Data transmission method and apparatus, and electronic device

Abstract

Provided in the embodiments of the present disclosure are a data transmission method and apparatus, and an electronic device. The data transmission method comprises: receiving a target data packet, wherein the target data packet comprises encrypted data and a security label, the encrypted data is obtained by using a key of a second virtual switch to encrypt an original data packet of a second virtual machine, the original data packet comprises address information, and the security label is generated on the basis of the address information; using a key of a first virtual switch to decrypt the encrypted data, and verifying the security label on the basis of the address information obtained by means of decryption and the key of the first virtual switch; and when the verification of the security label is successful, sending to a first virtual machine the original data packet obtained by means of decryption, wherein the first virtual machine corresponds to a destination address in the address information.

Description

[0001] This disclosure claims priority to Chinese patent application number 202410375124.1, filed with the China Patent Office on March 28, 2024, entitled "Data Transmission Method, Apparatus, and Electronic Device," the entire contents of which are incorporated herein by reference. Technical Field: This disclosure relates to the field of cloud networks, and more specifically, to data transmission methods, apparatuses, and electronic devices. Background: A Virtual Private Cloud (VPC) is a customized private network within which cloud resources, such as Elastic Compute Server (ECS), Server Load Balancer (SLB), and Database Server (RDS), can be created and managed.

[0002] When transmitting data, network elements in a VPC, such as virtual switches (vSwitches), virtual firewalls (vFirewall II), and gateways, look up corresponding entries in a session table based on the five-tuple in a data packet to confirm whether the packet is allowed to pass. In this solution, network elements rely on session tables to perform security control on data packets, requiring the creation of tens of millions of session tables. These tables occupy a large amount of memory resources, and the CPU resources consumed by creating and searching session tables are extremely high. The present disclosure provides a data transmission method, apparatus, and electronic device that implement security control of data packets based on security tags, reducing memory and CPU resource consumption. In a first aspect, the present disclosure provides a data transmission method, applied to a first virtual switch of a private network, wherein a first virtual machine is deployed in a subnet of the first virtual switch, and the private network further includes a second virtual switch, wherein a second virtual machine is deployed in the subnet of the second virtual switch. The method includes: receiving a target data packet, the target data packet including encrypted data and a security tag, wherein the encrypted data is obtained by encrypting an original data packet of the first-second virtual machine using a key of the second virtual switch, the original data packet including a quintuple and address information of data to be transmitted, and the security tag is generated based on the address information quintuple and the key; decrypting the encrypted data using the key of the first virtual switch, and verifying the security tag based on the decrypted address information quintuple and the key of the first virtual switch; and if the security tag passes verification, sending the decrypted original data packet to the second-first virtual machine, where the second-first virtual machine corresponds to the destination address in the address information quintuple. In a second aspect, the present disclosure provides a data transmission method, applied to a second virtual switch of a private network, wherein a second virtual machine is deployed in a subnet of the second virtual switch. The method comprises: encrypting an original data packet of the second virtual machine using a key of the second virtual switch to obtain encrypted data, wherein the original data packet includes address information; and encapsulating and sending a target data packet based on the encrypted data and a security tag, wherein the security tag is generated based on the address information.In a third aspect, the present disclosure provides a data transmission method, applied to a forwarding network element between a first virtual switch and a second virtual switch in a private network, wherein a first virtual machine is deployed in a subnet of the first virtual switch, and a second virtual machine is deployed in a subnet of the second virtual switch. The method includes: receiving a target data packet, the target data packet including encrypted data and a security label, wherein the encrypted data is obtained by encrypting an original data packet of the second virtual machine using a key, the original data packet includes address information, the security label is generated based on the address information, and a destination address in the address information corresponds to the first virtual machine; decrypting the encrypted data using the key of the forwarding network element, and verifying the security label based on the decrypted address information and the key of the forwarding network element; and if the security label passes the verification, sending the target data packet to a next-hop network element, where the next-hop network element is another forwarding network element between the first virtual switch and the second virtual switch, or the next-hop network element is the first virtual switch. In a fourth aspect, the present disclosure provides a data transmission device, which is applied to a first virtual switch of a private network, wherein a first virtual machine is deployed in a subnet of the first virtual switch, and the private network further includes a second virtual switch, wherein a second virtual machine is deployed in the subnet of the second virtual switch, the device including: a receiving module, configured to receive a target data packet, the target data packet including encrypted data and a security label, wherein the encrypted data is obtained by encrypting an original data packet of the first-second virtual machine using a key of the second virtual switch, the original data packet including a quintuple and address information of data to be transmitted, and the security label is generated based on the address information quintuple and the key; a verification module, configured to decrypt the encrypted data using the key of the first virtual switch, and verify the security label based on the decrypted address information quintuple and the key of the first virtual switch; and a sending module, configured to send the decrypted original data packet to the second-first virtual machine if the security label verification passes, the second-first virtual machine corresponding to the destination address in the address information quintuple.In a fifth aspect, the present disclosure provides a data transmission device, which is applied to a second virtual switch of a private network, wherein a second virtual machine is deployed in a subnet of the second virtual switch. The device includes: an encryption module, which is used to encrypt an original data packet of the second virtual machine using a key of the second virtual switch to obtain encrypted data, wherein the original data packet includes address information; and a sending module, which is used to encapsulate and send a target data packet based on the encrypted data and a security label, wherein the security label is generated based on the address information. In a sixth aspect, the present disclosure provides a data transmission device, which is applied to a forwarding network element between a first virtual switch and a second virtual switch in a private network, wherein a first virtual machine is deployed in a subnet of the first virtual switch, and a second virtual machine is deployed in a subnet of the second virtual switch. The device includes: a receiving module, configured to receive a target data packet, the target data packet including encrypted data and a security label, wherein the encrypted data is obtained by encrypting an original data packet of the second virtual machine using a key, the original data packet includes address information, the security label is generated based on the address information, and a destination address in the address information corresponds to the first virtual machine; a verification module, configured to decrypt the encrypted data using the key of the forwarding network element, and verify the security label based on the decrypted address information and the key of the forwarding network element; and a sending module, configured to send the target data packet to a next-hop network element if the security label verification passes, the next-hop network element being another forwarding network element between the first virtual switch and the second virtual switch, or the next-hop network element being the first virtual switch. In a seventh aspect, the present disclosure provides an electronic device, comprising: a memory and a processor; the memory is configured to store a computer program; and the processor is configured to execute the computer program stored in the memory, wherein the computer program, when executed, causes the processor to perform the method according to the first, second, or third aspect. In an eighth aspect, the present disclosure provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein when the processor executes the computer program, the processor performs the method according to the first, second, or third aspect. In a ninth aspect, the present disclosure provides a computer program product, comprising the computer program, wherein when the processor executes the computer program, the processor implements the method according to the first, second, or third aspect.In the data transmission method, apparatus, and electronic device provided herein, after encrypting the original data packet, the second virtual switch adds a security tag to the encrypted data based on the address information of the original data packet to obtain a target data packet. The security tag can identify and track the source and flow of the original data packet. Each network element that forwards or receives the target data packet verifies the security tag and, if the verification passes, allows the target data packet to be transmitted. Using the security tag, data packet security control is achieved, avoiding the creation and storage of a large number of session entries by each network element, and reducing the consumption of memory and CPU resources. BRIEF DESCRIPTION OF THE DRAWINGS To more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the following briefly introduces the figures required for the embodiments or the prior art description. Obviously, the figures described below illustrate some embodiments of the present disclosure. Those skilled in the art can also derive other figures based on these figures without inventive effort. Figure 1 is a schematic diagram of a VPC architecture provided by an embodiment of the present disclosure; Figure 2 is a flowchart diagram of a data transmission method provided by an embodiment of the present disclosure; Figure 3 is a schematic diagram of the structure of a target data packet provided by an embodiment of the present disclosure; Figure 4 is a flowchart diagram of a data transmission method provided by an embodiment of the present disclosure; Figure 5 is a flowchart diagram of a data transmission method provided by an embodiment of the present disclosure; Figure 6 is a flowchart diagram of a data transmission method provided by an embodiment of the present disclosure; Figure 7 is a schematic diagram of the structure of a data transmission device provided by an embodiment of the present disclosure; Figure 8 is a schematic diagram of the structure of a data transmission device provided by an embodiment of the present disclosure; Figure 9 is a schematic diagram of the structure of a data transmission device provided by an embodiment of the present disclosure; and Figure 10 is a schematic block diagram of an electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION: To further clarify the objectives, technical solutions, and advantages of the embodiments of the present disclosure, the technical solutions of the embodiments of the present disclosure will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only a portion of the embodiments of the present disclosure, not all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present disclosure without inventive effort are within the scope of protection of the present disclosure. The following introduces the terms used in the embodiments of the present disclosure. Quintuple: This refers to the source IP address, source port, destination IP address, destination port, and transport layer protocol. It uniquely identifies a session. Session table: This contains the quintuple and corresponding security policies, such as allow and deny. Security tags: This is used to identify and track the source and flow of data to ensure data security.Virtual switches are the fundamental network devices that make up a VPC. They connect to different cloud resources. When creating cloud resources within a VPC, you must specify the virtual switch to which they connect. Network Access Control Lists (ACLs) are network access control features within a VPC. They support customizing network ACL rules and binding them to virtual switches to implement access control for traffic flowing through ECS instances within the virtual switch. Security groups are virtual firewalls that control inbound and outbound traffic for ECS instances within a security group, thereby improving ECS ​​instance security. Table 1 illustrates some information about the session table of a network element in a VPC. As shown in Table 1, each entry in the session table consists of a quintuple and a corresponding policy. Each quintuple covers the inbound and outbound traffic of the network element, while the policy indicates whether to allow traffic to pass, ensuring packet security. For each session identified by a quintuple, the network element determines the policy to execute by searching the session table. (Table 1) Figure 1 is a schematic diagram of a VPC architecture provided by an embodiment of the present disclosure. As shown in Figure 1 , the network elements included in the VPC may include a first virtual switch and a second virtual switch. Optionally, the path between the first virtual switch and the second virtual switch may also include other network elements, such as a virtual firewall and a gateway. A first virtual machine is deployed in the subnet of the first virtual switch, and a second virtual machine is deployed in the subnet of the second virtual switch. The virtual machines in this embodiment of the present disclosure may be ECS instances. For example, a data packet generated by the second virtual machine in Figure 1 is transmitted to the first virtual machine via the second virtual switch, the virtual firewall, and the first virtual switch. During the transmission process, the second virtual switch, the virtual firewall, and the first virtual switch all need to look up the session table to determine whether to allow or deny the data packet. Because each network element through which each data packet passes needs to look up the session table, this solution requires each network element to create a session table with a large number of entries. Storing the session table consumes a large amount of memory resources, and creating and looking up the session table consumes a large amount of CPU resources. In light of this, embodiments of the present disclosure provide a data transmission method. In this method, after encrypting the original data packet, a security tag is added to the data packet based on the address information. Each network element that forwards or receives the data packet verifies the security tag and, if the verification passes, allows the data packet to be transmitted. This avoids the creation and storage of a large number of session entries by each network element, reducing the consumption of memory and CPU resources. Figure 2 is a flow diagram of a data transmission method provided by an embodiment of the present disclosure. As shown in Figure 2, the method includes:

[0003] S201. The second virtual switch encrypts an original data packet from the second virtual machine using its key to obtain encrypted data. The original data packet includes address information. Referring to the architecture shown in FIG1 , the second virtual machine is a virtual machine in the subnet of the second virtual switch, and the first virtual machine is a virtual machine in the subnet of the first virtual switch. The original data packet is generated by the second virtual machine and contains data that the second virtual machine needs to send to the first virtual machine, i.e., data to be transmitted. The address information in the original data packet includes a source address and a destination address. The source address includes a source IP address and a source port, which are the IP address and port of the second virtual machine, and the destination address includes a destination IP address and a destination port, which are the IP address and port of the first virtual machine. Optionally, in the example where the data structure of the original data packet includes a quintuple, the address information in the original data packet is the source IP address, source port, destination IP address, and destination port in the quintuple. After the original data packet of the second virtual machine reaches the second virtual switch, the second virtual switch encrypts the original data packet. The second virtual switch key used for encryption is issued by the VPC controller. The VPC controller can pre-issue the key to each network element in the VPC, including the second virtual switch and other network elements. In other words, each network element in the VPC can have the same key issued by the controller.

[0004] S202. The second virtual switch encapsulates and sends the target data packet based on the encrypted data and the security tag, where the security tag is generated based on the address information. In addition to encrypting the original data packet, the second virtual switch also adds a security tag to it. This security tag is generated based on the address information and can be used to identify and track the source and direction of the original data packet. If the data structure of the original data packet includes a quintuple, the security tag can be generated based on the quintuple. The target data packet is obtained by encapsulating the encrypted data and the security tag. For example, as shown in FIG3 , the target data packet may also include the underlying network address, i.e., the IP address and port of the underlying network, and a cyclic redundancy check (CRC). The CRC can be used to verify the integrity and accuracy of the data packet during subsequent transmission. The second virtual switch encapsulates the target data packet and sends it to the next-hop network element. A forwarding network element may exist in the path from the second virtual switch to the first virtual switch. Therefore, the next-hop network element of the second virtual switch may be the forwarding network element or the first virtual switch.

[0005] S203. After receiving the target data packet, the forwarding network element decrypts the encrypted data using its key and verifies the security label based on the decrypted address information and the forwarding network element's key. The forwarding network element in this step refers to another network element in the path from the second virtual switch to the first virtual switch. There may be one or more forwarding network elements, and each forwarding network element performs similar steps. The forwarding network element decrypts the encrypted data in the target data packet using its key to obtain the address information. The security label in the target data packet is then verified based on the decrypted address information and the forwarding network element's key. If the data structure of the original data packet includes a quintuple, the security label may be generated based on the quintuple. The forwarding network element decrypts the encrypted data in the target data packet using its key to obtain the quintuple. The security label in the target data packet is then verified based on the decrypted quintuple and the forwarding network element's key. The verification method corresponds to the method for generating the security tag by the second virtual switch. For example, if the operation for generating the security tag by the second virtual switch is reversible, the verification method of the forwarding network element may be to perform a corresponding inverse operation based on the security tag for verification. For example, if the operation for generating the security tag by the second virtual switch is irreversible, the verification method of the forwarding network element may be to regenerate the security tag using the decrypted address information to verify whether it matches.

[0006] S204. If the security label passes verification, the forwarding network element sends the target data packet to the next-hop network element. There may be one or more forwarding network elements. The forwarding network element sends the target data packet to the next-hop network element, which may be another forwarding network element or the first virtual switch. After transmission by one or more forwarding network elements, that is, one or more forwarding network elements execute steps S203-S204, if each forwarding network element passes verification of the security label, the target data packet is ultimately sent to the first virtual switch.

[0007] S205. After receiving the target data packet, the first virtual switch decrypts the encrypted data using the first virtual switch's key and verifies the security tag based on the decrypted address information and the first virtual switch's key. The first virtual switch performs similar processing after receiving the target data packet as the forwarding network element. The first virtual switch decrypts the encrypted data in the target data packet using the first virtual switch's key to obtain the address information. The security tag in the target data packet is then verified based on the decrypted address information and the first virtual switch's key. If the data structure of the original data packet includes a quintuple, the security tag may be generated based on the quintuple. The first virtual switch decrypts the encrypted data in the target data packet using the first virtual switch's key to obtain the quintuple. The security tag in the target data packet is then verified based on the decrypted quintuple and the first virtual switch's key. The verification method can be similar to that in S203, except that the forwarding network element's key is replaced with the first virtual switch's key. In addition, it should be noted that, in S203 and S205, before using the key of the forwarding network element or the key of the first virtual switch to decrypt the encrypted data, the CRC in the target data packet may be verified. If the verification passes, the encrypted data is decrypted using the key.

[0008] S206. If the security tag passes verification, the first virtual switch sends the decrypted original data packet to the first virtual machine. The destination address of the original data packet is the first virtual machine. If the target data packet arrives at the first virtual switch and passes verification, the first virtual switch sends the decrypted original data packet to the first virtual machine, thereby enabling transmission of the original data packet from the second virtual machine to the first virtual machine. In the method of the disclosed embodiment, after encrypting the original data packet, the second virtual switch adds a security tag to the encrypted data based on the address information to obtain the target data packet. The security tag can identify and track the source and flow of the original data packet. Each network element that forwards or receives the target data packet verifies the security tag and, if verification passes, allows the target data packet to be transmitted. Using the security tag implements data packet security control, avoids each network element from creating and storing a large number of session table entries, and reduces memory and CPU resource consumption. Based on the above embodiment, the process of each network element processing the original data packet or the target data packet will be further described. It should be noted that in the following embodiments, the address information can be replaced with a quintuple; the implementation principles remain the same. In one scenario, the original data packet includes the first data packet of a session identified by the address information. For the first data packet, before executing S201 to encrypt the original data packet using the second virtual switch's key, the second virtual switch may first perform a security check on the first data packet based on access control rules to determine whether transmission of the first data packet is permitted. The access control rule may be a security group rule or a network ACL rule. If the security check on the first data packet based on the access control rule determines that transmission of the first data packet is permitted, the second virtual switch then executes S201 to encrypt the first data packet using the second virtual switch's key. After encrypting the first data packet, the second virtual switch generates a security tag based on the address information and the second virtual switch's key. In one implementation, the second virtual switch performs a hash calculation on the address information and the second virtual switch's key, and determines the resulting hash value as the security tag. The hash calculation algorithm is not limited in the embodiments of the present disclosure; for example, it may be Message-Digest Algorithm 5 (MD5) or Secure Hash Algorithm (SHA).Accordingly, when the security tag is obtained by hashing the address information and the key of the second virtual switch, verifying the security tag based on the decrypted address information and the key of the forwarding network element in S203 includes: performing a hash calculation on the decrypted address information and the key of the forwarding network element. If the calculated result is consistent with the security tag, the verification passes; otherwise, the verification fails. Verifying the security tag based on the decrypted address information and the key of the first virtual switch in S205 includes: performing a hash calculation on the decrypted address information and the key of the first virtual switch. If the calculated result is consistent with the security tag, the verification passes; otherwise, the verification fails. In one implementation, the second virtual switch performs a reversible operation on the address information and the key of the second virtual switch, and determines the result of the reversible operation as the security tag. Optionally, the reversible operation may use a symmetric encryption algorithm, such as an Advanced Encryption Standard (AES) algorithm or a Data Encryption Standard (DES) algorithm, or the reversible operation may be an operation implemented using any reversible function. When the security label is obtained by performing a reversible operation on the address information and the key of the second virtual switch, the forwarding network element verifying the security label based on the decrypted address information and the key of the forwarding network element in S203 includes: performing an inverse operation of the reversible operation on the decrypted address information and the security label; if the result of the inverse operation is consistent with the key of the forwarding network element, the verification passes; otherwise, the verification fails; or performing an inverse operation of the reversible operation on the key of the forwarding network element and the security label; if the result of the inverse operation is consistent with the decrypted address information, the verification passes; otherwise, the verification fails. In S205, the first virtual switch verifies the security label based on the decrypted address information and the key of the first virtual switch, including: performing an inverse operation of a reversible operation on the decrypted quintuple and the security label, and if the result of the inverse operation is consistent with the key, the verification passes; otherwise, the verification fails; or performing an inverse operation of the reversible operation on the key and the security label, and if the result of the inverse operation is consistent with the decrypted quintuple, the verification passes; otherwise, the verification fails.For example, the second virtual switch uses a symmetric encryption algorithm to perform a reversible operation on the address information and the second virtual switch's key. In one implementation, the second virtual switch uses the address information to encrypt the second virtual switch's key to obtain a security label. The forwarding network element or the first virtual switch then decrypts the security label using the decrypted address information. If the result is consistent with the forwarding network element's or the first virtual switch's key, verification passes. In another implementation, the second virtual switch uses the second virtual switch's key to encrypt the address information to obtain a security label. The forwarding network element or the first virtual switch then decrypts the security label using their respective keys. If the decryption result is consistent with the address information obtained by decrypting the encrypted data, verification passes. After generating the security label, the second virtual switch creates an entry in the session table corresponding to the address information of the original data packet. The entry includes the policy for permitted transmission and the security label. This allows subsequent data packets with the same address information to use the same security label without having to recalculate it. In one scenario, the original data packet includes the second data packet or subsequent data packets of a session identified by the address information. That is, after transmitting the first data packet, the second virtual machine continues to send data packets with the same address information quintuple as the first data packet to the first virtual machine. For the second data packet or subsequent data packets, the second virtual switch searches the session table for an entry matching the address information of the second data packet or subsequent data packets and obtains a security tag from the entry. Because the second virtual switch has already calculated the security tag based on the address information and the key and stored it in the session table when transmitting the first data packet, the transmission process for the second data packet or subsequent data packets does not require recalculation of the security tag, thereby improving transmission efficiency and reducing computing resource consumption. In the data transmission method provided in the embodiments of the present disclosure, the second virtual switch only needs to create an outbound session table, not an inbound session table. When receiving return data packets from the first virtual machine switch, the second virtual switch only needs to verify the security tag added by the first virtual machine according to the method of the aforementioned embodiments. For the first virtual switch, since the received target data packet is verified using the security tag, there is no need to look up the session table. Therefore, there is no need to create an inbound session table. If the first virtual switch needs to send a data packet, it can simply create an outbound session table when the second data packet of the session corresponding to the quintuple is sent, referring to the method of the above embodiment.For the second virtual switch and the first virtual machine switch, compared to related techniques that require creating both inbound and outbound session tables, the method of the present embodiment can reduce the number of session tables by half, thereby reducing memory resource usage and lowering CPU resource consumption associated with creating and looking up session tables. For the forwarding network element between the second virtual switch and the first virtual machine switch, since the forwarded target data packets are verified based on security tags, no session table lookup is required for both receiving and sending. Therefore, no session table creation is required, thus reducing memory and CPU resource consumption. The method of the present embodiment trades computing power for memory space. In practical applications, computing power is cheap and fast, while memory is expensive and slow. Therefore, this method not only improves transmission efficiency and performance, but also reduces costs. Furthermore, this method effectively protects network data security and prevents unauthorized access and attacks to network packets. Figure 4 is a second flow diagram of a data transmission method provided by an embodiment of the present disclosure. This method is applied to the first virtual switch of a private network and includes:

[0009] S401. Receive a target data packet, where the target data packet includes encrypted data and a security tag. The encrypted data is obtained by encrypting an original data packet of the second virtual machine using a key of the second virtual switch. The original data packet includes address information, and the security tag is generated based on the address information.

[0010] S402. Decrypt the encrypted data using the key of the first virtual switch, and verify the security tag based on the decrypted address information and the key of the first virtual switch.

[0011] 5403. If the security tag verification passes, the decrypted original data packet is sent to the first virtual machine. The first virtual machine corresponds to the destination address in the address information. The method performed by the first virtual switch in the embodiment of the present disclosure can be found in the previous embodiment and will not be repeated here. Figure 5 is a third flow diagram of a data transmission method provided in the embodiment of the present disclosure. This method, applied to the second virtual switch in the private network, includes:

[0012] S501. Use the key of the second virtual switch to encrypt an original data packet of the second virtual machine to obtain encrypted data, where the original data packet includes address information.

[0013] 5502. Encapsulate and send a target data packet based on the encrypted data and the security tag, where the security tag is generated based on the address information. The method performed by the second virtual switch in the embodiments of the present disclosure can be found in the previous embodiments and will not be repeated here. Figure 6 is a fourth flow diagram of a data transmission method provided in the embodiments of the present disclosure. A forwarding network element used between a second virtual switch and a first virtual switch in a private network includes the following: 5601. Receive a target data packet, where the target data packet includes encrypted data and a security tag. The encrypted data is obtained by encrypting an original data packet of the second virtual machine using the second virtual switch's key. The original data packet includes address information. The security tag is generated based on the address information, and the destination address in the address information corresponds to the first virtual machine.

[0014] 5602. Decrypt the encrypted data using the key of the forwarding network element, and verify the security label based on the decrypted address information and the key of the forwarding network element.

[0015] S603. If the security tag verification passes, the target data packet is sent to the next-hop network element. The next-hop network element is another forwarding network element between the first virtual switch and the second virtual switch, or the next-hop network element is the first virtual switch. The method performed by the forwarding network element in the embodiments of the present disclosure can be found in the previous embodiments and will not be described in detail here. Figure 7 is a first structural diagram of a data transmission device provided in an embodiment of the present disclosure. The data transmission device is applied to the first virtual switch of a private network. As shown in Figure 7, the data transmission device 700 includes: a receiving module 701, configured to receive a target data packet. The target data packet includes encrypted data and a security tag. The encrypted data is obtained by encrypting an original data packet of a second virtual machine using a key of the second virtual switch. The original data packet includes address information, and the security tag is generated based on the address information; a verification module 702, configured to decrypt the encrypted data using the key of the first virtual switch and verify the security tag based on the decrypted address information and the key of the first virtual switch; and a sending module 703, configured to send the decrypted original data packet to the first virtual machine if the security tag verification passes. The first virtual machine corresponds to the destination address in the address information. In one implementation, the security tag is obtained by hashing the address information and the key of the second virtual switch. The verification module 702 is configured to: hash the decrypted address information and the key of the second virtual switch. If the hashed result is consistent with the security tag, the verification passes; otherwise, the verification fails. In one implementation, the security tag is obtained by performing a reversible operation on the address information and the key of the second virtual switch. The verification module 702 is configured to: perform the inverse of the reversible operation on the decrypted address information and the security tag. If the result of the inverse operation is consistent with the key of the first virtual switch, the verification passes; otherwise, the verification fails; or perform the inverse of the reversible operation on the key of the first virtual switch and the security tag. If the result of the inverse operation is consistent with the decrypted address information, the verification passes; otherwise, the verification fails. The device of the present embodiment can be used to execute the data transmission method of the aforementioned embodiment. Its implementation principles and technical effects are similar and will not be further described here. Figure 8 is a second structural schematic diagram of a data transmission device provided in an embodiment of the present disclosure.This data transmission device is applied to a second virtual switch in a private network. As shown in FIG8 , data transmission device 800 includes an encryption module 801 for encrypting an original data packet from a second virtual machine using a key of the second virtual switch to obtain encrypted data. The original data packet includes address information. A sending module 802 for encapsulating and sending a target data packet based on the encrypted data and a security tag, wherein the security tag is generated based on the address information. In one implementation, the original data packet includes the first data packet of a session identified by the address information. The device further includes a tag module for generating a security tag based on the address information and the key of the second virtual switch. In one implementation, the tag module is configured to perform a hash calculation on the address information and the key of the second virtual switch, and determine the resulting hash value as the security tag. In one implementation, the tag module is configured to perform a reversible operation on the address information and the key of the second virtual switch, and determine the result of the reversible operation as the security tag. In one implementation, the device further includes a security module for performing a security check on the first data packet based on access control rules to determine whether transmission of the first data packet is permitted. In one implementation, the apparatus further includes a creation module configured to create an entry in a session table corresponding to the address information, the entry including a policy for permitted transmission and a security label. In one implementation, the original data packet includes the second data packet or a data packet subsequent to the second data packet of the session identified by the address information. The apparatus further includes a search module configured to search the session table for an entry matching the address information of the second data packet or a data packet subsequent to the second data packet, and obtain the security label from the entry. The apparatus of the present embodiment can be used to execute the data transmission method of the aforementioned embodiment. Its implementation principles and technical effects are similar and will not be further described here. Figure 9 is a third structural schematic diagram of a data transmission apparatus provided in an embodiment of the present disclosure.The data transmission device uses a forwarding network element between a first virtual switch and a second virtual switch of a private network. As shown in FIG9 , the data transmission device 900 includes: a receiving module 901, configured to receive a target data packet, the target data packet including encrypted data and a security label, wherein the encrypted data is obtained by encrypting an original data packet of the second virtual machine using a key of the second virtual switch, the original data packet includes address information, the security label is generated based on the address information, and the destination address in the address information corresponds to the first virtual machine; a verification module 902, configured to decrypt the encrypted data using a key of the forwarding network element, and verify the security label based on the decrypted address information and the key of the forwarding network element; and a sending module 903, configured to send the target data packet to a next-hop network element if the security label verification passes. The next-hop network element is another forwarding network element between the first virtual switch and the second virtual switch, or the next-hop network element is the first virtual switch. In one implementation, the security tag is obtained by hashing the address information and the key of the second virtual switch. The verification module 902 is configured to: hash the decrypted address information and the key of the forwarding network element. If the hashed result is consistent with the security tag, the verification passes; otherwise, the verification fails. In one implementation, the security tag is obtained by performing a reversible operation on the address information and the key of the second virtual switch. The verification module 902 is configured to: perform the inverse of the reversible operation on the decrypted address information and the security tag. If the result of the inverse operation is consistent with the key of the forwarding network element, the verification passes; otherwise, the verification fails; or perform the inverse of the reversible operation on the key of the forwarding network element and the security tag. If the result of the inverse operation is consistent with the decrypted address information, the verification passes; otherwise, the verification fails. The apparatus of the present embodiment can be used to execute the data transmission method of the aforementioned embodiment. Its implementation principles and technical effects are similar and are not further described here. Figure 10 is a schematic block diagram of an electronic device provided by an embodiment of the present disclosure. As shown in Figure 10 , the electronic device 1000 may include at least one processor 1001 for implementing the data transmission method provided in the embodiments of the present disclosure. Optionally, the electronic device 1000 also includes at least one memory 1002 for storing program instructions and / or data. The memory 1002 is coupled to the processor 1001. Coupling in the embodiments of the present disclosure refers to an indirect coupling or communication connection between devices, units, or modules, and may be electrical, mechanical, or other forms, for information exchange between the devices, units, or modules. The processor 1001 may operate in conjunction with the memory 1002. The processor 1001 may execute program instructions stored in the memory 1002.At least one of the at least one memory may be included in the processor. Optionally, the electronic device 1000 further includes a communication interface 1003 for communicating with other devices via a transmission medium, thereby enabling the electronic device 1000 to communicate with other devices. The communication interface 1003 may be, for example, a transceiver, an interface, a bus, a circuit, or a device capable of performing transceiver functions. The processor 1001 may utilize the communication interface 1003 to transmit and receive data and / or information and to implement the methods provided in the embodiments of the present disclosure. For details, please refer to the detailed descriptions in the previous embodiments and are not repeated here. The specific connection medium between the processor 1001, memory 1002, and communication interface 1003 is not limited in the embodiments of the present disclosure. In FIG10 , the processor 1001, memory 1002, and communication interface 1003 are connected via a bus 1004. Bus 1004 is represented by a bold line in FIG10 . The connection between other components is for illustrative purposes only and is not intended to be limiting. Such buses may be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG10 uses only one thick line, but this does not indicate that there is only one bus or only one type of bus. It should be understood that the processor in the embodiments of the present disclosure may be an integrated circuit chip with signal processing capabilities. During implementation, the steps of the above-described method embodiments may be completed by hardware integrated logic circuits in the processor or by software instructions. The above-described processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of the present disclosure may be implemented or executed. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in conjunction with the embodiments of the present disclosure may be directly executed by a hardware decoding processor or by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium well-known in the art, such as a random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or register. The storage medium is located in the memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.It should also be understood that the memory in the embodiments of the present disclosure may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory may be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM (DR RAM). It should be noted that the memory used in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory. The present disclosure also provides a computer-readable storage medium storing a computer program (also referred to as code or instructions). When executed by a processor, the computer executes the method described in any of the aforementioned embodiments. The present disclosure also provides a computer program product comprising the computer program, which, when executed by a processor, implements the method described in any of the aforementioned embodiments. As used in this disclosure, the terms "unit," "module," and the like may be used to refer to computer-related entities, hardware, firmware, a combination of hardware and software, software, or software in execution. Those skilled in the art will appreciate that the various illustrative logical blocks and steps described in conjunction with the embodiments disclosed herein may be implemented using electronic hardware, or a combination of computer software and electronic hardware.Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Professionals may implement the described functions using different methods for each specific application, but such implementations should not be considered beyond the scope of this disclosure. In the several embodiments provided in this disclosure, it should be understood that the disclosed devices, equipment, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of units is merely a logical functional division. In actual implementation, other divisions may be used, such as combining or integrating multiple units or components into another system, or omitting or not implementing certain features. Furthermore, the coupling or direct coupling or communication connection shown or discussed between devices or units may be through interfaces, or indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms. Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of these units may be selected to achieve the objectives of this embodiment according to actual needs. In addition, the functional units in the various embodiments of the present disclosure may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. In the above embodiments, the functions of each functional unit may be implemented in whole or in part via software, hardware, firmware, or any combination thereof. When implemented using software, they may be implemented in whole or in part in the form of a computer program product. This computer program product includes one or more computer instructions (programs). When these computer program instructions (programs) are loaded and executed on a computer, they fully or partially generate the processes or functions according to the embodiments of the present disclosure. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method.The computer-readable storage medium can be any available medium accessible by a computer, or a data storage device such as a server or data center that integrates one or more available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, or magnetic tapes), optical media (e.g., digital video discs (DVDs)), or semiconductor media (e.g., solid-state drives (SSDs)). If the function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present disclosure, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes instructions for enabling a computer device (e.g., a personal computer, server, or network device) to execute all or part of the steps of the methods of various embodiments of the present disclosure. The aforementioned storage media include various media capable of storing program code, such as USB flash drives, removable hard drives, ROM, RAM, magnetic disks, or optical disks. The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, storage, and display) involved in this disclosure are all authorized by the user or fully authorized by all parties. The collection, use, and processing of relevant data must comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or deny. The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited to this. Any changes or substitutions that can be easily conceived by persons skilled in the art within the technical scope of this disclosure should be covered by the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be based on the scope of protection of the claims.

Claims

Claims 1. A data transmission method, wherein: A first virtual switch is applied to a private network, a first virtual machine is deployed in a subnet of the first virtual switch, the private network further includes a second virtual switch, a second virtual machine is deployed in the subnet of the second virtual switch, and the method includes: receiving a target data packet, the target data packet including encrypted data and a security tag, wherein the encrypted data is obtained by encrypting an original data packet of the second virtual machine using a key of the second virtual switch, the original data packet includes address information, and the security tag is generated based on the address information; decrypting the encrypted data using the key of the first virtual switch, and verifying the security tag based on the decrypted address information and the key of the first virtual switch; and if the security tag passes the verification, sending the decrypted original data packet to the first virtual machine, the first virtual machine corresponding to the destination address in the address information.

2. The method according to claim 1, wherein: The security tag is obtained by performing a hash calculation on the address information and a key of the second virtual switch; The verifying the security tag based on the decrypted address information and the key of the first virtual switch includes: performing a hash calculation on the decrypted address information and the key of the first virtual switch; if the calculated result is consistent with the security tag, the verification passes; otherwise, the verification fails.

3. The method according to claim 1, wherein: The security tag is obtained by performing a reversible operation on the address information and the key of the second virtual switch; The verifying the security label based on the decrypted address information and the key of the first virtual switch includes: performing an inverse operation of the reversible operation on the decrypted address information and the security label, and if the result of the inverse operation is consistent with the key of the first virtual switch, the verification passes; otherwise, the verification fails; or performing an inverse operation of the reversible operation on the key of the first virtual switch and the security label, and if the result of the inverse operation is consistent with the decrypted address information, the verification passes; otherwise, the verification fails.

4. A data transmission method, wherein: A second virtual switch is applied to a private network, and a second virtual machine is deployed in a subnet of the second virtual switch. The method includes: encrypting an original data packet of the second virtual machine using a key of the second virtual switch to obtain encrypted data, where the original data packet includes address information; and encapsulating and sending a target data packet based on the encrypted data and a security label, where the security label is generated based on the address information.

5. The method according to claim 4, wherein: The original data packet includes the first data packet of the session identified by the address information. Before encapsulating and sending the target data packet based on the encrypted data and the security label, the method further includes: generating the security label based on the address information and the key of the second virtual switch.

6. The method according to claim 5, wherein: Generating the security tag based on the address information and the key of the second virtual switch includes: performing a hash calculation on the address information and the key of the second virtual switch, and determining the obtained hash value as the security tag.

7. The method according to claim 5, wherein: The generating of the security tag based on the address information and the key of the second virtual switch includes: performing a reversible operation on the address information and the key of the second virtual switch, and determining the result of the reversible operation as is the security label.

8. The method according to any one of claims 5 to 7, wherein: Before encrypting the original data packet of the second virtual machine using the key of the second virtual switch to obtain encrypted data, the method further includes: performing a security check on the first data packet based on an access control rule to determine whether transmission of the first data packet is allowed.

9. The method according to claim 8, wherein: Also includes: An entry corresponding to the address information is created in a session table, where the entry includes a policy allowing transmission and the security label.

10. The method according to claim 9, wherein: The original data packet includes the second data packet or a data packet after the second data packet of the session identified by the address information. Before encrypting the original data packet of the second virtual machine using the key of the second virtual switch to obtain encrypted data, the method further includes: searching the session table for an entry that matches the address information of the second data packet or the data packet after the second data packet, and obtaining the security label from the entry.

11. A data transmission method, wherein: A forwarding network element is applied between a first virtual switch and a second virtual switch in a private network, wherein a first virtual machine is deployed in a subnet of the first virtual switch, and a second virtual machine is deployed in a subnet of the second virtual switch, and the method includes: receiving a target data packet, the target data packet including encrypted data and a security label, wherein the encrypted data is obtained by encrypting an original data packet of the second virtual machine using a key of the second virtual switch, the original data packet includes address information, the security label is generated based on the address information, and a destination address in the address information corresponds to the first virtual machine; decrypting the encrypted data using the key of the forwarding network element, and verifying the security label based on the decrypted address information and the key of the forwarding network element; and if the security label passes the verification, sending the target data packet to a next-hop network element, where the next-hop network element is another forwarding network element between the first virtual switch and the second virtual switch, or the next-hop network element is the first virtual switch.

12. The method according to claim 11, wherein: The security tag is obtained by performing a hash calculation on the address information and the key of the second virtual switch; and the verifying the security tag based on the decrypted address information and the key of the forwarding network element includes: performing a hash calculation on the decrypted address information and the key of the forwarding network element, and if a result of the calculation is consistent with the security tag, the verification passes; otherwise, the verification fails.

13. The method according to claim 11, wherein: The security label is obtained by performing a reversible operation on the address information and the key of the second virtual switch; and the verifying the security label based on the decrypted address information and the key of the forwarding network element includes: performing an inverse operation of the reversible operation on the decrypted address information and the security label, and if a result of the inverse operation is consistent with the key of the forwarding network element, the verification passes; otherwise, the verification fails; or performing an inverse operation of the reversible operation on the key of the forwarding network element and the security label, and if a result of the inverse operation is consistent with the decrypted address information, the verification passes; otherwise, the verification fails.

14. An electronic device, wherein: include: memory and processor; The memory is used to store computer programs; The processor is configured to execute a computer program stored in the memory, and when the computer program is executed, the processor is enabled to execute the method according to any one of claims 1 to 13.

15. A computer-readable storage medium, wherein: The computer readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor executes the method according to any one of claims 1 to 13. method.

16. A computer program product, wherein: The method comprises a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 13 is implemented. 14

Images