Data transmission method and apparatus, and computer device, storage medium and program product

Abstract

The present application relates to a data transmission method and apparatus, and a computer device, a storage medium and a program product. The method comprises: receiving a data checking rule, which is sent by a zero-trust controller, and a data packet to be transmitted, which is sent by a zero-trust proxy node, wherein said data packet is obtained after the zero-trust proxy node adds check data into an initial data packet; performing data checking on the check data in said data packet according to the data checking rule, so as to obtain a data check result; and according to the data checking result, determining whether to transmit said data packet to a database.

Description

Data transmission method, device, computer equipment, storage medium and program product

[0001] Related applications

[0002] This application claims priority to Chinese patent application number 2023109131905, filed on July 25, 2023, entitled “Data transmission method, device, computer equipment, storage medium and program product,” the entire text of which is hereby incorporated by reference. Technical Field

[0003] The present application relates to the field of information security technology, and in particular to a data transmission method, apparatus, computer equipment, storage medium, and program product. Background Art

[0004] With the development of computer technology, zero-trust networks have emerged. Zero-trust networks are networks where there is no trust between users and data is transmitted anonymously.

[0005] Traditional technology can transmit IP data packets based on the TCP / IP protocol (Transmission Control Protocol / Internet Protocol) in a zero-trust network, thereby achieving data transmission.

[0006] Security issues during data transmission are of paramount importance.

[0007] Summary of the Invention

[0008] In a first aspect, the present application provides a data transmission method. Applied to a zero-trust gateway in a zero-trust communication network, the method comprises:

[0009] Receive data verification rules sent by the zero-trust controller and a data packet to be transmitted sent by the zero-trust agent node; the data packet to be transmitted is obtained by the zero-trust agent node adding verification data to the initial data packet;

[0010] Performing data verification on the verification data in the data packet to be transmitted according to the data verification rule to obtain a data verification result;

[0011] Determine whether to transmit the data packet to be transmitted to the database according to the data verification result.

[0012] In one embodiment, the verification data includes user session information and user signature information, the user session information is used to indicate address information and session count information generated during the process of establishing a session connection with the zero-trust proxy node, and the user signature information is used to indicate the identity parameters of the user sending the initial data packet. The data verification rules include user session information verification rules and data signature verification rules; performing data verification on the verification data in the data packet to be transmitted according to the data verification rules to obtain a data verification result includes:

[0013] Performing data verification on the user session information in the data packet to be transmitted according to the user session information verification rule to generate a first data verification result;

[0014] Performing data verification on the user signature information in the data packet to be transmitted according to the data signature verification rule to generate a second data verification result;

[0015] The data verification result is generated according to the first data verification result and the second data verification result.

[0016] In one embodiment, performing data verification on the user session information in the data packet to be transmitted according to the user session information verification rule to generate a first data verification result includes:

[0017] Determine the network address type of the data packet to be transmitted according to the address information; the network address type includes a public network address type and a private network address type;

[0018] Determining whether it is necessary to update the source network address in the data packet to be transmitted according to the network address type of the data packet to be transmitted, and generating an intermediate data packet;

[0019] The session counting information in the intermediate data packet is verified according to the user session information verification rule to generate the first data verification result.

[0020] In one embodiment, determining whether it is necessary to update the source network address in the data packet to be transmitted based on the network address type of the data packet to be transmitted and generating the intermediate data packet includes:

[0021] If the network address type of the data packet to be transmitted is the private network address type, the data packet to be transmitted is used as the intermediate data packet;

[0022] If the network address type of the data packet to be transmitted is the public network address type, the source network address in the data packet to be transmitted is updated to the public network address corresponding to the data packet to be transmitted to generate the intermediate data packet.

[0023] In one embodiment, performing data verification on the user signature information in the data packet to be transmitted according to the data signature verification rule to generate a second data verification result includes:

[0024] The user signature information in the intermediate data packet is subjected to data verification according to the data signature verification rule to generate the second data verification result.

[0025] In one embodiment, the method further comprises:

[0026] Determining data packets that fail verification from the data packets to be transmitted, and generating abnormal session information based on the data packets that fail verification;

[0027] The abnormal session information is sent to the zero trust controller; the abnormal session information is used to instruct the zero trust controller to analyze the abnormal session information and send a session termination instruction to the zero trust agent node.

[0028] In one embodiment, the data verification rule is generated based on user standard signature information and user standard session information, wherein the user standard signature information includes user public key information and user identity standard information.

[0029] In one embodiment, the user standard signature information is obtained from the user certificate when the user certificate is verified.

[0030] In a second aspect, the present application further provides a data transmission method. Applied to a zero-trust controller in a zero-trust communication network, the method comprises:

[0031] Receive user certificates and user standard session information sent by the zero-trust agent node;

[0032] generating data verification rules based on the user certificate and user standard session information;

[0033] The data verification rule is sent to the zero trust gateway; the data verification rule is used to instruct the zero trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rule to obtain a data verification result; and determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

[0034] In one embodiment, generating the data verification rule based on the user certificate and the user standard session information includes:

[0035] Verifying the user certificate and generating a certificate verification result;

[0036] If the certificate verification result is that the certificate verification is passed, obtaining user standard signature information from the user certificate, wherein the user standard signature information includes user public key information and user standard identity information; and

[0037] The data verification rule is generated according to the user standard signature information and the user standard session information.

[0038] In a third aspect, the present application also provides a data transmission method. Applied to a zero-trust proxy node in a zero-trust communication network, the method comprises:

[0039] Obtain user credentials, user standard session information, and initial data packet;

[0040] Sending the user certificate and the user standard session information to a zero trust controller, so that the zero trust controller generates a data verification rule based on the user certificate and the user standard session information, and sends the data verification rule to a zero trust gateway;

[0041] Add verification data to the initial data packet to generate a data packet to be transmitted, and send the data packet to be transmitted to the zero-trust gateway; the data packet to be transmitted is used to instruct the zero-trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rule to obtain a data verification result; determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

[0042] In one embodiment, when the user certificate is verified, the zero-trust controller obtains the user standard signature information from the user certificate and generates data verification rules based on the standard signature information and the user standard session information, wherein the user standard signature information includes user public key information and user identity standard information.

[0043] In a fourth aspect, the present application further provides a data transmission device. Applicable to a zero-trust gateway in a zero-trust communication network, the device comprises:

[0044] A module for receiving data packets to be transmitted, configured to receive data verification rules sent by a zero-trust controller and data packets to be transmitted sent by a zero-trust agent node; the data packets to be transmitted are obtained by adding verification data to the initial data packets by the zero-trust agent node;

[0045] A data verification module is used to perform data verification on the verification data in the data packet to be transmitted according to the data verification rule to obtain a data verification result;

[0046] The data transmission module is used to determine whether to transmit the data packet to be transmitted to the database according to the data verification result.

[0047] In a fifth aspect, the present application further provides a data transmission device. Applicable to a zero-trust controller in a zero-trust communication network, the device comprises:

[0048] An information receiving module is used to receive user certificates and user standard session information sent by the zero-trust agent node;

[0049] A data verification rule generation module, configured to generate data verification rules based on the user certificate and user standard session information;

[0050] A data verification rule sending module is used to send the data verification rule to the zero trust gateway; the data verification rule is used to instruct the zero trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rule to obtain a data verification result; and determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

[0051] In a sixth aspect, the present application further provides a data transmission device. Applied to a zero-trust proxy node in a zero-trust communication network, the device comprises:

[0052] Information acquisition module, used to obtain user certificates, user standard session information and initial data packets;

[0053] An information sending data verification module is used to send the user certificate and the user standard session information to the zero trust controller, so that the zero trust controller generates a data verification rule based on the user certificate and the user standard session information, and sends the data verification rule to the zero trust gateway;

[0054] The module for generating data packets to be transmitted is used to add verification data to the initial data packet to generate a data packet to be transmitted, and send the data packet to be transmitted to the zero-trust gateway; the data packet to be transmitted is used to instruct the zero-trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rules to obtain a data verification result; and determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

[0055] In the seventh aspect, the present application also provides a zero-trust gateway, including a transceiver, a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program to perform the steps of the method in any one of the embodiments of the first aspect above.

[0056] In an eighth aspect, the present application further provides a zero-trust controller, comprising a transceiver, a processor, and a memory, wherein the memory stores a computer program, and the processor executes the computer program to control the transceiver to receive a user certificate and user standard session information sent by a zero-trust agent node;

[0057] used to control the processor to generate a data verification rule according to the user certificate and user standard session information;

[0058] Used to control the transceiver to send the data verification rules to the zero trust gateway; the data verification rules are used to instruct the zero trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rules to obtain a data verification result; and determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

[0059] In a ninth aspect, the present application further provides a zero-trust agent node, comprising a transceiver, a processor, and a memory, wherein the memory stores a computer program, and the processor executes the computer program to control the transceiver to obtain a user certificate, user standard session information, and an initial data packet;

[0060] Used to control the transceiver to send the user certificate and the user standard session information to the zero trust controller, so that the zero trust controller generates a data verification rule based on the user certificate and the user standard session information, and sends the data verification rule to the zero trust gateway;

[0061] Used to control the processor and the transceiver to add verification data to the initial data packet, generate a data packet to be transmitted, and send the data packet to be transmitted to the zero trust gateway; the data packet to be transmitted is used to instruct the zero trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rule to obtain a data verification result; determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

[0062] In a tenth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method in any one of the embodiments of the first to third aspects above.

[0063] In an eleventh aspect, the present application further provides a computer program product, comprising a computer program that, when executed by a processor, implements the steps of the method in any one of the embodiments of the first to third aspects.

[0064] In the twelfth aspect, the present application also provides a device configured to execute the method steps in any one of the embodiments of the first to third aspects above.

[0065] The details of one or more embodiments of the present application are set forth in the following drawings and description. Other features, objects, and advantages of the present application will become apparent from the description, drawings, and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the disclosed drawings without any creative work.

[0067] FIG1 is a diagram illustrating an application environment of a data transmission method according to an embodiment;

[0068] FIG2 is a flow chart of a data transmission method corresponding to a zero-trust gateway in one embodiment;

[0069] FIG3 is a schematic diagram of a flow chart of a data verification step in one embodiment;

[0070] FIG4 is a schematic flow chart of a step of generating a first data verification result in one embodiment;

[0071] FIG5 is a flow chart of the steps of sending abnormal session information in one embodiment;

[0072] FIG6 is a flow chart of a data transmission method corresponding to a zero-trust controller in another embodiment;

[0073] FIG7 is a flow chart of a data transmission method corresponding to a zero-trust proxy node in another embodiment;

[0074] FIG8 is a schematic diagram of the structure of a data packet to be transmitted in one embodiment;

[0075] FIG9 is a flow chart of a data transmission method corresponding to a zero-trust gateway in an optional embodiment;

[0076] FIG10 is a schematic diagram of the structure of a communication system corresponding to a zero-trust communication network in one embodiment;

[0077] FIG11 is a schematic diagram of a process for performing data verification and data transmission in a zero-trust communication network according to an embodiment;

[0078] FIG12 is a structural block diagram of a data transmission device corresponding to a zero-trust gateway in one embodiment;

[0079] FIG13 is a structural block diagram of a data transmission device corresponding to a zero-trust controller in one embodiment;

[0080] FIG14 is a structural block diagram of a data transmission device corresponding to a zero-trust proxy node in one embodiment;

[0081] FIG15 is a schematic diagram of the internal structure of a zero-trust gateway in one embodiment;

[0082] FIG16 is a schematic diagram of the internal structure of a zero-trust controller in another embodiment;

[0083] Figure 17 is a schematic diagram of the internal structure of a zero-trust agent node in another embodiment. DETAILED DESCRIPTION

[0084] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0085] With the development of computer technology, zero-trust networks have emerged. Zero-trust networks are networks where there is no trust between users and data is transmitted anonymously.

[0086] Traditional technology can transmit IP data packets based on the TCP / IP protocol (Transmission Control Protocol / Internet Protocol) in a zero-trust network, thereby achieving data transmission.

[0087] However, in the traditional data transmission process, there are security issues such as data being forged, tampered, and replay attacks. Therefore, the traditional data transmission method has the problem of low security.

[0088] The data transmission method provided in the embodiment of the present application can be applied to the application environment shown in Figure 1. Among them, the communication system 100 corresponding to the zero-trust communication network (i.e., zero-trust network) includes a zero-trust agent node 102, a zero-trust controller 104, a zero-trust gateway 106 and a database. The zero-trust agent node 102 can obtain data from the user terminal, and the zero-trust agent node 102 can send data to the zero-trust gateway 106 through the communication network, and the zero-trust agent node 102 can also send data to the zero-trust controller 104. Among them, the communication network includes a public network and a local area network. The zero-trust controller 104 can send data to the zero-trust gateway 106. The zero-trust gateway 106 can transmit data to the database, or the zero-trust gateway 106 can also transmit data to the zero-trust controller 104. In an embodiment of the present application, the zero trust gateway 106 receives the data verification rules sent by the zero trust controller 104 and the data packet to be transmitted sent by the zero trust agent node 102; the data packet to be transmitted is obtained after the zero trust agent node 102 adds verification data to the initial data packet; the zero trust gateway 106 performs data verification on the verification data in the data packet to be transmitted according to the data verification rules to obtain a data verification result; the zero trust gateway 106 determines whether to transmit the data packet to be transmitted to the database based on the data verification result.

[0089] User terminals may include, but are not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices may include smart speakers, smart TVs, smart air conditioners, and smart car devices. Portable wearable devices may include smart watches, smart bracelets, and head-mounted devices. Zero trust agent node 102, zero trust controller 104, and zero trust gateway 106 may all be implemented using independent servers or a server cluster consisting of multiple servers.

[0090] In one embodiment, as shown in FIG2 , a data transmission method is provided, which is described by taking the method applied to the zero trust gateway 106 in the zero trust communication network in FIG1 as an example, including the following steps:

[0091] S220, receiving the data verification rules sent by the zero trust controller and the data packet to be transmitted sent by the zero trust agent node; the data packet to be transmitted is obtained after the zero trust agent node adds verification data to the initial data packet.

[0092] A zero-trust communication network, also known as a zero-trust network, refers to a network where there is no trust between users and data is transmitted anonymously. The communication system corresponding to a zero-trust communication network includes zero-trust agent nodes, a zero-trust controller, a zero-trust gateway, and a database. Data verification rules are rules generated by zero-trust agent nodes and are used to verify the data in data packets to be transmitted. Data packets to be transmitted are data packets that require data verification and can only be transmitted after data verification passes. Data packets to be transmitted are the data packets obtained by the zero-trust agent node by adding verification data to the initial data packet. The initial data packet refers to the data packet obtained from the user terminal. Verification data refers to the data in the data packet to be transmitted used for data verification.

[0093] In some embodiments, since the communication system 100 corresponding to the zero-trust communication network includes a zero-trust agent node 102, a zero-trust controller 104, a zero-trust gateway 106, and a database, and both the zero-trust agent node 102 and the zero-trust controller 104 can send data to the zero-trust gateway 106, the zero-trust gateway 106 can optionally simultaneously receive the data verification rules sent by the zero-trust controller 104 and the data packet to be transmitted sent by the zero-trust agent node 102; alternatively, the zero-trust gateway 106 can first receive the data verification rules sent by the zero-trust controller 104, and then receive the data packet to be transmitted sent by the zero-trust agent node 102; alternatively, the zero-trust gateway 106 can first receive the data packet to be transmitted sent by the zero-trust agent node 102, and then receive the data verification rules sent by the zero-trust controller 104. It should be noted that in the embodiments of the present application, there is no limitation on the time sequence of the zero-trust gateway 106 receiving the data verification rules and receiving the data packet to be transmitted.

[0094] S240 , performing data verification on the verification data in the data packet to be transmitted according to a data verification rule to obtain a data verification result.

[0095] In some implementations, the zero-trust gateway 106 can perform data verification on the verification data in the data packet to be transmitted according to the data verification rules to obtain a data verification result. For example, it is assumed that the data verification rule includes a verification data threshold, and the data verification rule is: if the verification data is less than or equal to the verification data threshold, it means that the data verification is passed. Then, the zero-trust gateway 106 can compare the verification data threshold with the verification data in the data packet to be transmitted, thereby generating a data verification result. Among them, the data verification rules and the verification data threshold can be set according to the data packet, and the embodiment of the present application does not limit this. The data verification results include data verification passed and data verification failed.

[0096] S260: Determine whether to transmit the data packet to be transmitted to the database according to the data verification result.

[0097] In some implementations, the zero-trust gateway 106 may determine whether to transmit the data packet to be transmitted to the database based on the data verification result. For example, if the data verification result indicates that the data verification has passed, the zero-trust gateway 106 may transmit the data packet to be transmitted to the database. If the data verification result indicates that the data verification has failed, the zero-trust gateway 106 may discard the data packet to be transmitted.

[0098] In the above-mentioned data transmission method, data verification rules sent by a zero-trust controller and a data packet to be transmitted sent by a zero-trust proxy node are received; the data packet to be transmitted is obtained by the zero-trust proxy node adding verification data to the initial data packet; the verification data in the data packet to be transmitted is performed according to the data verification rules to obtain a data verification result; and based on the data verification result, a determination is made as to whether to transmit the data packet to be transmitted to the database. In the embodiment of the present application, the zero-trust proxy node can add verification data to the initial data packet to obtain a repackaged data packet to be transmitted. Thus, the zero-trust gateway can receive the data verification rules sent by the zero-trust controller and the repackaged data packet to be transmitted sent by the zero-trust proxy node, and perform data verification on the verification data in the repackaged data packet to be transmitted according to the data verification rules to obtain a more accurate data verification result. Furthermore, based on the more accurate data verification result, a determination can be made as to whether to transmit the data packet to be transmitted to the database. Because the present application requires that the verification data in the repackaged data packet to be transmitted be first verified according to the data verification rules, and because the present application can only transmit data packets to be transmitted that pass the data verification, the security of the data transmission process can be improved.

[0099] In the above embodiment, data verification is performed on the verification data in the transmitted data packet according to the data verification rules to obtain the data verification result. The specific method is described below. In one embodiment, the verification data includes user session information and user signature information. The user session information is used to indicate the address information and session count information generated during the establishment of the session connection with the zero-trust proxy node. The user signature information is used to indicate the identity parameters of the user who sent the initial data packet. The data verification rules include user session information verification rules and data signature verification rules. As shown in Figure 3, S240 includes:

[0100] S320: Perform data verification on the user session information in the data packet to be transmitted according to a user session information verification rule to generate a first data verification result.

[0101] Among them, the verification data may include but is not limited to user session information and user signature information. The user session information is used to indicate the address information and session count information generated during the process of establishing a session connection with the zero-trust agent node. The address information includes information such as the source network address, the destination network address, and the network address of the data packet to be transmitted. The session count information refers to the number of session information. The user signature information is used to indicate the identity parameters of the user who sent the initial data packet. The identity parameters may include but are not limited to the user name, the user's identity authentication identifier, etc. Thus, the zero-trust gateway 106 can receive verification data such as address information, session count information, and user identity parameters. The data verification rules include user session information verification rules and data signature verification rules. The user session information verification rules refer to the rules for performing data verification on user session information such as address information and session count information, and the data signature verification rules refer to the rules for performing data verification on user signature information.

[0102] In some implementations, the zero-trust gateway 106 may perform data verification on the user session information in the data packet to be transmitted according to the user session information verification rule, and generate a first data verification result. For example, it is assumed that the user session information verification rule includes a session information threshold, and the user session information verification rule is: if the user session information is less than or equal to the session information threshold, it means that the session information verification has passed. Then, the zero-trust gateway 106 may compare the session information threshold with the user session information in the data packet to be transmitted, thereby generating a first data verification result. Among them, the user session information verification rule and the session information threshold can be set according to the data packet, which is not limited in the embodiment of the present application. The first data verification result includes the session information verification passing and the session information verification failing.

[0103] S340: Perform data verification on the user signature information in the data packet to be transmitted according to a data signature verification rule to generate a second data verification result.

[0104] In some implementations, the zero-trust gateway 106 can perform data verification on the user signature information in the data packet to be transmitted according to the data signature verification rules, and generate a second data verification result. For example, it is assumed that the data signature verification rules include a data signature threshold, and the data signature verification rules are: if the user signature information is less than or equal to the data signature threshold, it means that the data signature verification is passed. Then, the zero-trust gateway 106 can compare the data signature threshold with the user signature information in the data packet to be transmitted, thereby generating a second data verification result. Among them, the data signature verification rules and the data signature threshold can be set according to the data packet, and the embodiments of the present application do not limit this. The second data verification result includes the data signature verification passing and the data signature verification failing.

[0105] S360: Generate a data verification result based on the first data verification result and the second data verification result.

[0106] In some implementations, the zero-trust gateway 106 can determine whether the session information verification has passed and whether the data signature verification has passed based on the first data verification result and the second data verification result. If the first data verification result is that the session information verification has passed, and the second data verification result is that the data signature verification has passed, that is, both the session information verification and the data signature verification have passed, then the data verification result is determined to be that the data verification has passed. If the first data verification result is that the session information verification has failed, and / or the second data verification result is that the data signature verification has failed, that is, at least one of the session information verification and the data signature verification has failed, then the data verification result is determined to be that the data verification has failed.

[0107] In this embodiment, since the verification data includes user session information and user signature information, and the data verification rules include user session information verification rules and data signature verification rules, performing data verification on the user session information in the data packet to be transmitted according to the user session information verification rules can more accurately generate a first data verification result; and performing data verification on the user signature information in the data packet to be transmitted according to the data signature verification rules can more accurately generate a second data verification result. Thus, a more accurate data verification result can be generated based on the more accurate first data verification result and the more accurate second data verification result.

[0108] In the above embodiment, the user session information in the transmission data packet is verified according to the user session information verification rule to generate a first data verification result. The specific method is described below. In one embodiment, as shown in Figure 4, S320 includes:

[0109] S420, determining the network address type of the data packet to be transmitted according to the address information; the network address type includes a public network address type and a private network address type.

[0110] In some implementations, the zero-trust gateway 106 can obtain the network address of the data packet to be transmitted from the address information of the data packet to be transmitted, and determine the network address type of the data packet to be transmitted based on the network address of the data packet to be transmitted. The network address type includes a public network address type and a private network address type. A public network address refers to an address that can be directly accessed on the Internet. A private network address refers to an address that can be directly accessed on a private network. A private network is a local area network, which is a regional network formed in a local area. Only computer devices within a specific area can access the private network. For example, if the network address of the data packet to be transmitted is a private network address, the zero-trust gateway 106 can determine that the network address type of the data packet to be transmitted is a private network address type; if the network address of the data packet to be transmitted is a public network address, the zero-trust gateway 106 can determine that the network address type of the data packet to be transmitted is a public network address type.

[0111] S440: Determine whether the source network address in the data packet to be transmitted needs to be updated according to the network address type of the data packet to be transmitted, and generate an intermediate data packet.

[0112] In some implementations, the zero-trust gateway 106 can determine, based on the network address type of the data packet to be transmitted, whether the network address of the data packet to be transmitted is a public network address or a private network address, thereby determining whether the source network address in the data packet to be transmitted needs to be updated, and then generating an intermediate data packet. The intermediate data packet is a data packet generated based on the network address type of the data packet to be transmitted.

[0113] In one embodiment, S440 includes:

[0114] If the network address type of the data packet to be transmitted is a private network address type, the data packet to be transmitted will be used as an intermediate data packet.

[0115] If the network address type of the data packet to be transmitted is a public network address type, the source network address in the data packet to be transmitted is updated to the public network address corresponding to the data packet to be transmitted, and an intermediate data packet is generated.

[0116] If the network address type of the data packet to be transmitted is a private network address type, that is, the network address sending the data packet to be transmitted is a private network address, it means that the network address translation (NAT) of the data packet to be transmitted has not been performed. In this case, the source network address in the data packet to be transmitted is the same as the private network address. Therefore, the zero trust gateway 106 can directly use the data packet to be transmitted as an intermediate data packet without updating the data packet to be transmitted.

[0117] If the network address type of the data packet to be transmitted is a public network address type, that is, the network address of the data packet to be transmitted is a public network address, then it means that the data packet to be transmitted has been subjected to Network Address Translation (NAT). At this time, the source network address in the data packet to be transmitted is still a private network address, but the real network address of the data packet to be transmitted is a public network address, that is, the source network address in the data packet to be transmitted is different from the real network address (i.e., the public network address). Therefore, the zero-trust gateway 106 can update the source network address in the data packet to be transmitted to the public network address corresponding to the data packet to be transmitted, thereby generating an intermediate data packet.

[0118] S460: Perform data verification on the session counting information in the intermediate data packet according to the user session information verification rule to generate a first data verification result.

[0119] In some implementations, the zero-trust gateway 106 may perform data verification on the session count information in the intermediate data packet according to the user session information verification rules to generate a first data verification result. For example, assuming that the user session information verification rules include a standard session count, and the user session information verification rules include: if the session count information in the intermediate data packet is less than or equal to the standard session count, it means that the session information verification has passed. Then, the zero-trust gateway 106 may compare the standard session count with the session count information in the intermediate data packet to generate a first data verification result. Among them, the user session information verification rules and the standard session count can be set according to the data packet, and the embodiments of the present application are not limited to this. It should be noted that, according to the verification process of the session count information, the zero-trust gateway 106 can determine whether redundant session information is received. If redundant session information is received, it indicates that a replay attack has occurred. At this time, the first data verification result is that the session information verification has failed, thereby effectively avoiding the occurrence of a replay attack.

[0120] In this embodiment, by determining the network address type of the data packet to be transmitted based on the address information, it is possible to more accurately determine whether the network address type is a public or private network address type. Consequently, based on the network address type of the data packet to be transmitted, it is possible to more accurately determine whether the source network address in the data packet to be transmitted needs to be updated, thereby generating an intermediate data packet containing an accurate source network address. Furthermore, by performing data verification on the session count information in the intermediate data packet containing the accurate source network address according to the user session information verification rules, a first data verification result can be more accurately generated.

[0121] In the above embodiment, data verification of the user signature information in the data packet to be transmitted is performed according to the data signature verification rule to generate a second data verification result. The specific method is described below. In one embodiment, S340 includes:

[0122] The user signature information in the intermediate data packet is verified according to the data signature verification rule to generate a second data verification result.

[0123] In some implementations, the zero-trust gateway 106 can perform data verification on the user signature information in the intermediate data packet according to the data signature verification rules to generate a second data verification result. For example, it is assumed that the user session information verification rules include a user standard signature, and the user session information verification rules include: if the user signature information in the intermediate data packet is equal to the user standard signature, it means that the session information verification is passed. Then, the zero-trust gateway 106 can compare the user standard signature with the user signature information in the intermediate data packet to generate a second data verification result. Among them, the user session information verification rules and the user standard signature can be set according to the data packet, and the embodiments of the present application are not limited to this.

[0124] In this embodiment, data verification is performed on the user signature information in the intermediate data packet containing the accurate source network address according to the data signature verification rule, so that the second data verification result can be generated more accurately.

[0125] In the above embodiment, it is involved to determine whether to transmit the data packet to be transmitted to the database based on the data verification result. The specific method of another embodiment is introduced below. In one embodiment, as shown in Figure 5, the above data transmission method further includes:

[0126] S520 , determining data packets that fail verification from the data packets to be transmitted, and generating abnormal session information according to the data packets that fail verification.

[0127] In some implementations, if the data verification result of a data packet to be transmitted indicates that the data verification has failed, i.e., at least one of the session information verification and the data signature verification has failed, the zero-trust gateway 106 may determine that the data packet to be transmitted is a data packet that has failed verification. Based on this, the zero-trust gateway 106 may determine the data packet that has failed verification from the data packets to be transmitted and, based on the data packet that has failed verification, generate abnormal session information corresponding to the data packet that has failed verification. The zero-trust gateway 106 may then discard the data packet that has failed verification.

[0128] S540, sending the abnormal session information to the zero trust controller; the abnormal session information is used to instruct the zero trust controller to analyze the abnormal session information and send a session termination instruction to the zero trust agent node.

[0129] In some implementations, the zero trust gateway 106 may send abnormal session information to the zero trust controller 104. The abnormal session information indicates that the session information corresponding to the data packet to be transmitted is abnormal. The abnormal session information is used to instruct the zero trust controller 104 to analyze the abnormal session information and send a session termination instruction to the zero trust agent node 102. The session termination instruction is used to instruct the termination of the session corresponding to the abnormal session information.

[0130] In this embodiment, packets that fail verification are identified from the packets to be transmitted, and abnormal session information is generated relatively accurately based on the packets that failed verification. This relatively accurate abnormal session information is then sent to the zero-trust controller, which analyzes the abnormal session information and sends a session termination instruction to the zero-trust proxy node, thereby terminating the abnormal session based on the abnormal session information.

[0131] In one embodiment, as shown in FIG6 , a data transmission method is further provided. The method is described by taking the application of the method to the zero trust controller 104 in the zero trust communication network in FIG1 as an example, and includes the following steps:

[0132] S620, receiving the user certificate and user standard session information sent by the zero trust agent node.

[0133] In some implementations, the zero trust controller 104 may receive a user certificate and user standard session information sent by the zero trust agent node 102. The user certificate is a certificate issued to the user by a certificate authority (CA). The user standard session information may include, but is not limited to, the user's actual five-tuple information. The five-tuple information typically includes the source network address, source port, destination network address, destination port, and transport layer protocol.

[0134] S640: Generate data verification rules based on the user certificate and the user standard session information.

[0135] In some implementations, the zero trust controller 104 may perform certificate verification on the user certificate and generate a certificate verification result. If the certificate verification result is that the certificate verification is passed, the zero trust controller 104 may obtain the user standard signature information from the user certificate. Thus, the zero trust controller 104 may generate data verification rules based on the user standard signature information and the user standard session information. The user standard signature information includes the user public key information and the user standard identity information. The user public key information is used to encrypt the user standard identity information. The user standard identity information may include the user's real identity parameters. The data verification rules include verification rules corresponding to the user standard signature information and verification rules corresponding to the user standard session information.

[0136] S660, sending data verification rules to the zero-trust gateway; the data verification rules are used to instruct the zero-trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rules to obtain a data verification result; and determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

[0137] In some implementations, the zero-trust controller 104 can send data verification rules to the zero-trust gateway 106, so that the zero-trust gateway 106 performs data verification on the verification data in the data packet to be transmitted according to the data verification rules to obtain a data verification result. Thus, the zero-trust gateway 106 determines whether to transmit the data packet to be transmitted to the database based on the data verification result. The steps for data verification and data transmission performed by the zero-trust gateway 106 are described in detail in the above embodiment and are not further described here.

[0138] In the above-mentioned data transmission method, the user certificate and user standard session information sent by the zero-trust proxy node are received, and relatively accurate user certificate and user standard session information can be obtained. Thus, based on the relatively accurate user certificate and user standard session information, relatively accurate data verification rules can be generated, and the relatively accurate data verification rules can be sent to the zero-trust gateway. The relatively accurate data verification rules are used to instruct the zero-trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rules, and obtain a data verification result; based on the data verification result, it is determined whether to transmit the data packet to be transmitted to the database.

[0139] In one embodiment, as shown in FIG7 , a data transmission method is further provided. The method is described by taking the application of the method to the zero trust agent node 102 in the zero trust communication network in FIG1 as an example, and includes the following steps:

[0140] S720: Obtain user certificate, user standard session information, and initial data packet.

[0141] In some implementations, the zero-trust proxy node 102 can obtain a user certificate from a user terminal. The zero-trust proxy node 102 can also establish a session connection with the zero-trust gateway 106 to generate standard user session information. The zero-trust proxy node 102 can also obtain an initial data packet from the user terminal. The initial data packet refers to a data packet without verification data added.

[0142] S740, sending the user certificate and the user standard session information to the zero trust controller, so that the zero trust controller generates data verification rules based on the user certificate and the user standard session information, and sends the data verification rules to the zero trust gateway.

[0143] In some implementations, the zero trust proxy node 102 may register a user with the zero trust controller 104 to send the user certificate to the zero trust controller 104. Furthermore, because the zero trust proxy node 102 may establish a session connection with the zero trust gateway 106, the zero trust proxy node 102 may perform a standard session information verification on the user's standard session information through the zero trust gateway 106 to generate a standard session information verification result. If the standard session information verification result indicates that the standard session information verification has passed, the zero trust proxy node 102 may send the verified standard session information to the zero trust controller 104 through the zero trust gateway 106, so that the zero trust controller 104 generates data verification rules based on the user certificate and the user's standard session information, and sends the data verification rules to the zero trust gateway 106.

[0144] S760, add verification data to the initial data packet, generate a data packet to be transmitted, and send the data packet to be transmitted to the zero trust gateway; the data packet to be transmitted is used to instruct the zero trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rules, obtain the data verification result, and determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

[0145] Figure 8 is a schematic diagram of the structure of a data packet to be transmitted in one embodiment. The initial data packet includes the version (typically 4 bits), header length (typically 4 bits), service type (typically 8 bits), total length (typically 16 bits), identifier (typically 16 bits), flags (typically 3 bits), offset (typically 13 bits), Time To Live (TTL, used to indicate the maximum number of network segments the initial data packet is allowed to pass through before being discarded, typically 8 bits), protocol (typically 8 bits), check bit (typically 16 bits), source network address (typically 32 bits), destination network address (typically 32 bits), options, data, and more. The zero-trust agent node 102 can add verification data to the end of the initial data packet to generate the data packet to be transmitted. The verification data includes user session information and user signature information. For example, the user session information may include a session counter field, which is used to count the number of session information. The user signature information may include a data signature information field, which is typically a 32-bit field. Furthermore, the total length of the initial data packet needs to be updated to the total length of the data packet after the verification data is added.

[0146] Afterwards, the zero-trust proxy node 102 can send the data packet to be transmitted to the zero-trust gateway 106. The data packet to be transmitted is used to instruct the zero-trust gateway 106 to perform data verification on the verification data in the data packet to be transmitted according to the data verification rules to obtain a data verification result. The zero-trust gateway 106 then determines whether to transmit the data packet to be transmitted to the database based on the data verification result. The steps for data verification and data transmission performed by the zero-trust gateway 106 are detailed in the above embodiment and are not further described here.

[0147] In the above-mentioned data transmission method, it is possible to obtain more accurate user certificates, user standard session information, and initial data packets; the more accurate user certificates and user standard session information are sent to the zero-trust controller, so that the zero-trust controller generates data verification rules based on the more accurate user certificates and user standard session information, and sends the data verification rules to the zero-trust gateway. It is also possible to add more accurate verification data to the initial data packet to generate a more accurate data packet to be transmitted, and send the more accurate data packet to be transmitted to the zero-trust gateway. Among them, the more accurate data packet to be transmitted is used to instruct the zero-trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rules to obtain a data verification result; and determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

[0148] In an optional embodiment, as shown in FIG9 , a data transmission method is provided, which is applied to a zero-trust gateway 106 in a zero-trust communication network. The data transmission method includes:

[0149] S902, receiving a data verification rule sent by the zero trust controller and a data packet to be transmitted sent by the zero trust agent node; the data packet to be transmitted is obtained by the zero trust agent node adding verification data to the initial data packet;

[0150] S904, determining the network address type of the data packet to be transmitted based on the address information; the network address type includes a public network address type and a private network address type;

[0151] S906, if the network address type of the data packet to be transmitted is a private network address type, the data packet to be transmitted is used as an intermediate data packet;

[0152] S908, if the network address type of the data packet to be transmitted is a public network address type, then update the source network address in the data packet to be transmitted to the public network address corresponding to the data packet to be transmitted, and generate an intermediate data packet;

[0153] S910, performing data verification on the session counting information in the intermediate data packet according to the user session information verification rule to generate a first data verification result;

[0154] S912, performing data verification on the user signature information in the intermediate data packet according to the data signature verification rule to generate a second data verification result;

[0155] S914, generating a data verification result based on the first data verification result and the second data verification result;

[0156] S916, determining whether to transmit the data packet to be transmitted to the database based on the data verification result;

[0157] S918, determining data packets that fail verification from the data packets to be transmitted, and generating abnormal session information based on the data packets that fail verification;

[0158] S920, send the abnormal session information to the zero trust controller; the abnormal session information is used to instruct the zero trust controller to analyze the abnormal session information and send a session termination instruction to the zero trust agent node.

[0159] Figure 10 is a schematic diagram of the structure of a communication system corresponding to a zero-trust communication network in one embodiment. The communication system 100 corresponding to the zero-trust communication network (i.e., a zero-trust network) includes a zero-trust proxy node 102, a zero-trust controller 104, a zero-trust gateway 106, and a database. Control flow message data or business flow message data can be transmitted between the zero-trust proxy node 102 and the zero-trust gateway 106 via the communication network; control flow message data can be transmitted between the zero-trust controller 104 and the zero-trust gateway 106; and business flow message data can be transmitted between the zero-trust gateway 106 and the database. Control flow message data refers to messages containing a certain sequence, while business flow message data refers to messages containing certain actions or transactions. The zero-trust proxy node 102 can sign the initial data packet (i.e., add verification information) to generate a data packet to be transmitted, and can send the data packet to the zero-trust gateway 106. The data signing process may include a PKI (Public Key Infrastructure) digital signature process. The zero-trust gateway 106 can perform data verification on the data packet to be transmitted and generate a data verification result.

[0160] Figure 11 is a schematic diagram of the process of performing data verification and data transmission in a zero-trust communication network in one embodiment. At step S1102, the zero-trust proxy node 102 may obtain a user certificate and register the user with the zero-trust controller 104, thereby sending the user certificate to the zero-trust controller 104. At step S1104, the zero-trust controller 104 may receive the user certificate sent by the zero-trust proxy node 102 and perform certificate verification on the user certificate, generating a certificate verification result. If the certificate verification result indicates that the certificate verification passes, the zero-trust controller 104 may obtain the user's standard signature information from the user certificate. At step S1106, the zero-trust proxy node 102 may also establish a session connection with the zero-trust gateway 106 and generate user standard session information. Subsequently, the zero-trust proxy node 102 may perform standard session information verification on the user's standard session information through the zero-trust gateway 106 and generate a standard session information verification result. At step S1108, if the standard session information verification result indicates that the standard session information verification passes, the zero-trust proxy node 102 may send the verified standard session information to the zero-trust controller 104 through the zero-trust gateway 106. S1110 , the zero trust controller 104 may generate a data verification rule based on the user standard signature information and the user standard session information. S1112 , the zero trust controller 104 may send the data verification rule to the zero trust gateway 106 .

[0161] As shown in Figure 11, at S1114, the zero-trust proxy node 102 can also obtain the initial data packet from the user terminal, and can add verification data at the end of the initial data packet to generate a data packet to be transmitted. Afterwards, at S1116, the zero-trust proxy node 102 can send the data packet to be transmitted to the zero-trust gateway 106. The zero-trust gateway 106 receives the data verification rules sent by the zero-trust controller 104 and the data packet to be transmitted sent by the zero-trust proxy node 102, and determines the network address type of the data packet to be transmitted based on the address information in the verification data; the network address type includes a public network address type and a private network address type. S1118, if the network address type of the data packet to be transmitted is a private network address type, the data packet to be transmitted is used as an intermediate data packet, and the session count information in the intermediate data packet is data-verified according to the user session information verification rule to generate a first data verification result; the user signature information in the intermediate data packet is data-verified according to the data signature verification rule to generate a second data verification result; and a data verification result is generated based on the first data verification result and the second data verification result.

[0162] As shown in Figure 11, at S1120, if the network address type of the data packet to be transmitted is a public network address type, the source network address in the data packet to be transmitted is updated to the public network address corresponding to the data packet to be transmitted, generating an intermediate data packet; and performing data verification on the session count information in the intermediate data packet according to the user session information verification rule to generate a first data verification result; performing data verification on the user signature information in the intermediate data packet according to the data signature verification rule to generate a second data verification result; and generating a data verification result based on the first data verification result and the second data verification result. S1122, if the data verification result is verification passed, the zero trust gateway 106 can transmit the verified data packet to be transmitted to the database. S1124, if the data verification result is verification failed, the zero trust gateway 106 can determine the data packet that failed verification from the data packets to be transmitted, generate abnormal session information based on the data packet that failed verification, and send the abnormal session information to the zero trust controller 104. The zero trust gateway 106 can also discard the data packet that failed verification. S1126, the zero trust controller 104 can analyze the abnormal session information and send a session termination instruction to the zero trust agent node 102, so that the zero trust agent node 102 terminates the session according to the session termination instruction.

[0163] In the above-mentioned data transmission method, the zero-trust proxy node in the embodiment of the present application can perform data signing on the initial data packet, that is, it can add user session information and user signature information to the initial data packet to obtain a re-encapsulated data packet to be transmitted. And the zero-trust controller in the embodiment of the present application can generate more accurate data verification rules. Thus, the zero-trust gateway can receive the more accurate data verification rules sent by the zero-trust controller and the re-encapsulated data packet to be transmitted sent by the zero-trust proxy node, and perform data verification on the user session information and user signature information in the re-encapsulated data packet to be transmitted according to the more accurate data verification rules to obtain a more accurate data verification result. Furthermore, it can be determined whether to transmit the data packet to be transmitted to the database based on the more accurate data verification result. Since the present application needs to first perform data verification on the verification data in the re-encapsulated data packet to be transmitted according to the more accurate data verification rules, and the present application can only transmit the data packet to be transmitted that has passed the data verification, the security of the data transmission process can be improved.

[0164] It should be understood that, although the steps in the flowcharts of the above embodiments are shown in sequence as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the flowcharts of the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily to be performed in sequence, but can be performed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0165] Based on the same inventive concept, embodiments of the present application further provide a data transmission device for implementing the aforementioned data transmission method. The implementation solution provided by this device is similar to the implementation solution described in the aforementioned method. Therefore, the specific limitations of one or more data transmission device embodiments provided below can be found in the above-mentioned limitations of the data transmission method and will not be further elaborated here.

[0166] In one embodiment, as shown in FIG12 , a data transmission device 1200 is provided, which is applied to a zero-trust gateway in a zero-trust communication network, and includes: a data packet receiving module 1220 to be transmitted, a data verification module 1240, and a data transmission module 1260, wherein:

[0167] The data packet receiving module 1220 is used to receive the data verification rules sent by the zero trust controller and the data packet to be transmitted sent by the zero trust agent node; the data packet to be transmitted is obtained by the zero trust agent node adding verification data to the initial data packet.

[0168] The data verification module 1240 is configured to perform data verification on the verification data in the data packet to be transmitted according to a data verification rule to obtain a data verification result.

[0169] The data transmission module 1260 is used to determine whether to transmit the data packet to be transmitted to the database according to the data verification result.

[0170] In one embodiment, the verification data includes user session information and user signature information. The user session information is used to indicate address information and session count information generated during the process of establishing a session connection with the zero-trust proxy node. The user signature information is used to indicate the identity parameters of the user who sent the initial data packet. The data verification rules include user session information verification rules and data signature verification rules. The data verification module 1240 includes:

[0171] a first data verification result generating unit, configured to perform data verification on the user session information in the data packet to be transmitted according to a user session information verification rule, and generate a first data verification result;

[0172] A second data verification result generating unit is used to perform data verification on the user signature information in the data packet to be transmitted according to the data signature verification rule to generate a second data verification result;

[0173] The data verification unit is used to generate a data verification result according to the first data verification result and the second data verification result.

[0174] In one embodiment, the first data verification result generating unit includes:

[0175] A network address type determination subunit is used to determine the network address type of the data packet to be transmitted according to the address information; the network address type includes a public network address type and a private network address type;

[0176] The intermediate data packet generating subunit is used to determine whether the source network address in the data packet to be transmitted needs to be updated according to the network address type of the data packet to be transmitted, and generate the intermediate data packet;

[0177] The first data verification result generating subunit is configured to perform data verification on the session counting information in the intermediate data packet according to the user session information verification rule to generate a first data verification result.

[0178] In one embodiment, the intermediate data packet generation subunit includes:

[0179] A first intermediate data packet generating subunit is configured to use the data packet to be transmitted as an intermediate data packet when the network address type of the data packet to be transmitted is a private network address type;

[0180] The second intermediate data packet generating subunit is used to update the source network address in the data packet to be transmitted to the public network address corresponding to the data packet to be transmitted, so as to generate an intermediate data packet when the network address type of the data packet to be transmitted is a public network address type.

[0181] In one embodiment, the second data verification result generating unit includes:

[0182] The second data verification result generating subunit is used to perform data verification on the user signature information in the intermediate data packet according to the data signature verification rule to generate a second data verification result.

[0183] In one embodiment, the data transmission device 1200 further includes:

[0184] The abnormal session information generating module is used to determine the data packets that fail the verification from the data packets to be transmitted, and generate abnormal session information based on the data packets that fail the verification;

[0185] The abnormal session information sending module is used to send abnormal session information to the zero trust controller; the abnormal session information is used to instruct the zero trust controller to analyze the abnormal session information and send a session termination instruction to the zero trust agent node.

[0186] In one embodiment, as shown in FIG13 , a data transmission device 1300 is provided, which is applied to a zero-trust controller in a zero-trust communication network and includes: an information receiving module 1320 , a data verification rule generating module 1340 , and a data verification rule sending module 1360 , wherein:

[0187] The information receiving module 1320 is used to receive the user certificate and user standard session information sent by the zero trust agent node.

[0188] The data verification rule generation module 1340 is used to generate data verification rules according to the user certificate and the user standard session information.

[0189] The data verification rule sending module 1360 is used to send data verification rules to the zero-trust gateway; the data verification rules are used to instruct the zero-trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rules to obtain the data verification result; and determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

[0190] In one embodiment, as shown in FIG14 , a data transmission device 1400 is provided, which is applied to a zero-trust agent node in a zero-trust communication network, and includes: an information acquisition module 1420, an information transmission data verification module 1440, and a data packet generation module 1460 to be transmitted, wherein:

[0191] The information acquisition module is used to obtain user certificates, user standard session information and initial data packets.

[0192] The information sending data verification module is used to send the user certificate and user standard session information to the zero trust controller, so that the zero trust controller generates data verification rules based on the user certificate and user standard session information, and sends the data verification rules to the zero trust gateway.

[0193] The module for generating data packets to be transmitted is used to add verification data to the initial data packet, generate the data packet to be transmitted, and send the data packet to be transmitted to the zero-trust gateway; the data packet to be transmitted is used to instruct the zero-trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rules to obtain the data verification result; and determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

[0194] Each module in the above-mentioned data transmission device can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0195] Figure 15 is a structural diagram of a zero-trust gateway provided in an embodiment of the present invention. The zero-trust gateway 1500 shown in Figure 15 includes: at least one processor 1501, a memory 1502, and at least one network interface 1504. The various components in the zero-trust gateway 1500 are coupled together through a bus system 1505. It can be understood that the bus system 1505 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 1505 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, various buses are labeled as bus systems 1505 in Figure 15. In addition, in an embodiment of the present invention, the zero-trust gateway 1500 also includes a transceiver 1506, which can be a plurality of elements, that is, including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium.

[0196] It is understood that the memory 1502 in the embodiment of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DRRAM). The memory 1502 of the systems and methods described in the embodiments of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0197] In some embodiments, the memory 1502 stores the following elements, executable modules or data structures, or subsets thereof, or extended sets thereof: an operating system 1502a. The operating system 1502a includes various system programs, such as a framework layer, a core library layer, and a driver layer, for implementing various basic services and processing hardware-based tasks.

[0198] In an embodiment of the present invention, by calling the program or instructions stored in the memory 1502, the receiver is used to receive the data verification rules sent by the zero-trust controller and the data packet to be transmitted sent by the zero-trust agent node; the data packet to be transmitted is obtained after the zero-trust agent node adds verification data to the initial data packet; the processor 1501 is used to perform data verification on the verification data in the data packet to be transmitted according to the data verification rules to obtain a data verification result; the transmitter is used to determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

[0199] Some or all of the methods disclosed in the above embodiments of the present invention may also be applied to the processor 1501, or implemented by the processor 1501, or implemented by the processor 1501 in conjunction with other components (e.g., a transceiver). The processor 1501 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method may be performed by hardware integrated logic circuits or software instructions in the processor 1501. The above processor 1501 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of the present invention may be implemented or executed. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in conjunction with the embodiments of the present invention may be directly implemented as being executed by a hardware decoding processor, or may be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in memory 1502, and processor 1501 reads information in memory 1502 and, in conjunction with its hardware, completes the steps of the above method.

[0200] It is understood that the embodiments described in the embodiments of the present invention can be implemented using hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSP devices, DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions of the present application, or a combination thereof.

[0201] For software implementation, the techniques of the embodiments of the present invention can be implemented through modules (e.g., procedures, functions, etc.) that perform the functions of the embodiments of the present invention. The software code can be stored in a memory and executed by the processor 1501. The memory can be implemented in the processor 1501 or external to the processor 1501.

[0202] In one embodiment, the verification data includes user session information and user signature information. The user session information is used to indicate the address information and session count information generated during the process of establishing a session connection with the zero-trust agent node. The user signature information is used to indicate the identity parameters of the user who sent the initial data packet. The data verification rules include user session information verification rules and data signature verification rules. The processor is specifically used to perform data verification on the user session information in the data packet to be transmitted according to the user session information verification rules to generate a first data verification result; perform data verification on the user signature information in the data packet to be transmitted according to the data signature verification rules to generate a second data verification result; and generate a data verification result based on the first data verification result and the second data verification result.

[0203] In one embodiment, the processor is further used to determine the network address type of the data packet to be transmitted based on the address information; the network address type includes a public network address type and a private network address type; based on the network address type of the data packet to be transmitted, determine whether it is necessary to update the source network address in the data packet to be transmitted and generate an intermediate data packet; perform data verification on the session count information in the intermediate data packet according to the user session information verification rule to generate a first data verification result.

[0204] In one embodiment, the processor is also used to use the data packet to be transmitted as an intermediate data packet if the network address type of the data packet to be transmitted is a private network address type; if the network address type of the data packet to be transmitted is a public network address type, the source network address in the data packet to be transmitted is updated to the public network address corresponding to the data packet to be transmitted to generate an intermediate data packet.

[0205] In one embodiment, the processor is further configured to perform data verification on the user signature information in the intermediate data packet according to a data signature verification rule to generate a second data verification result.

[0206] In one embodiment, the processor is further used to determine the data packets that fail verification from the data packets to be transmitted, and generate abnormal session information based on the data packets that fail verification; the transmitter is further used to send the abnormal session information to the zero trust controller; the abnormal session information is used to instruct the zero trust controller to analyze the abnormal session information and send a session termination instruction to the zero trust agent node.

[0207] Figure 16 is a schematic diagram of the structure of a zero-trust controller provided by an embodiment of the present invention. The zero-trust controller 1600 shown in Figure 16 includes: at least one processor 1601, a memory 1602, and at least one network interface 1604. The various components in the zero-trust controller 1600 are coupled together through a bus system 1605. It can be understood that the bus system 1605 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 1605 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, various buses are labeled as bus systems 1605 in Figure 16. In addition, in an embodiment of the present invention, a transceiver 1606 is also included. The transceiver can be multiple elements, that is, including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium.

[0208] It is understood that the memory 1602 in the embodiment of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DRRAM). The memory 1602 of the systems and methods described in the embodiments of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0209] In some embodiments, the memory 1602 stores the following elements, executable modules or data structures, or subsets or extensions thereof: an operating system 1602a. The operating system 1602a includes various system programs, such as a framework layer, a core library layer, and a driver layer, for implementing various basic services and processing hardware-based tasks.

[0210] In an embodiment of the present invention, by calling the program or instructions stored in the memory 1602, the receiver is used to receive the user certificate and user standard session information sent by the zero-trust agent node; the processor 1601 is used to generate data verification rules based on the user certificate and user standard session information; the transmitter is used to send the data verification rules to the zero-trust gateway; the data verification rules are used to instruct the zero-trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rules to obtain a data verification result; and it is determined whether to transmit the data packet to be transmitted to the database based on the data verification result.

[0211] Some or all of the methods disclosed in the above embodiments of the present invention may also be applied to the processor 1601, or implemented by the processor 1601, or implemented by the processor 1601 in conjunction with other components (e.g., a transceiver). The processor 1601 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method may be performed by hardware integrated logic circuits or software instructions in the processor 1601. The above processor 1601 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of the present invention may be implemented or executed. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in conjunction with the embodiments of the present invention may be directly implemented as being executed by a hardware decoding processor, or may be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in memory 1602, and processor 1601 reads information in memory 1602 and, in conjunction with its hardware, completes the steps of the above method.

[0212] It is understood that the embodiments described in the embodiments of the present invention can be implemented using hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSP devices, DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions of the present application, or a combination thereof.

[0213] For software implementation, the techniques of the embodiments of the present invention can be implemented through modules (e.g., procedures, functions, etc.) that perform the functions of the embodiments of the present invention. The software code can be stored in a memory and executed by the processor 1601. The memory can be implemented in the processor 1601 or external to the processor 1601.

[0214] Figure 17 is a structural diagram of a zero-trust agent node provided by an embodiment of the present invention. The zero-trust agent node 1700 shown in Figure 17 includes: at least one processor 1701, a memory 1702, and at least one network interface 1704. The various components in the zero-trust agent node 1700 are coupled together through a bus system 1705. It can be understood that the bus system 1705 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 1705 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, various buses are labeled as bus systems 1705 in Figure 17. In addition, in an embodiment of the present invention, a transceiver 1706 is also included. The transceiver can be multiple elements, that is, including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium.

[0215] It is understood that the memory 1702 in the embodiment of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DRRAM). The memory 1702 of the systems and methods described in the embodiments of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0216] In some embodiments, the memory 1702 stores the following elements, executable modules or data structures, or subsets or extensions thereof: an operating system 1702a. The operating system 1702a includes various system programs, such as a framework layer, a core library layer, and a driver layer, for implementing various basic services and processing hardware-based tasks.

[0217] In an embodiment of the present invention, by calling the program or instructions stored in the memory 1702, the receiver is used to obtain the user certificate, user standard session information and the initial data packet; the transmitter is used to send the user certificate and user standard session information to the zero trust controller, so that the zero trust controller generates data verification rules based on the user certificate and user standard session information, and sends the data verification rules to the zero trust gateway; the processor 1701 and the transmitter are used to add verification data to the initial data packet, generate a data packet to be transmitted, and send the data packet to be transmitted to the zero trust gateway; the data packet to be transmitted is used to instruct the zero trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rules to obtain a data verification result; and determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

[0218] Some or all of the methods disclosed in the above embodiments of the present invention may also be applied to the processor 1701, or implemented by the processor 1701, or implemented by the processor 1701 in conjunction with other components (e.g., a transceiver). The processor 1701 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method may be performed by hardware integrated logic circuits or software instructions in the processor 1701. The above processor 1701 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of the present invention may be implemented or executed. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in conjunction with the embodiments of the present invention may be directly implemented as being executed by a hardware decoding processor, or may be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in memory 1702, and processor 1701 reads information in memory 1702 and, in conjunction with its hardware, completes the steps of the above method.

[0219] It is understood that the embodiments described in the embodiments of the present invention can be implemented using hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSP devices, DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions of the present application, or a combination thereof.

[0220] For software implementation, the techniques of the embodiments of the present invention can be implemented through modules (e.g., procedures, functions, etc.) that perform the functions of the embodiments of the present invention. The software code can be stored in a memory and executed by the processor 1701. The memory can be implemented in the processor 1701 or external to the processor 1701.

[0221] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0222] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0223] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0224] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0225] The above-mentioned data transmission method, apparatus, computer device, storage medium, and program product receive data verification rules sent by a zero-trust controller and a data packet to be transmitted sent by a zero-trust proxy node; the data packet to be transmitted is obtained by the zero-trust proxy node adding verification data to the initial data packet; the verification data in the data packet to be transmitted is performed according to the data verification rules to obtain a data verification result; and based on the data verification result, it is determined whether to transmit the data packet to be transmitted to the database. The zero-trust proxy node in the embodiment of the present application can add verification data to the initial data packet to obtain a re-encapsulated data packet to be transmitted. Thus, the zero-trust gateway can receive the data verification rules sent by the zero-trust controller and the re-encapsulated data packet to be transmitted sent by the zero-trust proxy node, and perform data verification on the verification data in the re-encapsulated data packet to be transmitted according to the data verification rules to obtain a more accurate data verification result. Furthermore, based on the more accurate data verification result, it can determine whether to transmit the data packet to be transmitted to the database. Because the present application requires first performing data verification on the verification data in the re-encapsulated data packet to be transmitted according to the data verification rules, and because the present application can only transmit data packets to be transmitted that pass data verification, the security of the data transmission process can be improved.

[0226] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0227] The above embodiments merely illustrate several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art may make various modifications and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A data transmission method, applied to a zero-trust gateway in a zero-trust communication network, the method comprising: Receive data verification rules sent by the zero-trust controller and data packets to be transmitted sent by the zero-trust agent node; The data packet to be transmitted is obtained by the zero-trust proxy node adding verification data to the initial data packet; Performing data verification on the verification data in the data packet to be transmitted according to the data verification rule to obtain a data verification result; as well as Determine whether to transmit the data packet to be transmitted to the database according to the data verification result.

2. The method according to claim 1, wherein: The verification data includes user session information and user signature information, the user session information is used to indicate the address information and session count information generated during the process of establishing a session connection with the zero-trust proxy node, the user signature information is used to indicate the identity parameters of the user who sent the initial data packet, and the data verification rules include user session information verification rules and data signature verification rules; The step of performing data verification on the verification data in the data packet to be transmitted according to the data verification rule to obtain a data verification result includes: Performing data verification on the user session information in the data packet to be transmitted according to the user session information verification rule to generate a first data verification result; Performing data verification on the user signature information in the data packet to be transmitted according to the data signature verification rule to generate a second data verification result; and The data verification result is generated according to the first data verification result and the second data verification result.

3. The method according to claim 2, wherein: The step of performing data verification on the user session information in the data packet to be transmitted according to the user session information verification rule to generate a first data verification result includes: Determine the network address type of the data packet to be transmitted according to the address information; the network address type includes a public network address type and a private network address type; Determining whether it is necessary to update the source network address in the data packet to be transmitted according to the network address type of the data packet to be transmitted, and generating an intermediate data packet; and The session count information in the intermediate data packet is verified according to the user session information verification rule to generate the first data verification result.

4. The method according to claim 3, wherein: The step of determining whether it is necessary to update the source network address in the data packet to be transmitted according to the network address type of the data packet to be transmitted, and generating an intermediate data packet, comprises: If the network address type of the data packet to be transmitted is the private network address type, using the data packet to be transmitted as the intermediate data packet; and If the network address type of the data packet to be transmitted is the public network address type, the source network address in the data packet to be transmitted is updated to the public network address corresponding to the data packet to be transmitted, so as to generate the intermediate data packet.

5. The method according to claim 3 or 4, wherein: The performing data verification on the user signature information in the data packet to be transmitted according to the data signature verification rule to generate a second data verification result includes: The user signature information in the intermediate data packet is verified according to the data signature verification rule to generate the second data verification result.

6. The method according to any one of claims 1 to 5, wherein: The method further comprises: Determine a data packet that fails verification from the data packets to be transmitted, and generate abnormal session information according to the data packet that fails verification; The abnormal session information is sent to the zero trust controller; the abnormal session information is used to instruct the zero trust controller to analyze the abnormal session information and send a session termination instruction to the zero trust agent node.

7. The method according to any one of claims 1 to 5, wherein: The data verification rule is generated based on user standard signature information and user standard session information, wherein the user standard signature information includes user public key information and user identity standard information.

8. The method according to claim 7, wherein: The user standard signature information is obtained from the user certificate when the user certificate is verified.

9. A data transmission method, applied to a zero-trust controller in a zero-trust communication network, the method comprising: Receive user certificates and user standard session information sent by the zero-trust agent node; Generate data verification rules based on the user certificate and user standard session information; as well as The data verification rule is sent to the zero trust gateway; the data verification rule is used to instruct the zero trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rule, obtain a data verification result, and determine whether to transmit the data packet to be transmitted to the database according to the data verification result.

10. The method according to claim 9, wherein: The step of generating the data verification rule according to the user certificate and the user standard session information includes: Verifying the user certificate and generating a certificate verification result; When the certificate verification result is that the certificate verification is passed, obtaining user standard signature information from the user certificate, wherein the user standard signature information includes user public key information and user standard identity information; and The data verification rule is generated according to the user standard signature information and the user standard session information.

11. A data transmission method, applied to a zero-trust proxy node in a zero-trust communication network, the method comprising: Obtain user credentials, user standard session information, and initial data packet; Sending the user certificate and the user standard session information to a zero trust controller, so that the zero trust controller generates a data verification rule based on the user certificate and the user standard session information, and sends the data verification rule to a zero trust gateway; as well as Adding verification data to the initial data packet to generate a data packet to be transmitted, and sending the data packet to be transmitted to the zero-trust gateway; The data packet to be transmitted is used to instruct the zero-trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rule, obtain a data verification result, and determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

12. The data transmission method according to claim 11, wherein: When the user certificate is verified, the zero trust controller obtains the user standard signature information from the user certificate and generates data verification rules based on the standard signature information and the user standard session information, wherein the user standard signature information includes user public key information and user identity standard information.

13. A data transmission device, applied to a zero-trust gateway in a zero-trust communication network, the device comprising: A module for receiving data packets to be transmitted, used to receive data verification rules sent by the zero-trust controller and data packets to be transmitted sent by the zero-trust agent node; The data packet to be transmitted is obtained by the zero-trust proxy node adding verification data to the initial data packet; A data verification module, used to perform data verification on the verification data in the data packet to be transmitted according to the data verification rule to obtain a data verification result; The data transmission module is used to determine whether to transmit the data packet to be transmitted to the database according to the data verification result.

14. A data transmission device, applied to a zero-trust controller in a zero-trust communication network, the device comprising: An information receiving module, used to receive a user certificate and user standard session information sent by a zero-trust agent node; A data verification rule generation module, used to generate data verification rules according to the user certificate and user standard session information; A data verification rule sending module is used to send the data verification rule to the zero trust gateway; the data verification rule is used to instruct the zero trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rule to obtain a data verification result; and determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

15. A data transmission device, applied to a zero-trust proxy node in a zero-trust communication network, the device comprising: An information acquisition module, used to obtain user certificates, user standard session information and initial data packets; An information sending data verification module is used to send the user certificate and the user standard session information to the zero trust controller, so that the zero trust controller generates a data verification rule based on the user certificate and the user standard session information, and sends the data verification rule to the zero trust gateway; A data packet generation module to be transmitted, used for adding verification data to the initial data packet, generating a data packet to be transmitted, and sending the data packet to be transmitted to the zero-trust gateway; The data packet to be transmitted is used to instruct the zero-trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rule to obtain a data verification result; and determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

16. A zero-trust gateway, comprising a transceiver, a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program to perform the steps of the method according to any one of claims 1 to 8.

17. A zero trust controller, comprising a transceiver, a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program to control the transceiver to receive a user certificate and user standard session information sent by a zero trust agent node; Used to control the processor to generate a data verification rule according to the user certificate and the user standard session information; Used to control the transceiver to send the data verification rules to the zero trust gateway; the data verification rules are used to instruct the zero trust gateway to perform data verification on the verification data in the data packet to be transmitted according to the data verification rules to obtain a data verification result; determine whether to transmit the data packet to be transmitted to the database based on the data verification result.

18. A zero-trust proxy node, comprising a transceiver, a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program to control the transceiver to obtain a user certificate, user standard session information and an initial data packet; Used to control the transceiver to send the user certificate and the user standard session information to the zero trust controller, so that the zero trust controller generates a data verification rule based on the user certificate and the user standard session information, and sends the data verification rule to the zero trust gateway; Used to control the processor and the transceiver to add verification data to the initial data packet, generate a data packet to be transmitted, and send the data packet to be transmitted to the zero trust gateway; The data packet to be transmitted is used to instruct the zero-trust gateway to verify the data according to the data The verification rule performs data verification on the verification data in the data packet to be transmitted to obtain a data verification result; and determines whether to transmit the data packet to be transmitted to the database according to the data verification result.

19. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method according to any one of claims 1 to 12.

20. A computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 12.

21. An apparatus configured to perform the method of any one of claims 1 to 12.

Images