Transmission method of application layer protocol, computer program product, electronic equipment and storage medium

Abstract

The invention provides an application layer protocol transmission method, a computer program product, electronic equipment and a storage medium, and the method comprises the steps: obtaining user access information containing application layer protocol information; performing configuration conversion according to the user access information to obtain first message flow data; comparing the first message flow data with a first channel map to obtain second message flow data; analyzing the second message flow data to obtain a target data packet; and carrying out encrypted transmission on the target data packet. By implementing the application, the security and stability of the application layer protocol in the transmission process can be improved, attacks are reduced, the control strength is improved, the accuracy of data interaction is further improved, protocol transmission is more reasonable and effective, multiple potential safety hazards are avoided, and the risk of a user in access control is reduced.

Description

Technical Field

[0001] The present application relates to the technical field of data transmission, and in particular to a transmission method of an application layer protocol, a computer program product, an electronic device and a storage medium. Background Art

[0002] The application layer protocol of the prior art is usually transmitted based on multiple links in the form of command + data, such as the File Transfer Protocol (FTP). When the protocol passes through the network boundary, if security control is to be performed, an application layer gateway (ALG) is required to implement it. However, with the popularity of the Transport Layer Security (TLS), more and more application layer services support TLS. Due to the encryption operation, the original ALG implementation will not be able to parse the sub-link information by normal means, and therefore cannot play the role of a gateway.

[0003] The existing technology can simplify the problem of sub-links being easily intercepted by security software and devices such as firewalls when clients access by using passive mode, but it also increases the risk of access control on the server side. As a result, FTP cannot be decrypted, so it is impossible to use the expected connection method to dynamically open ports to control port-level access. The FTP service needs to open access to the data port, but this will cause attackers to use any IP to attack the open port, or add rules through the firewall to allow access, but the control is usually relatively strong, resulting in inaccurate data interaction. Summary of the invention

[0004] The purpose of the present application is to provide a transmission method, computer program product, electronic device and storage medium of an application layer protocol, which can improve the security and stability of the application layer protocol during transmission, reduce the occurrence of attacks, enhance control strength, and thus enhance the accuracy of data interaction, making protocol transmission more reasonable and effective, avoiding multiple security risks, and reducing the risk of users in access control.

[0005] In a first aspect, an embodiment of the present application provides a method for transmitting an application layer protocol, the method comprising:

[0006] Obtain user access information including application layer protocol information;

[0007] Perform configuration conversion according to the user access information to obtain first message flow data;

[0008] Comparing the first message flow data with the first channel map to obtain second message flow data;

[0009] Parsing the second message flow data to obtain a target data packet;

[0010] The target data packet is encrypted for transmission.

[0011] In the above implementation process, configuration conversion is performed according to user access information, and the message flow data is compared with the channel map to achieve encrypted transmission. This can improve the security and stability of the application layer protocol during transmission, reduce the occurrence of attacks, enhance control, and thus improve the accuracy of data interaction, making protocol transmission more reasonable and effective, avoiding multiple security risks, and reducing user risks in access control.

[0012] Furthermore, the step of performing configuration conversion according to the user access information to obtain the first message flow data includes:

[0013] Configuring an access control policy corresponding to the user access information;

[0014] The sub-link is registered according to the access control policy to obtain the first message flow data.

[0015] In the above implementation process, configuring the access control policy and registering the sub-link according to the access control policy can achieve precise control of access control, improve the availability of the access control policy and the security of user access information.

[0016] Further, the step of comparing the first message flow data with the first channel map to obtain the second message flow data includes:

[0017] Comparing the first message flow data with the first channel map to determine whether the first message flow data hits the first channel map;

[0018] If yes, decrypt the first message flow data to obtain the second message flow data;

[0019] If not, compare the first message flow data with the second channel map to determine whether the first message flow data hits the second channel map; if the first message flow data does not hit the second channel map, determine that the request in the user access information is invalid and intercept the user request.

[0020] In the above implementation process, the first message flow data is compared with the first channel map. The first message flow data can be compared with various information such as protocols, IP, etc. in the first channel map and the second channel map to ensure the security of the first message flow and improve data transmission efficiency.

[0021] Furthermore, the step of parsing the second message flow data to obtain the target data packet includes:

[0022] Performing callback processing on the sub-link according to the second message flow data to determine whether the five-tuple information is successfully called;

[0023] If so, determine whether there is a conversion requirement for the second message flow data; if there is a conversion requirement, modify the second message flow data to obtain the target data packet.

[0024] In the above implementation process, the sub-link is called back according to the second message flow data to obtain five-tuple information, which can improve the granularity of the data, enhance the control over the data transmission process, and accurately control the data channel interaction.

[0025] Furthermore, the step of parsing the second message flow data to obtain the target data packet further includes:

[0026] If the five-tuple information is successfully called, the five-tuple information is added to the second channel map.

[0027] In the above implementation process, after the five-tuple information is successfully called, the five-tuple information is added to the second channel map, so that the channel map can be more complete, further improving its comparison accuracy of the message flow data, making the message flow data more accurate.

[0028] Furthermore, the step of encrypting and transmitting the target data packet includes:

[0029] Detecting whether there is a session between the target data packet and the server;

[0030] If yes, encrypt the target data packet to obtain an encrypted message, and transmit the encrypted message;

[0031] If not, the target data packet is retransmitted.

[0032] In the above implementation process, when there is no session between the target data packet and the server, the target data packet is retransmitted to ensure accurate and secure transmission of the target data packet, which can improve the stability and security of the application layer protocol transmission process.

[0033] Further, the step of retransmitting the target data packet includes:

[0034] Initializing the target data packet to obtain an initialized target data packet;

[0035] The target data packet is encrypted to obtain an encrypted message, and the encrypted message is transmitted.

[0036] In the above implementation process, the target data packet is initialized and then encrypted for transmission, which further improves the security performance during the transmission process, avoids multiple security risks, and reduces the risk of users in access control.

[0037] In a second aspect, an embodiment of the present application provides a computer program product, which, when running on a computer, enables the computer to execute the method as described in any one of the first aspects.

[0038] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in any one of the first aspects when executing the computer program.

[0039] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which instructions are stored. When the instructions are executed on a computer, the computer executes the method as described in any one of the first aspects.

[0040] In a fifth aspect, an embodiment of the present application further provides a transmission device of an application layer protocol, the device comprising:

[0041] An acquisition module, used to acquire user access information including application layer protocol information;

[0042] A configuration conversion module, used to perform configuration conversion according to user access information to obtain first message flow data;

[0043] A comparison module, used for comparing the first message flow data with the first channel map to obtain second message flow data;

[0044] A parsing module, used for parsing the second message flow data to obtain a target data packet;

[0045] The transmission module is used to encrypt and transmit the target data packet.

[0046] In the above implementation process, configuration conversion is performed according to user access information, and the message flow data is compared with the channel map to achieve encrypted transmission. This can improve the security and stability of the application layer protocol during transmission, reduce the occurrence of attacks, enhance control, and thus improve the accuracy of data interaction, making protocol transmission more reasonable and effective, avoiding multiple security risks, and reducing user risks in access control.

[0047] Other features and advantages of the present disclosure will be set forth in the following description, or some features and advantages may be inferred or unambiguously determined from the description, or may be learned by implementing the above-mentioned technology of the present disclosure.

[0048] And it can be implemented according to the contents of the specification. The following is a detailed description of the preferred embodiments of the present application with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the range values. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0050] Figure 1 A schematic diagram of a flow chart of a transmission method of an application layer protocol provided in an embodiment of the present application;

[0051] Figure 2 A schematic diagram of the structure of a transmission device for an application layer protocol provided in an embodiment of the present application;

[0052] Figure 3 A schematic diagram of the structural composition of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0054] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0055] The specific implementation methods of the present application are further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present application, but are not used to limit the scope of the present application.

[0056] Embodiment 1

[0057] Figure 1 is a flow chart of the transmission method of the application layer protocol provided in the embodiment of the present application, such as Figure 1 As shown, the method includes:

[0058] S1, obtaining user access information including application layer protocol information;

[0059] S2, performing configuration conversion according to the user access information to obtain first message flow data;

[0060] S3, comparing the first message flow data with the first channel map to obtain second message flow data;

[0061] S4, parsing the second message flow data to obtain a target data packet;

[0062] S5, encrypt and transmit the target data packet.

[0063] In the above implementation process, configuration conversion is performed according to user access information, and the message flow data is compared with the channel map to achieve encrypted transmission. This can improve the security and stability of the application layer protocol during transmission, reduce the occurrence of attacks, enhance control, and thus improve the accuracy of data interaction, making protocol transmission more reasonable and effective, avoiding multiple security risks, and reducing user risks in access control.

[0064] An embodiment of the present application provides an access control method for a multi-link application layer protocol for TLS, provides a configuration interface for users, completes basic access control configuration and confirmation of custom sub-links, completes the operation of restoring plain text inside the device and ensures that the outside of the device is still ciphertext, completes the parsing of signaling on the command channel, sub-link confirmation and operating system network configuration to achieve access interception.

[0065] Furthermore, S2 includes:

[0066] Configure access control policies corresponding to user access information;

[0067] The sub-link is registered according to the access control policy to obtain the first message flow data.

[0068] In the above implementation process, configuring the access control policy and registering the sub-link according to the access control policy can achieve precise control of access control, improve the availability of the access control policy and the security of user access information.

[0069] Configure 1 access control policy and register the sub-link to confirm the conversion. After configuration and delivery, add data items such as protocol, IP, port, etc. in the first channel map.

[0070] Furthermore, S3 includes:

[0071] Compare the first message flow data with the first channel map to determine whether the first message flow data hits the first channel map;

[0072] If yes, decrypt the first message stream data to obtain the second message stream data;

[0073] If not, compare the first message flow data with the second channel map to determine whether the first message flow data hits the second channel map. If the first message flow data does not hit the second channel map, determine that the request in the user access information is invalid and intercept the user request.

[0074] In the above implementation process, the first message flow data is compared with the first channel map. The first message flow data can be compared with various information such as protocols, IP, etc. in the first channel map and the second channel map to ensure the security of the first message flow and improve data transmission efficiency.

[0075] In the embodiment of the present application, the channel map (the first channel map and the second channel map) refers to parent_channel_map, which is a data structure for searching connections.

[0076] During the first interaction, it is first determined whether the first message flow data can hit the first channel map. If it cannot hit, the request is considered invalid and the device intercepts it. If it hits, TLS is unloaded and the second message flow data (original message) is parsed based on the first message flow data.

[0077] Furthermore, S4 includes:

[0078] Perform callback processing on the sub-link according to the second message flow data to determine whether the five-tuple information is successfully called;

[0079] If so, determine whether there is a conversion requirement for the second message flow data; if there is a conversion requirement, modify the second message flow data to obtain a target data packet.

[0080] In the above implementation process, the sub-link is called back according to the second message flow data to obtain five-tuple information, which can improve the granularity of the data, enhance the control over the data transmission process, and accurately control the data channel interaction.

[0081] Through the sub-link conversion callback registered by the user, the five-tuple information of the sub-link to be established is obtained. If successful, the five-tuple information is added to the second channel map. After checking the second channel map after the message hits, the subsequent TLS does not perform any operation on the data and directly completes the forwarding.

[0082] Furthermore, S4 also includes:

[0083] If the five-tuple information is successfully called, the five-tuple information is added to the second channel map.

[0084] In the above implementation process, after the quintuple information is successfully called, the quintuple information is added to the first channel map, so that the channel map can be more complete, further improving its comparison accuracy of the message flow data, making the message flow data more accurate.

[0085] Furthermore, S5 includes:

[0086] Detect whether there is a session between the target data packet and the server;

[0087] If yes, the target data packet is encrypted to obtain an encrypted message, and the encrypted message is transmitted;

[0088] If not, the target data packet is retransmitted.

[0089] In the above implementation process, when there is no session between the target data packet and the server, the target data packet is retransmitted to ensure accurate and secure transmission of the target data packet, which can improve the stability and security of the application layer protocol transmission process.

[0090] Further, the step of retransmitting the target data packet includes:

[0091] Initializing the target data packet to obtain an initialized target data packet;

[0092] The target data packet is encrypted to obtain an encrypted message, and the encrypted message is transmitted.

[0093] In the above implementation process, the target data packet is initialized and then encrypted for transmission, which further improves the security performance during the transmission process, avoids multiple security risks, and reduces the risk of users in access control.

[0094] After TLS receives the target data packet, it writes the second message stream data on the TLS encrypted channel established with the server side to achieve encrypted transmission.

[0095] For example, taking FTPS passive mode as an example, the user sends and receives the gateway configuration whitelist for FTPS Server 2.2.2.2:21 on the device, and the registration sub-link confirmation method is that the command message hits PASV (this application embodiment takes ipv4 as an example, and does not consider the passive mode command extended by ipv6). The server response message [227 Entering Passive Mode (10,2,169,101,118,110)] can use 256*118+110 to confirm the connection port number.

[0096] The first message flow data is transmitted to TLS, and it is checked whether it is transmitted to the server's gateway configuration whitelist 2.2.2.2:21. If not, the first message flow data is discarded as an illegal message. If it is, the first channel map is searched, and the second message flow data (such as the original command / response message flow) is restored. If the first channel map cannot be found, the second channel map is searched later. After finding it, the message is directly forwarded to 2.2.2.2:21 through the operating system without additional processing.

[0097] The second message flow data passes through protocols such as user\pwd (login), list (list) and other commands. Since it cannot hit the PASV check of the user registration, it is forwarded normally to TLS to restore the encrypted message and communicate with 2.2.2.2:21. After hitting PASV, the sub-link is parsed as yyyy. The device adds 2.2.2.2:yyyy to the second channel map to prepare for subsequent sub-link interactions. Then this message is handed over to TLS to resume encrypted transmission.

[0098] Check whether the original message (second message stream data) contains syn. If so, initialize the TLS environment with 2.2.2.2:21, and write the plaintext message (target data packet) in encrypted form based on this.

[0099] The embodiment of the present application implements a multi-link protocol on top of TLS through an application layer gateway, refines the control strength, accurately controls the data channel interaction, completes the processing of the original message through TLS unloading and loading, and realizes a fast, accurate and secure control and transmission method of protocol data.

[0100] Embodiment 2

[0101] An embodiment of the present application provides a computer program product. When the computer program product is run on a computer, the computer executes any method of the first embodiment.

[0102] Embodiment 3

[0103] In order to execute the method corresponding to the above embodiment 1 to achieve the corresponding functions and technical effects, a transmission device of an application layer protocol is provided below, such as Figure 2 As shown, the device comprises:

[0104] Acquisition module 1, used to acquire user access information including application layer protocol information;

[0105] Configuration conversion module 2, used for performing configuration conversion according to user access information to obtain first message flow data;

[0106] A comparison module 3, used for comparing the first message flow data with the first channel map to obtain second message flow data;

[0107] The parsing module 4 is used to parse the second message flow data to obtain a target data packet;

[0108] The transmission module 5 is used to encrypt and transmit the target data packet.

[0109] In the above implementation process, configuration conversion is performed according to user access information, and the message flow data is compared with the channel map to achieve encrypted transmission. This can improve the security and stability of the application layer protocol during transmission, reduce the occurrence of attacks, enhance control, and thus improve the accuracy of data interaction, making protocol transmission more reasonable and effective, avoiding multiple security risks, and reducing user risks in access control.

[0110] Furthermore, the configuration conversion module 2 is also used for:

[0111] Configure access control policies corresponding to user access information;

[0112] The sub-link is registered according to the access control policy to obtain the first message flow data.

[0113] In the above implementation process, configuring the access control policy and registering the sub-link according to the access control policy can achieve precise control of access control, improve the availability of the access control policy and the security of user access information.

[0114] Furthermore, the comparison module 3 is also used for:

[0115] Compare the first message flow data with the first channel map to determine whether the first message flow data hits the first channel map;

[0116] If yes, decrypt the first message stream data to obtain the second message stream data;

[0117] If not, compare the first message flow data with the second channel map to determine whether the first message flow data hits the second channel map. If the first message flow data does not hit the second channel map, determine that the request in the user access information is invalid and intercept the user request.

[0118] In the above implementation process, the first message flow data is compared with the first channel map. The first message flow data can be compared with various information such as protocol, IP, etc. in the first channel map to ensure the security of the first message flow and improve data transmission efficiency.

[0119] Furthermore, the parsing module 4 is also used for:

[0120] Perform callback processing on the sub-link according to the second message flow data to determine whether the five-tuple information is successfully called;

[0121] If so, determine whether there is a conversion requirement for the second message flow data; if there is a conversion requirement, modify the second message flow data to obtain a target data packet.

[0122] In the above implementation process, the sub-link is called back according to the second message flow data to obtain five-tuple information, which can improve the granularity of the data, enhance the control over the data transmission process, and accurately control the data channel interaction.

[0123] Furthermore, the parsing module 4 is also used for:

[0124] If the five-tuple information is successfully called, the five-tuple information is added to the second channel map.

[0125] In the above implementation process, after the quintuple information is successfully called, the quintuple information is added to the first channel map, so that the channel map can be more complete, further improving its comparison accuracy of the message flow data, making the message flow data more accurate.

[0126] Furthermore, S5 includes:

[0127] Detect whether there is a session between the target data packet and the server;

[0128] If yes, the target data packet is encrypted to obtain an encrypted message, and the encrypted message is transmitted;

[0129] If not, the target data packet is retransmitted.

[0130] In the above implementation process, when there is no session between the target data packet and the server, the target data packet is retransmitted to ensure accurate and secure transmission of the target data packet, which can improve the stability and security of the application layer protocol transmission process.

[0131] Furthermore, the transmission module 5 is also used for:

[0132] Initializing the target data packet to obtain an initialized target data packet;

[0133] The target data packet is encrypted to obtain an encrypted message, and the encrypted message is transmitted.

[0134] In the above implementation process, the target data packet is initialized and then encrypted for transmission, which further improves the security performance during the transmission process, avoids multiple security risks, and reduces the risk of users in access control.

[0135] The transmission device of the application layer protocol can implement the method of the above embodiment 1. The options in the above embodiment 1 are also applicable to this embodiment and will not be described in detail here.

[0136] The rest of the contents of the embodiments of the present application can refer to the contents of the above-mentioned embodiment 1, and will not be repeated in this embodiment.

[0137] Embodiment 4

[0138] An embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the application layer protocol transmission method of the first embodiment.

[0139] Optionally, the above-mentioned electronic device may be a server.

[0140] See also Figure 3 , Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may include a processor 31, a communication interface 32, a memory 33 and at least one communication bus 34. The communication bus 34 is used to realize direct connection and communication between these components. The communication interface 32 of the device in the embodiment of the present application is used to communicate signaling or data with other node devices. The processor 31 may be an integrated circuit chip with signal processing capabilities.

[0141] The processor 31 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor 31 can also be any conventional processor, etc.

[0142] The memory 33 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc. The memory 33 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 31, the device can execute the above-mentioned Figure 1The method embodiment involves various steps.

[0143] Optionally, the electronic device may further include a storage controller and an input / output unit. The memory 33, the storage controller, the processor 31, the peripheral interface, and the input / output unit are electrically connected to each other directly or indirectly to achieve data transmission or interaction. For example, these components may be electrically connected to each other via a communication bus 34. The processor 31 is used to execute executable modules stored in the memory 33, such as software function modules or computer programs included in the device.

[0144] The input and output unit is used to provide users with the task creation and to create an optional time period or preset execution time for the task to enable interaction between the user and the server. The input and output unit can be, but is not limited to, a mouse and a keyboard.

[0145] Understandably, Figure 3 The structure shown is for illustration only. The electronic device may also include Figure 3 More or fewer components as shown, or with Figure 3 Different configurations are shown. Figure 3 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0146] In addition, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the transmission method of the application layer protocol of embodiment 1.

[0147] The embodiment of the present application also provides a computer program product, which, when running on a computer, enables the computer to execute the method described in the method embodiment.

[0148] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of boxes in the block diagram and / or the flowchart, can be implemented with a dedicated hardware-based device that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0149] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0150] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0151] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application. It should be noted that similar numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0152] The above is only a specific implementation of the present application, but the protection range of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical range disclosed in the present application, which should be included in the protection range of the present application. Therefore, the protection range of the present application should be based on the protection range of the claims.

[0153] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A transmission method of an application layer protocol, characterized in that: The method comprises: Obtain user access information including application layer protocol information; Perform configuration conversion according to the user access information to obtain first message flow data; Comparing the first message flow data with the first channel map to obtain second message flow data; Parsing the second message flow data to obtain a target data packet; The target data packet is encrypted for transmission.

2. The transmission method of the application layer protocol according to claim 1, characterized in that: The step of performing configuration conversion according to the user access information to obtain the first message flow data includes: Configuring an access control policy corresponding to the user access information; The sub-link is registered according to the access control policy to obtain the first message flow data.

3. The transmission method of the application layer protocol according to claim 1, characterized in that: The step of comparing the first message flow data with the first channel map to obtain the second message flow data includes: Comparing the first message flow data with the first channel map to determine whether the first message flow data hits the first channel map; If yes, decrypt the first message flow data to obtain the second message flow data; If not, compare the first message flow data with the second channel map to determine whether the first message flow data hits the second channel map; if the first message flow data does not hit the second channel map, determine that the request in the user access information is invalid and intercept the user request.

4. The transmission method of the application layer protocol according to claim 2, characterized in that: The step of parsing the second message flow data to obtain a target data packet includes: Performing callback processing on the sub-link according to the second message flow data to determine whether the five-tuple information is successfully called; If so, determine whether there is a conversion requirement for the second message flow data; if there is a conversion requirement, modify the second message flow data to obtain the target data packet.

5. The transmission method of the application layer protocol according to claim 4, characterized in that: The step of parsing the second message flow data to obtain the target data packet also includes: If the five-tuple information is successfully called, the five-tuple information is added to the second channel map.

6. The transmission method of the application layer protocol according to claim 1, characterized in that: The step of encrypting and transmitting the target data packet comprises: Detecting whether there is a session between the target data packet and the server; If yes, encrypt the target data packet to obtain an encrypted message, and transmit the encrypted message; If not, the target data packet is retransmitted.

7. The transmission method of the application layer protocol according to claim 6, characterized in that: The step of retransmitting the target data packet comprises: Initializing the target data packet to obtain an initialized target data packet; The target data packet is encrypted to obtain an encrypted message, and the encrypted message is transmitted.

8. A computer program product, characterized in that When the computer program product is executed on a computer, the computer is enabled to perform the method according to any one of claims 1 to 7.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the transmission method of the application layer protocol according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The computer program is stored therein, and when the computer program is executed by a processor, the transmission method of the application layer protocol as claimed in any one of claims 1 to 7 is implemented.

Images