A network gate channel control method, device, computer equipment and storage medium

Abstract

The present invention discloses a network gate channel control method, device and computer equipment, comprising: obtaining data to be transmitted, wherein the data to be transmitted at least includes protocol information and field information, wherein the protocol information is used to identify the protocol and data type of the data, wherein the protocol information and the field information can be used to identify the data, when the data is determined to be a SIP protocol according to the protocol information, further determining whether the data includes a key field according to the field information, if the key field is included, controlling the state of the data flow channel according to the key field, thus controlling the data flow channel during the transmission process, thereby solving the insecurity problem caused by the traditional data transmission process when the SIP protocol is used as the network gate protocol, and ensuring the security of both sides of the network gate.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network gate channel control method, device, computer equipment and storage medium. Background Art

[0002] With the development of the Internet, network security has received more and more attention. Among them, a network gatekeeper is a device that can isolate the two ends of a network and allow data packets that meet the preset screening conditions to pass through. The network gatekeeper plays a very important role in network security.

[0003] When transmitting data, the gatekeeper needs to establish a secure channel for transmission. The SIP protocol is a protocol that only negotiates signaling and does not transmit data. After the negotiation command, a new connection will be created to complete the data exchange. The new connection does not belong to the SIP protocol, which makes it impossible to pass through the gatekeeper. If a new channel is established in advance to transmit data packets, after the newly established channel transmits data, the time for the next data packet to be transmitted again is unknown. Therefore, the channel must be kept open to ensure that the next data packet that meets the conditions can effectively pass through the gatekeeper. However, if the channel is always open, it will bring hidden dangers to the security of the network. Summary of the invention

[0004] Therefore, in order to solve the deficiencies of the prior art, the embodiments of the present invention provide a network gate channel control method, device, computer equipment and storage medium.

[0005] According to a first aspect, an embodiment of the present invention discloses a gatekeeper channel control method, including:

[0006] Acquire a data packet to be transmitted, the data packet at least including protocol information and field information;

[0007] If the protocol information is SIP protocol information, determining whether the field information includes a key field;

[0008] If the key field is included, the state of the data flow channel is controlled according to the key field.

[0009] Optionally, the state includes establishment and closing, and the state of the data stream channel is controlled according to the key field, specifically including:

[0010] If the key field is a request field, a data flow channel is established;

[0011] If the key field is the end field, the data flow channel is closed.

[0012] Optionally, when the data stream channel does not exist and it is determined that the field information includes a key field, the method further includes:

[0013] A data stream channel is created according to the data packet so that the state of the data stream channel can be controlled according to the key fields later.

[0014] Optionally, the method further comprises:

[0015] Periodically checking whether a target data packet exists in the data stream channel, where the target data packet is a data packet allowed to be transmitted by the data stream channel;

[0016] If there is a target data packet in the data flow channel and when the data packet in the data flow channel does not meet the preset conditions, the data flow channel is closed.

[0017] Optionally, if the target data packet does not exist in the data stream channel, the method further includes:

[0018] Count the duration of time when no target data exists in the statistical data flow channel;

[0019] If the duration exceeds the preset time threshold, the data stream channel is closed.

[0020] Optionally, if the protocol information is not SIP protocol information, the data stream channel is not established.

[0021] Optionally, if the data does not include a key field, the data flow channel is not established.

[0022] According to a second aspect, an embodiment of the present invention further discloses a network gate channel control device, the device comprising:

[0023] An acquisition module, used to acquire data to be transmitted, the data at least including protocol information and field information;

[0024] A determination module, used for determining whether the field information includes a key field if the protocol information is SIP protocol information;

[0025] A control module is used to control the state of the data flow channel according to the key field if the key field is included.

[0026] According to the third aspect, an embodiment of the present invention also discloses a computer device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the steps of the network gate channel control method as the first aspect or any optional implementation manner of the first aspect.

[0027] According to the fourth aspect, the embodiment of the present invention further discloses a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the network gate channel control method as in the first aspect or any optional embodiment of the first aspect.

[0028] The technical solution of the present invention has the following advantages:

[0029] The network gate channel control method, device, computer equipment and storage medium provided by the present invention include: obtaining a data packet to be transmitted, wherein the data packet to be transmitted includes at least protocol information and field information, wherein the protocol information and field information can be used to identify the protocol and data type of the data packet; when the data packet is determined to be a SIP protocol according to the protocol information, further determining whether the data includes a key field according to the field information; if the key field is included, controlling the state of the data flow channel according to the key field, thereby controlling the data flow channel during the transmission process, thereby solving the insecurity problem caused by the traditional data transmission process when the SIP protocol is used as the network gate protocol, and ensuring the security of both sides of the network gate. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0031] Figure 1 A flowchart of a specific example of a method for controlling a network gate channel according to an embodiment of the present invention;

[0032] Figure 2 A schematic diagram of a specific example of a method for controlling a network gate channel according to an embodiment of the present invention;

[0033] Figure 3 A schematic diagram of a specific example of a method for controlling a network gate channel according to an embodiment of the present invention;

[0034] Figure 4 This is a schematic flow chart of SIP protocol data transmission in an embodiment of the present invention;

[0035] Figure 5 is a principle block diagram of a specific example of a network gate channel control device in an embodiment of the present invention;

[0036] Figure 6 FIG. 4 is a specific example diagram of a computer device in an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0039] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, it can also be the internal connection of two components, it can be a wireless connection, or it can be a wired connection. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0040] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0041] In view of the technical problems mentioned in the background technology, the present application embodiment provides a network gate channel control method, see Figure 1 As shown, the method comprises the following steps:

[0042] Step 101: Acquire a data packet to be transmitted, where the data packet at least includes protocol information and field information.

[0043] Exemplarily, the data packet to be transmitted is data that is transmitted from one end of the network gate to the other end, wherein the data to be transmitted includes at least protocol information and field information, wherein the protocol information can enable the network gate to determine which transmission protocol the data packet adopts, and the field information can determine the data type or data information in the data packet.

[0044] Step 102: If the protocol information is SIP protocol information, determine whether the field information includes a key field.

[0045] Exemplarily, the SIP protocol is a special protocol among transmission protocols, in which the SIP protocol cannot directly transmit data packets. When the transmitted data is a data packet, it is necessary to negotiate with the data packet according to the SIP protocol to build a data flow channel that can pass the data packet, in which the key field is the content of the data flow channel negotiated with the SIP protocol.

[0046] Step 103: If the key field is included, the state of the data stream channel is controlled according to the key field.

[0047] Exemplarily, the data stream channel may be a data stream channel supporting protocols such as TCP or UDP. When the information corresponding to the key field is TCP, the state of the data stream channel corresponding to the TCP protocol is controlled.

[0048] If the key field is a request field, a data flow channel is established; if the key field is an end field, the data flow channel is closed.

[0049] Exemplarily, the key field may be an Invite request field. When it is a request field, a data flow channel corresponding to the request field is established; when the key field may be a Bye end field, a data flow channel corresponding to the end field is established.

[0050] In a specific embodiment, when the data stream channel does not exist and it is determined that the field information includes a key field, the method further includes:

[0051] A data stream channel is created according to the data packet so that the state of the data stream channel can be controlled according to the key fields later.

[0052] For example, the premise of controlling the state of the data flow channel according to the key field is that the corresponding data flow channel already exists. When the corresponding data flow channel does not exist and the data packet needs to be transmitted, the corresponding data flow channel needs to be established for transmission. When creating a data flow channel, all data packets need to be received. After receiving all the data packets, a data flow channel that allows the data packets to pass is created according to the data packets.

[0053] On the basis of the above embodiments, the embodiments of the present application further disclose another method for controlling a network gate channel. Considering that the data flow channel is always open when there is no target data transmission, a time factor is introduced to control the data flow channel. Preferably, the specific implementation method is as follows:

[0054] The data stream channel is periodically checked to see if there is a target data packet, where the target data packet is a data packet being transmitted in the data stream channel.

[0055] If there is a target data packet in the data flow channel and when the data packet in the data flow channel does not meet the preset conditions, the data flow channel is closed.

[0056] Exemplarily, for the created data flow channel, it is necessary to periodically check the usage of the corresponding data flow channel, where the usage is to check whether there is a target data packet being transmitted in the data flow channel, where the target data packet is the data packet being transmitted in the data flow channel. When the data flow channel includes the target data packet, it is necessary to determine whether the target data packet is not a data packet allowed to be transmitted in the data flow channel. It should be explained here why the data packet that is not allowed to be transmitted is in the data flow channel. This target data packet is disguised so that the data flow channel mistakenly thinks it is a real data packet allowed to pass. Therefore, it is necessary to determine whether the target data packet is a real data packet, where the preset means are prior art and will not be repeated here.

[0057] In a specific embodiment, if there is no target data packet in the data flow channel, the method further includes: counting the duration of the absence of target data in the statistical data flow channel; if the duration exceeds a preset time threshold, closing the data flow channel.

[0058] Exemplarily, when the target data packet is not included in the data flow channel, it is necessary to count the duration of the absence of the target data packet in the data flow channel. When the duration exceeds a preset time threshold, the channel is closed, where the preset time threshold can be determined based on actual conditions, and the preset time threshold is not limited in the embodiment of the present application.

[0059] like Figure 2 and Figure 3 FIG. 1 is a schematic diagram of two specific implementations in the embodiment of the present application, wherein Figure 2 To control the state of the data stream channel based on protocol information and key fields, Figure 3 To control the closing of the data channel according to the preset time threshold.

[0060] Figure 2 Specifically, firstly, a SIP protocol is preset, and it is determined whether there is a data packet that complies with the SIP protocol specification in the acquired data packet. If it is not a SIP protocol data packet, the data packet jumps out of this program; after determining that it is a SIP protocol data packet, analyze whether there is a data packet requesting to create a new connection (due to the nature of the SIP protocol, if there is a data packet to create a new connection, relevant fields can be found in the data packet, such as the "INVITE" field). If there is no request data, the data packet jumps out of this program; if there is a request data packet, it starts to collect information in the next data packet; after the collection is completed, another channel is automatically created for the communication of the video stream; after the creation is completed, the data passes, and the channel closing process is entered.

[0061] Figure 3 Specifically, a timed check function is pre-set to check whether the automatically established data flow channel still has data packets or information that does not meet the predetermined value, such as attack packets, or problems such as excessive traffic or too little traffic; check whether there is still data flow, and if so, check whether it is compliant. If it is compliant, continue with the next detection, otherwise the channel will be closed and it is considered that there is a risk; if there is no traffic, check whether the closing time (preset manually) is exceeded, and if not, mark the security channel; if the closing time is exceeded, close the security channel; and close the corresponding channel by parsing the key field "BYE" in the SIP protocol.

[0062] like Figure 4 As shown in the figure, it is a schematic diagram of data transmission through the SIP protocol. The client uses the SIP protocol to send a request to the server to use a random port A to obtain data. The server responds to use a random port B for transmission. After negotiation, after the client requests port B, the server sends data to port A through port B until it receives a request from the client that it does not want to receive data. The server stops sending data and closes the respective ports. If a gatekeeper is not set on the server, the client can send any data to the server, which causes the server to be in an unsafe state. If a gatekeeper is set, the gatekeeper can intercept data that does not meet the channel conditions in advance to ensure the security of the server. However, due to the characteristics of SIP, it is currently impossible to accurately and timely open the corresponding data channel for data to pass. If timeliness is guaranteed, it is necessary to open extra channels to ensure that random ports A or B are included in them, but the result will still put the server in an unsafe state. If security is guaranteed, it is necessary to obtain the negotiated port from the network data packet to add a new secure channel. However, even if the manual operation time is short, it is already very slow compared to the computer. As a result, no matter how the operation is performed, it is impossible to ensure that the data flow passes through the gatekeeper. As a result, the two cannot be achieved at the same time.

[0063] In this way, data to be transmitted is obtained, wherein the data to be transmitted includes at least protocol information and field information, wherein the protocol information is used to identify the protocol and data type of the data, wherein the protocol information and the field information can be used to identify the protocol of the data, and when it is determined that the data is a SIP protocol according to the protocol information, it is further determined according to the field information whether the data includes a key field, and if the key field is included, the state of the data flow channel is controlled according to the key field, so that the data flow channel is accurately and timely controlled during the transmission process, thereby solving the problem of insecurity of the channel existing for a long time due to the traditional inaccurate opening and untimely closing, and ensuring that the safe data passes through the network gate.

[0064] The above is an embodiment of the network gate channel control method provided by the present application. The following describes other embodiments of the network gate channel control provided by the present application. Please refer to the following for details.

[0065] The embodiment of the present invention also discloses a network gate channel control device, such as Figure 5 As shown, the device comprises:

[0066] The acquisition module 501 is used to acquire data to be transmitted, where the data at least includes protocol information and field information;

[0067] A determination module 502, configured to determine whether the field information includes a key field if the protocol information is SIP protocol information;

[0068] The control module 503 is used to control the state of the data flow channel according to the key field if the key field is included.

[0069] In an optional embodiment, the state includes establishment and shutdown, and the control module is specifically used to:

[0070] If the key field is a request field, a data flow channel is established;

[0071] If the key field is the end field, the data flow channel is closed.

[0072] In an optional embodiment, when the data stream channel does not exist and it is determined that the field information includes a key field, the device is further configured to:

[0073] A data stream channel is created according to the data packet so that the state of the data stream channel can be controlled according to the key fields later.

[0074] In an optional embodiment, the device is further used for:

[0075] Periodically checking whether a target data packet exists in the data stream channel, where the target data packet is a data packet allowed to be transmitted by the data stream channel;

[0076] If there is a target data packet in the data flow channel and when the data packet in the data flow channel does not meet the preset conditions, the data flow channel is closed.

[0077] In an optional embodiment, if the target data packet does not exist in the data stream channel, the device is further configured to:

[0078] Count the duration of time when no target data exists in the statistical data flow channel;

[0079] If the duration exceeds the preset time threshold, the data stream channel is closed.

[0080] In an optional embodiment, if the protocol information is not SIP protocol information, the data stream channel is not established.

[0081] In an optional embodiment, if the data does not include a key field, the data flow channel is not established.

[0082] The functions performed by the various components in the network gate channel control device provided by the embodiment of the present invention have been described in detail in any of the above method embodiments, and therefore will not be repeated here.

[0083] By executing this device, data to be transmitted is obtained, wherein the data to be transmitted at least includes protocol information and field information, wherein the protocol information is used to identify the protocol and data type of the data, wherein the protocol information and the field information can be used to identify the data, when the data is determined to be a SIP protocol according to the protocol information, whether the data includes a key field is further determined according to the field information, and if the key field is included, the state of the data flow channel is controlled according to the key field, so that the data flow channel is controlled during the transmission process, thereby solving the insecurity problem caused by the traditional data transmission process when the SIP protocol is used as the network gate protocol, and ensuring the security of both sides of the network gate.

[0084] The embodiment of the present invention also provides a computer device, such as Figure 6 As shown, the computer device may include a processor 601 and a memory 602, wherein the processor 601 and the memory 602 may be connected via a bus or other means. Figure 6 The example of connecting through bus is taken in the following.

[0085] The processor 601 may be a central processing unit (CPU). The processor 601 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0086] The memory 602 is a non-transient computer-readable storage medium that can be used to store non-transient software programs, non-transient computer executable programs and modules, such as program instructions / modules corresponding to the sports training method in the embodiment of the present invention. The processor 601 executes various functional applications and data processing of the processor by running the non-transient software programs, instructions and modules stored in the memory 602, that is, implementing the sports training method in the above method embodiment.

[0087] The memory 602 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required by at least one function; the data storage area may store data created by the processor 601, etc. In addition, the memory 602 may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 602 may optionally include a memory remotely arranged relative to the processor 601, and these remote memories may be connected to the processor 601 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0088] One or more modules are stored in the memory 602, and when executed by the processor 601, the execution is as follows: Figure 1 The sports training method in the illustrated embodiment.

[0089] For details of the above computer equipment, please refer to Figure 1 The corresponding related descriptions and effects in the illustrated embodiments can be understood and will not be repeated here.

[0090] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0091] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A network gate channel control method, characterized in that: include: Acquire a data packet to be transmitted, wherein the data packet includes at least protocol information and field information; If the protocol information is SIP protocol information, determining whether the field information includes a key field; The SIP protocol cannot directly transmit data packets. When the data to be transmitted is a data packet, the SIP protocol negotiates with the data packet to build a data stream channel that can pass through the SIP protocol data packet. The key field is the content of the data stream channel negotiated with the SIP protocol. If a key field is included, controlling the state of the data stream channel according to the key field; The state includes opening and closing, and the state of controlling the data stream channel according to the key field specifically includes: If the key field is a request field, opening the data flow channel; If the key field is an end field, the data stream channel is closed.

2. The method according to claim 1, characterized in that When the data stream channel does not exist and it is determined that the field information includes the key field, the method further includes: The data stream channel is created according to the data packet, so that the state of the data stream channel is subsequently controlled according to the key field.

3. The method according to any one of claims 1 to 2, characterized in that: The method further comprises: Periodically checking whether the data stream channel has a target data packet, the target data packet being a data packet allowed to be transmitted by the data stream channel; If the target data packet exists in the data flow channel and when the data packet in the data flow channel does not meet the preset condition, the data flow channel is closed.

4. The method according to claim 3, characterized in that If the target data packet does not exist in the data stream channel, the method further includes: Counting the duration time when the target data does not exist in the data stream channel; If the duration exceeds a preset time threshold, the data stream channel is closed.

5. The method according to claim 1, characterized in that If the protocol information is not SIP protocol information, the data stream channel is not established.

6. The method according to claim 1, characterized in that If the data does not include a key field, the data flow channel is not established.

7. A network gate channel control device, characterized in that: include: An acquisition module, used to acquire data to be transmitted, wherein the data at least includes protocol information and field information; A determination module, configured to determine whether the field information includes a key field if the protocol information is SIP protocol information; The SIP protocol cannot directly transmit data packets. When the data to be transmitted is a data packet, the SIP protocol negotiates with the data packet to build a data stream channel that can pass through the SIP protocol data packet. The key field is the content of the data stream channel negotiated with the SIP protocol. A control module, for controlling the state of the data stream channel according to the key field if the key field is included; The state includes opening and closing, and the state of controlling the data stream channel according to the key field specifically includes: If the key field is a request field, opening the data flow channel; If the key field is an end field, the data stream channel is closed.

8. A computer device, characterized in that: include: at least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor performs the steps of the network gate channel control method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the gatekeeper channel control method according to any one of claims 1 to 6 are implemented.

Images