target network address of the data to be transmitted from the transmission configuration parameters and forwards the data to that target network address. In this case, the currently transmitted data is determined to have legitimate circulation permissions, and the server device sends the data to the receiving end corresponding to the target network address according to the normal forwarding path, thus completing the data circulation process normally.

[0043] When the routing policy matched by the security level identifier extracted from the transmission configuration parameters by the server device is a blocking action, the server device will not forward the data to be transmitted. Instead, it will return a blocking response to the sending device. This blocking response is used to notify the sending device that the data transmission has been rejected. In this case, the currently transmitted data is determined to lack legitimate circulation permissions, and the server device directly intercepts the data at the network forwarding layer, preventing the data from reaching the receiving end corresponding to the target network address.

[0044] By configuring two explicit routing behaviors—forwarding and blocking—on the server-side device, clear and mandatory processing logic is provided for data of different security levels. When data does not meet the preset flow conditions, the server-side device blocks the data before it enters the core network and sends feedback to the sender. This avoids invalid data consuming network bandwidth and computing resources, while allowing the sender to be promptly notified of transmission failures. This binary division of forwarding and blocking behaviors covers the main processing scenarios in the data flow process, ensuring the normal flow of compliant data while implementing mandatory boundary control for non-compliant data. This effectively reduces the security risk of sensitive data being illegally disseminated while ensuring data transmission efficiency.

[0045] The data transmission method provided in this application will be described below through a specific embodiment.

[0046] In a data exchange involving cross-provincial data circulation, data is divided into "ordinary commercial data" (Level 1) and "personal sensitive information" (Level 2). Level 2 data is prohibited from leaving the province. The control plane equipment is deployed on the data exchange management platform. The sending end equipment A is located in province X, the server end equipment is deployed at the network exit of province X and interconnected with the server end equipment in province Y, and the receiving end equipment B is located in province Y.

[0047] The administrator configures the policy on the control plane: Level 1 data can be forwarded to province Y; Level 2 data can only be forwarded within the province, and will be blocked if it leaves the province.

[0048] When sending device A needs to transmit a batch of "personally sensitive information" (Level 2) to receiving device B, the control plane generates a specific IPv6 address 2001:db8:1:1:0000:0000:0002:0001; the first 64 bits 2001:db8:1:1 point to the server device in province X; a specific field in the last 64 bits 0000:0000:0002:0001 encodes the "Level 2" information. The control plane sends this address as a dialing parameter to the terminal of sending device A.

[0049] The terminal of sending device A initiates a PPPoE over IPv6 dial-up connection using the IPv6 address 2001:db8:1:1:0000:0000:0002:0001 to establish a tunnel with the server device in province X. The data packet is encapsulated as: [IPv6 OuterHeader (dst=2001:db8:1:1...)][PPPoE Header][PPP Header][Original Data].

[0050] After receiving the packet, the server device in province X strips off the tunnel header, PPPoE header, and PPP header, reads the outer IPv6 header, parses the last 64 bits, and identifies the data sensitivity level as "Level 2". Then, the server device queries its local routing policy table and finds that the routing behavior for "Level 2" data is "forward within the province, block out of the province". Since the target receiver B is located in province Y (determined to be out of the province), the policy matching result is "block". Therefore, the server device discards the data packet, does not forward it to the server device in province Y, and returns a blocking response to the sending device A.

[0051] In addition, if the data transmitted is "ordinary business data" (level 1), the last 64 bits issued by the control plane will encode "level 1". After the server device parses the data and matches the "allow outbound travel" policy, it will forward the message to the server device in province Y and finally deliver it to the receiving device B.

[0052] As can be seen from the above embodiments, the present invention achieves a refined and dynamic security fence strategy at the network entry point by encoding data sensitivity into the tunnel encapsulation address.

[0053] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0054] Based on the same inventive concept, this application also provides a data transmission apparatus for implementing the data transmission method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, specific limitations in one or more data transmission apparatus embodiments provided below can be found in the limitations of the data transmission method described above, and will not be repeated here.

[0055] In one exemplary embodiment, such as Figure 3 As shown, a data transmission device is provided, applied to a control plane device, comprising: The generation module 301 is used to generate transmission configuration parameters based on the target network address and security level identifier of the data to be transmitted; The sending module 302 is used to send the transmission configuration parameters to the sending device of the data to be transmitted, so that the sending device can transmit the data to be transmitted based on the transmission configuration parameters.

[0056] In one exemplary embodiment, such as Figure 4 As shown, a data transmission device is provided, applied to a server-side device, comprising: The parsing module 401 is used to parse the data packets transmitted by the sending device to obtain the data to be transmitted and the transmission configuration parameters; the transmission configuration parameters are generated by the control plane device according to the target network address and security level identifier of the data to be transmitted, and then sent to the sending device. The routing module 402 is used to extract the security level identifier of the data to be transmitted from the transmission configuration parameters, and to perform routing processing on the data to be transmitted according to a pre-set routing strategy corresponding to the security level identifier.

[0057] Each module in the aforementioned data transmission device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0058] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores measurement data and / or positioning information. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a data transmission method.

[0059] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0060] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps: Generate transmission configuration parameters based on the target network address and security level identifier of the data to be transmitted; The transmission configuration parameters are sent to the sending device of the data to be transmitted, so that the sending device can transmit the data to be transmitted based on the transmission configuration parameters.

[0061] In one exemplary embodiment, another computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps: The data packets transmitted by the sending device are parsed to obtain the data to be transmitted and the transmission configuration parameters; the transmission configuration parameters are generated by the control plane device based on the target network address and security level identifier of the data to be transmitted, and then sent to the sending device. The security level identifier of the data to be transmitted is extracted from the transmission configuration parameters, and the data to be transmitted is routed according to the pre-set routing policy corresponding to the security level identifier.

[0062] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor: Generate transmission configuration parameters based on the target network address and security level identifier of the data to be transmitted; The transmission configuration parameters are sent to the sending device of the data to be transmitted, so that the sending device can transmit the data to be transmitted based on the transmission configuration parameters.

[0063] In one embodiment, another computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, performs the following steps: The data packets transmitted by the sending device are parsed to obtain the data to be transmitted and the transmission configuration parameters; the transmission configuration parameters are generated by the control plane device based on the target network address and security level identifier of the data to be transmitted, and then sent to the sending device. The security level identifier of the data to be transmitted is extracted from the transmission configuration parameters, and the data to be transmitted is routed according to the pre-set routing policy corresponding to the security level identifier.

[0064] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps: Generate transmission configuration parameters based on the target network address and security level identifier of the data to be transmitted; The transmission configuration parameters are sent to the sending device of the data to be transmitted, so that the sending device can transmit the data to be transmitted based on the transmission configuration parameters.

[0065] In one embodiment, another computer program product is provided, including a computer program that, when executed by a processor, performs the following steps: The data packets transmitted by the sending device are parsed to obtain the data to be transmitted and the transmission configuration parameters; the transmission configuration parameters are generated by the control plane device based on the target network address and security level identifier of the data to be transmitted, and then sent to the sending device. The security level identifier of the data to be transmitted is extracted from the transmission configuration parameters, and the data to be transmitted is routed according to the pre-set routing policy corresponding to the security level identifier.

[0066] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0067] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0068] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0069] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A data transmission method, characterized in that, Applied to control plane equipment, the method includes: Generate transmission configuration parameters based on the target network address and security level identifier of the data to be transmitted; The transmission configuration parameters are sent to the sending device of the data to be transmitted, so that the sending device can transmit the data to be transmitted based on the transmission configuration parameters.

2. The method according to claim 1, characterized in that, The target network address includes a functional parameter address; the generation of transmission configuration parameters based on the target network address and security level identifier of the data to be transmitted includes: The security level identifier of the data to be transmitted is encoded and written into the function parameter address, and the encoded target network address is used as the transmission configuration parameter.

3. A data transmission method, characterized in that, Applied to server-side devices, the method includes: The data packets transmitted by the sending device are parsed to obtain the data to be transmitted and the transmission configuration parameters; the transmission configuration parameters are generated by the control plane device based on the target network address and security level identifier of the data to be transmitted, and then sent to the sending device. The security level identifier of the data to be transmitted is extracted from the transmission configuration parameters, and the data to be transmitted is routed according to the pre-set routing policy corresponding to the security level identifier.

4. The method according to claim 3, characterized in that, Extracting the security level identifier of the data to be transmitted from the transmission configuration parameters includes: The address of the function parameter in the transmission configuration parameters is parsed to obtain the security level identifier of the data to be transmitted.

5. The method according to claim 3, characterized in that, The routing policy includes forwarding or blocking actions; the routing process for the data to be transmitted according to the pre-set routing policy corresponding to the security level identifier includes: If the routing policy corresponding to the security level identifier is forwarding behavior, then the target network address of the data to be transmitted is extracted from the transmission configuration parameters, and the data to be transmitted is forwarded to the target network address; If the routing policy corresponding to the security level identifier is a blocking action, then a blocking response is returned to the sending device.

6. A data transmission device, characterized in that, Applied to control surface equipment, the device includes: The generation module is used to generate transmission configuration parameters based on the target network address and security level identifier of the data to be transmitted; The sending module is used to send the transmission configuration parameters to the sending device of the data to be transmitted, so that the sending device can transmit the data to be transmitted based on the transmission configuration parameters.

7. A data transmission device, characterized in that, Applied to server-side equipment, the device includes: The parsing module is used to parse the data packets transmitted by the sending device to obtain the data to be transmitted and the transmission configuration parameters; the transmission configuration parameters are generated by the control plane device based on the target network address and security level identifier of the data to be transmitted, and then sent to the sending device. The routing module is used to extract the security level identifier of the data to be transmitted from the transmission configuration parameters, and to perform routing processing on the data to be transmitted according to a pre-set routing strategy corresponding to the security level identifier.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images