Network filtering method, device, equipment and system

Abstract

The present application discloses a network filtering method, device, system and equipment. The method combines the characteristics of the operating system filter and the NDI S filter to realize hierarchical network filtering using the operating system filter and the NDI S filter at different levels of the network protocol. Through the data packet marking mechanism, the operating system filter and the NDI S filter communicate, and the process identifier and process path of the incoming data packet are passed from the operating system filter to the NDI S filter, so that the NDI S filter can obtain the process context of the network data packet. After the NDI S filter is associated with the process information, it can block the illegal process from abusing the network port, thereby achieving the effect that the network port is only allowed to be used by legal processes. Since this processing method does not require the construction of an IRP request, it does not require additional allocation of memory resources and maintenance of resource status, and it does not need to consider releasing resources at the right time, so it can effectively reduce the implementation complexity and resource consumption.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and specifically to a network filtering method, device and system, and an electronic device. Background Art

[0002] With the rapid development and popularization of computer and network technology, more and more users store data information in computers, including important data related to survival and development. Protecting computer systems from external intrusions and important data from internal leakage is an important part of information security system construction.

[0003] In practical applications, usually only a small number of network ports are opened for necessary data transmission, but hackers and malware often obtain open ports by scanning and use these ports for illegal operations. Traditional network firewalls cannot distinguish network data packets at the process level and cannot block illegal data transmission. Therefore, it is necessary to use a network filter driver module to protect network ports and only allow legitimate processes to use them. At present, a typical network filter driver method is to realize network bottom layer filtering by combining Windows File Protection Program (WFP) and Network Driver Interface Specification (NDIS) filter driver. This method constructs IRP (IO Request Packet) request to send network connection information from WFP to NDIS filter. NDIS filter blocks illegal processes from abusing network ports based on network connection information.

[0004] However, in the process of implementing the present invention, the inventors found that the above technical solution has at least the following problems: the solution is to send the network connection information from WFP to the NDIS filter by constructing an IRP request, which is not only complex to implement but also consumes a lot of resources. In summary, how to reduce the implementation complexity of the network filter driver model and reduce the resources consumed by the network filter driver has become a problem that those skilled in the art need to solve urgently. Summary of the invention

[0005] The present application provides a network filtering system to solve the problems of high complexity and high resource consumption in the prior art. The present application also provides a network filtering method and device, and an electronic device.

[0006] The present application provides a network filtering system, comprising:

[0007] For a data packet flowing out from a network port opened for use by a target process, determining process information of the data packet through an operating system filter;

[0008] The operating system filter transmits the process information to the network driver interface specification NDIS filter through a data packet marking mechanism;

[0009] The NDIS filter filters data packets outside the target process according to the process information.

[0010] Optionally, the operating system filter transmits the process information to a network driver interface specification NDIS filter through a data packet marking mechanism, including:

[0011] The operating system filter encapsulates the process information into a process context structure;

[0012] By means of a data packet marking mechanism, the memory address of the process context structure is associated with the network buffer list structure of the data packet;

[0013] The operating system filter allows the data packet to pass;

[0014] The NDIS filter filters data packets outside the target process according to the process information, including:

[0015] The NDIS filter obtains the memory address from the network buffer list structure;

[0016] According to the memory address, obtaining the process context structure;

[0017] The process information is obtained from the process context structure.

[0018] Optionally, the NDIS filter filters data packets other than the target process according to the process information, including:

[0019] According to the process information, determining whether the data packet is a data packet of the target process;

[0020] If the above judgment result is yes, the NDIS filter releases the data packet;

[0021] If the above judgment result is no, the NDIS filter intercepts the data packet.

[0022] Optionally, the process information includes: a process identifier and a process path.

[0023] Optionally, the target process is a process of a cloud product instance on a cloud product server.

[0024] Optionally, the cloud product includes: a cloud desktop product;

[0025] The NDIS filter filters data packets outside the cloud desktop process according to the process information.

[0026] The present application also provides a network filtering device, comprising:

[0027] a process information determination unit, configured to determine the process information of a data packet flowing out of a network port opened to a target process through an operating system filter;

[0028] The process information transmission unit is used for the operating system filter to transmit the process information to the network driver interface specification NDIS filter through the data packet marking mechanism;

[0029] The data packet filtering unit is used for the NDIS filter to filter data packets outside the target process according to the process information.

[0030] The present application also provides an electronic device, comprising:

[0031] Processor and memory;

[0032] The memory is used to store a program for implementing the above method. The device is powered on and runs the program of the method through the processor.

[0033] The present application also provides a network filtering system, comprising:

[0034] Cloud product clients and cloud product servers;

[0035] The network filtering device is deployed in the cloud product instance on the cloud product server.

[0036] The present application also provides an online behavior management system, including:

[0037] Client and server;

[0038] The server deploys the above network filtering device.

[0039] The present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, and when the computer-readable storage medium is run on a computer, the computer executes the above-mentioned various methods.

[0040] The present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the above-mentioned various methods.

[0041] Compared with the prior art, this application has the following advantages:

[0042] The network filtering method provided in the embodiment of the present application combines the characteristics of the operating system filter (such as WFP) and the NDIS filter to realize hierarchical network filtering using the operating system filter and the NDIS filter at different levels of the network protocol. Through the packet tagging mechanism, the operating system filter and the NDIS filter communicate with each other, and the process identifier and process path of the incoming data packet are passed from the operating system filter to the NDIS filter, so that the NDIS filter can obtain the process context of the network data packet. After the NDIS filter is associated with the process information, it can block the illegal process from abusing the network port, thereby achieving the effect that the network port is only allowed to be used by legal processes. Since this processing method does not require the construction of IRP requests, it does not require additional allocation of memory resources and maintenance of resource status, and there is no need to consider releasing resources at the right time, so it can effectively reduce the implementation complexity and resource consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 Schematic diagram of application scenarios of an embodiment of the network filtering system provided by the present application;

[0044] Figure 2 A schematic diagram of a flow chart of an embodiment of a network filtering method provided in the present application. DETAILED DESCRIPTION

[0045] Many specific details are described in the following description to facilitate a full understanding of the present application. However, the present application can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of the present application, so the present application is not limited by the specific implementation disclosed below.

[0046] In the present application, a network filtering system, method and device, and electronic device are provided. In the following embodiments, various solutions are described in detail one by one.

[0047] In order to explain the network filtering method more intuitively, the following briefly describes the application scenarios of the method. Figure 1, which is a schematic diagram of the application scenario of the embodiment of the network filtering method of the present application. In this embodiment, multiple testers responsible for testing the online banking application system use their respective laptops to test the online banking application system in a remote working mode through the cloud desktop program installed on their laptops. A cloud desktop instance corresponding to each tester is generated on the cloud desktop server, and the tester's laptop transmits data with the cloud desktop instance through the network port opened to the cloud desktop process. The cloud desktop server can first filter the network data packets through the cloud firewall, but the cloud firewall cannot distinguish the network data packets of the process, and the network port opened to the cloud desktop process may be exploited by malicious software. The network filtering device provided by the embodiment of the present application is used in the cloud desktop instance to perform process-based network filtering processing on the network data packets flowing out of the network port of the instance to ensure that the network port is not abused.

[0048] Depend on Figure 1 It can be seen that the network filtering device provided in this embodiment implements hierarchical network filtering using the operating system filter "WFP filter driver" and the NDIS filter "NDIS Filter driver", and passes the process information of the network data packet from the operating system filter to the NDIS filter through the data packet marking mechanism, so that the NDIS filter can obtain the process context of the data packet. If the data packet belongs to the cloud desktop process, the data packet is allowed to pass; if the data packet belongs to other processes (such as malware processes, etc.), the data packet is intercepted.

[0049] It should be noted that the network filtering method provided in the embodiment of the present application is also applicable to cloud desktop services in other application fields, such as cloud desktop services in the e-commerce field. In one example, the staff of the e-commerce platform can perform customer service processing, order inquiry and other operations in a remote working mode through the cloud desktop program installed on their laptops, and use the cloud desktop to process some confidential data and files, ensuring that confidential information does not land on the employees' local computers, thereby meeting the requirements of data security.

[0050] In addition, the network filtering method provided in the embodiment of the present application can also be applied to other application fields besides cloud desktop services, such as Internet behavior management and other fields. In one example, the method is applied in an Internet behavior management system, through which Internet behaviors unrelated to work, such as instant messaging tools, stock trading software, online games, and online audio and video entertainment, can be disabled, and the behavior of sending files through the network can also be intercepted.

[0051] In specific implementation, the Internet behavior management system may include a server and a client. The Internet behavior information of the client user will be sent to the server through the client, and the server deploys the network filtering device provided in the embodiment of the present application, and the network filtering device processes the network data packets from the network port open to the client as follows: determine the process information of the data packet through the operating system filter (such as instant messaging tools, stock trading software, online games, online audio and video entertainment, etc.); the operating system filter transmits the process information to the network driver interface specification NDIS filter through the data packet marking mechanism; the NDIS filter filters the data packets outside the target process according to the process information.

[0052] First embodiment

[0053] Please refer to Figure 2 , which is a flow chart of an embodiment of the network filtering method of the present application. The execution subject of the method includes a network filtering device, which can be deployed in a cloud product instance. In this embodiment, the method may include the following steps:

[0054] Step S201: for a data packet flowing out from a network port opened to a target process, the process information of the data packet is determined through an operating system filter.

[0055] A process is a computer program running on a data set. It is the basic unit for resource allocation and scheduling in the system and the foundation of the operating system structure. The target process can be a certain process, including but not limited to: the process of the cloud product instance on the cloud product server (referred to as the cloud product process), or the program process on other devices (such as e-commerce platform servers, etc.).

[0056] The cloud product server, including the server of the cloud computing platform, can provide cloud product services to enterprise users or individual users. The cloud product can be a cloud terminal product provided by a public cloud computing platform or a private cloud computing platform. The cloud computing platform is a dynamic, easily scalable, and usually virtualized resource computing platform provided through the Internet. Users do not need to understand the details of the cloud, nor do they need to have professional knowledge of the cloud or directly control the infrastructure. The cloud computing platform can provide a variety of cloud products with rich and diverse functional infrastructure (IaaS), such as cloud host products, cloud database products, load balancing products, content distribution products, big data products, algorithm products, etc., providing basic information technology (IT) services, intelligent big data data processing and algorithm analysis services.

[0057] In one example, the target process is: the process of the cloud desktop instance on the cloud desktop server. For example, the target process is the process of the cloud desktop product used to perform the test of the MyBank. Multiple testers use their own laptops to perform remote work using the cloud desktop instances corresponding to each tester on the cloud desktop server through the cloud desktop product program installed on the laptops. Assuming there are 10 testers, there are 10 cloud desktop instances. These 10 cloud desktop instances use their own network ports for data transmission. A network filtering device can be deployed in each cloud desktop instance, which performs network filtering on the data packets flowing out of the corresponding network port.

[0058] In another example, the target process is a process of a virtual machine on a cloud server. Different virtual machines correspond to different network ports and perform network filtering processing through different network filtering devices.

[0059] The network filtering device determines the process information of the data packet through the operating system filter. The operating system filter can distinguish data packets of different processes, including but not limited to: an operating system filter based on the Windows operating system filtering platform WFP, or an operating system filter constructed based on other network filter drivers on the Windows operating system, such as WFP can be replaced by TDI network filter driver. Among them, WFP is a framework for operating TCP / IP network protocol stack data packets provided on the Windows operating system, which is easy to use.

[0060] The process information includes, but is not limited to, process identification and process path information. The process information can be read from the data packet through the operating system filter, such as the information of the TCP / IP network protocol stack data packet including: protocol name (protocol), sending and receiving direction (director), source IP address (source ip address), source port (sourceport), destination IP address (destination ip address), destination port (destination port), process identification (process id), process image file path (process image file path), etc., wherein the source IP address, source port, destination IP address, destination port, etc. belong to the process path information.

[0061] After the process information of the data packet is determined by the operating system filter, the next step may be entered to transmit the process information to the network driver interface specification NDIS filter through a data packet marking mechanism.

[0062] Step S203: the operating system filter transmits the process information to the network driver interface specification NDIS filter through a data packet marking mechanism.

[0063] The method provided in the embodiment of the present application enables the operating system filter and the NDIS filter to communicate through the packet tagging mechanism, and transmits information such as the process identifier and process path of the incoming data packet from the operating system filter to the NDIS filter. The prior art is to construct an IRP request to make the NDIS filter associate the process information of the data packet. This processing method requires additional allocation of memory resources, maintenance of resource status, and release of resources at the appropriate time, so the implementation complexity and resource consumption are both high.

[0064] In one example, step S203 may include the following sub-steps: 1) the operating system filter encapsulates the process information into a process context structure (Context structure); 2) through a packet tagging mechanism, the memory address of the Context structure is marked as a tag in the packet, such as in a network buffer list structure (such as a NET_BUFFER_LIST structure) associated with the packet; 3) the operating system filter releases the packet.

[0065] During specific implementation, the operating system filter may also pre-register TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) filter functions to intercept IP access operations.

[0066] Step S205: The NDIS filter filters data packets other than the target process according to the process information.

[0067] The NDIS filter can determine whether the data packet is a data packet of the target process according to the process information; if the determination result is yes, the NDIS filter releases the data packet; if the determination result is no, the NDIS filter intercepts the data packet.

[0068] Correspondingly, step S205 may include the following sub-steps: 1) the NDIS filter obtains the memory address from the label of the data packet, such as reading the memory address in the network buffer list structure; 2) according to the memory address, obtains the process context structure; 3) obtains the process information from the process context structure.

[0069] In specific implementation, the NDIS filter can match the information such as protocol name, source / destination IP address, source / destination port, sending / receiving direction, process identifier, process path, etc. obtained from the process context structure with the network filtering rule, and the matching result can be no matching rule, release or block, and the NDIS filter releases or blocks the data packet according to the matching result. The network filtering rule matching belongs to the relatively mature existing technology and will not be described here.

[0070] As can be seen from the above embodiments, the network filtering method provided by the embodiments of the present application combines the characteristics of the operating system filter (such as WFP) and the NDIS filter to realize hierarchical network filtering using the operating system filter and the NDIS filter at different levels of the network protocol. Through the packet tagging mechanism, the operating system filter and the NDIS filter communicate with each other, and the process identifier and process path of the incoming data packet and other information are passed from the operating system filter to the NDIS filter, so that the NDIS filter can obtain the process context of the network data packet. After the NDIS filter is associated with the process information, it can block the illegal process from abusing the network port, thereby achieving the effect that the network port is only allowed to be used by legal processes. Since this processing method does not require the construction of an IRP request, it does not require additional allocation of memory resources and maintenance of resource status, and there is no need to consider releasing resources at the right time, so it can effectively reduce the implementation complexity and resource consumption.

[0071] Second embodiment

[0072] In the above-mentioned embodiment, a network filtering method is provided, and correspondingly, the present application also provides a network filtering device. The device corresponds to the embodiment of the above-mentioned method. Since the device embodiment is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the system embodiment. The device embodiment described below is only illustrative.

[0073] The present application further provides a network filtering device, comprising:

[0074] a process information determination unit, configured to determine the process information of a data packet flowing out of a network port opened to a target process through an operating system filter;

[0075] The process information transmission unit is used for the operating system filter to transmit the process information to the network driver interface specification NDIS filter through the data packet marking mechanism;

[0076] The data packet filtering unit is used for the NDIS filter to filter data packets outside the target process according to the process information.

[0077] Third embodiment

[0078] In the above-mentioned embodiment, a network filtering method is provided, and correspondingly, the present application also provides an electronic device. The device corresponds to the embodiment of the above-mentioned method. Since the device embodiment is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the system embodiment. The device embodiment described below is only illustrative.

[0079] The present application further provides an electronic device, including:

[0080] Processor and memory;

[0081] The memory is used to store a program for implementing the network filtering method. The device is powered on and the program of the method is run by the processor.

[0082] Fourth embodiment

[0083] In the above-mentioned embodiment, a network filtering method is provided, and correspondingly, the present application also provides a network filtering system. The system corresponds to the embodiment of the above-mentioned method. Since the system embodiment is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The system embodiment described below is only illustrative.

[0084] A network filtering system of this embodiment includes: a cloud product client and a cloud product server, wherein a network filtering device is deployed in a cloud product instance on the cloud product server.

[0085] In this embodiment, multiple testers responsible for testing the online banking application system use their own laptops to test the online banking application system in a remote working mode through the cloud desktop program (cloud product client) installed on their laptops. A cloud desktop instance corresponding to each tester is generated on the cloud desktop server (cloud product server), and the tester's laptop transmits data with the cloud desktop instance through the network port opened to the cloud desktop process. The cloud desktop server can first filter the network data packets through the cloud firewall, but the cloud firewall cannot distinguish the network data packets of the process, and the network port opened to the cloud desktop process may be used by malicious software. The network filtering device provided in the embodiment of the present application is used in the cloud desktop instance to perform process-based network filtering on the network data packets flowing out of the network port of the instance to ensure that the network port is not abused.

[0086] As can be seen from the above embodiments, the network filtering system provided by the embodiments of the present application combines the characteristics of the operating system filter (such as WFP) and the NDIS filter to realize hierarchical network filtering using the operating system filter and the NDIS filter at different levels of the network protocol. Through the packet tagging mechanism, the operating system filter and the NDIS filter communicate with each other, and the process identifier and process path of the incoming data packet and other information are passed from the operating system filter to the NDIS filter, so that the NDIS filter can obtain the process context of the network data packet. After the NDIS filter is associated with the process information, it can block the illegal process from abusing the network port, thereby achieving the effect that the network port is only allowed to be used by legal processes. Since this processing method does not require the construction of IRP requests, it does not require additional allocation of memory resources and maintenance of resource status, and there is no need to consider releasing resources at the right time, so it can effectively reduce the implementation complexity and resource consumption.

[0087] Fifth embodiment

[0088] In the above-mentioned embodiment, a network filtering method is provided. Correspondingly, the present application also provides an online behavior management system. The system corresponds to the embodiment of the above-mentioned method. Since the system embodiment is basically similar to the method embodiment, the description is relatively simple. For the relevant parts, please refer to the partial description of the method embodiment. The system embodiment described below is only illustrative.

[0089] A surfing behavior management system of this embodiment includes: a client and a server, wherein a network filtering device is deployed in the server.

[0090] The online behavior management system can be used to disable online behaviors unrelated to work, such as instant messaging tools, stock trading software, online games, online audio and video entertainment, and can also intercept the behavior of sending files through the network.

[0091] In this embodiment, the client user's online behavior information will be sent to the server through the client. The server deploys the network filtering device provided in the embodiment of the present application. The network filtering device processes the network data packets from the network port open to the client as follows: the process information of the data packet is determined through the operating system filter (such as instant messaging tools, stock trading software, online games, online audio and video entertainment, etc.); the operating system filter transmits the process information to the network driver interface specification NDIS filter through the data packet marking mechanism; the NDIS filter filters data packets other than the target process based on the process information.

[0092] As can be seen from the above embodiments, the Internet behavior management system provided by the embodiment of the present application combines the characteristics of the operating system filter (such as WFP) and the NDIS filter to realize hierarchical network filtering using the operating system filter and the NDIS filter at different levels of the network protocol. Through the packet tagging mechanism, the operating system filter and the NDIS filter communicate with each other, and the process identifier and process path of the incoming data packet are passed from the operating system filter to the NDIS filter, so that the NDIS filter can obtain the process context of the network data packet. After the NDIS filter is associated with the process information, it can block the illegal process from abusing the network port, thereby achieving the effect that the network port is only allowed to be used by legal processes. Since this processing method does not require the construction of an IRP request, it does not require additional allocation of memory resources and maintenance of resource status, and there is no need to consider releasing resources at the right time, so it can effectively reduce the implementation complexity and resource consumption.

[0093] Although the present application is disclosed as above in the form of a preferred embodiment, it is not intended to limit the present application. Any technical personnel in this field may make possible changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be based on the scope defined by the claims of the present application.

[0094] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0095] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0096] 1. Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include non-transitory media such as modulated data signals and carrier waves.

[0097] 2. Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems or computer program products. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

Claims

1. A network filtering method, characterized in that: include: For a data packet flowing out from a network port opened for use by a target process, determining process information of the data packet through an operating system filter; The operating system filter encapsulates the process information into a process context structure; through a data packet marking mechanism, the memory address of the process context structure is associated with the network buffer list structure of the data packet; the operating system filter releases the data packet and transmits the process information to a network driver interface specification NDIS filter; The NDIS filter obtains the memory address from the network buffer list structure; obtains the process context structure according to the memory address; obtains the process information from the process context structure; and filters data packets other than the target process according to the process information.

2. The method according to claim 1, characterized in that The NDIS filter filters data packets outside the target process according to the process information, including: According to the process information, determining whether the data packet is a data packet of the target process; If the above judgment result is yes, the NDIS filter releases the data packet; If the above judgment result is no, the NDIS filter intercepts the data packet.

3. The method according to claim 1, characterized in that The process information includes: a process identifier and a process path.

4. The method according to claim 1, characterized in that: The target process is a process of a cloud product instance on a cloud product server.

5. The method according to claim 4, characterized in that The cloud products include: cloud desktop products; The NDIS filter filters data packets outside the cloud desktop process according to the process information.

6. A network filtering device, characterized in that: include: a process information determination unit, configured to determine the process information of a data packet flowing out of a network port opened to a target process through an operating system filter; The process information transmission unit is used for the operating system filter to encapsulate the process information into a process context structure; through a data packet marking mechanism, the memory address of the process context structure is associated with the network buffer list structure of the data packet; the operating system filter releases the data packet and transmits the process information to the network driver interface specification NDIS filter; A data packet filtering unit is used for the NDIS filter to obtain the memory address from the network buffer list structure; obtain the process context structure according to the memory address; obtain the process information from the process context structure; and filter data packets other than the target process according to the process information.

7. An electronic device, characterized in that: include: Processor and memory; A memory for storing a program for implementing the method according to any one of claims 1 to 5, wherein the device is powered on and runs the program of the method through the processor.

8. A network filtering system, characterized in that: include: Cloud product clients and cloud product servers; The network filtering device according to claim 6 is deployed in the cloud product instance on the cloud product server.

9. A surfing behavior management system, characterized in that: include: Client and server; The server deploys the network filtering device according to claim 6.

Images