Data transmission method, system, electronic device, storage medium and program product

Abstract

The application discloses a data transmission method and system, electronic equipment, a storage medium and a program product. The application is applied to a data transmission system, the system comprises an outer network isolation subsystem and an inner network service subsystem, the method is executed by the inner network service subsystem, and comprises the following steps: receiving an internet protocol request sent by a protocol adapter based on an inner network address, the internet protocol request is obtained by converting an outer network request received by the outer connection load balancer through the protocol adapter, and the inner network address is obtained by converting an outer network address corresponding to the outer network request through a network address conversion gateway; controlling the number of internet protocol requests in the same specified time period to be not greater than a specified threshold; performing multiple security checks on the internet protocol request; if the check is passed, sending the internet protocol request to a target server, so that the target server executes logical processing of corresponding services based on the internet protocol request to obtain a processing result. Therefore, the security of data is improved.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to data transmission methods, systems, electronic devices, storage media, and program products. Background Technology

[0002] With the continuous development of digital business, government affairs, finance, industrial control and other sectors generally have network architectures with multiple security levels. Different security domains (for example, classified networks, office intranets, the Internet and production networks) need to be isolated to prevent cross-network penetration attacks, lateral spread of malicious code and leakage of sensitive data.

[0003] To prevent external network attacks from penetrating the internal network, existing technologies typically employ firewalls or isolation gateways to construct network isolation boundaries. Traditional network isolation technologies focus on blocking direct cross-network communication channels, lacking sophisticated control over cross-domain data flows, resulting in low data security. Therefore, a new data transmission method based on network isolation technology is urgently needed. Summary of the Invention

[0004] This invention provides a data transmission method, system, electronic device, storage medium, and program product to improve data security.

[0005] According to a first aspect of the present invention, a data transmission method is provided, applied to a data transmission system, the data transmission system including an external network isolation subsystem and an internal network service subsystem, wherein the external network isolation subsystem includes an external load balancer, a network address translation gateway, and a protocol adapter, and the data transmission method is executed by the internal network service subsystem, the method comprising: The protocol adapter receives an Internet Protocol (IP) request based on an internal network address, wherein the IP request is obtained by converting an external network request received by the external load balancer through the protocol adapter, and the internal network address is obtained by spoofing and converting the external network address corresponding to the external network request through the network address translation gateway. Control the number of Internet Protocol requests within the same specified time period to not exceed a specified threshold; Perform multiple security checks on the Internet Protocol request; If the multiple verifications pass, the Internet Protocol request is sent to the target server so that the target server can execute the corresponding financial business logic based on the Internet Protocol request, obtain the processing result, and return it.

[0006] According to another aspect of the present invention, a data transmission system is provided, the data transmission system comprising an external network isolation subsystem and an internal network service subsystem, wherein the external network isolation subsystem comprises an external load balancer, a network address translation gateway, and a protocol adapter, wherein: The external load balancer is used to receive requests from the external network; The network address translation gateway is used to spoof and translate the external network address corresponding to the external network request to obtain the internal network address; The protocol adapter is used to convert the external network request into an Internet Protocol request, and send the Internet Protocol request to the internal network service subsystem based on the internal network address; The intranet service subsystem is used to receive the Internet Protocol (IP) request, control the number of IP requests within the same specified time period to not exceed a specified threshold, and perform multiple security checks on the IP requests. If the multiple checks pass, the IP requests are sent to the target server so that the target server can perform the corresponding financial business logic processing based on the IP requests, obtain the processing results, and return them.

[0007] According to another aspect of the present invention, an electronic device is provided, the electronic device including at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data transmission method described in the first aspect.

[0008] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the data transmission method described in any embodiment of the present invention.

[0009] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the data transmission method as described in any embodiment of the present invention.

[0010] The technical solution of this invention involves receiving external network requests through an external load balancer in an external network isolation subsystem; then, spoofing and converting the external network address corresponding to the external network request through a network address translation gateway in the external network isolation subsystem to obtain an internal network address; next, converting the external network request through a protocol adapter in the external network isolation subsystem to obtain an Internet Protocol (IP) request, and sending the IP request to the internal network service subsystem based on the internal network address; after receiving the IP request, the internal network service subsystem controls the number of IP requests within the same specified time period to not exceed a specified threshold; and performs multiple security checks on the IP request; if the multiple checks pass, the IP request is sent to the target server, so that the target server can execute the corresponding financial business logic processing based on the IP request, obtain the processing result, and return it. Therefore, this embodiment first achieves physical isolation through an external network isolation subsystem, and then uses multiple security checks in the internal network subsystem to ensure data security, achieving dual protection of physical isolation and logical control, thus improving data security.

[0011] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a schematic diagram of the structure of a data transmission system provided according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating the data transmission method provided according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the signature verification process provided according to an embodiment of the present invention; Figure 4 This is a schematic diagram of the process for performing data decryption and verification using Internet Protocol requests according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the process for performing gray-scale route matching and verification on Internet Protocol requests according to an embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of the present invention. Detailed Implementation

[0014] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0015] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0016] Before introducing the data transmission method provided in the embodiments of this application, for ease of understanding, the data transmission system of the embodiments of this application will be described in detail below. Figure 1 This is a schematic diagram of the data transmission system. Figure 1 As can be seen, the data transmission system 100 includes an external network isolation subsystem 101 and an internal network service subsystem 102. The external network isolation subsystem 101 includes an external load balancer 1011, a network address translation gateway 1012, a server load balancing cluster 1013, and a protocol adapter 1014. The internal network service subsystem 102 includes an internal load balancer 1021, a server load balancing cluster 1022, and an access layer module 1023. Wherein: External load balancer 1011 is used to receive requests from the external network; Network Address Translation Gateway 1012 is used to spoof and translate the external network address corresponding to the external network request to obtain the internal network address; Server load balancing cluster 1013 is used to mount external load balancers in dual campuses to achieve priority scheduling of traffic within the same campus and has self-isolation and fault self-healing capabilities. Protocol adapter 1014 is used to convert the external network request into an Internet Protocol request, and send the Internet Protocol request to the internal network service subsystem based on the internal network address; An inline load balancer 1021 is used to receive the Internet Protocol request; Server load balancing cluster 1022 is used to mount dual-campus inline load balancers, supporting same-campus priority routing and fault self-recovery. The access layer module 1023 is used to control the number of Internet Protocol requests within the same specified time period to not exceed a specified threshold; and to perform multiple security checks on the Internet Protocol requests; if the multiple checks pass, the Internet Protocol requests are sent to the target server so that the target server can perform the corresponding financial business logic processing based on the Internet Protocol requests, obtain the processing results, and return them.

[0017] The data transmission method in the embodiments of this application will now be described in detail. This data transmission method is executed by the intranet service subsystem. Figure 2 A flowchart of a data transmission method provided in an embodiment of the present invention, from Figure 2 As can be seen from this, it may specifically include the following steps: S210: Receive the Internet Protocol request sent by the protocol adapter based on the internal network address, wherein the Internet Protocol request is obtained by converting the external network request received by the external load balancer through the protocol adapter, and the internal network address is obtained by spoofing and converting the external network address corresponding to the external network request through the network address translation gateway; S220: Controls the number of Internet Protocol requests within the same specified time period to not exceed a specified threshold; The specified threshold in this application embodiment is dynamically adjustable, and this application embodiment does not limit the specified threshold.

[0018] It should be noted that the specified time period in this application embodiment can be set according to the specific actual situation, and this application embodiment does not limit the specified time period.

[0019] S230: Perform multiple security checks on the Internet Protocol request; In one possible implementation, S230 can be specifically implemented as: performing signature verification, data decryption verification, and gray-scale route matching verification on the Internet Protocol request.

[0020] The signature verification in the embodiments of this application will be explained below. Figure 3 This is a flowchart illustrating the signature verification process, which may include the following steps: S310: Decrypt the message in the Internet Protocol request using the pre-set public key to obtain the decryption result; S320: Calculate the hash digest of the key fields in the Internet Protocol request to obtain the hash digest; S330: Compare the hash digest with the decryption result to determine whether the hash digest and the decryption result are the same. If yes, proceed to S340; otherwise, proceed to S350. S340: Signature verification confirmed; S350: Signature verification failed.

[0021] Therefore, the accuracy of signature verification is guaranteed in the embodiments of this application, further improving the security of data transmission.

[0022] Figure 4 This is a flowchart illustrating the process of decrypting and verifying data for Internet Protocol (IP) requests. It may include the following steps: S410: Decrypt the Internet Protocol request using a data decryption algorithm to obtain business data and pre-stored verification information; The data decryption algorithm in this application embodiment can be set according to the specific actual situation, and this application embodiment does not limit it.

[0023] S420: Based on the aforementioned business data, determine the target verification information; S430: Compare the target verification information with the pre-stored verification information. If yes, execute S440; otherwise, execute S450. S440: Data decryption confirmed successful; S450: Data decryption failed.

[0024] Therefore, in this embodiment of the application, after decryption is completed, a verification information comparison is added. That is, a low-cost verification operation is used to achieve strong verification of the authenticity and integrity of the data, thereby preventing the data from being tampered with.

[0025] Figure 5 This is a flowchart illustrating the process of performing gray-scale route matching and verification for Internet Protocol requests. Specifically, it may include the following steps: S510: Obtain the target field from the Internet Protocol request; The target field in this embodiment can be the header field. This embodiment does not limit the target field; the target field can be set according to specific circumstances.

[0026] S520: Using the pre-set correspondence between each target field and each server, determine whether there is a target server corresponding to the target field in the Internet Protocol request. If there is, execute S530; if not, execute S540. S530: Gray-scale route matching verification has passed; S540: Gray-scale route matching verification failed.

[0027] Therefore, in this embodiment of the application, the correctness and stability of new routing strategies, new functions or new services are verified securely without affecting all users, while achieving refined traffic control and risk isolation.

[0028] S240: If the multi-verification passes, the Internet Protocol request is sent to the target server so that the target server can perform the corresponding financial business logic processing based on the Internet Protocol request, obtain the processing result, and return it.

[0029] In one possible implementation, the success of the multi-check is determined by the following method: If the signature verification, data decryption, and gray-scale route matching verification all pass, then the multi-verification is considered successful; otherwise, the multi-verification is considered unsuccessful.

[0030] The data transmission device provided in the embodiments of the present invention can execute the data transmission method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0031] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0032] The information collected is information and data authorized by the user or fully authorized by all parties. The collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant countries and regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation portals are provided for users to choose to authorize or refuse.

[0033] Provide users with corresponding operation entry points, allowing them to choose to agree to or reject the automated decision results; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0034] Figure 6A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0035] like Figure 6 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0036] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0037] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as data transfer methods.

[0038] In some embodiments, the data transfer method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and / or installed on an electronic device via ROM and / or a communication unit. When the computer program is loaded into RAM and executed by a processor, one or more steps of the data transfer method may be performed. Alternatively, in other embodiments, the processor may be configured to perform the data transfer method by any other suitable means (e.g., by means of firmware).

[0039] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0040] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0041] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0042] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0043] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0044] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0045] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0046] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A data transmission method, characterized in that, This is applied to a data transmission system, which includes an external network isolation subsystem and an internal network service subsystem. The external network isolation subsystem includes an external load balancer, a network address translation gateway, and a protocol adapter. The data transmission method is executed by the internal network service subsystem, and the method includes: The protocol adapter receives an Internet Protocol (IP) request based on an internal network address, wherein the IP request is obtained by converting an external network request received by the external load balancer through the protocol adapter, and the internal network address is obtained by spoofing and converting the external network address corresponding to the external network request through the network address translation gateway. Control the number of Internet Protocol requests within the same specified time period to not exceed a specified threshold; Perform multiple security checks on the Internet Protocol request; If the multiple verifications pass, the Internet Protocol request is sent to the target server so that the target server can execute the corresponding financial business logic based on the Internet Protocol request, obtain the processing result, and return it.

2. The method according to claim 1, characterized in that, The multiple security checks performed on the Internet Protocol request include: The Internet Protocol request is subject to signature verification, data decryption verification, and gray-scale route matching verification.

3. The method according to claim 2, characterized in that, The signature verification of the Internet Protocol request includes: The message in the Internet Protocol request is decrypted using a pre-set public key to obtain the decryption result; A hash digest is calculated by performing a hash digest calculation on the key fields in the Internet Protocol request. The hash digest is compared with the decryption result to determine whether the hash digest and the decryption result are the same; If so, then the signature verification is successful; If not, then the signature verification failed.

4. The method according to claim 2, characterized in that, Performing data decryption verification on the Internet Protocol request includes: The Internet Protocol request is decrypted using a data decryption algorithm to obtain business data and pre-stored verification information; Based on the aforementioned business data, the target verification information is determined; The target verification information is compared with the pre-stored verification information; If they are the same, then the data decryption was successful; If they are different, then the data decryption has failed.

5. The method according to claim 2, characterized in that, Performing gray-scale route matching verification on the Internet Protocol request includes: Retrieve the target field from the Internet Protocol request; By using the pre-set correspondence between each target field and each server, it is determined whether there is a target server corresponding to the target field in the Internet Protocol request; If it exists, then the grayscale route matching verification is considered successful; If it does not exist, then the grayscale route matching verification has failed.

6. The method according to claim 2, characterized in that, Determine whether the multi-check method passes using the following method: If the signature verification passes, the data decryption succeeds, and the gray-scale route matching verification passes, then the multi-verification is considered successful. Otherwise, the multi-validation process is deemed to have failed.

7. A data transmission system, characterized in that, The data transmission system includes an external network isolation subsystem and an internal network service subsystem. The external network isolation subsystem includes an external load balancer, a network address translation gateway, and a protocol adapter, wherein: The external load balancer is used to receive requests from the external network; The network address translation gateway is used to spoof and translate the external network address corresponding to the external network request to obtain the internal network address; The protocol adapter is used to convert the external network request into an Internet Protocol request, and send the Internet Protocol request to the internal network service subsystem based on the internal network address; The intranet service subsystem is used to receive the Internet Protocol (IP) request, control the number of IP requests within the same specified time period to not exceed a specified threshold, and perform multiple security checks on the IP requests. If the multiple checks pass, the IP requests are sent to the target server so that the target server can perform the corresponding financial business logic processing based on the IP requests, obtain the processing results, and return them.

8. An electronic device, characterized in that, The electronic device includes at least one processor; and a memory communicatively connected to the at least one processor; wherein... The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data transmission method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the data transmission method according to any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the data transmission method according to any one of claims 1-6.

Images