Data processing method, device, equipment, and computer-readable storage medium

Abstract

The present application discloses a data processing method, device, equipment, and computer-readable storage medium, wherein the method includes: receiving session information sent by a visiting device, wherein the session information includes: session request information or handshake information; determining the target domain name information and target IP address information of the visited device based on the session information; querying the accessible domain name library, and if the accessible domain name library does not contain the target domain name information, querying the interception domain name library, and if the interception domain name library contains the target domain name information, intercepting the session information. In the DOH scenario, it can improve the efficiency of intercepting bad information.

Description

Technical Field

[0001] The present application belongs to the field of Internet technology, and in particular, relates to a data processing method, device, equipment, and computer-readable storage medium. Background Art

[0002] The content on the Internet is complex and mixed, and children may accidentally visit some bad websites. If they are exposed to such websites for a long time, it is easy to have a negative impact on their growth. In addition, there are also websites related to games and entertainment, which children can easily become addicted to.

[0003] Currently, a specific website or a certain type of website can be blocked according to the settings of the router by the parents, which can protect children from negative content while allowing them to access positive and healthy content while surfing the Internet. In related technologies, before the browser visits a website each time, the router can obtain the specific IP address corresponding to the domain name of the visited website through the interaction of DNS messages, and establish interception rules based on this information to implement targeted blocking for specific websites.

[0004] However, most browsers have introduced DOH to protect users' online privacy. When DOH is turned on, DNS interaction messages will be loaded into Https. Https is a ciphertext interaction, and it is impossible to parse the specific content of the DNS message interaction, and it is also impossible to obtain the website and IP that the user is visiting. Therefore, the DOH function will cause the existing parental control function to fail, and it will be impossible to parse the traffic interaction process, and it will be impossible to control children's online behavior, which will make the shielding of dangerous or bad websites ineffective, and the efficiency of intercepting bad information is poor. Summary of the invention

[0005] The embodiment of the present application provides an implementation solution different from the prior art to solve the technical problem of poor efficiency in intercepting bad information in a DOH scenario.

[0006] In a first aspect, the present application provides a data processing method, comprising:

[0007] Receiving session information sent by a visiting device, the session information including: session request information or handshake information;

[0008] Determine the target domain name information and the target IP address information of the accessed device based on the session information;

[0009] The accessible domain name library is queried. If the accessible domain name library does not contain the target domain name information, the interception domain name library is queried. If the interception domain name library contains the target domain name information, the session information is intercepted.

[0010] In a second aspect, the present application provides a data processing device, including:

[0011] A receiving module, used for receiving session information sent by a visiting device, wherein the session information includes: session request information or handshake information;

[0012] A determination module, configured to determine target domain name information and target IP address information of a corresponding visited device based on the session information;

[0013] The interception module is used to query the accessible domain name library. If the accessible domain name library does not contain the target domain name information, the interception domain name library is queried. If the interception domain name library contains the target domain name information, the session information is intercepted.

[0014] In a third aspect, the present application provides an electronic device, including:

[0015] Processor; and

[0016] A memory, configured to store executable instructions of the processor;

[0017] The processor is configured to execute the method described in any one of the first aspect or any possible implementation manners of the first aspect by executing the executable instructions.

[0018] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method described in the first aspect or any of the possible implementations of the first aspect is implemented.

[0019] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the method described in the first aspect or any possible implementation manner of the first aspect.

[0020] The data processing method provided by the present application receives session information sent by a visiting party device, wherein the session information includes: session request information or handshake information; determines the target domain name information and target IP address information of the visited party device based on the session information; queries an accessible domain name library, and if the accessible domain name library does not contain the target domain name information, queries an interception domain name library, and if the interception domain name library contains the target domain name information, a scheme for intercepting the session information can enable, in a DOH scenario, after the visiting party and the visited party actually establish a session, to intercept bad information according to the session information, thereby ensuring the privacy security of the user, and intercepting bad information, thereby improving the efficiency of intercepting bad information in the DOH scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0022] Figure 1a A flowchart of a data processing method provided in one embodiment of the present application;

[0023] Figure 1b A scenario diagram of a method for obtaining target domain name information and target IP address information provided in an embodiment of the present application;

[0024] Figure 1c A schematic diagram of a storage method of an accessible domain name library provided in an embodiment of the present application;

[0025] Figure 1d A flowchart of a data processing method provided in one embodiment of the present application;

[0026] Figure 2 A schematic diagram of the structure of a data processing device provided in one embodiment of the present application;

[0027] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, but cannot be understood as limiting the present application.

[0029] The terms "first" and "second" etc. in the specification, claims and drawings of the embodiments of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein, for example. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, the process, method, system, product or equipment comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0030] First, some terms in the embodiments of the present application are explained below to facilitate understanding by those skilled in the art.

[0031] DNS: Domain Name Server, domain name resolution server, domain name resolution is a service that points the domain name to the website space IP, so that people can easily access the website through the registered domain name. The IP address is a digital address that identifies the site on the Internet. In order to facilitate memory, the domain name is used instead of the IP address to identify the site address. Domain name resolution is the process of converting the domain name to the IP address. The resolution of the domain name is completed by the DNS server. Domain name resolution is also called domain name pointing, server setting, domain name configuration, and reverse IP registration, etc. The DNS server resolves the easy-to-remember domain name into an IP address, and then binds a subdirectory to the domain name on the host of this IP address. The address on the Internet is a digital IP address, and the main purpose of domain name resolution is to facilitate memory.

[0032] The DoH protocol is DNS Over HTTPS, which can protect user privacy by sending data in an encrypted manner when performing DNS queries.

[0033] HTTP, Hypertext Transfer Protocol, is designed to ensure communication between clients and servers. HTTP works as a request-response protocol between clients and servers. A web browser may be a client, while a network application on a computer may also be a server. For example: a client (browser) submits an HTTP request to a server; the server returns a response to the client. The response contains information about the status of the request and the content that may have been requested.

[0034] GET and POST: Two HTTP request methods:

[0035] When performing request-response between clients and servers, the two most commonly used methods are: GET and POST. GET refers to requesting data from a specified resource, and POST refers to submitting data to be processed by a specified resource.

[0036] The handshake protocol refers to a type of network protocol that is mainly used to allow the client and server to confirm each other's identities.

[0037] The inventor found through research that with the popularization of the Internet, most families can use the Internet to search and browse the content they are interested in, including underage children. However, the content on the Internet is complex and mixed, and children may inadvertently visit some bad websites. If they are exposed to such websites for a long time, it is easy to have a negative impact on the growth of children. In addition, there are websites related to games and entertainment. If the child's self-control is not strong, it is easy to indulge in them. Therefore, it is necessary to screen the websites browsed by children, control their online behavior, reduce children's exposure to bad websites, and avoid excessive online use.

[0038] Many routers on the market currently support parental control functions, that is, parents can selectively block a specific website or a certain type of website for their children. This function can protect children from negative content while allowing them to access positive and healthy content while surfing the Internet. Specifically, before the browser visits a website each time, the router can obtain the specific IP address corresponding to the domain name of the visited website through the interaction of DNS messages. This stage is carried out before the actual browsing of the Internet, that is, before the relevant HTTP and HTTPS related messages are generated, the user's Internet behavior is parsed, and the website is blocked before the HTTPS and HTTP sessions are started. And the DNS interaction process is in plain text, so the parental control module can obtain the domain name and IP of the website that the user is visiting by parsing the DNS interaction message, and establish interception rules based on this information to implement fixed-point blocking for specific websites.

[0039] The basic logic of the parental control function is to intercept Internet data packets, parse the interaction process of the traffic to know the website that the child is about to visit, and then determine whether the website needs to be intercepted, and perform subsequent processing on the traffic based on the results. However, most browsers now have launched the DOH function in order to protect the user's Internet privacy. After it is turned on, the DNS interaction message will be loaded into Https. Https is a ciphertext interaction, and it is impossible to parse the specific content of the DNS message interaction, and it is also impossible to obtain the website and IP that the user is visiting. Therefore, the DOH function will cause the existing parental control function to fail, and it will be impossible to parse the interaction process of the traffic, and it will be impossible to control the child's Internet behavior. In this case, although it helps to protect the user's personal information security, it will make the shielding of dangerous or bad websites ineffective, and the efficiency of intercepting bad information is poor.

[0040] The present application provides a method for intercepting DNS Over Https traffic to ensure that even if the user uses the DOH function, the traffic can be normally screened and filtered, so that in the DOH scenario, after the visitor and the visited party actually establish a session, bad information can be intercepted according to the session information, which not only ensures the privacy security of the user, but also can intercept bad information, thereby improving the efficiency of intercepting bad information in the DOH scenario.

[0041] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0042] FIG1 is a flow chart of a data processing method provided by an exemplary embodiment of the present application. The method may be applicable to a routing device (such as a router). The method may at least include the following steps:

[0043] S101, receiving session information sent by a visiting device, wherein the session information includes: session request information or handshake information;

[0044] S102, determining the target domain name information and the target IP address information of the accessed device based on the session information;

[0045] S103: querying the accessible domain name library. If the accessible domain name library does not contain the target domain name information, querying the intercepted domain name library. If the intercepted domain name library contains the target domain name information, intercepting the session information.

[0046] Specifically, the aforementioned access device may be an electronic device used by a user to browse webpage content, such as a PC or a mobile phone.

[0047] Further, the aforementioned target IP address information is the IP address of the visited device, and the aforementioned target domain name information is the domain name information of the visited device; further, see Figure 1b As shown, since the DNS interaction process has been completed when establishing HTTPS and HTTP sessions, that is, the accessing device sends a domain name resolution request to the router, the router sends the domain name resolution request to the DNS server, and the DNS server responds to the domain name resolution request and obtains the corresponding IP address information. Therefore, the aforementioned target IP address information can be determined based on the IP field of the message header in the session information; the target domain name information can be determined based on the Host field of the HTTP Get message (i.e., the session request information), or the extended field of the HTTPS handshake message (i.e., the handshake information).

[0048] Furthermore, the aforementioned accessible domain name library can be a domain name library consisting of domain name information corresponding to the visited device that is allowed to be accessed by the visiting device in advance. The accessible domain name library can be set by the administrator according to the needs of most users, and the specific setting quantity and setting method are not limited in this application.

[0049] Furthermore, the aforementioned interception domain name library can be set by the user. Based on this, the method further includes:

[0050] S01, obtaining an update instruction for the interception domain name library sent by a management device;

[0051] S02. Update the interception domain name library based on the update instruction.

[0052] Specifically, the update instruction includes any one or more of the following:

[0053] A deletion instruction for the first domain name information in the intercepted domain name library, a new addition instruction for the second domain name information in the intercepted domain name library, and a modification instruction for the third domain name information in the intercepted domain name library.

[0054] Specifically, the aforementioned management device may be a device for users to update the interception domain name library. The user may update the interception domain name library through the client or setting page corresponding to the interception domain name library on the management device side.

[0055] Furthermore, if the accessible domain name library contains the target domain name information, it is not intercepted.

[0056] Furthermore, since repeated HTTP Get and HTTPS handshake messages are generated when the accessing device accesses the same website, if the accessible domain name library does not store domain name information that is not included in the intercepted domain name library, when the accessing device accesses the website corresponding to the same domain name information multiple times, it is necessary to determine multiple times whether the domain name information is included in the intercepted domain name library and determine not to intercept, which wastes router resources. Based on this, the above method also includes: after querying the intercepted domain name library, if the intercepted domain name library does not contain the target domain name information, the session information is not intercepted, and the target domain name information is added to the accessible domain name library.

[0057] Furthermore, in order to ensure the efficiency of the query, the method further includes:

[0058] Obtaining the total number of domain name information in the accessible domain name database;

[0059] If the total number is greater than a preset threshold, the oldest historical domain name information stored in the accessible domain name database is deleted. Specifically, the number of deleted historical domain name information is not limited in this application.

[0060] Specifically, a hash table can be used to record the accessible domain name information in the accessible domain name library. In addition, since the storage space of the router is limited, an LRU algorithm (Least Recently Used) can be used to record only the most recent accessible domain name information.

[0061] Specifically, see Figure 1c As shown, Figure 1cA schematic diagram of the storage method of the accessible domain name library provided for the present application, in which three accessible domain name information are stored in the accessible domain name library, and the accessible domain name library can adopt a hash + bidirectional linked list structure, in which the bidirectional linked list adopts an LRU algorithm for management. This structure takes into account both query efficiency and storage space. The Data node stores the filtering records of a user visiting a website (such as accessible domain name information). The Key value of the hash table is generated by hashing the website domain name, and the Value is the address of the Data node. In addition, the Data nodes are connected through a bidirectional linked list. Frequently visited domain names are arranged in the head area (Head) of the linked list, and those that are rarely visited are arranged in the tail (Tail) of the linked list. When searching or adding records, the hit or newly generated entries are stored in the head area; when the accessible domain name information recorded exceeds the set upper limit of the number of domain names, the records at the tail are deleted.

[0062] Furthermore, when the routing device obtains the update instruction sent by the management device for the interception domain name library, it can determine the domain name information to be updated and the update indication according to the update instruction; wherein, when the update indication is a new addition indication, the domain name information to be updated is added to the interception domain name library, and when the update indication is a modification indication, the domain name information to be modified in the interception domain name library is modified to the modified domain name information according to the domain name information to be modified and the modified domain name information in the domain name information to be updated; further, when the update indication is a deletion indication, the domain name information to be updated in the interception domain name library is deleted.

[0063] Furthermore, the aforementioned update instruction may also be update information for domain name type information, and the domain name type information may correspond to multiple domain name information.

[0064] Furthermore, the method of the present application may also include:

[0065] It is detected whether the accessible domain name library contains duplicate domain name information stored in the intercepted domain name library. If so, the duplicate domain name information in the accessible domain name library is deleted.

[0066] Furthermore, the management of the accessible domain name library, intercepted domain name library, and IP address interception library by the router can be based on the / proc file system to implement the operations on the accessible domain name library, intercepted domain name library, and IP address interception library. For example, the duplicate domain name information in the accessible domain name library can be deleted through the / proc file system.

[0067] Furthermore, the target IP address information can be directly determined according to the session information, and the above method further includes:

[0068] Detect whether there is an IP address interception library. If so, query whether the target IP address information is stored in the IP address interception library. If so, intercept the session information. If not, trigger the step of querying the accessible domain name library.

[0069] Specifically, the target IP address information is not stored in the IP address interception library, the target domain name information is included in the interception domain name library, and after intercepting the session information, the method further includes:

[0070] The target IP address information is added to the IP address interception library.

[0071] Furthermore, if the intercepted domain name library does not contain the target domain name information, the target domain name information is added to the accessible domain name library.

[0072] Furthermore, the method can also set different accessible domain name libraries, intercepted domain name libraries, and IP address interception libraries for different access party devices; for example, different access party devices may correspond to any one or more of the following libraries: accessible domain name libraries, intercepted domain name libraries, and IP address interception libraries.

[0073] Specifically, the aforementioned accessible domain name library, intercepted domain name library, and IP address interception library may constitute a determination group; different access party devices may also correspond to different determination groups. Accordingly, before querying the accessible domain name library, the above also includes:

[0074] Obtaining a query identifier of the accessing device;

[0075] Determine the corresponding judgment group according to the query identifier;

[0076] The accessible domain name library, intercepted domain name library, and IP address interception library are obtained from the determination group.

[0077] Optionally, the query identifier may be a MAC address of the accessing device;

[0078] Further, determining the corresponding determination group according to the query identifier includes:

[0079] Obtaining a query identifier of the accessing device;

[0080] Determine the user information corresponding to the query identifier according to the first correspondence table;

[0081] The determination group corresponding to the user information is determined according to the user information and the second correspondence table.

[0082] Specifically, the aforementioned first correspondence table may include multiple query identifiers and their respective corresponding user information; the second correspondence table may include multiple user information and their respective corresponding determination groups.

[0083] Optionally, the first correspondence table and the second correspondence table can be set by the user through a management device.

[0084] This application also provides a specific embodiment to further illustrate the solution of this application:

[0085] Specifically, see Figure 1d As shown, the method of this embodiment can be applied to a router, and can specifically include the following steps:

[0086] Obtain session information A (HTTP get or HTTPS handshake message) from the accessing device; obtain domain name a and IP address b from session information A;

[0087] Check whether b is stored in the IP address interception library. If so, intercept session information A. If not, check whether a is stored in the accessible domain name library. If so, do not intercept session information A and send session information A to the visited device. If not, check whether a is stored in the interception domain name library. If so, intercept session information A and add b to the IP address interception library. If not, do not intercept session information A and send session information A to the visited device and add a to the accessible domain name library.

[0088] Furthermore, the interception domain name library may be updated accordingly according to the user's operation on the interception domain name library. For details, please refer to the above-mentioned embodiment, which will not be described again here.

[0089] Furthermore, the aforementioned IP address interception library, accessible domain name library, and interception domain name library can all be / proc file systems, and this application does not impose any limitation on this.

[0090] The data processing method provided by the present application receives session information sent by a visiting party device, wherein the session information includes: session request information or handshake information; determines the target domain name information and target IP address information of the visited party device based on the session information; queries an accessible domain name library, and if the accessible domain name library does not contain the target domain name information, queries an interception domain name library, and if the interception domain name library contains the target domain name information, a scheme for intercepting the session information can enable, in a DOH scenario, after the visiting party and the visited party actually establish a session, to intercept bad information according to the session information, thereby ensuring the privacy security of the user, and intercepting bad information, thereby improving the efficiency of intercepting bad information in the DOH scenario.

[0091] Figure 2 A schematic diagram of a data processing device provided as an exemplary embodiment of the present application, the device at least comprising:

[0092] The receiving module 21 is used to receive session information sent by the visiting device, wherein the session information includes: session request information or handshake information;

[0093] A determination module 22, configured to determine target domain name information and target IP address information of a corresponding visited device based on the session information;

[0094] The interception module 23 is used to query the accessible domain name library. If the accessible domain name library does not contain the target domain name information, the interception domain name library is queried. If the interception domain name library contains the target domain name information, the session information is intercepted.

[0095] The interception module 23 may be a parental control module with a control function.

[0096] Optionally, the device is also used for:

[0097] Obtaining an update instruction for the interception domain name library sent by a management device;

[0098] The interception domain name library is updated based on the update instruction.

[0099] Optionally, the update instruction includes any one or more of the following:

[0100] A deletion instruction for the first domain name information in the intercepted domain name library, a new addition instruction for the second domain name information in the intercepted domain name library, and a modification instruction for the third domain name information in the intercepted domain name library.

[0101] Optionally, the device is also used for:

[0102] Detect whether there is an IP address interception library. If so, query whether the target IP address information is stored in the IP address interception library. If so, intercept the session information. If not, trigger the step of querying the accessible domain name library.

[0103] Optionally, the target IP address information is not stored in the IP address interception library, the target domain name information is included in the interception domain name library, and after intercepting the session information, the device is further used to:

[0104] The target IP address information is added to the IP address interception library.

[0105] Optionally, if the intercepted domain name library does not contain the target domain name information, the device is further configured to add the target domain name information to the accessible domain name library.

[0106] Optionally, the device is further used to: obtain the total amount of domain name information in the accessible domain name library;

[0107] If the total number is greater than a preset threshold, the historical domain name information with the earliest storage time in the accessible domain name library is deleted.

[0108] It should be understood that the device embodiment and the method embodiment may correspond to each other, and similar descriptions may refer to the method embodiment. To avoid repetition, no further description is given here. Specifically, the device may perform the above method embodiment, and the above and other operations and / or functions of each module in the device are the corresponding processes in each method in the above method embodiment, respectively, and no further description is given here for the sake of brevity.

[0109] The above describes the device of the embodiment of the present application from the perspective of the functional module in conjunction with the accompanying drawings. It should be understood that the functional module can be implemented in hardware form, can be implemented by instructions in software form, and can also be implemented by a combination of hardware and software modules. Specifically, the steps of the method embodiment in the embodiment of the present application can be completed by the hardware integrated logic circuit and / or software form instructions in the processor, and the steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or a combination of hardware and software modules in the decoding processor to perform. Optionally, the software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory, and completes the steps in the above method embodiment in conjunction with its hardware.

[0110] Figure 3 is a schematic block diagram of an electronic device provided in an embodiment of the present application, and the electronic device may include:

[0111] The memory 301 and the processor 302, the memory 301 is used to store the computer program and transmit the program code to the processor 302. In other words, the processor 302 can call and run the computer program from the memory 301 to implement the method in the embodiment of the present application.

[0112] For example, the processor 302 may be configured to execute the above method embodiments according to instructions in the computer program.

[0113] In some embodiments of the present application, the processor 302 may include but is not limited to:

[0114] General-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc.

[0115] In some embodiments of the present application, the memory 301 includes but is not limited to:

[0116] Volatile memory and / or non-volatile memory. Among them, the non-volatile memory can be read-only memory (ROM), programmable ROM (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM) or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus random access memory (DR RAM).

[0117] In some embodiments of the present application, the computer program may be divided into one or more modules, which are stored in the memory 301 and executed by the processor 302 to complete the method provided by the present application. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the electronic device.

[0118] like Figure 3 As shown, the electronic device may also include:

[0119] The transceiver 303 may be connected to the processor 302 or the memory 301 .

[0120] The processor 302 may control the transceiver 303 to communicate with other devices, specifically, to send information or data to other devices, or to receive information or data sent by other devices. The transceiver 303 may include a transmitter and a receiver. The transceiver 303 may further include an antenna, and the number of antennas may be one or more.

[0121] It should be understood that the various components in the electronic device are connected via a bus system, wherein the bus system includes not only a data bus but also a power bus, a control bus and a status signal bus.

[0122] The present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a computer, the computer can perform the method of the above method embodiment. In other words, the present application embodiment also provides a computer program product containing instructions, and when the instructions are executed by a computer, the computer can perform the method of the above method embodiment.

[0123] When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disc (digital video disc, DVD)), or a semiconductor medium (e.g., a solid state drive (solid state disk, SSD)), etc.

[0124] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0125] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the module is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0126] The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. For example, each functional module in each embodiment of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0127] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A data processing method, characterized in that: include: Receiving session information sent by a visiting device, the session information including: session request information or handshake information; Determine the target domain name information and target IP address information of the accessed device based on the session information, wherein the target IP address information is determined according to the IP field of the message header in the session information, and the target domain name information is determined according to the Host field of the HTTP Get message or the extended field of the HTTPS handshake message, the HTTP Get message is the session request information, and the HTTPS handshake message is the handshake information; Detect whether there is an IP address interception library. If so, query whether the target IP address information is stored in the IP address interception library. If so, intercept the session information. If not, trigger the step of querying the accessible domain name library. The accessible domain name library is queried. If the accessible domain name library does not contain the target domain name information, the interception domain name library is queried. If the interception domain name library contains the target domain name information, the session information is intercepted.

2. The method according to claim 1, characterized in that The method further comprises: Obtaining an update instruction for the interception domain name library sent by a management device; The interception domain name library is updated based on the update instruction.

3. The method according to claim 2, characterized in that The update instruction includes any one or more of the following: A deletion instruction for the first domain name information in the intercepted domain name library, a new addition instruction for the second domain name information in the intercepted domain name library, and a modification instruction for the third domain name information in the intercepted domain name library.

4. The method according to claim 1, characterized in that: The target IP address information is not stored in the IP address interception library, the target domain name information is included in the interception domain name library, and after intercepting the session information, the method further includes: The target IP address information is added to the IP address interception library.

5. The method according to claim 1, characterized in that If the intercepted domain name library does not contain the target domain name information, the method further includes: The target domain name information is added to the accessible domain name library.

6. The method according to claim 5, characterized in that The method further comprises: Obtaining the total number of domain name information in the accessible domain name database; If the total number is greater than a preset threshold, the historical domain name information with the earliest storage time in the accessible domain name library is deleted.

7. A data processing device, characterized in that: include: A receiving module, used for receiving session information sent by a visiting device, wherein the session information includes: session request information or handshake information; a determination module, configured to determine target domain name information and target IP address information of a corresponding visited device based on the session information, wherein the target IP address information is determined according to an IP field of a message header in the session information, and the target domain name information is determined according to a Host field of an HTTP Get message or an extended field of an HTTPS handshake message, wherein the HTTP Get message is the session request information, and the HTTPS handshake message is the handshake information; The device is also used to: detect whether there is an IP address interception library, if so, query whether the target IP address information is stored in the IP address interception library, if yes, intercept the session information, if not, trigger the step of querying the accessible domain name library; The interception module is used to query the accessible domain name library. If the accessible domain name library does not contain the target domain name information, the interception domain name library is queried. If the interception domain name library contains the target domain name information, the session information is intercepted.

8. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to perform the method of any one of claims 1 to 6 by executing the executable instructions.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images