CN116566711A - A data transmission method, device, equipment and storage medium - Google Patents

Abstract

The application discloses a data transmission method, a device, equipment and a storage medium, which relate to the field of data transmission and comprise the following steps: the target VPC collects data through the internal equipment and sends an online request message determined based on the encrypted IP address to the cloud security platform through a preset common port for verification; the preset shared port is a port shared by a plurality of VPCs; if the verification is successful, verifying the confirmed online message obtained from the cloud security platform, and after the verification is successful, transmitting an online establishment message determined based on the identification of the target VPC to the cloud security platform through a preset common port to perform verification operation; and if the verification is successful, transmitting the data to the cloud security platform through a preset shared port for processing. According to the method and the device, the plurality of VPCs share one port, the number of ports exposed to the outside is reduced, network resources are saved, the risk of being attacked is reduced, and the security of data transmission is ensured by encrypting the IP address of the internal device.

Description

A data transmission method, device, equipment and storage medium

technical field

The present invention relates to the field of data transmission, in particular to a data transmission method, device, equipment and storage medium.

Background technique

In the process of private cloud network construction, the network security service SaaS (Software-as-a-Service, software as a service) is gradually evolving. Providing network security services on the cloud can bring users a convenient experience, and data is aggregated in different dimensions. And through the large screen, users can clearly and intuitively understand the security status of assets. For example, security products such as log audit and database audit can collect a large amount of basic data for security operations. However, due to the existence of VPC (Virtual Private Cloud, virtual private cloud), tenant networks need to be differentiated in terms of business, and data security needs to be met. Different business data often only open a few ports for transmission.

In the prior art, when the internal network transmits various types of business data to the external network, multiple different IPs and ports are often opened for transmission. Using multiple IPs and ports means that each IP and port needs to be assigned an independent Network resources, which will cause a waste of network resources, resulting in network congestion and performance degradation. And each IP and port needs independent security protection. Once a security hole occurs in one of the IP or ports, attackers can use this hole to attack the entire network system; in addition, since each IP and port need to be maintained independently, increasing Reduced maintenance costs, especially when maintaining a large number of IPs and ports, a lot of manpower and time will be wasted.

Contents of the invention

In view of this, the object of the present invention is to provide a data transmission method, device, device and storage medium, which can share one port through multiple VPCs, reduce the number of ports exposed to the outside, save network resources, reduce the risk of being attacked, and Encrypt the IP address of the internal device to ensure the security of data transmission. The specific plan is as follows:

In the first aspect, the present application provides a data transmission method applied to a target VPC, including:

Collect the load data through the internal device, and send the online request message determined based on the encrypted internal device IP address to the cloud security platform through the preset shared port, so that the cloud security platform can verify the online request message. Operation; the preset shared port is a port shared by multiple VPCs;

If the cloud security platform successfully verifies the online request message, it will verify the online confirmation message obtained from the cloud security platform, and after the verification is successful, send the The online establishment message determined based on the identifier of the target VPC is sent to the cloud security platform, so that the cloud security platform performs a verification operation on the online establishment message;

If the cloud security platform successfully verifies the online establishment message, the load data is transmitted to the cloud security platform through the preset shared port, so that the cloud security platform is based on the target VPC Indicates that the load data is processed.

Optionally, the online request message determined based on the encrypted internal device IP address is sent to the cloud security platform through the preset shared port, including:

Obtain an internal device IP address corresponding to the internal device, and use a key file to symmetrically encrypt the internal device IP address to obtain an encrypted internal device IP address;

Add the encrypted internal device IP address to the first preset field of the online request message, and send the added online request message to the cloud security platform through the preset shared port.

Optionally, before performing symmetric encryption on the IP address of the internal device using the key file, the method further includes:

Obtain the key file generated and issued by the cloud security platform.

Optionally, the cloud security platform performs a verification operation on the online request message, including:

The cloud security platform uses the key file to symmetrically decrypt the encrypted internal device IP address in the first preset field of the added online request message to obtain the decrypted internal device IP address. address;

The cloud security platform judges whether the decrypted internal device IP address is consistent with the source address of the added connection request message, and if they are consistent, sends a connection confirmation message to the target VPC.

Optionally, sending the connection establishment message determined based on the identity of the target VPC to the cloud security platform through the preset shared port includes:

Add the identifier of the target VPC to the second preset field of the connection establishment message to obtain the added connection establishment message;

Send the added connection establishment message to the cloud security platform through the preset shared port.

Optionally, the transmitting the load data to the cloud security platform through the preset shared port includes:

determining a characteristic field based on the business data type corresponding to the load data, and processing the load data by using the characteristic field and a delimiter to obtain processed load data;

The processed payload data is transmitted to the cloud security platform through the preset common port.

Optionally, the cloud security platform processes the load data based on the identifier of the target VPC, including:

The cloud security platform obtains the identifier of the target VPC in the second preset field of the added connection establishment message, so as to determine the target VPC corresponding to the processed load data based on the identifier, and Analyzing the processed load data to obtain the load data and the characteristic field, and then determining the business data type corresponding to the characteristic field;

The cloud security platform performs a processing operation corresponding to the business data type on the load data to obtain a processing result, and aggregates and displays the processing result.

In a second aspect, the present application provides a data transmission device applied to a target VPC, including:

The request message sending module is used to collect load data through the internal device, and send the online request message determined based on the encrypted internal device IP address to the cloud security platform through a preset shared port, so that the cloud security platform can The online request message is verified; the preset shared port is a port shared by multiple VPCs;

Establishing a message sending module, used to verify the online confirmation message obtained from the cloud security platform if the cloud security platform successfully verifies the online request message, and after the verification is successful, Send the connection establishment message determined based on the identity of the target VPC to the cloud security platform through the preset common port, so that the cloud security platform can verify the connection establishment message;

A data transmission module, configured to transmit the load data to the cloud security platform through the preset shared port if the cloud security platform successfully verifies the online establishment message, so that the cloud security platform The load data is processed based on the identifier of the target VPC.

In a third aspect, the present application provides an electronic device, including:

memory for storing computer programs;

A processor, configured to execute the computer program to implement the aforementioned data transmission method.

In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, and when the computer program is executed by a processor, the aforementioned data transmission method is implemented.

In this application, the load data is collected by the internal device, and the online request message determined based on the encrypted internal device IP address is sent to the cloud security platform through the preset shared port, so that the cloud security platform can report the online request. The document is checked and operated; the preset shared port is a port shared by multiple VPCs; if the cloud security platform successfully checks the online request message, the confirmation online report obtained from the cloud security platform The text is verified, and after the verification is successful, the online establishment message determined based on the identity of the target VPC is sent to the cloud security platform through the preset common port, so that the cloud security platform can Perform a verification operation on the online establishment message; if the cloud security platform successfully verifies the online establishment message, then transmit the load data to the cloud security platform through the preset shared port, so that the The cloud security platform processes the load data based on the identifier of the target VPC. It can be seen that this application uses multiple VPCs to share one port for message and data transmission, reducing the number of ports exposed to the outside world, saving network resources and maintenance costs, and reducing the risk of being attacked. Encryption is performed to ensure the security of data transmission; in addition, this application inserts the VPC identifier into the message, so that data from different VPCs can be distinguished according to the VPC identifier.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention, and those skilled in the art can also obtain other drawings according to the provided drawings without creative work.

Fig. 1 is a flow chart of a data transmission method disclosed in the present application;

FIG. 2 is a structural diagram for establishing a data transmission channel disclosed in the present application;

Fig. 3 is a kind of TCP syn message transmission logic diagram disclosed by the application;

FIG. 4 is a flow chart of a specific data transmission method disclosed in the present application;

FIG. 5 is a schematic structural diagram of a data transmission device disclosed in the present application;

FIG. 6 is a structural diagram of an electronic device disclosed in the present application.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

In the prior art, when the internal network transmits various types of business data to the external network, multiple different IPs and ports are often opened for transmission, and independent network resources and independent security protection need to be allocated for each IP and port. To this end, this application provides a data transmission method that can share one port through multiple VPCs, reduce the number of ports exposed to the outside world, save network resources, and reduce the risk of being attacked, and encrypt the IP address of the internal device to Ensure the security of data transmission.

Referring to Fig. 1, the embodiment of the present invention discloses a data transmission method applied to a target VPC, including:

Step S11, collect the load data through the internal device, and send the online request message determined based on the encrypted internal device IP address to the cloud security platform through the preset shared port, so that the cloud security platform can process the online request message Perform a verification operation; the preset shared port is a port shared by multiple VPCs.

In this embodiment, a VPC contains multiple PC devices, and a collection plug-in is installed on each PC device to collect data. If you want to transmit the data collected by the internal devices of the VPC to the cloud security platform SaaS service, A reliable data transmission channel needs to be established. As shown in Figure 2, the VPC transmits all messages and data collected by the collection plug-in to the near-security product side of the channel establishment module through the near-source side of the channel establishment module, and then sends them to the cloud security platform. The essence of the channel establishment module is It is equivalent to setting up a preset shared port to uniformly forward all messages and collect data collected by plug-ins. It should be noted that the preset shared port is a port shared by multiple VPCs. In this way, the number of open ports can be reduced and network resources can be saved. In addition, the default shared port provides TCP (Transmission Control Protocol, Transmission Control Protocol) and UDP (User Datagram Protocol, User Datagram Protocol) for data transmission; and, only designated devices can be connected to the preset shared port, even if other devices Knowing the port, it is not possible to connect at will. Specifically, the establishment of TCP and UDP connections can be supported by setting the communication protocol and port in the nginx configuration file.

In this embodiment, the sending the online request message determined based on the encrypted internal device IP address to the cloud security platform through the preset shared port may include obtaining the internal device IP address corresponding to the internal device, and using The key file symmetrically encrypts the internal device IP address to obtain the encrypted internal device IP address; adds the encrypted internal device IP address to the first preset field of the online request message, and passes The preset shared port sends the added connection request message to the cloud security platform. Further, before using the key file to symmetrically encrypt the IP address of the internal device, it also includes obtaining the key file generated and issued by the cloud security platform. It can be understood that, as shown in Figure 3, in order to ensure the security of data transmission and the legitimacy of online establishment, the security authentication module of the cloud security platform generates and issues a key file to the target VPC, where the target VPC is multiple Any one of the VPCs, the cloud security platform manages all SaaS security products. After the target VPC obtains the key file, it uses the key file to symmetrically encrypt the IP address of the internal device to obtain the encrypted IP address of the internal device, and puts the encrypted IP address of the internal device in the Options of the TCP syn connection request message. field, and then send the TCP syn connection request message to the cloud security platform through the preset shared port.

In this embodiment, the cloud security platform performs a verification operation on the online request message, which may include the first preset of the added online request message by the cloud security platform using the key file The encrypted internal device IP address in the field is symmetrically decrypted to obtain the decrypted internal device IP address; the cloud security platform judges that the decrypted internal device IP address is consistent with the added online request report Check whether the source addresses of the messages are consistent, and if they are consistent, send a confirmation message to the target VPC. It is understandable that, as shown in Figure 3, after the cloud security platform obtains the TCP syn connection request message sent by the target VPC, it uses the key file to symmetrically decrypt the encrypted internal device IP address in the Options field to obtain the decrypted followed by the IP address of the internal device. Compare the decrypted IP address of the internal device with the source address of the TCP syn connection request message. If they are consistent, it is determined that the connection initiator, that is, the target VPC, is legal, and a TCP ack confirmation message is sent to the target VPC; if If they are inconsistent, it is determined that the connection initiator is illegal, and reply reset to refuse the connection. In this way, this application encrypts the IP address of the internal device of the VPC, and compares the decrypted IP address with the source address of the message through the cloud security platform, thereby ensuring the legitimacy of the connection establishment and data transmission security.

Step S12, if the cloud security platform successfully verifies the online request message, then verify the connection confirmation message obtained from the cloud security platform, and after the verification is successful, pass the preset The common port sends the connection establishment message determined based on the identifier of the target VPC to the cloud security platform, so that the cloud security platform can verify the connection establishment message.

In this embodiment, if the cloud security platform successfully verifies the TCP syn online request message, the cloud security platform will send a TCP ack confirmation message to the target VPC, and the target VPC will further verify the TCP ack confirmation message . If the target VPC confirms to the TCP ack that the verification of the connection message is successful, it will send the TCP syn+ack connection establishment message determined based on the identity of the target VPC to the cloud security platform through the preset shared port. Specifically, the sending the online establishment message determined based on the target VPC identifier to the cloud security platform through the preset common port may include adding the target VPC identifier to the online establishment message. The second preset field is to obtain the added connection establishment message; and send the added connection establishment message to the cloud security platform through the preset shared port. It is understandable that since multiple VPCs transmit messages and data through preset shared ports, in order to distinguish data from different VPCs, the target VPC identifier can be added to the TCP syn+ack connection establishment report In the Options field of the file, the TCP syn+ack connection establishment message is sent to the cloud security platform through the preset shared port. After the cloud security platform obtains the TCP syn+ack connection establishment message, it verifies the TCP syn+ack connection establishment message. If the verification fails, the connection between the target VPC and the cloud security platform cannot be established.

Step S13: If the cloud security platform successfully verifies the connection establishment message, transmit the load data to the cloud security platform through the preset shared port, so that the cloud security platform can The identifier of the target VPC processes the load data.

In this embodiment, if the cloud security platform successfully verifies the TCP syn+ack online establishment message, the connection between the target VPC and the cloud security platform is completed, and then the target VPC transmits the load data to the cloud through a preset shared port. secure platform. Specifically, the transmitting the load data to the cloud security platform through the preset shared port may include determining a characteristic field based on the business data type corresponding to the load data, and using the characteristic field and the delimiter Process the load data to obtain processed load data; transmit the processed load data to the cloud security platform through the preset shared port. It is understandable that the data collected by multiple devices in a VPC may also correspond to different types of business data, such as log audit data and database audit data. In order to distinguish data of different business data types, you can first pass the internal device The business data type corresponding to the collected load data determines the characteristic field, and then adds the characteristic field to the head of the load data, and adds a separator to distinguish the characteristic field and the load data, so as to obtain the processed load data. For example, the load data is 123, the corresponding business data type is log audit data, and then the characteristic field is determined to be logaudit, and the delimiter is ===, then the processed load data is logaudit===123, and then through the preset shared port Transmit the processed load data logaudit===123 to the cloud security platform. In this way, by adding characteristic fields and delimiters to the data collected by the internal devices of the VPC, and then sending it to the cloud security platform, it is possible to distinguish different business types of data.

In this embodiment, the cloud security platform processes the load data based on the identifier of the target VPC, which may include the cloud security platform obtaining the second preset field of the added connection establishment message. The identification of the target VPC, so as to determine the target VPC corresponding to the processed load data based on the identification, and analyze the processed load data to obtain the load data and the characteristic field, and then determine the The business data type corresponding to the characteristic field; the cloud security platform performs a processing operation corresponding to the business data type on the load data to obtain a processing result, and aggregates and displays the processing result. It can be understood that after the cloud security platform obtains the processed load data, it can determine the source of the processed load data based on the identifier of the target VPC in the Options field of the TCP syn+ack connection establishment message. Furthermore, the cloud security platform analyzes the processed load data to obtain the real load data and characteristic fields, as well as the business data type corresponding to the characteristic fields, so as to process the real load data accordingly and aggregate the processing results displayed for the user to view.

It can be seen that, on the one hand, this application transmits messages and data through multiple VPCs sharing one port, reducing the number of exposed ports, saving network resources and maintenance costs, and reducing the risk of being attacked; on the other hand, this application By encrypting the IP address of the internal device, and the cloud security platform decrypts the encrypted IP address and compares it with the source address of the online request message, thereby ensuring the security of data transmission and the legality of online establishment; on the other hand, the application By inserting the VPC identifier into the field of the online establishment message, the data from different VPCs can be distinguished according to the VPC identifier, and this application adds a characteristic field and a delimiter to the load data, and then sends it to the cloud security platform. Realize the distinction of data of different business types.

As shown in Figure 4, the embodiment of the present invention discloses a data transmission method, wherein, VPC1 and VPC2 collect load data through the collection plug-ins installed in their respective internal devices, and respectively obtain the security authentication module of the cloud security platform to generate and issue Use the key file to symmetrically encrypt the IP addresses of the respective internal devices to obtain the encrypted internal device IP addresses, and put the encrypted internal device IP addresses in the Options of the respective TCP syn connection request messages field, and then send respective TCP syn connection request messages to the cloud security platform through the preset shared port. The cloud security platform uses the key file to symmetrically decrypt the encrypted internal device IP addresses in the two Options fields to obtain the decrypted internal device IP addresses, and then compares the decrypted internal device IP addresses with the corresponding TCPsyn online request The source addresses of the packets are compared, and if they are consistent, it is determined that the connection initiators VPC1 and VPC2 are legitimate, and TCP ack confirmation packets are sent to VPC1 and VPC2 respectively.

VPC1 and VPC2 will further verify the TCP ack confirmation message obtained by them. If the verification of the TCP ack confirmation message is successful, the respective VPC identifiers will be added to the Options field of the TCP syn+ack connection establishment message , and then send the TCP syn+ack connection establishment message to the cloud security platform through the preset shared port. The cloud security platform verifies the two TCP syn+ack connection establishment messages. If the verification is successful, the connection between VPC1 and the cloud security platform and the connection between VPC2 and the cloud security platform are completed. Then VPC1 and VPC2 will determine the characteristic field according to the business data type corresponding to the respective payload data, and add the characteristic field and separator to the header of the respective payload data to distinguish the characteristic field and the payload data, so as to be processed After load data data1 and data2. VPC1 and VPC2 respectively transmit the processed load data data1 and data2 to the cloud security platform through the preset shared port. The identifiers in the Options field of the document can determine the corresponding sources of the processed load data data1 and data2, and then send the identifiers of VPC1 and data1 and the identifiers of VPC2 and data2 to the business attribute processing module of the cloud security platform to The load data data1 and data2 are analyzed separately to obtain the real load data and characteristic fields, as well as the business data types corresponding to the characteristic fields, so that the real load data are respectively processed corresponding to their respective business data types, and the processing results are Aggregated display for users to view.

It can be seen that, on the one hand, this application transmits messages and data through multiple VPCs sharing one port, reducing the number of exposed ports, saving network resources and maintenance costs, and reducing the risk of being attacked; on the other hand, this application By encrypting the IP address of the internal device, and the cloud security platform decrypts the encrypted IP address and compares it with the source address of the online request message, thereby ensuring the security of data transmission and the legality of online establishment; on the other hand, the application By inserting the VPC identifier into the field of the online establishment message, the data from different VPCs can be distinguished according to the VPC identifier, and this application adds a characteristic field and a delimiter to the load data, and then sends it to the cloud security platform. Realize the distinction of data of different business types.

Referring to Fig. 5, the embodiment of the present invention discloses a data transmission device, which is applied to the target VPC, including:

The request message sending module 11 is used for collecting load data by the internal equipment, and sends the online request message determined based on the encrypted internal equipment IP address to the cloud security platform through a preset shared port, so that the cloud security platform can The online request message is verified; the preset shared port is a port shared by multiple VPCs;

Set up message sending module 12, be used for if described cloud security platform checks successfully to described online request message, then check the confirmation online message that obtains from described cloud security platform, and after the check is successful , sending the connection establishment message determined based on the identity of the target VPC to the cloud security platform through the preset shared port, so that the cloud security platform performs a verification operation on the connection establishment message;

The data transmission module 13 is used to transmit the load data to the cloud security platform through the preset shared port if the cloud security platform successfully verifies the online establishment message, so that the cloud security The platform processes the load data based on the identifier of the target VPC.

It can be seen that this application uses multiple VPCs to share one port for message and data transmission, reducing the number of ports exposed to the outside world, saving network resources and maintenance costs, and reducing the risk of being attacked. Encryption is performed to ensure the security of data transmission; in addition, this application inserts the VPC identifier into the message, so that data from different VPCs can be distinguished according to the VPC identifier.

In some specific embodiments, the request message sending module 11 may specifically include:

An IP address encryption unit, configured to obtain an internal device IP address corresponding to the internal device, and use a key file to symmetrically encrypt the internal device IP address to obtain an encrypted internal device IP address;

The first message sending unit is used to add the encrypted internal device IP address to the first preset field of the online request message, and send the added online request message to the cloud through the preset shared port secure platform.

In some specific embodiments, the data transmission device may further include:

The key file obtaining unit is configured to obtain the key file generated and issued by the cloud security platform.

In some specific embodiments, the establishment of the message sending module 12 may specifically include:

An identification adding unit, configured to add the identification of the target VPC to the second preset field of the connection establishment message, so as to obtain the added connection establishment message;

A second message sending unit, configured to send the added connection establishment message to the cloud security platform through the preset shared port.

In some specific embodiments, the data transmission module 13 may specifically include:

A data processing unit, configured to determine a characteristic field based on the business data type corresponding to the load data, and process the load data by using the characteristic field and a delimiter to obtain processed load data;

A data transmission unit, configured to transmit the processed payload data to the cloud security platform through the preset shared port.

Further, the embodiment of the present application also discloses an electronic device. FIG. 6 is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the figure should not be regarded as any limitation on the application scope of the present application.

FIG. 6 is a schematic structural diagram of an electronic device 20 provided by an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21 , at least one memory 22 , a power supply 23 , a communication interface 24 , an input/output interface 25 and a communication bus 26 . Wherein, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21, so as to implement relevant steps in the data transmission method disclosed in any of the foregoing embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows is applicable Any communication protocol in the technical solution of the present application is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the external, and its specific interface type can be selected according to specific application needs, here Not specifically limited.

In addition, the memory 22, as a resource storage carrier, can be a read-only memory, random access memory, magnetic disk or optical disk, etc., and the resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage. .

Wherein, the operating system 221 is used to manage and control various hardware devices and computer programs 222 on the electronic device 20 , which may be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program 222 that can be used to complete the data transmission method performed by the electronic device 20 disclosed in any of the foregoing embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

Further, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned disclosed data transmission method is realized. Regarding the specific steps of the method, reference may be made to the corresponding content disclosed in the foregoing embodiments, and details are not repeated here.

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same or similar parts of each embodiment can be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and for relevant details, please refer to the description of the method part.

Professionals can further realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software or a combination of the two. In order to clearly illustrate the possible For interchangeability, in the above description, the composition and steps of each example have been generally described according to their functions. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present application.

The steps of the methods or algorithms described in connection with the embodiments disclosed herein may be directly implemented by hardware, software modules executed by a processor, or a combination of both. Software modules can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other Any other known storage medium.

Finally, it should also be noted that in this text, relational terms such as first and second etc. are only used to distinguish one entity or operation from another, and do not necessarily require or imply that these entities or operations, any such actual relationship or order exists. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

The technical solution provided by this application has been introduced in detail above, and specific examples have been used in this paper to illustrate the principle and implementation of this application. The description of the above embodiments is only used to help understand the method and core idea of this application; At the same time, for those skilled in the art, based on the idea of this application, there will be changes in the specific implementation and application scope. In summary, the content of this specification should not be construed as limiting the application.

Claims (10)

1. A data transmission method, applied to a target VPC, comprising:

load data are collected through the internal equipment, and an online request message determined based on the encrypted IP address of the internal equipment is sent to a cloud security platform through a preset shared port, so that the Yun Anquan platform performs verification operation on the online request message; the preset shared port is a port shared by a plurality of VPCs;

if the Yun Anquan platform checks the online request message successfully, checking the confirmed online message obtained from the cloud security platform, and after the verification is successful, sending an online establishment message determined based on the identification of the target VPC to the cloud security platform through the preset common port, so that the Yun Anquan platform performs a verification operation on the online establishment message;

and if the Yun Anquan platform successfully checks the online establishment message, transmitting the load data to the cloud security platform through the preset common port so that the cloud security platform processes the load data based on the identification of the target VPC.

2. The method for transmitting data according to claim 1, wherein the sending, through the preset common port, the online request message determined based on the encrypted IP address of the internal device to the cloud security platform includes:

acquiring an internal equipment IP address corresponding to the internal equipment, and symmetrically encrypting the internal equipment IP address by utilizing a key file to obtain an encrypted internal equipment IP address;

and adding the encrypted IP address of the internal equipment to a first preset field of the online request message, and sending the added online request message to a cloud security platform through a preset shared port.

3. The data transmission method according to claim 2, wherein before the symmetric encryption of the IP address of the internal device using the key file, further comprising:

and acquiring a key file generated and issued by the cloud security platform.

4. The data transmission method according to claim 2, wherein the verifying the online request message by the Yun Anquan platform includes:

the cloud security platform symmetrically decrypts the encrypted internal equipment IP address in the first preset field of the added online request message by utilizing the key file so as to obtain the decrypted internal equipment IP address;

and the cloud security platform judges whether the decrypted IP address of the internal device is consistent with the source address of the added online request message, and if so, sends a confirmation online message to the target VPC.

5. The method according to any one of claims 1 to 4, wherein the sending, through the preset common port, the online establishment message determined based on the identification of the target VPC to the cloud security platform includes:

adding the identification of the target VPC to a second preset field of the online establishment message to obtain an added online establishment message;

and sending the added online establishment message to the cloud security platform through the preset shared port.

6. The data transmission method according to claim 5, wherein the transmitting the load data to the cloud security platform through the preset common port includes:

determining a characteristic field based on the service data type corresponding to the load data, and processing the load data by utilizing the characteristic field and the separator to obtain processed load data;

and transmitting the processed load data to the cloud security platform through the preset shared port.

7. The data transmission method according to claim 6, wherein the cloud security platform processes the load data based on the identity of the target VPC, comprising:

the cloud security platform obtains the identification of the target VPC in a second preset field of the added online establishment message so as to determine the target VPC corresponding to the processed load data based on the identification, analyzes the processed load data to obtain the load data and the characteristic field, and then determines the service data type corresponding to the characteristic field;

and the Yun Anquan platform performs processing operation corresponding to the service data type on the load data to obtain a processing result, and aggregates and displays the processing result.

8. A data transmission apparatus for application to a target VPC, comprising:

the request message sending module is used for acquiring load data through the internal equipment, and sending an online request message determined based on the encrypted IP address of the internal equipment to the cloud security platform through a preset common port so that the Yun Anquan platform can verify the online request message; the preset shared port is a port shared by a plurality of VPCs;

the establishment message sending module is used for verifying the confirmation online message obtained from the cloud security platform if the Yun Anquan platform verifies the online request message successfully, and sending an online establishment message determined based on the identification of the target VPC to the cloud security platform through the preset common port after the verification is successful, so that the Yun Anquan platform verifies the online establishment message;

and the data transmission module is used for transmitting the load data to the cloud security platform through the preset shared port if the Yun Anquan platform successfully verifies the online establishment message, so that the cloud security platform processes the load data based on the identification of the target VPC.

9. An electronic device, comprising:

a memory for storing a computer program;

a processor for executing the computer program to implement the data transmission method according to any one of claims 1 to 7.

10. A computer-readable storage medium for storing a computer program which, when executed by a processor, implements the data transmission method according to any one of claims 1 to 7.