GRE message auditing method, GRE message auditing device and processing equipment

Abstract

The invention provides a GRE message auditing method, a GRE message auditing device and processing equipment, which are used for providing a set of practical auditing processing scheme and specifically combining user internet behavior management to more effectively perform deep auditing processing on a GRE message, so that the high-quality auditing requirement of an enterprise on the GRE message can be met, and the auditing efficiency of the GRE message is improved. And stable and reliable network security protection is provided. The method comprises the following steps: acquiring a GRE message to be audited; if the to-be-audited GRE message is a data message, stripping a header field packaged under a GRE protocol from the to-be-audited GRE message, continuing to perform recalculation based on the length of the stripped message, and processing a target message containing new quintuple information; performing user internet behavior management on a user corresponding to the target message; under the condition that the user online behavior management releases the target message, on one hand, the traffic statistical information is updated for the user corresponding to the target message, and on the other hand, the auditing condition involved in the access of the target message to the Internet resource is processed.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a GRE message auditing method, apparatus and processing equipment. Background Art

[0002] With the rapid development of the Internet, more and more enterprises use the Generic Routing Encapsulation (GRE) protocol to allow branches and headquarters to establish corresponding tunnels for data message transmission to meet the communication needs between branches and headquarters in certain aspects.

[0003] GRE is actually an encapsulation protocol that provides a mechanism to encapsulate a message of one protocol in a message of another protocol, so that messages can be transmitted in heterogeneous networks. The channel for heterogeneous message transmission is called a tunnel.

[0004] In this case, the inventor of the present application discovered that the application engine of the relevant equipment responsible for auditing in the prior art would only parse and audit the outer IP packets. Since the original packets were encapsulated inside the GRE packets, the application engine could only see the GRE protocol and could not effectively audit and control the transmission data in the GRE protocol tunnel, that is, the GRE packets, which would affect network security performance. Summary of the invention

[0005] The present application provides a GRE message auditing method, apparatus, and processing equipment, which are used to provide a set of practical audit processing solutions, and specifically combine user Internet behavior management to more effectively perform in-depth audit processing on GRE messages. In this way, it can meet the internal high-quality auditing needs of GRE messages and provide stable and reliable network security protection.

[0006] In a first aspect, the present application provides a GRE message auditing method, the method comprising:

[0007] Obtain the GRE message to be audited, wherein the GRE message to be audited is specifically a data message transmitted within the enterprise through a GRE tunnel under the GRE protocol;

[0008] If the GRE message to be audited is a data message, the header field encapsulated under the GRE protocol is stripped from the GRE message to be audited, and the length of the message after stripping is recalculated to process the target message containing the new five-tuple information;

[0009] According to the preset user online behavior management strategy, the user online behavior management is carried out for the user corresponding to the target message;

[0010] When the target message is released by the user online behavior management, on the one hand, the traffic statistics information of the user corresponding to the target message is updated, and on the other hand, the audit situation related to the target message accessing Internet resources is processed.

[0011] In combination with the first aspect of the present application, in a first possible implementation manner of the first aspect of the present application, obtaining a GRE message to be audited includes:

[0012] Get the currently arriving traffic packets;

[0013] Determine whether the currently arriving traffic packet is a GRE packet;

[0014] If yes, it is determined to be a GRE message to be audited.

[0015] In combination with the first possible implementation of the first aspect of the present application, in a second possible implementation of the first aspect of the present application, determining whether the currently arriving traffic message is a GRE message includes:

[0016] Determine whether the Protocol field value of the IP layer of the currently arriving traffic message is 47;

[0017] If yes, it is determined that the currently arriving traffic packet is a GRE packet.

[0018] In combination with the first aspect of the present application, in a third possible implementation manner of the first aspect of the present application, if the GRE message to be audited is a control message, the method further includes:

[0019] Block the GRE packets to be audited.

[0020] In combination with the first aspect of the present application, in a fourth possible implementation manner of the first aspect of the present application, after processing the target message containing the new five-tuple information, the method further includes:

[0021] If a corresponding session without a blocking mark has been established in advance for the target message, the corresponding session is associated with the target message;

[0022] If the target message does not have a corresponding session established in advance, then establish and associate a corresponding session with the target message;

[0023] If the user online behavior management makes a policy action to block the target message, the target message is discarded and a blocking mark is configured for the corresponding session.

[0024] In combination with the first aspect of the present application, in a fifth possible implementation manner of the first aspect of the present application, the method further includes:

[0025] Identify the user corresponding to the target message.

[0026] In combination with the first aspect of the present application, in the sixth possible implementation method of the first aspect of the present application, the audit situation specifically includes at least one of terminal traffic aggregation, terminal traffic analysis, terminal traffic control, web page access filtering, Internet privacy protection, network application control, bandwidth traffic management, information sending and receiving auditing, and user behavior analysis.

[0027] In a second aspect, the present application provides a GRE message auditing device, the device comprising:

[0028] An acquisition unit, used for acquiring a GRE message to be audited, wherein the GRE message to be audited is specifically a data message transmitted within the enterprise through a GRE tunnel under a GRE protocol;

[0029] A processing unit, configured to strip the header field encapsulated under the GRE protocol from the GRE message to be audited if the GRE message to be audited is a data message, and continue to recalculate based on the message length after stripping, and process the target message containing the new five-tuple information;

[0030] A management unit, used to carry out user online behavior management for the user corresponding to the target message according to a preset user online behavior management strategy;

[0031] The audit unit is used to update the traffic statistics information of the user corresponding to the target message on the one hand, and to process the audit situation involved in the target message accessing Internet resources on the other hand when the user online behavior management releases the target message.

[0032] In conjunction with the second aspect of the present application, in a first possible implementation manner of the second aspect of the present application, the acquiring unit is specifically configured to:

[0033] Get the currently arriving traffic packets;

[0034] Determine whether the currently arriving traffic packet is a GRE packet;

[0035] If yes, it is determined to be a GRE message to be audited.

[0036] In combination with the first possible implementation of the second aspect of the present application, in a second possible implementation of the second aspect of the present application, the acquiring unit is specifically configured to:

[0037] Determine whether the Protocol field value of the IP layer of the currently arriving traffic message is 47;

[0038] If yes, it is determined that the currently arriving traffic packet is a GRE packet.

[0039] In combination with the second aspect of the present application, in a third possible implementation manner of the second aspect of the present application, the processing unit is further configured to:

[0040] If the GRE message to be audited is a control message, the GRE message to be audited is blocked.

[0041] In combination with the second aspect of the present application, in a fourth possible implementation manner of the second aspect of the present application, the processing unit is further configured to:

[0042] If a corresponding session without a blocking mark has been established in advance for the target message, the corresponding session is associated with the target message;

[0043] If the target message does not have a corresponding session established in advance, then establish and associate a corresponding session with the target message;

[0044] If the user online behavior management makes a policy action to block the target message, the target message is discarded and a blocking mark is configured for the corresponding session.

[0045] In combination with the second aspect of the present application, in a fifth possible implementation manner of the second aspect of the present application, the processing unit is further configured to:

[0046] Identify the user corresponding to the target message.

[0047] In combination with the second aspect of the present application, in the sixth possible implementation method of the second aspect of the present application, the audit situation specifically includes at least one of terminal traffic aggregation, terminal traffic analysis, terminal traffic control, web page access filtering, Internet privacy protection, network application control, bandwidth traffic management, information sending and receiving auditing, and user behavior analysis.

[0048] In a third aspect, the present application provides a processing device, including a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method provided in the first aspect of the present application or any possible implementation method of the first aspect of the present application is executed.

[0049] In a fourth aspect, the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the method provided by the first aspect of the present application or any possible implementation of the first aspect of the present application.

[0050] From the above content, it can be concluded that the present application has the following beneficial effects:

[0051] Aiming at the audit target of GRE messages, this application provides a set of practical audit processing solutions, and specifically combines user Internet behavior management to more effectively perform in-depth audit processing on GRE messages. In this way, it can meet the high-quality audit needs of GRE messages within the enterprise and provide stable and reliable network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0053] Figure 1 A flowchart of the GRE message auditing method for this application;

[0054] Figure 2 A schematic diagram of an example of identifying a GRE message for this application;

[0055] Figure 3 A structural diagram of a GRE message auditing device of this application;

[0056] Figure 4 A schematic diagram of the structure of the processing equipment of this application. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0058] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than that illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can change the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0059] The division of modules in this application is a logical division. There may be other division methods when it is implemented in actual applications. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. In addition, the modules or submodules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed in multiple circuit modules, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present application.

[0060] Before introducing the GRE message auditing method provided by this application, the background content involved in this application is first introduced.

[0061] The GRE message audit method, device and computer-readable storage medium provided in this application can be applied to processing equipment to provide a set of practical audit processing solutions, and specifically combine user Internet behavior management to more effectively perform in-depth audit processing on GRE messages. In this way, it can meet the internal high-quality audit needs of GRE messages and provide stable and reliable network security protection.

[0062] The GRE message audit method mentioned in this application can be executed by a GRE message audit device, or a server, physical host or user equipment (UE) and other different types of processing devices integrated with the GRE message audit device. Among them, the GRE message audit device can be implemented in hardware or software, and the UE can be a terminal device such as a smart phone, a tablet computer, a laptop computer, a desktop computer or a personal digital assistant (PDA), and the processing device can be set in a device cluster.

[0063] It can be understood that, based on the in-depth analysis of GRE messages for the purpose of traffic message auditing, the present application also combines user Internet behavior management. Therefore, the processing device that executes the GRE message auditing method of the present application or is equipped with the application service corresponding to the GRE message auditing method of the present application can specifically be a user Internet behavior management device in the enterprise's internal network architecture. Of course, it can also be other types of device nodes in the network architecture. In addition, in some cases, the present application solution can also be implemented by a third-party service provided by a third-party device outside the enterprise's internal network architecture, which is also possible.

[0064] Thus, the present application does not impose too many restrictions on the specific device type and device deployment form of the processing device, and it can be flexibly and adaptively adjusted based on actual conditions and application requirements.

[0065] Next, the GRE message auditing method provided by this application is introduced.

[0066] First, see Figure 1 , Figure 1 A flow chart of the GRE message auditing method of the present application is shown. The GRE message auditing method provided by the present application may specifically include the following steps S101 to S104:

[0067] Step S101, obtaining a GRE message to be audited, wherein the GRE message to be audited is specifically a data message transmitted within the enterprise through a GRE tunnel under the GRE protocol;

[0068] It can be understood that in specific applications, as long as the GRE message has audit requirements, it can be deeply audited through this application solution.

[0069] For example, the GRE message transmitted to the user's Internet behavior management device is assumed to be the GRE message to be audited mentioned here; for another example, the GRE message transmitted through the GRE tunnel is identified as the GRE message to be audited mentioned here; for another example, the current GRE message that needs to be audited under the user's manual configuration is identified as the GRE message to be audited mentioned here; for another example, the GRE message on the corresponding transmission link or device node in the network architecture is autonomously identified as the GRE message to be audited mentioned here... Obviously, the acquisition and processing of the GRE message to be audited here is relatively flexible, and multiple different methods can exist at the same time to achieve diversified application effects.

[0070] At the same time, in actual applications, the audit processing initiated by the GRE message to be audited is usually initiated in the form of a GRE message audit task. The task can be initiated manually, forwarded by other devices, or initiated autonomously by the device according to a pre-configured autonomous initiation strategy, which is also relatively flexible.

[0071] On the basis of the GRE message audit task, the corresponding acquisition and processing of the GRE message to be audited can be triggered according to the guidance of the task information or according to other default configurations.

[0072] Specifically, as an exemplary embodiment herein, obtaining the GRE message to be audited may include:

[0073] Get the currently arriving traffic packets;

[0074] Determine whether the currently arriving traffic packet is a GRE packet;

[0075] If yes, it is determined to be a GRE message to be audited.

[0076] It can be seen that when applying the present application scheme in actual situations, it may involve the identification and processing of the GRE message, which is the processing object of the scheme. In more popular terms, when implementing the present application scheme in a specific application scenario, the present application scheme can be used to extract the targeted GRE messages from different types of traffic messages, thereby making it easier to implant the present application scheme into the original network architecture and its original network configuration work within the enterprise.

[0077] Furthermore, for the specific type of traffic message, GRE message, the present application also provides a more specific implementation solution.

[0078] In this regard, as an exemplary embodiment, determining whether the currently arriving traffic message is a GRE message may specifically include:

[0079] Determine whether the Protocol field value of the IP layer of the currently arriving traffic message is 47;

[0080] If yes, it is determined that the currently arriving traffic packet is a GRE packet.

[0081] For details, please refer to Figure 2 An example schematic diagram of the present application identifying a GRE message is shown in Figure 2 From the series of field contents of the IP layer of the given GRE message, it can be seen that if the field value or field ID of the Protocol field is 47, it can be determined that it is a legal GRE message to be processed by the present application solution.

[0082] On the contrary, if it is identified that the currently arriving traffic message is not / is not the GRE message to be processed by the solution of this application, it can be discarded.

[0083] Of course, when the present application solution is implemented in a specific application scenario, the traffic message determined to be a GRE message can be directly used as a GRE message to be audited to trigger the GRE message audit processing involved in the present application solution.

[0084] Step S102, if the GRE message to be audited is a data message, the header field encapsulated under the GRE protocol is stripped from the GRE message to be audited, and the length of the message after stripping is recalculated to process the target message containing the new five-tuple information;

[0085] It can be understood that this involves parsing the current GRE message to be audited to separate the target message originally secured by the GRE protocol, and before this parsing, it may also involve determining whether the GRE message to be audited is a data message.

[0086] It can be seen here that the GRE message auditing goal to be achieved by the present application is specifically for GRE messages of data message type. In addition to data message types, GRE messages can also involve control message types. Correspondingly, the present application method can also involve the judgment of whether the current GRE message is a control message type or the judgment processing of the control message type in details.

[0087] Generally speaking, the GRE messages of the control message type are related messages for the control plane, but do not involve related user data and lack relevant audit value. Therefore, they can be ignored in the GRE message audit processing involved in the present application scheme.

[0088] In this regard, as an exemplary embodiment, if the GRE message to be audited is a control message, the method of the present application may further include:

[0089] Block the GRE packets to be audited.

[0090] It can be understood that the blocking processing in the GRE message audit processing involved in the present application scheme here can be direct blocking and giving up further audit processing, or it can be carried out according to the user Internet behavior management strategy involved later (usually directly deployed on the user Internet behavior management device and the list, of course other device nodes are also possible, as long as the data processing involved in user Internet behavior management can be achieved) to perform specific blocking, or make further judgments on whether to block, and block when it is determined that blocking is necessary.

[0091] Under the condition of data message type, the deep analysis and processing of the current GRE message can be specifically processed by the dplane process of the device (a process for executing the GRE message analysis and processing involved in this application). The dplane process can specifically strip off the header field of the current GRE message originally encapsulated by the GRE protocol (corresponding to the original encapsulation processing of the GRE protocol), and recalculate the length of the stripped message to form a new message containing new five-tuple information, and obtain the original message before GRE encapsulation, which is recorded as the target message in this application.

[0092] Step S103, performing user online behavior management on the user corresponding to the target message according to the preset user online behavior management strategy;

[0093] Next, after the target message corresponding to the GRE message is restored through the previous parsing process, the target message can be completely parsed according to the user Internet behavior management policy carried by the device and pre-configured in this application, and the different aspects of user Internet behavior involved can be analyzed to determine whether it exceeds the normal range, whether there are abnormalities, and whether it is dangerous or even offensive, and give adaptive reminders, constraints / restrictions, blocking and other specific behavior management methods.

[0094] It is understandable that the management of user online behavior based on traffic packets is a relatively mature category in the prior art. Therefore, the specific content of user online behavior management here can refer to the prior art.

[0095] Of course, in specific applications, in addition to directly adopting existing technologies, further optimization and improvement can be made on the basis of existing technologies, or even novel self-developed solutions can be adopted to further improve processing efficiency and processing accuracy. In actual situations, this can be adaptively configured according to specific circumstances.

[0096] As an example, you can traverse the Internet behavior management policy table. If the current policy is enabled, you can find out whether the destination IP address for access is in the policy's resource list based on the quintuple information of the target message. If all of the conditions are met, it means that the policy is met and the conditions for releasing the message are met (it does not necessarily mean releasing it directly, and it may also involve other aspects of Internet behavior management, such as Internet access permissions. The overall user Internet behavior management mainly involves two aspects: Internet behavior supervision and Internet access permission control).

[0097] It should be noted that user online behavior management involves specific users. Therefore, the present application may also involve corresponding identification processing of the users involved in the current GRE message / target message.

[0098] In this regard, as an exemplary embodiment, the method of the present application may further include:

[0099] Identify the user corresponding to the target message.

[0100] In the specific user identification process, the identification goal can be achieved through a unique identifier used to identify the user's identity (which can be involved in the specific content of the data message, or it can be carried in the header itself, and is related to the internal data message sending mechanism of the enterprise, typically such as work number, account number, etc.), or, the identification goal can be achieved through information related to the user's identity, such as five-tuple information, device name, etc., which can indirectly identify the user's identity. These are all possible.

[0101] At the same time, the present application may also involve session management, that is, the session factor may be introduced to handle the user online behavior management related to the session, and more user online behavior management may also be carried out with the session unit as the processing unit.

[0102] Correspondingly, as an exemplary embodiment, after the target message containing the new five-tuple information is processed, the method of the present application may further include:

[0103] If the target message has a corresponding session pre-established without a blocking mark, the target message is associated with the corresponding session (if a blocking mark exists, the message can be directly blocked);

[0104] If the target message does not have a corresponding session established in advance, then establish and associate a corresponding session with the target message;

[0105] If the user's online behavior management makes a policy action to block the target message, the target message will be discarded, and a blocking mark will be configured for the corresponding session (corresponding to the setting of whether to block the real-time update of the session. Conversely, there may be a further setting to cancel the blocking mark of the relevant session, corresponding to the situation where a misjudgment is identified and corrected).

[0106] From the embodiments here, it can be seen that the present application for session management may specifically involve session creation and extended applications based on blocking tags, so as to achieve a more delicate and better performance processing effect for the data processing work involved in the session in terms of details.

[0107] In terms of details, the configured session record table can also be used to record relevant information of the session itself, such as message information and user information related to the session, and further, blocking records, user online behavior management results, etc. can also be recorded.

[0108] Step S104, when the target message is released by the user online behavior management, on the one hand, the traffic statistics information of the user corresponding to the target message is updated, and on the other hand, the audit situation related to the target message accessing Internet resources is processed;

[0109] It can be noted that the audit processing of the target message in this application is not carried out directly after obtaining the target message, but the conditions or trigger conditions are determined based on the processing results of the previous user online behavior management to determine whether to proceed with further audit processing.

[0110] Among them, this application specifically updates the traffic statistics information of the user corresponding to the target message and continues to promote the recording of subsequent situations of the user's online behavior management when the previous processing result of the online behavior management is to release the target message. On the other hand, it can involve different aspects of auditing when the target message accesses Internet resources.

[0111] It is understandable that when audit processing is carried out after obtaining the data message, the processing link itself can adopt the existing technology, or use the audit concept / processing of the existing technology. Of course, in the specific application of this application scheme, it can also involve audit means obtained by improving the existing technology, or involve novel self-developed audit means, which can be configured according to the actual situation.

[0112] In the specific audit processing process, this application provides a practical implementation solution based on the specific business type.

[0113] Correspondingly, as an exemplary embodiment, the audit conditions involved in the target message accessing Internet resources collected and recorded here may specifically include at least one of terminal traffic aggregation, terminal traffic analysis, terminal traffic control, web page access filtering, Internet privacy protection, network application control, bandwidth traffic management, information sending and receiving audit (or protocol audit) and user behavior analysis.

[0114] It is easy to understand that the embodiments herein are the types of audit situations or audit processing that may be specifically involved in this application, and provide a supporting solution for implementation, which has better practical value.

[0115] Step S105: restore the target message to the original GRE message to be audited and continue forwarding.

[0116] When the current GRE inner layer message, ie, the target message, is completed, the forwarding work of the original GRE message can be continued, and further processing can be performed in combination with the specific application scenario.

[0117] For example, a notification of audit completion or specific audit results can be sent to the device that forwards the GRE messages for audit processing. If the device is responsible for forwarding the GRE messages to be audited, it can wait for the audit to be completed before continuing to forward the GRE messages to be audited. Otherwise, it can be blocked if there is an abnormality.

[0118] For another example, the target message is restored to the original GRE message to be audited (the corresponding processing program does not save the original GRE message in a series of dynamic processing), and continues to forward it according to the original transmission path and forwarding direction.

[0119] For another example, forwarding may continue according to the original transmission path and forwarding direction (the corresponding processing program preserves the original GRE message in a dynamic series of processing). Otherwise, if an abnormality occurs, the message may be blocked.

[0120] For example, local storage, remote storage, output of audit completion prompts, display of audit content, or further data analysis.

[0121] It is understandable that after completing the audit processing of the current GRE message to be audited, the data processing that can be involved next is relatively flexible and can be processed according to the pre- or real-time configured data processing strategy / rules. This application does not make specific limitations.

[0122] Finally, for the content of the solution shown above, in general, for the audit target of GRE messages, this application provides a set of practical audit processing solutions, and specifically combines user behavior management to more effectively perform in-depth audit processing on GRE messages. In this way, it can meet the internal high-quality audit needs of GRE messages and provide stable and reliable network security protection.

[0123] The above is an introduction to the GRE message auditing method provided by this application. In order to better implement the GRE message auditing method provided by this application, this application also provides a GRE message auditing device from the perspective of functional modules.

[0124] See also Figure 3 , Figure 3 This is a structural diagram of a GRE message auditing device of the present application. In the present application, the GRE message auditing device 300 may specifically include the following structure:

[0125] The acquisition unit 301 is used to acquire the GRE message to be audited, wherein the GRE message to be audited is specifically a data message transmitted through a GRE tunnel under the GRE protocol within the enterprise;

[0126] The processing unit 302 is used for stripping the header field encapsulated under the GRE protocol from the GRE message to be audited if the GRE message to be audited is a data message, and continuing to recalculate based on the message length after stripping, and processing the target message containing the new five-tuple information;

[0127] A management unit 303 is used to carry out user online behavior management for the user corresponding to the target message according to a preset user online behavior management strategy;

[0128] The audit unit 304 is used to update the traffic statistics information of the user corresponding to the target message on the one hand, and process the audit situation related to the target message accessing Internet resources on the other hand, when the user online behavior management releases the target message.

[0129] In an exemplary embodiment, the acquisition unit 301 is specifically configured to:

[0130] Get the currently arriving traffic packets;

[0131] Determine whether the currently arriving traffic packet is a GRE packet;

[0132] If yes, it is determined to be a GRE message to be audited.

[0133] In another exemplary embodiment, the acquiring unit 301 is specifically configured to:

[0134] Determine whether the Protocol field value of the IP layer of the currently arriving traffic message is 47;

[0135] If yes, it is determined that the currently arriving traffic packet is a GRE packet.

[0136] In another exemplary embodiment, the processing unit 302 is further configured to:

[0137] If the GRE message to be audited is a control message, the GRE message to be audited is blocked.

[0138] In another exemplary embodiment, the processing unit 302 is further configured to:

[0139] If a corresponding session without a blocking mark has been established in advance for the target message, the corresponding session is associated with the target message;

[0140] If the target message does not have a corresponding session established in advance, then establish and associate a corresponding session with the target message;

[0141] If the user online behavior management makes a policy action to block the target message, the target message is discarded and a blocking mark is configured for the corresponding session.

[0142] In another exemplary embodiment, the processing unit 302 is further configured to:

[0143] Identify the user corresponding to the target message.

[0144] In another exemplary embodiment, the audit situation specifically includes at least one of terminal traffic aggregation, terminal traffic analysis, terminal traffic control, web page access filtering, Internet privacy protection, network application control, bandwidth traffic management, information sending and receiving auditing, and user behavior analysis.

[0145] This application also provides a processing device from the perspective of hardware structure, see Figure 4 , Figure 4401, a computer program stored in the memory 402, and an input / output device 403. The processor 401 is used to execute the computer program stored in the memory 402. Figure 1 The steps of the GRE message audit method in the corresponding embodiment; or, the processor 401 is used to execute the computer program stored in the memory 402 to implement the following Figure 3 Corresponding to the functions of each unit in the embodiment, the memory 402 is used to store the processor 401 executing the above Figure 1 The computer program required by the GRE message auditing method in the corresponding embodiment.

[0146] Exemplarily, the computer program may be divided into one or more modules / units, one or more modules / units are stored in the memory 402, and executed by the processor 401 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

[0147] The processing device may include, but is not limited to, a processor 401, a memory 402, and an input / output device 403. Those skilled in the art will appreciate that the illustration is merely an example of a processing device and does not constitute a limitation on the processing device, and may include more or fewer components than shown in the illustration, or a combination of certain components, or different components. For example, the processing device may also include a network access device, a bus, etc., and the processor 401, the memory 402, the input / output device 403, etc. are connected via a bus.

[0148] The processor 401 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the processing device, and uses various interfaces and lines to connect various parts of the entire device.

[0149] The memory 402 can be used to store computer programs and / or modules. The processor 401 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 402 and calling the data stored in the memory 402. The memory 402 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the processing device, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0150] When the processor 401 is used to execute the computer program stored in the memory 402, the following functions can be implemented:

[0151] Obtain the GRE message to be audited, wherein the GRE message to be audited is specifically a data message transmitted within the enterprise through a GRE tunnel under the GRE protocol;

[0152] If the GRE message to be audited is a data message, the header field encapsulated under the GRE protocol is stripped from the GRE message to be audited, and the length of the message after stripping is recalculated to process the target message containing the new five-tuple information;

[0153] According to the preset user online behavior management strategy, the user online behavior management is carried out for the user corresponding to the target message;

[0154] When the target message is released by the user online behavior management, on the one hand, the traffic statistics information of the user corresponding to the target message is updated, and on the other hand, the audit situation related to the target message accessing Internet resources is processed.

[0155] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working process of the GRE message audit device, processing device and its corresponding units described above can refer to the following. Figure 1 The description of the GRE message auditing method in the corresponding embodiment will not be repeated here in detail.

[0156] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0157] To this end, the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the present application as follows: Figure 1 For the steps of the GRE message audit method in the corresponding embodiment, the specific operations can be referred to as follows Figure 1 The description of the GRE message auditing method in the corresponding embodiment will not be repeated here.

[0158] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0159] Due to the instructions stored in the computer-readable storage medium, the present application can be executed. Figure 1 The steps of the GRE message audit method in the corresponding embodiment, therefore, the present application can be implemented as follows Figure 1 The beneficial effects that can be achieved by the GRE message auditing method in the corresponding embodiment are detailed in the previous description and will not be repeated here.

[0160] The above is a detailed introduction to the GRE message auditing method, apparatus, processing equipment and computer-readable storage medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the core idea of ​​the present application. At the same time, for technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A GRE message audit method, characterized in that: The method comprises: Acquire a GRE message to be audited, wherein the GRE message to be audited is specifically a data message transmitted within the enterprise through a GRE tunnel under a GRE protocol; If the GRE message to be audited is a data message, the header field encapsulated under the GRE protocol is stripped from the GRE message to be audited, and the length of the message after stripping is recalculated to process the target message containing the new five-tuple information; According to the preset user online behavior management strategy, the user online behavior management is carried out for the user corresponding to the target message; When the user online behavior management allows the target message to pass, on the one hand, the traffic statistics information of the user corresponding to the target message is updated, and on the other hand, the audit situation related to the target message accessing Internet resources is processed.

2. The method according to claim 1, characterized in that The obtaining of the GRE message to be audited includes: Get the currently arriving traffic packets; Determine whether the currently arriving traffic message is a GRE message; If yes, it is determined to be the GRE message to be audited.

3. The method according to claim 2, characterized in that The determining whether the currently arriving traffic message is a GRE message includes: Determine whether the Protocol field value of the IP layer of the currently arriving traffic message is 47; If so, it is determined that the currently arriving traffic message is the GRE message.

4. The method according to claim 1, characterized in that: If the GRE message to be audited is a control message, the method further includes: The GRE message to be audited is blocked.

5. The method according to claim 1, characterized in that: After the target message containing the new five-tuple information is processed, the method further includes: If a corresponding session without a blocking mark has been pre-established for the target message, associating the target message with the corresponding session; If the corresponding session is not pre-established for the target message, establishing and associating the corresponding session for the target message; If the user online behavior management makes a policy action to block the target message, the target message is discarded and the blocking mark is configured for the corresponding session.

6. The method according to claim 1, characterized in that The method further comprises: The user corresponding to the target message is identified.

7. The method according to claim 1, characterized in that The audit situation specifically includes at least one of terminal traffic aggregation, terminal traffic analysis, terminal traffic control, web page access filtering, Internet privacy protection, network application control, bandwidth traffic management, information sending and receiving auditing, and user behavior analysis.

8. A GRE message auditing device, characterized in that: The device comprises: An acquisition unit, configured to acquire a GRE message to be audited, wherein the GRE message to be audited is specifically a data message transmitted within the enterprise through a GRE tunnel under a GRE protocol; A processing unit, configured to, if the GRE message to be audited is a data message, strip the header field encapsulated under the GRE protocol from the GRE message to be audited, and continue to recalculate based on the message length after stripping, and process the target message containing the new five-tuple information; A management unit, configured to carry out user online behavior management for the user corresponding to the target message according to a preset user online behavior management strategy; The audit unit is used to update the traffic statistics information of the user corresponding to the target message on the one hand, and process the audit situation related to the target message accessing Internet resources on the other hand when the user online behavior management releases the target message.

9. A processing device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and the processor executes the method according to any one of claims 1 to 7 when calling the computer program in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 7.

Images