Data transmission method, apparatus and device

Abstract

A data transmission method, an apparatus and a device. In the present application, a first apparatus generates an encryption key of data on the basis of characteristics of the data, and uses the encryption key of the data to encrypt the data; when the first apparatus needs to transmit first data, the first apparatus transmits a data message, the data message carrying the encrypted data. An encryption key of data is related to characteristics of the data, in this encryption mode, different encryption keys are used for encrypting different data; when the first apparatus needs to transmit data, the data message carries the encrypted data, which ensures data security and well meets the security requirements on different data, thereby improving the flexibility of secure transmission of data. Moreover, even if the encrypted data is decrypted during data transmission and the encryption key of the data is compromised, the security of other data transmitted by the first apparatus will not be affected.

Description

A data transmission method, apparatus, and device

[0001] Cross Reference to Related Applications

[0002] This application claims priority to the Chinese Patent Application No. 202410650120.X, filed on May 23, 2024, and entitled "A data transmission method, apparatus, and device", the entire contents of which are incorporated herein by reference. TECHNICAL FIELD

[0003] The present application relates to the field of communication technology, and in particular to a data transmission method, apparatus, and device. BACKGROUND

[0004] Data security is an important factor to be considered in data transmission process. When data is transmitted from one computing device to another computing device, it is necessary to prevent the data from being intercepted during transmission to cause data leakage.

[0005] The two parties of communication can use some existing security protocols to ensure data security in data transmission process, such as Internet Protocol Security (IPSec) and Transport Layer Security (TLS). However, the data security of these security protocols is protected at the granularity of data channel. Once a data channel is established between the two parties of communication, the same key is used to encrypt any data transmitted in the data channel, and therefore the flexibility is poor. SUMMARY

[0006] The present application provides a data transmission method, apparatus, and device to improve the flexibility of secure data transmission.

[0007] In a first aspect, the present application provides a data transmission method, which is executed by a first device. In the method, the first device can transmit the data in the form of ciphertext. Taking first data as an example, the first device generates an encryption key of the first data according to the characteristics of the first data; then, the first data is encrypted by using the encryption key of the first data. When the first device needs to transmit the first data, the first device transmits a first data packet, and the first data packet carries the encrypted first data.

[0008] By the above method, the encryption key of the first data is related to the feature of the first data, and different encryption keys are used for encrypting different data in this encryption mode; when the first device needs to transmit the first data, the encrypted first data is carried in the first data packet, which can guarantee the security of the first data and well meet the security requirements of different data, and improve the flexibility of data security transmission. In addition, even if the encrypted first data is cracked and the encryption key of the first data is leaked during data transmission, it will not affect the security of other data transmitted by the first device.

[0009] In a possible implementation, the present application does not limit the specific type of the feature of the first data, and the following lists several features of the first data: the user to which the first data belongs, the data type of the first data, the security level of the first data, the destination address of the first data packet, and the index of the first data.

[0010] By the above method, the specific type of the feature of the first data is more, and the security of the data can be guaranteed in different granularity. For example, the security of the data is guaranteed in the granularity of the user, and the security of the data is guaranteed in the granularity of the security level; the protection granularity of the data security is effectively expanded.

[0011] In a possible implementation, the first device can transmit the first data packet through a data channel, and the first device can also transmit other data packets through the data channel. For example, the first device transmits a second data packet through the data channel, and the second data packet carries encrypted second data, and the encryption key of the second data is different from the encryption key of the first data.

[0012] By the above method, the first data and the second data are transmitted through the same data channel, and the encryption key of the second data is different from the encryption key of the first data; the protection granularity of the data security transmission is no longer in the granularity of the data channel, but the security protection is targeted for different data.

[0013] In a possible implementation, the first data packet carries the feature of the first data.

[0014] By the above method, the first data packet carries the feature of the first data, so that the receiver of the first data packet can generate a decryption key of the first data by using the feature of the first data to decrypt the encrypted first data.

[0015] In a possible implementation, the feature of the first data is placed in the packet header of the first data packet.

[0016] By the above method, the feature of the first data is placed in the message header of the first data message, so that the receiver of the first data message can quickly extract the feature of the first data from the first data message.

[0017] In a possible implementation, the first data can be stored in the first device in an encrypted manner, that is, after the first data is encrypted by using an encryption key of the first data, the encrypted first data can be stored persistently.

[0018] Suppose that the first device contains a storage node with a data storage function, the first device can store the encrypted first data persistently in the storage node. In other words, the first data is stored in the storage node in the form of ciphertext, and the storage node does not need to perform a decryption operation in the process of storing the encrypted first data.

[0019] By the above method, the first data is stored in the first device in the form of ciphertext, which can ensure the security of the first data inside the first device.

[0020] In a possible implementation, when the first device needs to transmit the first data, the first device can directly obtain the stored encrypted first data inside the first device and carry the first data in a first data message.

[0021] Still suppose that the first device contains a storage node with a data storage function, the first device can read the first data in the form of ciphertext from the persistent storage in the storage node. After the stored encrypted first data is read from the storage node, the first data is carried in a first data message, and the first data message is transmitted.

[0022] By the above method, when the first device needs to transmit the first data, the first device does not need to perform a decryption and encryption operation on the stored first data, but directly carries the stored encrypted first data in the first data message, reducing the calculation power consumption of the first device caused by the decryption and encryption operation. In addition, the data transmission efficiency is improved by omitting the decryption and encryption operation.

[0023] In a possible implementation, when the first device needs to transmit the first data, the first device first reads the stored encrypted first data from the first device. The first device migrates the first data from the persistent storage of the first device to the memory of the storage node in the form of ciphertext, that is, the first data always remains in the state of ciphertext during the migration, and the first data is also stored in the form of ciphertext (that is, the encrypted first data) in the memory of the first device.

[0024] Still assuming that the first device contains a storage node with data storage function, when the first device reads the first data in the form of ciphertext from the persistent storage in the storage node, the first device migrates the first data in the form of ciphertext from the persistent storage of the storage node to the memory of the storage node, and obtains the first data in the form of ciphertext from the memory.

[0025] Through the above method, when the first data is migrated within the first device, the first data always remains in the ciphertext state, which can ensure the security of the first data within the first device. In addition, since the first data is still stored in the ciphertext state after migration to the memory, there is no need to perform decryption and encryption operations on the encrypted first data, thereby reducing the computing power consumption of the first device.

[0026] In a possible implementation, before the first device reads the first data in the form of ciphertext from the persistent storage, the first device can first determine whether the receiving device of the first data message belongs to the target group. If the receiving device belongs to the target group, the first device reads the first data in the form of ciphertext from the persistent storage. Otherwise, when reading the first data, the first device first decrypts the stored encrypted data, and stores the first data in the memory of the first device in the plaintext state.

[0027] Through the above method, according to the membership relationship between the receiving device and the target group, it is determined whether the stored encrypted data needs to be decrypted, which can meet the different group requirements for data security.

[0028] In a possible implementation, the first data message also carries an authentication code, and the authentication code is used for integrity protection of the features of the first data.

[0029] Through the above method, the authentication code carried in the first data can prevent the features of the first data from being tampered with, and facilitate the receiving device to generate an encryption key of the first data by using the correct features of the first data.

[0030] In a possible implementation, the data encryption algorithm called for encrypting the first data is a symmetric encryption algorithm, or can be an asymmetric encryption algorithm. The data encryption algorithm is set flexibly, and can be applied to different scenarios.

[0031] In a possible implementation, when the receiving device of the first data message does not belong to the target group or is currently not required to transmit the first data (e.g., processing the first data internally), the first device can read the first data in plaintext from the persistent storage (in the storage node or in the first device). After reading the first data, the first data is stored in the memory of the first device, and if transmission to a receiving device that does not belong to the target group is required, the first data can be re-encrypted and transmitted; if processing of the first data is required, the first data can be processed in the memory.

[0032] Through the above method, the first device can support two reading modes of the first data, one being reading in ciphertext state and the other being reading in plaintext state, so as to ensure that the first device can be applied to different scenarios.

[0033] In a second aspect, the present application further provides a data transmission method, which is executed by a second device, and in the method, the second device receives a first data message and saves encrypted first data carried in the first data message. When the first data needs to be processed, the second device generates a decryption key of the first data based on a feature of the first data, and decrypts the encrypted first data by using the decryption key.

[0034] Through the above method, the decryption key of the first data is related to the feature of the first data, and different decryption keys are used for decryption of different data, which can ensure the security of the first data and well meet different security requirements of different data.

[0035] In a possible implementation, the feature of the first data includes part or all of the following: a user to which the first data belongs, a data type of the first data, a security level of the first data, a destination address of the first data message, and an index of the first data.

[0036] In a possible implementation, the second device receives the modified first data message through a data channel, and the second device can also receive other data messages through the data channel, such as a second data message, the second data message carrying encrypted second data, and a decryption key of the second data being different from the decryption key of the first data.

[0037] Through the above method, the decryption key of the second data is different from the decryption key of the first data, and the protection granularity of data security transmission is no longer the data channel, but targeted security protection for different data.

[0038] In a possible implementation, the first data message carries the feature of the first data, so that the second device can generate the decryption key of the first data by using the feature of the first data.

[0039] In a possible implementation, the feature of the first data is placed in the packet header of the first data packet, and the second device can quickly read the feature of the first data from the packet header.

[0040] In a possible implementation, when the second device stores the encrypted first data carried in the first data packet, the encrypted first data is stored in the persistent storage, i.e., the encrypted first data is directly stored in the persistent storage, and after receiving the encrypted first data, the second device does not perform a decryption operation, but directly stores the encrypted first data.

[0041] Suppose that the second device includes a storage node with a storage function, and when the second device stores the encrypted first data, the second device stores the encrypted first data in the storage node in a persistent manner. No decryption operation is performed in the storage node, but the encrypted first data is directly stored.

[0042] Through the above method, no decryption operation is performed in the second device, and the security of the encrypted second data in the second device can be ensured.

[0043] In a possible implementation, when the second device stores the encrypted first data in a persistent manner, the second device can store the encrypted first data in the memory of the second device, and then migrate the encrypted first data to the persistent storage of the storage node.

[0044] Suppose that the second device includes a storage node with a storage function, and when the second device stores the encrypted first data, the second device stores the encrypted first data carried in the first data packet in the memory of the storage node, and then migrates the encrypted first data to the persistent storage of the storage node.

[0045] Through the above method, the first data is always in a ciphertext state when stored in the memory and during the process of migrating from the memory to the persistent storage, which can effectively prevent the leakage of the first data and ensure the security of the first data.

[0046] In a possible implementation, the first data packet also carries an authentication code, and the authentication code is used for integrity protection of the feature of the first data. The authentication code can effectively prevent the feature of the first data from being tampered with during the transmission of the first data packet.

[0047] In a possible implementation, the second device obtains the feature of the first data from the first data message, generates a reference authentication code based on the feature of the first data, and compares the reference authentication code with the authentication code to determine whether the feature of the first data in the first data message is complete. If the reference authentication code is the same as the authentication code, the feature of the first data in the first data message is complete, otherwise, the feature of the first data in the first data message is incomplete.

[0048] By the above method, the second device can timely find whether the feature of the first data is tampered by a simple comparison operation.

[0049] In a third aspect, the present application further provides a data transmission system, which comprises the first device and the second device. The beneficial effects can be referred to the description of the first aspect and the second aspect, which will not be repeated here. In the data transmission system:

[0050] The first device is configured to generate an encryption key of the first data according to the feature of the first data, encrypt the first data by using the encryption key of the first data, and transmit a first data message, wherein the first data message carries the encrypted first data.

[0051] The second device is configured to save the encrypted first data carried in the first data message after receiving the first data message, and generate a decryption key of the first data based on the feature of the first data and decrypt the encrypted first data by using the decryption key in the case of needing to process the first data.

[0052] In a possible implementation, the feature of the first data comprises part or all of the following: a user to which the first data belongs, a data type of the first data, a security level of the first data, a destination address of the first data message, and an index of the first data.

[0053] In a possible implementation, the feature of the first data comprises part or all of the following: a user to which the first data belongs, a data type of the first data, a security level of the first data, a destination address of the first data message, and an index of the first data.

[0054] In a possible implementation, the first device transmits the first data message through a data channel, and can also transmit a second data message through the data channel, wherein the second data message carries encrypted second data, and an encryption key of the second data is different from the encryption key of the first data.

[0055] The second device receives the first data message through a data channel, and can also receive a second data message through the data channel, wherein the second data message carries encrypted second data, and a decryption key of the second data is different from the decryption key of the first data.

[0056] In a possible implementation, the first data message carries the feature of the first data.

[0057] In a possible implementation, the feature of the first data is placed in the message header of the first data message.

[0058] In a possible implementation, after the first device encrypts the first data by using the encryption key of the first data, the first device stores the encrypted first data in the persistent storage of the storage node.

[0059] In a possible implementation, the first device reads the first data in the form of ciphertext from the persistent storage in the storage node, and transmits the first data message.

[0060] In a possible implementation, when the first device reads the first data in the form of ciphertext from the persistent storage in the storage node, the first device migrates the first data in the form of ciphertext from the persistent storage (of the storage node or the first device) to the memory (of the storage node or the first device), and acquires the first data in the form of ciphertext from the memory.

[0061] In a possible implementation, before the first device reads the first data in the form of ciphertext from the persistent storage, the first device determines that the receiving device of the first data message belongs to the target group.

[0062] In a possible implementation, the second device stores the encrypted first data in the persistent storage of the storage node or the persistent storage.

[0063] In a possible implementation, the second device stores the encrypted first data carried in the first data message in the memory (of the storage node or the first device), and migrates the encrypted first data to the persistent storage (of the storage node or the first device).

[0064] In a possible implementation, the second device acquires the feature of the first data from the first data message, generates a reference authentication code based on the feature of the first data, and compares the reference authentication code with the authentication code to determine whether the feature of the first data in the first data message is complete.

[0065] In a fourth aspect, the present application provides a data device having functions to implement the behaviors in the method examples of the first aspect. The advantages can be referred to the description of the first aspect. The functions can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the functions. In one possible design, the data device includes a first key generation module, a first management module, and a first encryption engine, which can perform the corresponding functions in the method examples of the first aspect. The details can be referred to the description of the method examples.

[0066] In a fifth aspect, the present application provides a data device having functions to implement the behaviors in the method examples of the second aspect. The advantages can be referred to the description of the second aspect. The functions can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the functions. In one possible design, the data device includes a second key generation module, a second management module, and a second encryption engine, which can perform the corresponding functions in the method examples of the second aspect. The details can be referred to the description of the method examples.

[0067] In a sixth aspect, the present application provides a computing device including a processor and a memory, and can further include a network card. The processor executes program instructions in the memory to perform the method provided in the first aspect or any possible implementation of the first aspect. Alternatively, the processor executes program instructions in the memory to perform the method provided in the second aspect or any possible implementation of the second aspect. The memory is coupled to the processor and stores computer program instructions and data necessary for determining the data transmission process. The network card is used for communication with other devices.

[0068] In a seventh aspect, the present application provides a computing device system including at least one computing device. Each computing device includes a memory and a processor. The processor of the at least one computing device is configured to access the code in the memory to perform the method provided in the first aspect or any possible implementation of the first aspect. Alternatively, the processor of the at least one computing device is configured to access the code in the memory to perform the method provided in the second aspect or any possible implementation of the second aspect.

[0069] In an eighth aspect, the present application provides a computer readable storage medium, which, when executed by a computing device, causes the computing device to perform the method provided in the first aspect or any possible implementation of the first aspect, or perform the method provided in the second aspect or any possible implementation of the second aspect. The storage medium stores computer program instructions. The storage medium includes, but is not limited to, a volatile memory, such as a random access memory (RAM), and / or a non-volatile memory, such as a flash memory, a hard disk drive (HDD), and / or a solid state drive (SSD).

[0070] In a ninth aspect, the present application provides a computing device program product, which includes computer program instructions, when executed by a computing device, causes the computing device to perform the method provided in the first aspect or any possible implementation of the first aspect, or perform the method provided in the second aspect or any possible implementation of the second aspect. The computing device program product can be a software package, which can be downloaded and executed on the computing device when the method provided in the first aspect or any possible implementation of the first aspect, or the method provided in the second aspect or any possible implementation of the second aspect is needed.

[0071] In a tenth aspect, the present application further provides a computer chip, which is connected to a memory and is configured to read and execute computer program instructions stored in the memory, to perform the method provided in the first aspect and any possible implementation of the first aspect, or perform the method provided in the second aspect and any possible implementation of the second aspect. BRIEF DESCRIPTION OF DRAWINGS

[0072] FIG. 1 is a structural schematic diagram of a data transmission system according to an embodiment of the present application;

[0073] FIG. 2A is a structural schematic diagram of a first device according to an embodiment of the present application;

[0074] FIG. 2B is a structural schematic diagram of a second device according to an embodiment of the present application;

[0075] FIGS. 3A-3C are structural schematic diagrams of a data device according to an embodiment of the present application;

[0076] FIGS. 4A-4B are schematic diagrams of a data transmission scenario according to an embodiment of the present application;

[0077] FIG. 5 is a schematic diagram of a data transmission method according to an embodiment of the present application;

[0078] FIG. 6 is a schematic diagram of data migration in a first device according to an embodiment of the present application;

[0079] FIG. 7 is a schematic diagram of data migration in a second device according to an embodiment of the present application. DETAILED DESCRIPTION

[0080] Before introducing a data transmission method according to an embodiment of the present application, some concepts involved in the embodiment are clarified:

[0081] (1) Internet Protocol Security (IPSec)

[0082] IPSec is a security tunnel protocol family based on Internet Protocol (IP) network, which includes authentication, encryption, tunnel encapsulation and other protocols. Among them, authentication header (AH), encapsulating security payload (ESP), security association (SA) and internet key exchange (IKE) are included.

[0083] AH is a protocol for implementing data verification, ESP is a protocol for data encryption and ensuring data integrity (ensuring data integrity means preventing data from being tampered with), and ESP can be used independently or in combination with AH. IKE is a protocol for securely exchanging keys in a network. SA defines a protocol for negotiating data encryption / decryption methods and mutual authentication methods between communication parties.

[0084] (2) Transport Layer Security (TLS)

[0085] TLS protocol is a protocol established on the basis of TCP protocol in the transport layer, which serves the application layer and realizes the function of encrypting application layer messages before transmitting them by TCP.

[0086] TLS protocol specifies that communication parties need to encrypt transmitted data, ensure data integrity during transmission, and need to be mutually authenticated.

[0087] The TLS protocol includes two layers, one layer is a TLS record protocol, which specifies that the data transmitted is encrypted using a symmetric key. The other layer is a TLS handshake protocol, which is mainly divided into a handshake protocol, a cipher specification change protocol, a warning protocol and an application data protocol.

[0088] Among them, the handshake protocol defines the way for the two communication parties to negotiate the data encryption algorithm and share the key. The cipher specification change defines the way to notify the other party of the changed key when the key of one party is changed. The warning protocol defines the way to transmit the error to the other party when the error (or fault) occurs in one party. The application data protocol defines the protocol for one party to communicate the application data carried by TLS to the other party.

[0089] (3) Data encryption algorithm.

[0090] The data encryption algorithm includes a symmetric encryption algorithm and a non-object encryption algorithm.

[0091] The symmetric encryption algorithm has the characteristic that the same key is used for data encryption and decryption.

[0092] The characteristic of the asymmetric encryption algorithm is that different keys are used for data encryption and decryption, which are usually divided into public key and private key. Among them, the data encrypted by the public key can be decrypted by the private key, and vice versa. Generally, the public key is public, and any device or device can obtain it, while the private key is not public, and the private key can only be known and saved by the owner of the key.

[0093] (4) Key: root key, encryption key, decryption key.

[0094] The data transmission method in the embodiment of the application involves a plurality of different keys. In order to facilitate the distinction, the plurality of different keys are named.

[0095] The encryption key is the key used for data encryption. The decryption key corresponds to the encryption key, and the decryption key is the key used for decrypting the encrypted data.

[0096] In the embodiment of the application, the encryption key and the decryption key are associated with the data. The so-called "association" means that different data uses different encryption keys for encryption and different decryption keys for decryption. The generation of the encryption key and the decryption key needs to combine the characteristic information of the data and the root key.

[0097] The root key is a key material used to generate other keys. That is, other keys are derived from the root key. In the embodiment of the application, the encryption key and the decryption key are derived from the root key.

[0098] The process of deriving the encryption key and the decryption key from the root key (and the feature information of the data) needs to use a key derivation function. The key derivation function is a technology that changes an original key (such as the root key) into one or more keys with higher security. There are many types of key derivation functions, such as HMAC-based key derivation (HKDF), password-based key derivation function 2 (PBKDF2), blowfish-based cryptographic hash algorithm (Bcrypt), script-encrypt cryptographic (scrypt), and Argon2. Among them, HMAC is a hash-based message authentication code

[0099] The specific type of the key derivation function used in the process of deriving the encryption key and the decryption key from the root key (and the feature information of the data) is not limited in the embodiments of the present application.

[0100] In addition, in the embodiments of the present application, for any determined data (such as the first data or the second data), the encryption key of the data and the decryption key of the data are the keys used for encryption and decryption. The encryption key and the decryption key can be symmetric keys, that is, the encryption key and the decryption key are the same, and the data encryption algorithm used for data encryption is a symmetric encryption algorithm. The encryption key and the decryption key can also be asymmetric keys, that is, the encryption key and the decryption key are different, and the data encryption algorithm used for data encryption is an asymmetric encryption algorithm.

[0101] Data security is an important factor that needs to be considered in the process of data storage and data transmission. For example, when the data is stored in the hard disk of a computing device, it is necessary to prevent data leakage caused by theft of the hard disk or access of the hard disk by malicious programs. For another example, when data is transmitted from one computing device to another computing device, it is necessary to prevent data leakage caused by interception of the data during transmission.

[0102] Generally, data storage and data transmission are dependent on different data security measures.

[0103] Security measures in data storage: When data in memory needs to be stored in non-memory storage (non-memory storage refers to storage that is not memory, such as a disk, a hard disk), the data can be encrypted using a key first, and then the encrypted data is stored. But the key is related to the storage where the data is stored, that is, the same key is used to encrypt the data in the same storage. Since different data may have different security requirements, this encryption method cannot guarantee the security of different data.

[0104] In addition, inside the device, the data in the memory of the device always exists in plaintext form. For example, when the encrypted data in the non-memory storage is transferred to the memory, the data needs to be decrypted and then written into the memory. Therefore, the security of the data in the memory or the process of writing data into the memory cannot be well guaranteed inside the device.

[0105] Security measures in data transmission: Data transmission is achieved by using some existing security protocols, such as IPSec and TLS. But the data security of these security protocols is protected at the granularity of data channels; once a data channel is established between the two communicating parties, the same key is used to encrypt any data transmitted in the data channel. This security guarantee method is at the granularity of data channels, and cannot meet the different security requirements of different data.

[0106] In addition, since data storage and data transmission depend on different security measures for data, when data in the non-memory storage needs to be transmitted in a device, the data needs to be decrypted first and placed in the memory. Then, when the data is transmitted through the network card of the device, the data needs to be encrypted again based on the key defined by the security protocol, and then the encrypted data is transmitted through the network card of the device. The entire process needs to perform a decryption operation and an encryption operation, which not only cannot guarantee the security of the data, but also increases the computational power consumption of the device.

[0107] In the embodiments of the present application, in order to meet the security requirements of different data, the encryption key used to encrypt the data during data storage or data transmission is generated based on the characteristics of the data and the root key, so as to guarantee the security of different data. In addition, for the same data, the encryption key used during data storage or data transmission is the same, so when the data needs to be transmitted, the stored encrypted data is directly extracted, and the encrypted data is transmitted. In the entire process, the data does not need to be decrypted and then encrypted, which can effectively reduce the computational power consumption caused by encryption and decryption operations.

[0108] As shown in FIG. 1, a data transmission system is provided in the embodiment of the present application, and the data transmission system includes a plurality of data devices 10. From the perspective of data transmission, the data transmission system includes two types of data devices 10, one type of data device 10 is a data device 10 as a data receiving end, and another type of data device 10 is a data device 10 as a data sending end. For any data device 10 in the data transmission system, the data device 10 can act as a data receiving end and a data sending end. In the following, in order to clearly introduce the functions of the data device 10 as a data receiving end and the functions of the data device 10 as a data sending end, two data devices 10 that perform data interaction are taken as an example for description, and of the two data devices 10, the data device 10 as a data sending end is referred to as a first device 100, and the data device 10 as a data receiving end is referred to as a second device 200.

[0109] Before the functions of the first device 100 and the second device 200 are described, the concept of data involved in the embodiment of the present application is clarified. In the embodiment of the present application, the specific form of data is related to the organization form of data in the data device 10 (such as the first device 100 or the second device 200). For example, in the data device 10, data is organized in the form of a file system, and the data (such as the first data or the second data) mentioned in the embodiment of the present application can be understood as a file or a directory. For another example, in the data device 10, data is organized and stored in the form of an object, and the data (or target data) mentioned in the embodiment of the present application can be understood as an object. For another example, in the data device 10, data is organized and stored in the form of a data block, and the data (or target data) mentioned in the embodiment of the present application can be understood as a data block. In addition, the data mentioned in the embodiment of the present application is data with security requirements, that is, data that needs to be prevented from being stolen.

[0110] In the embodiment of the present application, the first device 100 has a data transmission function and a data storage function, the first device 100 can store data in the memory of the first device 100, and can also transmit data in the memory of the first device 100 to the second device 200. In the process of data storage or data transmission, the first device 100 needs to ensure the security of the data.

[0111] The first device 100 can ensure the security of the data from part or all of the following two aspects.

[0112] Aspect one, ensuring the security of the data in the first device 100.

[0113] In the first device 100, the first device 100 stores the data by encryption, that is, the data is encrypted by using an encryption key of the data, and the encrypted data is stored.

[0114] The encryption key used for encrypting the data is associated with the data to be encrypted, i.e. different data is encrypted using different encryption keys.

[0115] The first device 100 internally stores a root key. For any data, the first device 100 generates an encryption key of the data based on a feature of the data and the root key, encrypts the data using the encryption key of the data, and stores the encrypted data. The first device 100 comprises a persistent storage, and the first device 100 can store the encrypted data in the persistent storage.

[0116] In the first device 100, when the data needs to be processed, the first device 100 generates a decryption key of the data based on a feature of the data and the root key, decrypts the encrypted data using the decryption key, obtains the data, and processes the data. After the data processing is completed, the first device 100 can encrypt and store the data in the aforementioned manner. Processing the data in the first device 100 refers to operating on the data itself, such as modifying, updating, compressing, calculating, deleting part of the data, viewing, etc. The processing operation on the data does not include migration of the data, i.e. the data is transferred from one storage location to another storage location, for example, the data is migrated from the persistent storage of the first device 100 to the memory of the first device 100, or the data is migrated from the memory to the persistent storage. In other words, when the data needs to be migrated, the first device 100 does not need to decrypt the encrypted data, but directly migrates the encrypted data.

[0117] Based on the source of the data in the first device 100, the data in the first device 100 comprises two types of data. One type of data is data generated by the first device 100 itself during operation. The other type is data transmitted to the first device 100 by an external device (i.e. a device other than the first device 100, such as other data devices 10 in the data transmission system).

[0118] For the data generated by the first device 100 itself during operation, the first device 100 can analyze the data to obtain the feature of the data, and then generate the encryption key of the data based on the feature of the data and the root key, and then complete the encryption and storage of the data by means of the encryption key.

[0119] For the data transmitted by the external device to the first device 100, if the external device can transmit the feature of the data to the first device 100 at the same time of transmitting the data. The first device 100 receives the feature of the data transmitted by the external device, generates the encryption key of the data based on the feature of the data and the root key, encrypts the data by using the encryption key of the data, and stores the encrypted data. If the external device does not transmit the feature of the data to the first device 100 at the same time of transmitting the data. The first device 100 can analyze the data to obtain the feature of the data, and then generates the encryption key of the data based on the feature of the data and the root key, and then encrypts and stores the data by using the encryption key.

[0120] The manner of transmitting the data by the external device to the first device 100 is not limited in the embodiment of the present application, and the manner of transmitting the data by the external device to the first device 100 can be different from the manner of transmitting the data by the first device 100 to the second device 200. If the data transmitted by the external device to the first device 100 is encrypted data, for example, the external device transmits the data to the first device 100 based on IPSec or TLS, and the first device 100 decrypts the encrypted data, and then encrypts and stores the data by using the above-mentioned manner. If the data transmitted by the external device to the first device 100 is not encrypted, the first device 100 can encrypt and store the data by using the above-mentioned manner. Of course, the manner of transmitting the data by the external device to the first device 100 can be the same as the manner of transmitting the data by the first device 100 to the second device 200. If the manner of transmitting the data by the external device to the first device 100 is the same as the manner of transmitting the data by the first device 100 to the second device 200, the data received by the first device 100 from the external device is encrypted data, and the encryption key used by the first device 100 to encrypt the data is generated based on the root key and the feature of the data. In this case, the first device 100 can directly save the encrypted data.

[0121] In the embodiment of the present application, the encryption key used by the first device 100 to encrypt the data is generated based on the root key and the feature of the data. For different data, the feature of the data is different, and the encryption key used to encrypt different data is also different. Therefore, the first device 100 can ensure the security of the data in the first device 100 by using the data as the granularity.

[0122] Aspect two, ensure the security of the data flowing between the first device 100 and the second device 200.

[0123] The first device 100 sends data to the second device 200 in the form of ciphertext, that is, the first device 100 sends encrypted data to the second device 200, so as to ensure the security of data flowing between the data devices 10. The first device 100 transmits a data packet to the second device 200, and the data packet carries encrypted data. The encryption manner of the first device 100 to the data can refer to the related description in the first aspect, and details are not described herein.

[0124] Since the characteristics of different data to be transmitted are different, the encryption keys used for encrypting different data are also different. The first device 100 can ensure the security of data flowing between the first device 100 and the second device 200 in the granularity of data. The security of different data in the transmission process is ensured.

[0125] Optionally, when the first device 100 transmits data to the second device 200, the first device 100 can also transmit the characteristics of the data to the second device 200. The transmission manner of the characteristics of the data is not limited in the embodiments of the present application. For example, the first device 100 transmits two data packets to the second device 200, one of which carries encrypted data, and the other of which carries the characteristics of the data. For another example, the first device 100 transmits one data packet to the second device 200, and the data packet carries encrypted data and the characteristics of the data. In the data packet, the encrypted data and the characteristics of the data can be the payload of the data packet and be carried in the data packet. Alternatively, the encrypted data is the payload of the data packet and is carried in the data packet, and the characteristics of the data are the header of the data packet and are carried in the data packet.

[0126] When the first device 100 ensures the security of data in the above two aspects, when the first device 100 needs to transmit data, since the data exists in the first device 100 in the form of ciphertext, if the data is stored in the hard disk or other persistent storage of the first device 100, the first device 100 first reads the data in the form of ciphertext from the persistent storage, and migrates the read ciphertext (that is, encrypted data) to the memory. Then the ciphertext in the memory is transmitted to the network card of the first device 100, and the ciphertext is directly transmitted through the network card of the first device 100, that is, the encrypted data is directly transmitted. If the data has been stored in the memory of the first device 100, the first device 100 directly transmits the ciphertext in the memory of the first device 100 to the network card of the first device 100, and a data packet carrying the ciphertext is directly transmitted through the network card of the first device 100. In the whole process, the data always exists in the form of ciphertext, which can effectively ensure the security of the data, and the first device 100 does not need to perform encryption and decryption operations in the whole process, which can reduce the consumption of the computing power of the first device 100.

[0127] For the first device 100, the first device 100 can belong to one or more groups, each group containing a plurality of data devices 10, and the security requirements for data interaction between data devices 10 in different groups are different. For example, the data to be transmitted needs to be encrypted when data devices 10 in a group interact with each other. For another example, data is transmitted in plaintext form when data devices 10 in a group interact with each other, that is, the data to be transmitted does not need to be encrypted. For another example, the data needs to be encrypted with a pre-configured key when data devices 10 in a group interact with each other, that is, all data devices 10 in the group share the same key.

[0128] The data transmission system is understood as a target group to which the first device 100 belongs. When data devices 10 in the target group interact with each other, the data to be transmitted needs to be encrypted, and the encryption key of the data is related to the characteristics of the data. Therefore, when the first device 100 receives the data device 10 (such as the second device 200) that is a data device 10 in the target group, the first device 100 reads the data in the form of ciphertext from the persistent storage of the first device 100, migrates the encrypted data from the persistent storage to the memory, and then transmits the datagram carrying the encrypted data through the network card.

[0129] In the embodiment of the application, similar to the first device 100, the second device 200 also has data transmission and data storage functions. The second device 200 can receive data transmitted by the first device 100 and can also store data in the memory of the second device 200. During data storage or data transmission, the second device 200 also needs to ensure the security of the data.

[0130] In the embodiment of the application, the second device 200 ensures the security of the data from some or all of the following two aspects.

[0131] Aspect 1, ensuring the security of the data in the second device 200.

[0132] Similar to the first device 100, in the second device 200, the second device 200 encrypts and stores the data, that is, the data is stored in the form of ciphertext in the memory in the second device 200. The memory can be the memory or the persistent storage. The ciphertext is decrypted to obtain the data when the data needs to be processed.

[0133] The second device 200 guarantees the security of data in the second device 200 in a manner similar to that of the first device 100 guaranteeing the security of data in the first device 100. For details, refer to the foregoing description of the first device 100 guaranteeing the security of data in the first device 100, which will not be repeated here.

[0134] Aspect 2: Guaranteeing the security of data flowing between the first device 100 and the second device 200.

[0135] The second device 200, as a data receiving end, receives the encrypted data from the first device 100. The second device 200 can receive a data packet carrying the encrypted data sent by the first device 100, and obtain the encrypted data from the data packet.

[0136] After receiving the encrypted data, since the encrypted data received from the first device 100 is encrypted data encrypted by the encryption key of the data, the second device 200 does not need to decrypt the encrypted data, but directly saves the encrypted data. Inside the second device 200, the encrypted data reaches the memory of the second device 200 through the network card of the second device 200, and then is migrated from the memory of the second device 200 to the persistent storage of the second device 200. The encrypted data does not need to be decrypted and encrypted during the migration process.

[0137] It should be noted that when the second device 200 needs to process the data after receiving the encrypted data, the second device 200 can generate the decryption key of the data by using the characteristics of the data and the root key, decrypt the encrypted data by using the decryption key, obtain the data, and process the data. After the data processing is completed, the second device 200 can encrypt and store the data in the foregoing manner. The characteristics of the data can be transmitted by the first device 100 to the second device 200.

[0138] The structure of the first device 100 and the second device 200 will be described from a logical point of view. As shown in FIG. 2A, the structure of the first device 100 provided in an embodiment of the present application is shown. The first device 100 includes a first management module 101, a first key generation module 102, and a first encryption engine 103.

[0139] In the first device 100, the first management module 101 is a control party for data storage and data transmission.

[0140] For data storage, the first management module 101 can acquire the feature of the data to be stored, transmit the feature of the data to the first key generation module 102 to acquire the encryption key of the data from the first key generation module 102. After acquiring the encryption key of the data, the first management module 101 transmits the data and the encryption key of the data to the first encryption engine 103 to instruct the first encryption engine 103 to encrypt the data. After the encryption engine encrypts the data, the first management module 101 stores the encrypted data. The first management module 101 can store the encrypted data in the persistent storage of the first device 100. For example, the first management module 101 can migrate the encrypted data from the memory to the persistent storage.

[0141] Correspondingly, when the encrypted data needs to be decrypted (e.g., the data needs to be processed), the first management module 101 transmits the feature of the data to the first key generation module 102 to acquire the decryption key of the data from the first key generation module 102. After acquiring the decryption key of the data, the first management module 101 can transmit the decryption key of the data to the first encryption engine 103 to instruct the first encryption engine 103 to decrypt the encrypted data, and the first management module 101 acquires the encrypted data from the first encryption engine 103.

[0142] For data transmission, when data needs to be transmitted to the second device 200, the first management module 101 transmits a data packet to the second device 200, the data packet carrying the encrypted data, which is obtained by encrypting the data using the encryption key of the data. The encryption process of the data can be referred to the foregoing description, which will not be repeated here.

[0143] Inside the first device 100, when the encrypted data is stored in the persistent storage, the first management module 101 migrates the encrypted data from the persistent storage to the memory of the first device 100, and the encrypted state of the data is still maintained in the memory, that is, the encrypted data is stored in the memory, and then the encrypted data in the memory is transmitted to the second device 200.

[0144] If different groups have different requirements for the interaction between the data devices 10, the first management module 101 can also determine that the receiving device of the data belongs to a target group before acquiring the encrypted data from the persistent storage, wherein the target group requires that the data to be transmitted between the data devices 10 needs to be encrypted, and the encryption key of the data is related to the feature of the data.

[0145] Optionally, the first management module 101 can also transmit the characteristic of the data to the second device 200. The embodiment of the present application does not limit the transmission manner of the characteristic of the data. For example, the characteristic of the data can be carried in the data packet, the characteristic of the data can be carried as the payload in the data packet together with the encrypted data, or the characteristic of the data can be carried as part of the packet header in the data packet.

[0146] In addition, the first management module 101 can also transmit the characteristic of the data to the second device 200 through the data packet. The characteristic of the data can be carried in the data packet, for example, in the data header of the data packet. Optionally, the data packet can also carry an authentication code to protect the integrity of the characteristic of the data.

[0147] In addition, the first management module 101 can transmit data packets (the first data packet and the second data packet mentioned in the following embodiments) to the second device 200 through the data channel. The data carried in these data packets is encrypted data, and the encryption key used for the encrypted data is related to the data characteristic. Different data characteristics have different encryption keys. The type of the data characteristic can be referred to the foregoing description, which will not be repeated here.

[0148] The first key generation module 102 is configured to generate an encryption key or a decryption key of the data. The first key generation module 102 stores a root key. When the first key generation module 102 receives the characteristic of the data from the first management module 101 under the instruction of the first management module 101, the first key generation module 102 generates the encryption key or the decryption key of the data based on the characteristic of the data and the root key.

[0149] The first encryption engine 103 is configured to encrypt or decrypt the data. The first encryption engine 103 can encrypt the data by using the encryption key obtained from the first management module 101, or decrypt the encrypted data by using the decryption key obtained from the first management module 101 under the instruction of the first management module 101.

[0150] As shown in FIG. 2B, the structure of the second device 200 provided by the embodiment of the present application is shown. The second device 200 includes a second management module 201, a second key generation module 202, and a second encryption engine 203.

[0151] In the second device 200, the second management module 201 is the control party of the data storage and the data transmission.

[0152] For data transmission, the second management module 201 can receive the encrypted data sent by the first device 100. For example, the second management module 201 receives the data packet sent by the first device 100, and obtains the encrypted data from the data packet.

[0153] For data storage, the second management module 201 stores the encrypted data directly after obtaining the encrypted data. The second management module 201 can migrate the encrypted data from the memory of the second device 200 to the persistent storage of the second device 200 or the storage node of the second device 200, so as to realize the persistent storage of the data.

[0154] In addition, when the data needs to be processed, the second management module 201 transmits the feature of the data obtained from the first device 100 to the second key generation module 202 to instruct the generation of the decryption key of the data. After the second management module 201 obtains the decryption key of the data from the second key generation module 202, the second management module 201 can transmit the decryption key of the data to the second encryption engine 203 to instruct the second encryption engine 203 to decrypt the encrypted data, and the second management module 201 obtains the encrypted data from the second encryption engine 203.

[0155] The embodiments of the present application do not limit the way in which the second management module 201 obtains the feature of the data from the first device 100. For example, the feature of the data and the encrypted data are carried in the same data packet, and the second management module 201 obtains the feature of the data from the data packet. The feature of the data can be carried as the payload in the data packet together with the encrypted data, or the feature of the data can be carried as part of the packet header in the data packet.

[0156] In addition, the second management module 201 can also determine whether the feature of the data carried in the data packet is complete by using the authentication code carried in the data packet.

[0157] In addition, the second management module 201 can receive data packets (such as the first data packet and the second data packet mentioned in the embodiments below) through the data channel, the data carried in these data packets are all encrypted data, and the decryption key used for decrypting the data is related to the data feature, and the decryption key of the data is different for different data features. The type of the data feature can be referred to the foregoing description, which will not be repeated here.

[0158] The second key generation module 202 is configured to generate the decryption key of the data. The second key generation module 202 stores a root key, and the second key generation module 202 can obtain the feature of the data from the second management module 201 under the instruction of the second management module 201, and generate the decryption key based on the feature of the data and the root key.

[0159] The second encryption engine 203 is configured to decrypt the data. The second encryption engine 203 can decrypt the encrypted data by using the decryption key obtained from the second management module 201 under the instruction of the second management module 201.

[0160] The division of the modules in the embodiments of the present application is illustrative, and is merely a logical functional division. In actual implementation, another division manner can be used. In addition, each functional module in each embodiment of the present application can be integrated in one processor, or can be physically separated, or two or more modules can be integrated in one module. The integrated module can be implemented in the form of hardware or in the form of a software functional module.

[0161] Taking the first device 100 as an example, for each module in the first device 100, one possible deployment manner is that the first management module 101, the first key generation module 102, and the first encryption engine 103 are deployed in a processor (a processor of a computing device, a processor in a storage node, or a processor in a computing node mentioned below) or an acceleration device (an acceleration device in a computing device mentioned below) of the first device 100. Taking the deployment of the first management module 101, the first key generation module 102, and the first encryption engine 103 in the processor of the first device 100 as an example, the first management module 101, the first key generation module 102, or the first encryption engine 103 can be circuit logic in the processor, or can be software running on the processor (in this case, computer program instructions related to the first management module 101, the first key generation module 102, or the first encryption engine 103 can be stored in a memory of the first device 100).

[0162] Another possible deployment manner is that the first management module 101 and the first key generation module 102 are deployed in the processor or the acceleration device of the first device 100, and the first encryption engine 103 is deployed in a memory of the first device 100, that is, the memory of the first device 100 is a memory with an encryption function. For example, the first encryption engine 103 is deployed in a controller (such as a controller in a hard disk) in the memory. Similarly, the first management module 101, the first key generation module 102, or the first encryption engine 103 can be circuit logic, or can be software.

[0163] It should be noted that when the first encryption engine 103 is deployed in the memory (such as the persistent memory) of the first device 100, the memory of the first device 100 supports the data to flow out in the cipher text state, that is, the memory of the first device 100 can not decrypt the stored encrypted data, but directly transmit the encrypted data to other modules (such as the first management module 101). For example, when the first device 100 needs to send data to the second device 200, inside the first device 100, the first management module 101 can obtain the encrypted data from the memory of the first device 100, such as the first management module 101 initiating an instruction to the first encryption engine 103 to obtain the encrypted data, and the first encryption engine 103 obtains the encrypted data from the memory after receiving the instruction, and directly transmits the encrypted data to the first management module 101.

[0164] The deployment of each module in the second device 200 is similar to the deployment of each module in the first device 100, and specific details can be referred to the foregoing description, which will not be repeated here.

[0165] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing an end device (which can be a personal computer, a mobile phone, or a network device, etc.) or a processor to execute all or part of the steps of the method of each embodiment of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0166] The description of the functions of each module in the first device 100 and the second device 200 is only a general description in simple language. The process of data encryption and decryption and data migration within the data device can be referred to the related content in the foregoing and the following of the embodiments of the present application, which will not be expanded here.

[0167] The structure of the first device 100 and the second device 200 will be described from the hardware perspective below. The following lists several possible hardware structures of the first device 100 and the second device 200.

[0168] As shown in FIG. 3A, a data transmission system is provided in an embodiment of the present application, in which the data transmission system includes a cluster of computing nodes 300 and a cluster of storage nodes 400, the cluster of computing nodes 300 includes a plurality of computing nodes 300, and the cluster of storage nodes 400 includes a plurality of storage nodes 400. Each of the computing nodes 300 can communicate with each other. The computing node 300 is a computing device, such as a server, a desktop computer, or a controller of a storage array, etc. The computing node 300 can communicate with any storage node 400 through a network. As for the cluster of storage nodes 400, each of the storage nodes 400 in the cluster of storage nodes 400 can also communicate with each other. In the data transmission system, the data apparatus 10 can be regarded as an apparatus including the computing nodes 300 and the storage nodes 400, i.e., the functions of the data apparatus 10 are deployed on the computing nodes 300 and the storage nodes 400 respectively, in which the computing nodes 300 are used to undertake data encryption and decryption operations and data packet transmission operations (i.e., sending or receiving data packets), and the storage nodes 400 are used to undertake data storage functions. The storage nodes 400 can directly store the encrypted data received from the computing nodes 300 without decrypting the encrypted data, and the storage nodes 400 can also directly transmit the stored encrypted data to the computing nodes 300 without decrypting the stored encrypted data.

[0169] In hardware, as shown in FIG. 3A, the computing node 300 at least includes a processor 301, a memory 302, and a network card 303.

[0170] The processor 301 is the operation core and control core of the computing node 300, which can be a central processing unit (CPU), or other specific integrated circuits. The processor 301 can also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc.

[0171] The processor 301 is configured to process a data request from outside the computing node 300 or a request generated inside the computing node 300. For example, when the processor 301 receives a data request for requesting storage data, the processor 301 temporarily stores the data in the data request in the memory 302. When the total amount of data in the memory 302 reaches a certain threshold, the processor 301 sends the data stored in the memory 302 to the storage node 400 for persistent storage. In the embodiment of the present application, if the data carried by the data request is not encrypted, the processor 301 can encrypt the data. The processor 301 can encrypt the data in the manner described above with reference to the first device 100, which will not be described herein again. After encrypting the data, the processor 301 can send the encrypted data to the storage node 400 for persistent storage. If the data carried by the data request is encrypted, the processor 301 can send the encrypted data to the storage node 400 for persistent storage.

[0172] When the processor 301 receives a data request for requesting reading data, if the data is stored in the memory 302 of the computing node 300, the processor 301 can carry the data in the memory 302 in a data packet and transmit the data packet. If the data is stored in the memory 302 of the storage node 400, the processor 301 can obtain the data from the storage node 400, carry the obtained data in a data packet and transmit the data packet. In the embodiment of the present application, if the data has not been encrypted in the memory 302, the processor 301 can encrypt the data. The processor 301 can encrypt the data in the manner described above with reference to the first device 100, which will not be described herein again. Then, the encrypted data is carried in the data packet and transmitted. If the data has been encrypted in the memory 302, the processor 301 can directly carry the encrypted data in the data packet and transmit the data packet. If the data is stored in the storage node 400 in the form of ciphertext, the processor 301 can read the stored encrypted data from the storage node 400, carry the encrypted data in the data packet and transmit the data packet.

[0173] In addition, the processor 301 is configured to perform computation or processing on data, such as metadata management, duplicate data deletion, data compression, virtual storage space and address conversion. FIG. 3A only shows one processor 301, and the number of processors 301 is not limited in the embodiment of the present application.

[0174] The memory 302 refers to an internal memory directly exchanging data with the processor 301, and can be used as temporary data storage of an operating system or other programs running. The memory 302 can include random access memory and read only memory (ROM). For example, the random access memory is dynamic random access memory (DRAM), or storage class memory (SCM). The memory 302 can also include other random access memories such as static random access memory (SRAM), etc. The memory 302 can also include a dual in-line memory module or dual in-line memory module (DIMM). The embodiments of the present application do not limit the specific type of the memory 302 and the type of memory included in the memory 302.

[0175] The network card 303 is used for communication with the storage node 400. For example, when the total amount of data in the memory 302 reaches a certain threshold, the computing node 300 can send a request to the storage node 400 through the network card 303 to persistently store the data in the memory 302. In addition, the computing node 300 can also include a bus for communication between the components inside the computing node 300. In terms of function, since the main function of the computing node 300 in FIG. 3A is to calculate the business, in actual implementation, the computing node 300 can also be built-in with a small amount of hard disk, or externally connected with a small amount of hard disk.

[0176] One storage node 400 includes one or more control units 401, network cards 402 and multiple hard disks 403. The network card 402 is used for communication with the computing node 300. The hard disk 403 is used for storing data, which can be a magnetic disk or other types of storage media, such as a solid state disk 403 or a shingled magnetic recording hard disk 403, etc. The hard disk 403 can be understood as the persistent storage in the data device 10. In actual application, the hard disk 403 can also be replaced by other persistent storage.

[0177] The control unit 401 is used to write data into the hard disk 403 or read data from the hard disk 403 according to the request sent by the computing node 300. The control unit 401 can have some simple computing functions.

[0178] In the embodiments of the present application, when the control unit 401 receives a request for writing data from the computing node 300, the control unit 401 can persist the encrypted data carried in the request to the hard disk 403. In the process of persisting the data to the hard disk 403, the control unit 401 can first temporarily store the encrypted data in the internal memory of the control unit 401, and then migrate the encrypted data stored in the memory to the hard disk 403. When the control unit 401 receives a request for reading data from the computing node 300, the control unit 401 reads the stored encrypted data from the memory or the hard disk 403 according to the request, and then feeds back the encrypted data to the computing node 300.

[0179] In actual applications, the control unit 401 can have various forms. In one case, the control unit 401 includes a processor and a memory. The processor is used to perform read and write data operations. The memory is used to temporarily store data to be written to the hard disk 403 or data to be read from the hard disk 403 and sent to the computing node 300. The type of processor can refer to the foregoing description of the processor 301, which will not be repeated here. In another case, the control unit 401 is a programmable electronic component, such as a data processing unit (DPU). Alternatively, the DPU here can also be replaced by a graphics processing unit (GPU), a neural-network processing unit (NPU), or other processing chips.

[0180] In another embodiment, the functions of the control unit 401 can be offloaded to the network card 402. In other words, in the embodiment shown in FIG. 3A, the storage node 400 does not have a control unit 401 inside, but the data read and write functions are completed by the network card 402. At this time, the network card 402 is an intelligent network card 402. It can contain a processor and a memory. The processor is used to perform read and write data operations. The memory is used to temporarily store data to be written to the hard disk 403 or data to be read from the hard disk 403 and sent to the computing node 300. The processor can also be a programmable electronic component, such as a DPU.

[0181] In FIG. 3A, the data apparatus 10 can be regarded as a "device" including the computing node 300 and the storage node 400, in which the computing node 300 undertakes data encryption and decryption operations, while the storage node 400 undertakes data storage functions and does not undertake encryption and decryption operations, and directly stores the encrypted data obtained from the computing node 300, or directly feeds back the stored encrypted data to the computing node 300. In actual applications, the storage node 400 can also undertake data encryption and decryption operations, in which case the data apparatus 10 is the storage node 400, which can process requests from the computing node 300 or from other storage nodes 400, such as a request for storing data. If the data carried by the data request is not encrypted, the storage node 400 can encrypt the data, and the encryption method of the storage node 400 for the data can refer to the related description of the encryption of the data by the first apparatus 100, which will not be described here. After encrypting the data, the storage node 400 can store it in the hard disk 403. If the data carried by the data request is encrypted, the storage node 400 can store the encrypted data in the hard disk 403. For example, the request is for reading data, and if the data stored in the memory of the storage node 400 has not been encrypted, the storage node 400 can encrypt the data, and the encryption method of the storage node 400 for the data can refer to the related description of the encryption of the data by the first apparatus 100, which will not be described here. Then, the encrypted data is carried in the data packet, and the data packet is transmitted. If the data stored in the memory has been encrypted, the storage node 400 can directly carry the encrypted data in the data packet and transmit the data packet. If the data has been stored in the hard disk 403 in the form of ciphertext, the storage node 400 can read the stored encrypted data from the storage node 400 (the storage node 400 can migrate the encrypted data from the hard disk 403 to the memory, and temporarily store the encrypted data in the memory), carry the encrypted data in the data packet, and transmit the data packet.

[0182] As shown in FIG. 3B, the computing device 500 includes a network card 503, a processor 501, and a memory 502. The network card 503, the processor 501, and the memory 502 are connected through a bus 504.

[0183] The network card 503 is used to communicate with devices located outside the computing device 500. For example, an external apparatus can send a data packet to the computing device 500 through the network card 503, and the data packet carries encrypted data. For another example, the computing device 500 can send a data packet to an external apparatus through the network card 503, and the data packet carries encrypted data.

[0184] The processor 501 is the operation core and control core of the computing device 500. The type of the processor can refer to the foregoing description of the processor 301, and details are not described herein.

[0185] The type of the memory 502 is similar to the type of the foregoing memory. Details can refer to the foregoing description. In addition, the memory can further include a FLASH, a hard disk drive (HDD) or a solid state drive (SSD) and the like persistent storage.

[0186] The embodiment is not limited to the number of the memory 502. The processor 501 is connected to the memory 502 through a double data rate (DDR) bus or other types of buses. The memory 502 can be understood as the internal memory of the computing device 500, which is also called the main memory. The processor 501 executes some steps of the first device 100 or the second device 200 in the embodiment shown in FIG. 5 below by calling the computer program instructions in the memory. When the computing device 500 is the first device 100, some steps of the first device 100 in the embodiment shown in FIG. 5 below are executed by calling the computer program instructions in the memory. When the computing device 500 is the second device 200, some steps of the second device 200 in the embodiment shown in FIG. 5 below are executed by calling the computer program instructions in the memory.

[0187] The memory 502 can also be understood as the memory of the computing device 500 other than the internal memory. For example, the memory 502 can be the persistent storage (such as a hard disk or a disk) of the computing device 500, or the memory that can be accessed by the host and is located remotely.

[0188] FIG. 3C is a structural schematic diagram of a computing device according to an embodiment of the present application. The computing device 600 includes a host 610 and an acceleration device 620. The host 610 is the main part of the computing device. The host 610 includes but is not limited to a personal computer, a server, a mobile phone, a tablet computer or a smart car and the like.

[0189] Inside the computing device 600, the host 610 and the acceleration device 620 both have data processing capabilities. The host 610 is the main processing core in the computing device 600, and the host 610 can complete data operations required to be performed by the computing device 600. From the perspective of data storage and data transmission, the host 610 has the ability of storing data and transmitting data. In the embodiments of the present application, since the acceleration device 620 is added in the computing device 600, the acceleration device 620 can replace the host 610 to realize data storage and data transmission, or can assist the host 610 to realize part of the functions of data storage and data transmission.

[0190] The acceleration device 620 is connected with the host 610. The acceleration device 620 can be an external device of the host 610, or can be deployed inside the host 610, for example, the acceleration device 620 is located on the mainboard or backboard of the host 610. The acceleration device 620 (for example, the processing module 621 in the acceleration device 620) exchanges data with the host 610 (for example, the processor 611 in the host 610) through the bus 614. The bus 614 can be a peripheral component interconnect express (PCIe) bus, or a bus of a compute express link (CXL), a universal serial bus (USB) protocol or other protocols.

[0191] From another perspective, the acceleration device 620 is a module with data processing function attached to the host 610, and undertakes part of the functions of the host 610. That is, part of the functions of the host 610 are offloaded to the acceleration device 620, and the acceleration device 620 replaces the host 610 to perform part of the operations, so as to reduce the pressure of the host 610, especially the pressure of the processor 611 in the host 610, and release the computing power of the processor 611. In the embodiments of the present application, the acceleration device 620 can replace the host 610 to realize data storage and data transmission.

[0192] When the computing device 600 is the first device 100, the acceleration device 620 can generate an encryption key of data, encrypt the data using the encryption key of the data, and store the encrypted data in the memory 612 of the host 610. The acceleration device 620 can also acquire the encrypted data from the memory 612 of the host 610 at the instruction of the host 610 (the processor 611 of the host 610), and transmit a data packet carrying the encrypted data to the second device 200. In addition, when the data needs to be processed in the computing device 600, the acceleration device 620 can generate a decryption key of the data, decrypt the data in the memory 610 using the decryption key of the data, and transmit the data to the host (the processor 611 of the host 610) for processing by the processor 611 of the host 610.

[0193] When the computing device 600 is the second device 200, the acceleration device 620 can receive a data packet carrying encrypted data, acquire the encrypted data from the data packet, and store the encrypted data in the memory 612 of the host 610. The acceleration device 620 can also generate a decryption key of the data at the instruction of the host 610 (the processor 611 of the host 610), decrypt the encrypted data in the memory 612 of the host 610, and transmit the decrypted data to the host 610. In addition, the acceleration device 620 can also encrypt data in the computing device 600, i.e., generate an encryption key of the data, encrypt the data using the encryption key, and store the encrypted data in the memory 612 of the host 610.

[0194] Embodiments of the present application do not limit the specific form of the acceleration device 620. For example, the acceleration device 620 can be an offload card or an acceleration card inserted into the host 610. For another example, the acceleration device 620 can be a network card of the host 610 inserted into the host 610. In addition to being capable of encrypting and decrypting data, the acceleration device 620, as a network card, can also complete processing of data based on a network protocol, such as implementing encapsulation and transmission of data.

[0195] The internal structures of the host 610 and the acceleration device 620 will be described below.

[0196] The host 610 includes a network card 613, a processor 611, and a memory 612. The network card 613 is used to communicate with devices located outside the host 610. For example, an external device can send a data packet to the host 610 through the network card 613, or transmit a data packet to an external device through the network card.

[0197] In the embodiments of the present application, if the acceleration device 620 is inserted into the host 610 in the form of a network card, the acceleration device 620 acts as a “network card 613” to realize direct message transmission between the host 610 and the external device. That is, the data packet sent by the external device to the host 610 is first transmitted to the acceleration device 620, and the acceleration device 620 can parse the data packet to obtain the encrypted data therefrom. When the host 610 needs to send a data packet to the external device, the acceleration device 620 generates a data packet carrying the encrypted data obtained from the memory 612 and transmits the data packet to the external device.

[0198] If the acceleration device 620 is inserted into the host 610 in the form of a non-network card (such as an offload card or an acceleration card), the network card 613 transmits the data packet sent by the external device to the processor 611 of the host 610. The processor 611 of the host 610 transmits the encrypted data carried in the data packet to the acceleration device 620, so that the acceleration device 620 stores the encrypted data in the memory 612. When the host 610 needs to send a data packet to the external device, the processor 611 of the host 610 instructs the acceleration device 620 to send a data packet, and the acceleration device 620 generates a data packet carrying the encrypted data obtained from the memory 612 and transmits the data packet to the external device through the network card 613.

[0199] The specific type of the processor 611 and the function of the memory 612 are similar to the specific type of the processor 301 and the function of the memory 302, and specific details can be referred to the foregoing content, which will not be described here.

[0200] The acceleration device 620 includes a processing module 621 and a memory 622, and the processing module 621 and the memory 622 are connected through a bus. The system bus can be a PCIe-based line, or a CXL, USB protocol or other protocol bus. Although not shown, the acceleration device 620 can also include a power supply circuit for supplying power to the processing module 621.

[0201] The processing module 621 is the main operation unit of the acceleration device 620 and is the core unit of the acceleration device 620, and the processing module 621 undertakes the main functions of the acceleration device 620. For example, the data encryption and decryption and data storage operations required by the acceleration device 620 can be performed by the processing module 621. The processing module 621 can execute some methods required by the first device 100 or the second device 200 in the embodiments shown in FIG. 6 below by calling computer program instructions in the memory 622.

[0202] The embodiments of the present application do not limit the specific type of the processing module, and the processing module 621 can be a data processing unit (DPU), a DSP, an ASIC, an FPGA, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Any component with processing function can be used as the processing module 621.

[0203] The memory 622 can support the operation of the processing module 621, and the memory 622 is used to store data and / or computer program instructions required for the operation. For example, the memory 622 can store features of data, encryption keys, decryption keys, etc. The memory 622 can also be used to store computer program instructions required for the operation.

[0204] The type of the memory 622 is similar to that of the memory 612, and details can be referred to the foregoing content, which will not be described here. The memory 622 is understood as the memory of the acceleration device 620.

[0205] The data transmission system mentioned in the embodiments of the present application can be applied to different data transmission scenarios, and two scenarios are listed as follows:

[0206] Scenario one: data transmission scenario based on data port.

[0207] In some common data transmission scenarios, there is a special type of data transmission scenario, which has the characteristic of "fragmentation" of data transmission. That is, in this type of data transmission scenario, the data producer will generate some fragmented data scatteredly, and the fragmented data refers to data with small data volume. The data producer will transmit these fragmented data in multiple times. The gateway connected with the data producer receives the fragmented data transmitted by the data producer, and sends the fragmented data to reach the receiver of the fragmented data. If the gateway transmits the fragmented data every time it receives one, then the gateway needs to send the fragmented data in multiple times, which is low in data transmission efficiency, causes waste of resources, and increases the cost of data transmission.

[0208] To this end, the concept of a "data port" is introduced, which can aggregate the received fragmented data, and when the aggregated fragmented data reaches a certain data volume, the data port sends the aggregated fragmented data out again. In actual application, considering that there are more than one data producer, which may be far apart in physical location, or more than one data receiver, which may be far apart in physical location, multiple data ports will be set up to form a multiple data port system, and data interaction can be performed between the data ports in the multiple data port system. The fragmented data is transmitted from the data producer to the multiple data port system, and in the data port, the fragmented data is aggregated and sent at different data ports, and finally flows out of the data port system to the data receiver.

[0209] As shown in FIG. 4A, a schematic diagram of a data port system is exemplarily drawn, which includes multiple data ports (only two data ports are exemplarily shown in FIG. 4A), each of which has a persistent storage such as an SSD, a processor (for supporting encryption and decryption operations on data), a memory (for storing computer program instructions required by the processor and caching data to be transmitted or data to be stored), and a network card (for interacting with other data ports) to store fragmented data.

[0210] The data port system can adopt the architecture of the data transmission system as shown in FIG. 1, and the data port can be understood as the data device 10 in the data transmission system, such as the first device 100 or the second device 200. In the data port system, the data transmission manner between the data ports is similar to the data transmission manner between the first device 100 and the second device 200. That is, the data is transmitted in the form of ciphertext between the data ports, and the encryption key of the data is related to the characteristics of the data. In the data port, the data can also be saved in the state of ciphertext.

[0211] Scenario two, data transmission scenario of data center.

[0212] With the emergence of various small data centers (such as edge data centers), the demand for data interaction between different data centers also increases accordingly. As shown in FIG. 4B, two data centers are exemplarily shown, which can transmit data to each other.

[0213] The transmission manner between the data devices 10 in the data transmission system in the embodiments of the present application can be applied to the data transmission scenario between the data centers. In this case, the data device 10 can be understood as a server in the data center, and the data device 10 as the data receiver and the data device 10 as the data sender are deployed in different data centers.

[0214] The data transmission method provided by the embodiment of the present application is described below in combination with FIG. 5, taking the first data needing to be stored or transmitted as an example. The method includes two parts, one part is the storage process of the first data in the first device 100, which can be specifically referred to steps 501-502. The other part is the transmission process of the first data between the first device 100 and the second device 200. It can be specifically referred to steps 503-505.

[0215] Step 501: The first device 100 acquires the feature of the first data, and generates the encryption key of the first data according to the feature of the first data and the root key.

[0216] In the first device 100, the first data needs to be encrypted and stored, therefore, the first device 100 needs to generate the encryption key of the first data first. In step 501, the encryption key is generated based on the feature of the first data and the root key.

[0217] The embodiment of the present application does not limit the specific type of the feature of the first data. For example, the feature of the first data is the user to which the first data belongs, the data type and other attributes. For another example, in some scenarios, it can be determined in advance which device the first data needs to be sent to (such as the data port scenario), and the feature of the first data can be the address of the receiving device of the first data, that is, the destination address of the data packet in step 504, such as the IP address or the MAC address. For another example, the feature of the first data can be the index of the first data. For another example, the feature of the first data is the security level of the first data.

[0218] Since the feature of the first data is a "parameter" needed to generate the encryption key of the first data, the specific type of the feature of the first data determines the "protection granularity" of the data security in the first device 100 to a certain extent.

[0219] For example, the first data is characterized by an identity of a user to which the first data belongs, and the first device 100 is configured to protect the first data at a user granularity. In other words, different users have different encryption keys, and the data of different users are protected accordingly. Assume that there are two users, user A and user B. The data of user A is encrypted by an encryption key that is generated based on the identity of user A and a root key, and the data of user A is encrypted by the same encryption key. Similarly, the data of user B is encrypted by an encryption key that is generated based on the identity of user B and the root key, and the data of user B is encrypted by the same encryption key. The encryption key of one user (generally, the encryption key can be used to derive a decryption key) is leaked, and the data of the other user is not affected.

[0220] For example, the first data is characterized by a data type of the first data, and the first device 100 is configured to protect the first data at a data type granularity. In other words, different data types have different encryption keys, and the data of different types is protected accordingly. Assume that in an e-commerce scenario, the data types include, but are not limited to, purchase records, return and exchange records, monthly sales, and monthly profits. The data of different types is encrypted by different encryption keys, and the security of the data of different types is ensured.

[0221] In the embodiments of the present application, the user is allowed to configure the protection granularity of the data security in the first device 100, that is, to configure the specific type of the characteristic of the first data. The first device 100 provides an interface for the user to configure the data security protection granularity, and the user can configure the specific type of the characteristic of the first data through the interface. The interface is understood as a configuration function provided by the first device 100 for the user, and the embodiments of the present application do not limit the specific form of the interface. For example, the interface is a visual interface for the user. For another example, the interface is an instruction for configuring the specific type of the characteristic of the first data.

[0222] In addition to the characteristic of the first data, the root key is another "parameter" required for generating the encryption key of the first data, and embodiments of the present application do not limit the configuration manner of the root key. For example, the root key is pre-configured in the first device 100 and the second device 200. For another example, the root key is determined through negotiation between the first device 100 and the second device 200. The first device 100 and the second device 200 can negotiate the root key through the IKE protocol in the IPsec or the handshake protocol in the TLS.

[0223] When generating the encryption key of the first data, the first device 100 can take the characteristic of the first data and the root key as input parameters of a key derivation function such as HKDF, PBKDF2, Bcrypt, Scrypt, Argon2, to obtain the encryption key of the first data.

[0224] Suppose the key derivation function is HKDF, then the encryption key DEK 第一数据 of the first data satisfies: DEK 第一数据 = HKDF (root key, characteristic)

[0225] Step 502: The first device 100 encrypts the first data by using the encryption key and stores the encrypted first data.

[0226] After generating the encryption key of the first data, the first device 100 encrypts the first data by using the encryption key. The first device 100 can call a symmetric encryption algorithm to encrypt the first data by using the encryption key, in which case the encryption key of the first data is the same as the decryption key of the target, and embodiments of the present application do not limit the type of symmetric encryption algorithm used for the first data. The symmetric encryption algorithm can be a data encryption standard (DES) algorithm, an advanced encryption standard (AES), an authenticated encryption with associated data (AEAD) algorithm, and the like.

[0227] Suppose the symmetric encryption algorithm is AEAD, then the encrypted first data DATA encry satisfies: DATA encry = AEAD (DEK 第一数据 , DATA plain ), where DATA plain is the data before encryption

[0228] The first device 100 can also call an asymmetric encryption algorithm, and encrypt the first data by using the encryption key. In this case, the encryption key of the first data is different from the decryption key of the first data. Embodiments of the present application do not limit the type of the asymmetric encryption algorithm used for the first data, which can be RSA, an elliptic curve cryptography (ECC), or the like. Generally, the key used by the asymmetric encryption algorithm for encrypting and decrypting the first data is called a public key and a private key. That is, the public key is the encryption key, and the private key is the decryption key.

[0229] When the first device 100 calls an asymmetric encryption algorithm and encrypts the first data by using the encryption key, the public key pubK used for encryption satisfies:

[0230] pubK = <Func (Value), n>.

[0231] The private key priK used for decryption satisfies:

[0232] priK = <Value, n>

[0233] where n is a large constant, Value = KDF (root key, feature), and Func (·) is a function related to the asymmetric encryption algorithm.

[0234] In the first device 100, the first data is stored in the form of ciphertext. When the first data needs to be processed, the first device 100 can decrypt the encrypted first data.

[0235] If the first device 100 calls a symmetric encryption algorithm and encrypts the first data by using the encryption key, the decryption key used for decrypting the encrypted first data is the same as the encryption key. Therefore, the decryption key of the first data is generated in the same way as the encryption key. The encrypted first data is decrypted by using the decryption key.

[0236] If the first device 100 calls an asymmetric encryption algorithm and encrypts the first data by using the encryption key, the decryption key used for decrypting the encrypted first data is different from the encryption key.

[0237] Step 503: In the case where the first data needs to be transmitted to the second device 200, the first device 100 acquires the encrypted first data.

[0238] There are many scenarios in which the first device 100 needs to transmit the first data to the second device 200. For example, the first device 100 receives a data instruction triggered by a user, which indicates that the first device 100 needs to transmit the first data to the second device 200. For another example, when the first device 100 needs to back up the first data, the first device 100 can back up the first data in the second device 200, that is, the first device 100 needs to transmit a copy of the first data to the second device 200. For another example, the second device 200 sends a data request to the first device 100, which requests to obtain the first data, and the first device 100 determines that the first device 100 needs to transmit the first data to the second device 200 after receiving the data request.

[0239] When the first device 100 determines that the first device 100 needs to transmit the first data to the second device 200, the first device 100 first obtains the encrypted first data. Since the first data is stored in the first device 100 in an encrypted manner, the first device 100 can directly obtain the encrypted data from the memory of the first device 100.

[0240] Suppose that the encrypted data is stored in the persistent storage of the first device 100, as shown in FIG. 6, which is a flow diagram of the encrypted first data in the first device 100 according to an embodiment of the present application.

[0241] The first device 100 migrates the encrypted first data from the persistent storage to the memory of the first device 100, and directly stores the encrypted first data in the memory. Then, the first device 100 transmits the encrypted data in the memory of the first device 100 to the second device 200 through the network card of the first device 100. As can be seen from FIG. 6, the first data always exists in the form of ciphertext in the first device 100 before being transmitted from the first device 100, thereby ensuring the security of the first data in the first device 100.

[0242] It is worth noting that, in the embodiment of the present application, the first device 100 migrates the encrypted first data from the persistent storage to the memory of the first device 100 has two meanings:

[0243] The first meaning is that the first device 100 migrates the encrypted first data stored in the persistent storage to the memory of the first device 100, and after the migration, the persistent storage no longer stores the encrypted first data.

[0244] The second meaning is that the first device 100 copies the encrypted first data from the persistent storage to the memory of the first device 100, and after the migration, the persistent storage still stores the encrypted first data.

[0245] The first meaning is that the first device 100 changes the storage location of the encrypted first data, and the second meaning is that the first device 100 migrates a copy of the encrypted first data to the memory of the first device 100. The two meanings are applicable to different data transmission scenarios. For example, the first meaning is applicable to a data transmission scenario based on a data port, in which the data port is only used for data relay, and generally, the data port does not need to save the data after the data is transmitted to the opposite side, and therefore, the migration of the data in the data port means changing the storage location of the data. The second meaning is applicable to a data transmission scenario of a data center. The data center has a data management function as the owner of the data, and therefore, after the data center transmits the data to another data center, the data center still needs to retain the data, and therefore, the migration of the data in the data center means the migration of the data copy.

[0246] In addition, before obtaining the encrypted first data, the first device 100 can also determine whether the second device 200 belongs to the target group. If the second device 200 belongs to the target group, the first device 100 reads the first data in the form of ciphertext from the persistent storage, and does not perform a decryption operation on the encrypted data in the memory, but directly saves the encrypted first data. If the second device 200 does not belong to the target group, it is assumed that the group to which the second device 200 belongs requires that the interaction between the data devices 10 does not need to encrypt the data, and therefore, the first device 100 can read the first data in the form of ciphertext from the persistent storage, and decrypt the encrypted data in the memory. The first device 100 can also read the first data in plaintext from the persistent storage (in this case, it can be understood that the persistent storage has encryption and decryption functions, and can encrypt or decrypt the data stored therein).

[0247] Step 504: The first device 100 sends a first data packet to the second device 200, and the first data packet carries the encrypted first data.

[0248] The first device 100 and the second device 200 establish a data channel, and the data packets transmitted between the first device 100 and the second device 200 are transmitted to the opposite side through the data channel. The specific type of the data channel is not limited in the embodiments of the present application. For example, the data channel can be a data channel established based on an IPSec or TLS protocol.

[0249] The first device 100 can transmit the first data packet to the second device 200 through the data channel. The first device 100 can also transmit other data packets through the data channel. For example, the first device 100 can transmit a second data packet to the second device 200 through the data channel, and the second data packet carries encrypted second data. The encryption key of the second data is generated according to the feature of the second data and the root key. The encryption key of the second data is generated in a similar manner to the encryption key of the first data, and the only difference is that the feature of the data used is different.

[0250] After obtaining the encrypted data, the first device 100 carries the encrypted data in the first data packet, and the encrypted data is the payload of the first data packet.

[0251] In the embodiment of the present application, the first device 100 can also send the feature of the first data to the second device 200, and the present application does not limit the transmission manner of the feature of the first data. For example, the first device 100 can transmit two data packets to the second device 200, one of which is the first data packet carrying the encrypted first data, and the other of which is the third data packet carrying the feature of the first data.

[0252] For another example, the first device 100 sends the first data packet to the second device 200, and the first data packet carries the encrypted first data and the feature of the first data. In the first data packet, the encrypted first data and the feature of the first data can be the payload of the first data packet. In the first data packet, the encrypted first data is the payload of the first data packet, and the feature of the first data is part of the packet header of the first data packet.

[0253] Whether the characteristic of the first data is transmitted through the third data message or the first data message, the characteristic of the first data in the data message (for example, the third data message or the first data message) can exist in the form of plaintext, that is, the characteristic of the first data is not encrypted. The characteristic of the first data in the data message can also exist in the form of ciphertext, that is, the characteristic of the first data needs to be encrypted, and the data message carries the encrypted characteristic of the first data. The embodiments of the present application do not limit the key used for encrypting the characteristic of the first data. For example, the first device 100 can encrypt the characteristic of the first data by using the public key of the second device 200. For another example, the first device 100 establishes a data channel with the second device 200 based on IPSec or TLS, and then the first device 100 and the second device 200 negotiate a key used for encrypting the transmitted data based on IPSec or TLS. In this case, the first device 100 can encrypt the characteristic of the first data by using the key.

[0254] The characteristic of the first data is an important parameter for generating an encryption key and a decryption key of the first data, and needs to be prevented from being tampered with during transmission. That is, the characteristic of the first data needs to be integrity protected during transmission.

[0255] The way in which the first device 100 integrity protects the characteristic of the first data is introduced as follows:

[0256] Step 0: The first device 100 and the second device 200 jointly maintain a key used for integrity protection. The embodiments of the present application do not limit the configuration manner of the key. For example, the first device 100 and the second device 200 can be preconfigured with the key. For another example, the first device 100 establishes a data channel based on IPSec or TLS, and then the first device 100 and the second device 200 negotiate a key used for integrity protection based on IPSec or TLS. The negotiated key used for integrity protection is a key used for integrity protection of the data transmitted in the data channel.

[0257] Step 1: The first device 100 generates an authentication code by using the characteristic of the first data and the key.

[0258] The authentication code ICV satisfies: ICV = Func (key, characteristic of the first data)

[0259] Wherein, the Func(·) represents a password algorithm for generating the authentication code, and embodiments of the present application do not limit the specific type of the algorithm, for example, the algorithm can be a hash-based message authentication code (HMAC), a cipher block chaining-message authentication code (CMAC), etc.

[0260] It should be noted that if the feature of the first data and the encrypted data are carried in the same first data packet, then the feature of the first data and the encrypted data are taken as a whole or the entire first data packet is integrity protected. That is, the authentication code ICV satisfies: ICV = Func (key, first data packet)

[0261] Step 2, the first device 100 carries the authentication code in the tail of the first data packet (the first data packet is the first data packet carrying the feature of the first data), and transmits the first data packet to the second device 200.

[0262] Step 3, the second device 200 obtains the feature of the first data from the first data packet after receiving the first data packet, and generates a new authentication code in the same way as step 2. The second device 200 compares the generated new authentication code with the authentication code in the tail of the first data packet, if the two authentication codes are consistent, it means that the feature of the first data is not tampered in the transmission process, and the feature of the first data is complete. If the two authentication codes are inconsistent, it means that the feature of the first data is tampered in the transmission process, and the feature of the first data is not complete.

[0263] Step 505: The second device 200 receives the first data packet, obtains the encrypted first data from the first data packet, and stores the encrypted first data.

[0264] On the second device 200 side, in order to ensure the security of the first data, the second device 200 can directly save the encrypted first data after receiving the first data packet.

[0265] Referring to FIG. 7, FIG. 7 is a flow conversion schematic diagram of the encrypted first data in the second device 200 provided by embodiments of the present application.

[0266] After the second device 200 receives the first data packet, the encrypted data reaches the memory of the second device 200 through the network card of the second device 200, and then, when the memory in the second device 200 reaches a certain data amount, or the processor of the second device 200 instructs to migrate the first data to the persistent storage, the encrypted data is migrated from the memory of the second device 200 to the persistent storage of the second device 200.

[0267] As can be seen from FIG. 7, after the second data is received, the first data always exists in the form of ciphertext inside the second device 200, thereby ensuring the security of the first data in the second device 200.

[0268] In the second device 200, there are cases that require processing of the first data, in which case the second device 200 needs to decrypt the encrypted first data to obtain the first data and then process the first data. The second device 200 decrypts the encrypted first data in a manner similar to that of the first device 100, which can be seen from the foregoing, and will not be described here again.

[0269] The descriptions of the processes corresponding to the above respective figures each have their own focuses, and the parts not described in detail in a certain process can be seen from the related descriptions of other processes.

[0270] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes computer program instructions, which, when loaded and executed on a computer, generate all or part of the processes or functions described in the embodiments of the present application with reference to FIG. 5.

[0271] The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center through a wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer-readable storage medium can be any available medium accessible by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as an SSD).

[0272] Obviously, many modifications and variations of the present application are possible in light of the above teachings. It is, therefore, to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A data transmission method, characterized by, The method comprises: generating an encryption key of the first data according to a feature of the first data; encrypting the first data by using the encryption key of the first data; transmitting a first data packet, wherein the first data packet carries the encrypted first data.

2. The method of claim 1, wherein, The feature of the first data comprises part or all of the following: a user to which the first data belongs, a data type of the first data, a security level of the first data, a destination address of the first data packet, and an index of the first data.

3. The method of claim 1, wherein, The first data packet is transmitted through a data channel, and the method further comprises: transmitting a second data packet through the data channel, wherein the second data packet carries encrypted second data, and an encryption key of the second data is different from the encryption key of the first data.

4. The method according to any one of claims 1 to 3, characterized in that, The first data packet carries the feature of the first data.

5. The method of claim 1, wherein, After the first data is encrypted by using the encryption key of the first data, the method further comprises: persistently storing the encrypted first data in a storage node.

6. The method according to any one of claims 1 to 5, characterized in that, The transmission of the first data packet comprises: reading the first data in the form of ciphertext from the persistent storage in the storage node, and transmitting the first data packet.

7. The method of claim 6, wherein, The reading of the first data in the form of ciphertext from the persistent storage in the storage node comprises: migrating the first data in the form of ciphertext from the persistent storage of the storage node to the memory of the storage node, and obtaining the first data in the form of ciphertext from the memory.

8. A data transmission method, characterized by, The method comprises: after receiving the first data packet, saving the encrypted first data carried in the first data packet; in a case where the first data needs to be processed, generating a decryption key of the first data based on the feature of the first data, and decrypting the encrypted first data by using the decryption key.

9. The method of claim 8, wherein, The feature of the first data comprises part or all of the following: a user to which the first data belongs, a data type of the first data, a security level of the first data, a destination address of the first data packet, and an index of the first data.

10. The method of claim 8, wherein, The first data packet is received through a data channel, and the method further comprises: receiving the first data packet and a second data packet through the data channel, wherein the second data packet carries encrypted second data, and a decryption key of the second data is different from the decryption key of the first data.

11. The method according to any one of claims 8 to 10, characterized in that, The first data packet carries the feature of the first data.

12. The method of claim 8, wherein, The saving of the encrypted first data carried in the first data packet comprises: persistently storing the encrypted first data in a storage node.

13. The method of claim 12, wherein, The persistently storing of the encrypted first data in the storage node comprises: saving the encrypted first data carried in the first data packet in the memory of the storage node, and migrating the encrypted first data to the persistent storage of the storage node.

14. A data transmission apparatus, characterized by comprising: The method comprises: a first key generation module configured to generate an encryption key of the first data according to a feature of the first data. The first encryption engine is configured to encrypt the first data by using an encryption key of the first data. The first management module is configured to transmit a first data packet, and the first data packet carries the encrypted first data.

15. The apparatus of claim 14, wherein, The first data packet is transmitted through a data channel, and the first management module is further configured to: transmit a second data packet through the data channel, and the second data packet carries encrypted second data, and an encryption key of the second data is different from the encryption key of the first data.

16. The device of any one of claims 14-15, wherein, The first management module is configured to: read the first data in the form of ciphertext from a persistent storage in the storage node, and transmit the first data packet.

17. A data transmission apparatus, characterized by comprising: The method comprises: The second management module is configured to, after receiving the first data packet, save the encrypted first data carried in the first data packet. The second key generation module is configured to, in a case where the first data needs to be processed, generate a decryption key of the first data based on a feature of the first data. The second encryption engine is configured to decrypt the encrypted first data by using the decryption key.

18. The apparatus of claim 17, wherein, The first data packet is received through a data channel, and the second management module is further configured to: receive the first data packet and a second data packet through the data channel, and the second data packet carries encrypted second data, and a decryption key of the second data is different from the decryption key of the first data.

19. A computing device, comprising: The computing device comprises a processor and a memory; The memory is configured to store computer program instructions. The processor executes the computer program instructions in the memory to perform the method in any one of claims 1 to 13.

20. A computer-readable storage medium, characterized in that, The computer readable storage medium is executed by the computing device, and the computing device performs the method in any one of claims 1 to 13.

Images