A method and device for monitoring information communication data

Abstract

The present invention discloses an information-based communication data monitoring method and device, and relates to the field of communication technology. The information-based communication data monitoring method comprises: obtaining communication data to be monitored; the communication data to be monitored is data transmitted from a first device to a second device; determining whether the encoding method of the communication data to be monitored is correct according to a preset data transmission protocol; the preset data transmission protocol is a data transmission protocol between the first device and the second device; if the encoding method of the communication data to be monitored is incorrect, re-encoding the communication data to be monitored according to at least two preset encoding methods; the at least two encoding methods are different from the encoding methods corresponding to the data transmission protocol, and the at least two encoding methods are stored on the second device; marking the re-encoded communication data to be monitored as unsafe data, and transmitting it to the second device. This monitoring method improves the security of communication data.

Description

Technical Field

[0001] The present invention relates to information communication, and in particular to an information communication data monitoring method and device. Background Art

[0002] With the development of communication technology and big data, a large amount of communication data will be transmitted in various application scenarios. For example, in the Internet communication scenario, the server and the client need to exchange network data; in the power grid communication scenario, the distribution master station and the distribution terminal need to exchange power grid data, etc.

[0003] In these application scenarios, there are still a large number of attackers who may steal data or damage data, resulting in data security not being guaranteed. Therefore, the security of these transmitted communication data also needs to be monitored at all times.

[0004] In the prior art, the monitoring of communication data mostly monitors whether the data has been tampered with. For example, a firewall obtains the transmitted data, and then uses some data verification rules to verify the communication data to verify whether the data has been tampered with. This monitoring method is too common and relies on preset verification rules. It cannot cope with some special attack methods of attackers, and thus cannot guarantee the security of communication data.

[0005] The information disclosed in this background technology section is only intended to enhance the understanding of the overall background of the invention and should not be regarded as an acknowledgment or any form of suggestion that the information constitutes the prior art already known to a person skilled in the art. Summary of the invention

[0006] The object of the present invention is to provide an information-based communication data monitoring method, which can improve the security of communication data.

[0007] To achieve the above-mentioned purpose, an embodiment of the present invention provides an information-based communication data monitoring method, including: obtaining communication data to be monitored; the communication data to be monitored is data transmitted from a first device to a second device; determining whether the encoding method of the communication data to be monitored is correct according to a preset data transmission protocol; the preset data transmission protocol is a data transmission protocol between the first device and the second device; if the encoding method of the communication data to be monitored is incorrect, re-encoding the communication data to be monitored according to at least two preset encoding methods; the at least two encoding methods are different from the encoding methods corresponding to the data transmission protocol, and the at least two encoding methods are stored on the second device; marking the re-encoded communication data to be monitored as unsafe data, and transmitting it to the second device.

[0008] In one or more embodiments of the present invention, determining whether the encoding method of the communication data to be monitored is correct according to the preset data transmission protocol includes: decoding the communication data to be monitored according to the data decoding methods corresponding to the multiple data transmission protocols stored locally, and determining the decoding method corresponding to the communication data to be monitored; determining whether the data transmission protocol corresponding to the decoding method corresponding to the communication data to be monitored is consistent with the preset data transmission protocol; if the data transmission protocol corresponding to the decoding method corresponding to the communication data to be monitored is consistent with the preset data transmission protocol, determining that the encoding method of the communication data to be monitored is correct; if the data transmission protocol corresponding to the decoding method corresponding to the communication data to be monitored is inconsistent with the preset data transmission protocol, determining that the encoding method of the communication data to be monitored is incorrect.

[0009] In one or more embodiments of the present invention, determining whether the encoding method of the communication data to be monitored is correct according to a preset data transmission protocol includes: decoding the communication data to be monitored according to a decoding method corresponding to the preset data transmission protocol; if the decoding of the communication data to be monitored is successful, determining that the encoding method of the communication data to be monitored is correct; if the decoding of the communication data to be monitored fails, determining that the decoding method of the communication data to be monitored is incorrect.

[0010] In one or more embodiments of the present invention, the re-encoding of the communication data to be monitored according to at least two preset encoding methods includes: obtaining the decoded data corresponding to the communication data to be monitored; determining the encoding rules of the at least two preset encoding methods; the encoding rules include: combined encoding, separate encoding and cross encoding; wherein, combined encoding is to encode the decoded data in sequence using the at least two encoding methods, separate encoding is to encode the decoded data using a specified encoding method among the at least two encoding methods, and cross encoding is to encode different parts of the decoded data using different encoding methods among the at least two encoding methods; a plurality of encoding rules are stored on the second device, and the plurality of encoding rules include the encoding rules of the at least two preset encoding methods; the decoded data is encoded according to the encoding rules of the at least two preset encoding methods to obtain the re-encoded communication data to be monitored.

[0011] In one or more embodiments of the present invention, the information-based communication data monitoring method also includes: if the encoding method of the communication data to be monitored is correct, obtaining the decoded data corresponding to the communication data to be monitored; performing a security check on the decoded data according to the preset communication data characteristics; the security check includes: data integrity check, data validity check and data correctness check; the preset communication data characteristics are characteristics of the data transmitted between the first device and the second device; if the security check result indicates that the communication data to be monitored is safe data, marking the communication data to be monitored as safe data and transmitting it to the second device; if the security check result indicates that the communication data to be monitored is unsafe data, marking the communication data to be monitored as unsafe data and transmitting it to the second device.

[0012] In one or more embodiments of the present invention, the information-based communication data monitoring method also includes: receiving the communication data processing result fed back by the second device; the communication data processing result includes: the decoding result of the communication data to be monitored, used to characterize whether the communication data to be monitored is decoded successfully; and the security assessment result obtained by the second device performing a security assessment on the communication data to be monitored; determining whether the first device and the second device need to change the data transmission protocol based on the communication data processing result; if the first device and the second device need to change the data transmission protocol, determining the target data transmission protocol from the multiple data transmission protocols stored locally; synchronizing the target data transmission protocol to the first device and the second device, so that the first device and the second device change the data transmission protocol based on the target data transmission protocol.

[0013] In one or more embodiments of the present invention, determining the target data transmission protocol from a plurality of locally stored data transmission protocols includes: determining the similarity between the plurality of data transmission protocols and the preset data transmission protocol; determining a plurality of alternative data transmission protocols whose similarity to the preset data transmission protocol is less than the preset similarity; obtaining the usage frequency of the plurality of alternative data transmission protocols, and obtaining the usage frequency of the preset data transmission protocol; determining the alternative data transmission protocol whose usage frequency is greater than the usage frequency of the preset data transmission protocol and less than the preset usage frequency as the target data transmission protocol.

[0014] In one or more embodiments of the present invention, the information communication data monitoring method also includes: obtaining a replaced data transmission protocol sent by the first device or the second device; determining whether the replaced data transmission protocol belongs to the target data transmission protocol; if the replaced data transmission protocol does not belong to the target data transmission protocol, marking the first device and / or the second device as an unsafe device.

[0015] In one or more embodiments of the present invention, the information-based communication data monitoring method also includes: updating the at least two encoding methods so that the updated at least two encoding methods are different from the at least two encoding methods stored on the second device; the updated at least two encoding methods are used to re-encode new communication data to be monitored; when receiving the encoding method acquisition request sent by the second device, verifying the security of the second device; if the second device passes the security verification, synchronizing the updated at least two encoding methods to the second device, so that the second device can process the re-encoded new communication data to be monitored that is transmitted later.

[0016] An embodiment of the present invention further provides an information-based communication data monitoring device, comprising: various functional modules for implementing the information-based communication data monitoring method described in one or more of the above embodiments.

[0017] Compared with the prior art, the information communication data monitoring method and device according to the embodiment of the present invention monitors the communication data from the perspective of the communication data transmission protocol. For the communication data transmitted between two devices, when the corresponding data transmission protocol is determined, the encoding method of the communication data is also determined. Therefore, it is first determined whether the encoding method of the communication data is correct. If it is not correct, it means that the communication data may be unsafe data. At this time, the communication data can be re-encoded, and after re-encoding, it is sent to the second device. In this way, on the one hand, if the communication data is unsafe data, by re-encoding, the security risks caused by the communication data to the data recipient can be avoided. On the other hand, if the communication data is safe data, the corresponding encoding method is stored on the second device, and the second device can also decode it by the corresponding decoding method, and then further determine the security of the data. And, if the communication data is safe data, by re-encoding, the communication data can also be prevented from being reused by attackers. Therefore, the technical solution can fully guarantee the security of the communication data based on the level of the communication data transmission protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 is a flow chart of an information communication data monitoring method according to an embodiment of the present invention;

[0019] Figure 2 It is a schematic structural diagram of an information communication data monitoring device according to an embodiment of the present invention.

[0020] Description of main reference numerals:

[0021] 200 - information communication data monitoring device; 210 - acquisition module; 220 - processing module. DETAILED DESCRIPTION

[0022] The specific implementation modes of the present invention are described in detail below in conjunction with the accompanying drawings, but it should be understood that the protection scope of the present invention is not limited by the specific implementation modes.

[0023] Unless explicitly stated otherwise, throughout the specification and claims, the term “comprise” or variations such as “include” or “comprising”, etc., will be understood to include the stated elements or components but not to exclude other elements or components.

[0024] The technical solution provided by the embodiments of the present invention can be applied to various application scenarios that require the transmission of communication data, for example: in the Internet scenario, the network data is transmitted; another example: in the power grid scenario, the power grid data is transmitted; another example: in the communication scenario, the communication data is transmitted, such as: audio, video, etc., and examples are not given one by one here.

[0025] In these application scenarios that require the transmission of communication data, devices that transmit communication data are involved, for example: in the Internet scenario, the client and the server transmit network data; in the power grid scenario, the power distribution master station and the distribution terminal transmit the power grid data; in the communication scenario, the communication data is transmitted between the communication terminal and the communication terminal or the server.

[0026] The technical solution of the embodiment of the present invention can be applied to the security monitoring equipment in the above application scenarios, such as firewalls, relay servers, etc. That is, the hardware operating environment of the technical solution is the monitoring equipment in different application scenarios.

[0027] For the monitoring device and the device that transmits communication data to each other, the three are connected in pairs, that is, the two devices that transmit communication data are connected in communication, and the monitoring device is connected in communication with the two devices respectively. During the process of transmitting communication data between the two devices, the monitoring device can intercept the transmitted communication data and ensure the security of the transmitted communication data by monitoring the communication data.

[0028] In the technical solution of the embodiment of the present invention, the communication data refers to informationized communication data, that is, the communication data corresponds to a large amount of information, which is encoded by a corresponding encoding method and then communicated in an informationized manner.

[0029] like Figure 1 FIG. 1 is a flowchart of an information communication data monitoring method provided by an embodiment of the present invention, and the monitoring method includes:

[0030] Step 110: Acquire the communication data to be monitored.

[0031] The communication data to be monitored is data transmitted from the first device to the second device. Taking the above application scenario as an example, the first device may be a server, a power distribution master station, a communication terminal, etc., and the second device may be a client, a power distribution terminal, a communication terminal, etc.

[0032] The first device and the second device usually pre-negotiate a data transmission protocol, and then when performing data transmission, the data is packaged according to the data packaging method corresponding to the data transmission protocol.

[0033] Among them, the data transmission protocol can be understood as a communication protocol. When different communication protocols are used, the data packaging method is also different. It can be understood that the data transmission protocol here can refer to mature data transmission protocols, and the corresponding packaging method also refers to mature technologies, which will not be introduced here by example.

[0034] In some embodiments, when the first device and the second device negotiate a communication protocol, an online or offline negotiation method may be used.

[0035] Taking online negotiation as an example, the first device sends the communication protocols it can allow to the second device, or the second device sends the communication protocols it can allow to the first device. Then the first device or the second device determines a more suitable protocol based on the protocol sent by the other party, and synchronizes it to the other party to complete the negotiation of the protocol.

[0036] Taking offline negotiation as an example, the maintenance personnel of the first device and the second device respectively jointly determine a communication protocol that meets the communication conditions of the first device and the second device.

[0037] In some embodiments, the first device and the second device may need to establish communication relationships with multiple devices. Therefore, for a device, the communication protocols negotiated with different devices may be the same or different. However, they cannot all be the same. For example, assuming that a device needs to establish communication with three devices, if the communication protocols negotiated with two of them are the same, the communication protocol negotiated with the other one is different from the two negotiated communication protocols.

[0038] Step 120: Determine whether the encoding method of the communication data to be monitored is correct according to the preset data transmission protocol.

[0039] The preset data transmission protocol is the data transmission protocol between the first device and the second device, that is, the aforementioned data transmission protocol negotiated between the first device and the second device.

[0040] As a first optional implementation, step 120 includes: decoding the communication data to be monitored according to the data decoding methods corresponding to the multiple data transmission protocols stored locally, and determining the decoding method corresponding to the communication data to be monitored; determining whether the data transmission protocol corresponding to the decoding method corresponding to the communication data to be monitored is consistent with the preset data transmission protocol; if the data transmission protocol corresponding to the decoding method corresponding to the communication data to be monitored is consistent with the preset data transmission protocol, determining that the encoding method of the communication data to be monitored is correct; if the data transmission protocol corresponding to the decoding method corresponding to the communication data to be monitored is inconsistent with the preset data transmission protocol, determining that the encoding method of the communication data to be monitored is incorrect.

[0041] In this embodiment, the monitoring device locally stores multiple data transmission protocols, and can decode the monitored communication data using the data decoding methods corresponding to each data transmission protocol. When the data decoding method corresponding to a certain data transmission protocol successfully decodes the monitored communication data, it indicates that the decoding method corresponding to the data transmission protocol is the actual decoding method of the monitored communication data.

[0042] However, if the communication data is being transmitted or the first device is attacked, the monitored communication data will not be transmitted according to the negotiated data transmission protocol. At this time, the adopted data transmission protocol will be inconsistent with the preset data transmission protocol.

[0043] Therefore, by decoding the communication data to be monitored, the data transmission protocol corresponding to the decoding method when the decoding is successful is the data transmission protocol actually used, and it is compared with the preset data transmission protocol. If the two are consistent, it means that the communication data to be monitored uses the correct encoding method and has not been attacked. If the two are inconsistent, it means that the communication data to be monitored does not use the correct encoding method and may be attacked.

[0044] In some embodiments, if the data transmission protocol stored locally cannot be decoded successfully, it also means that the monitoring data is not encoded in the correct way. In addition, since the monitoring device does not successfully decode the data, the data can be directly intercepted and the first device and the second device, as well as the relevant monitoring personnel, can be notified to manually check the situation.

[0045] Although the above judgment process is relatively complicated, it can more accurately judge whether the communication data to be monitored adopts the correct encoding method.

[0046] As another optional implementation, step 120 includes: decoding the monitored communication data according to a decoding method corresponding to a preset data transmission protocol; if the decoding of the monitored communication data is successful, determining that the encoding method of the monitored communication data is correct; if the decoding of the monitored communication data fails, determining that the decoding method of the monitored communication data is incorrect.

[0047] In this embodiment, a simpler embodiment is adopted, and the monitoring device directly decodes the communication data to be monitored according to the decoding method corresponding to the preset data transmission protocol. If the decoding is successful, it means that the communication data to be monitored uses the preset data transmission protocol and the encoding method is correct; if the decoding fails, it means that the communication data to be monitored does not use the preset data transmission protocol and the encoding method is incorrect.

[0048] This implementation can simply and quickly determine whether the decoding method of the communication data to be monitored is correct.

[0049] Step 130: If the encoding method of the communication data to be monitored is incorrect, re-encode the communication data to be monitored according to at least two preset encoding methods.

[0050] Among them, at least two encoding methods are different from the encoding methods corresponding to the data transmission protocol, and at least two encoding methods are stored on the second device.

[0051] If the encoding method of the communication data to be monitored is incorrect, it means that the communication data to be monitored may be unsafe data, so the monitoring device may process it again.

[0052] Since at least two encoding methods are stored on the second device, after the second device receives the re-encoded communication data to be monitored, it can also find the corresponding decoding method based on the at least two encoding methods, and then implement data decoding.

[0053] Among them, at least two encoding methods include: character replacement, character modification and other mature encoding technologies.

[0054] As an optional implementation, step 130 includes: obtaining decoded data corresponding to the communication data to be monitored; determining encoding rules of at least two preset encoding methods; the encoding rules include: combined encoding, separate encoding and cross encoding; wherein, combined encoding is to encode the decoded data in sequence using at least two encoding methods, separate encoding is to encode the decoded data using a specified encoding method among at least two encoding methods, and cross encoding is to encode different parts of the decoded data using different encoding methods among at least two encoding methods; a plurality of encoding rules are stored on the second device, and the plurality of encoding rules include encoding rules of at least two preset encoding methods; the decoded data is encoded according to the encoding rules of at least two preset encoding methods to obtain re-encoded communication data to be monitored.

[0055] Among them, combined coding is to encode the decoded data using at least two coding methods in sequence. For example, assuming there are coding method one and coding method two, the decoded data is first encoded using coding method one to obtain the first encoded data; then the first encoded data is encoded using coding method two to obtain the second encoded data, which is the final encoded data.

[0056] Separate encoding is to encode the decoded data using a specified encoding method. For example, assuming there are encoding methods 1 and 2, and encoding method 2 is specified for encoding, then encoding method 2 is directly used to encode the decoded data, which is the final encoded data.

[0057] Cross-coding is to encode different parts of the decoded data using different encoding methods among at least two encoding methods. For example, assuming there are encoding method one and encoding method two, encoding method one encodes the first half of the decoded data, and encoding method two encodes the second half of the decoded data to obtain the final encoded data.

[0058] In addition, the second device stores multiple encoding rules in addition to at least two encoding methods. Thus, after receiving the re-encoded data, the second device can try to decode the re-encoded data using at least two encoding methods and encoding rules.

[0059] Based on the encoding rules, the monitoring device may use at least one of the encoding rules to encode the decoded data to obtain re-encoded communication data to be monitored.

[0060] For example: assuming there are three encoding rules, the monitoring device can first encode the communication data to be monitored according to the first encoding rule to obtain the data encoded for the first time; then encode the data encoded for the first time according to the second encoding rule to obtain the data encoded for the second time; finally, encode the data encoded for the second time according to the third encoding rule to obtain the re-encoded communication data to be monitored.

[0061] Of course, when the encoding rules are other numbers, some corresponding encoding methods can be used for encoding, and examples are not given here one by one.

[0062] Step 140: Mark the re-encoded communication data to be monitored as unsafe data, and transmit it to the second device.

[0063] In this step, the monitoring device adds identification information to the re-encoded communication data to be monitored, so as to indicate whether the data is safe data, and then transmits it to the second device.

[0064] In some embodiments, the method of marking unsafe data may be: adding an identifier to indicate whether it is safe data at the beginning or end of the communication data. For example, when the data is safe data, a first identifier is added at the beginning or end of the data; when the data is unsafe data, a second identifier is added at the beginning or end of the data. The first identifier is different from the second identifier, and the field length of the first identifier and the second identifier is less than a preset length, such as 4 bytes, 8 bytes, etc.

[0065] For the second device, after receiving the re-encoded communication data to be monitored, it recognizes the identification information therein and no longer decodes it according to the decoding method corresponding to the negotiated data transmission protocol, but decodes it according to at least two stored encoding methods and corresponding encoding rules.

[0066] It can be understood that at least two encoding methods and corresponding encoding rules are stored on the second device, but the second device does not know which encoding methods and encoding rules are used by the monitoring device. Therefore, for the second device, various possible encoding methods and corresponding encoding rules can be pre-arranged and combined, various possible decoding methods can be pre-generated, and then decoding can be performed in turn according to various possible decoding methods.

[0067] After obtaining the decoded data, the second device can further judge the security of the data according to its own security judgment rules and obtain the corresponding communication data processing results. For the monitoring device, corresponding processing can also be performed based on the communication data results.

[0068] In some embodiments, the security judgment rules include: integrity check rules, rationality check rules, correctness check rules, etc., which are not limited here. The specific forms of these rules can refer to mature technologies in the field and are not introduced in detail here.

[0069] Therefore, as an optional implementation, the monitoring method also includes: receiving communication data processing results fed back by the second device, the communication data processing results including: decoding results of the communication data to be monitored, used to characterize whether the communication data to be monitored is decoded successfully; and security assessment results obtained by the second device performing a security assessment on the communication data to be monitored; determining whether the first device and the second device need to change the data transmission protocol based on the communication data processing results; if the first device and the second device need to change the data transmission protocol, determining a target data transmission protocol from a plurality of data transmission protocols stored locally; synchronizing the target data transmission protocol to the first device and the second device, so that the first device and the second device change the data transmission protocol based on the target data transmission protocol.

[0070] In this embodiment, the communication data processing result includes a decoding result, which can indicate whether the second device successfully decodes the communication data to be monitored; and a security assessment result obtained by the second device performing a security assessment on the communication data to be monitored.

[0071] In some embodiments, if the second device successfully decodes the communication data to be monitored and the security assessment result is unsafe data, it is determined that the data transmission protocol needs to be changed.

[0072] In other embodiments, if the second device successfully decodes the communication data to be monitored and the security assessment result is safe data, it is determined that there is no need to change the data transmission protocol.

[0073] In other embodiments, if the second device fails to decode the communication data to be monitored, then it is determined that the data transmission protocol needs to be changed regardless of the security assessment result.

[0074] If you determine that the data transmission protocol does not need to be changed, you do not need to perform subsequent steps.

[0075] If it is determined that the data transmission protocol needs to be changed, a target data transmission protocol is determined and synchronized to the first device and the second device, so that the first device and the second device re-determine a new data transmission protocol based on the target data transmission protocol.

[0076] As an optional implementation, a target data transmission protocol is determined from a plurality of locally stored data transmission protocols, including: determining a similarity between a plurality of data transmission protocols and a preset data transmission protocol; determining a plurality of candidate data transmission protocols whose similarity to the preset data transmission protocol is less than a preset similarity; obtaining usage frequencies of the plurality of candidate data transmission protocols, and obtaining a usage frequency of the preset data transmission protocol; determining an alternative data transmission protocol whose usage frequency is greater than the usage frequency of the preset data transmission protocol and less than the preset usage frequency as the target data transmission protocol.

[0077] In this embodiment, the monitoring device locally stores a plurality of data transmission protocols, and first determines the similarity between the plurality of data transmission protocols and a preset data transmission protocol.

[0078] In some embodiments, the similarity may include: complexity similarity, security similarity, etc. It is understandable that different data transmission protocols have such information themselves, and a more comprehensive similarity can be directly determined based on such information, and then determined as the similarity between the data transmission protocols.

[0079] After the similarity is determined, the data transmission protocol with a similarity less than a preset similarity is determined as an alternative data transmission protocol. The preset similarity can be set in combination with the actual application scenario, for example, the preset similarity can be 50%.

[0080] Based on a plurality of candidate data transmission protocols, usage frequencies of the candidate data transmission protocols may be counted.

[0081] In some embodiments, the usage frequency may be determined in combination with the usage records of other devices, wherein the usage record or usage frequency of the transmission protocol of the device may be used as information directly monitored by the monitoring device.

[0082] Furthermore, based on the usage frequency, an alternative data transmission protocol having a usage frequency greater than the preset data transmission protocol and less than the preset usage frequency is determined as the target data transmission protocol.

[0083] Among them, the preset usage frequency can be set in combination with different application scenarios and is not limited here.

[0084] For the first device and the second device, the target data transmission protocol is only used as a reference. The first device and the second device can actually select the corresponding data transmission protocol as the replaced data transmission protocol based on their own situations.

[0085] In some embodiments, if the first device and / or the second device is attacked, the first device and / or the second device may not obey the arrangement of the monitoring device.

[0086] Therefore, as an optional implementation, the monitoring method also includes: obtaining the replaced data transmission protocol sent by the first device or the second device; determining whether the replaced data transmission protocol belongs to the target data transmission protocol; if the replaced data transmission protocol does not belong to the target data transmission protocol, marking the first device and / or the second device as an unsafe device.

[0087] In this implementation, if the replaced data transmission protocol does not belong to the target data transmission protocol, the first device and / or the second device may be marked as an unsafe device so that relevant staff can check the first device and / or the second device.

[0088] Of course, if the replaced data transmission protocol belongs to the target data transmission protocol, then the replaced data transmission protocol can be recorded.

[0089] After the first device and / or the second device is marked as an unsafe device, some information stored locally on the monitoring device needs to be updated to prevent the information from being illegally stolen.

[0090] Therefore, as an optional implementation, the monitoring method also includes: updating at least two encoding methods so that the updated at least two encoding methods are different from the at least two encoding methods stored on the second device; the updated at least two encoding methods are used to re-encode new communication data to be monitored; when receiving the encoding method acquisition request sent by the second device, verifying the security of the second device; if the second device passes the security verification, synchronizing the updated at least two encoding methods to the second device, so that the second device can process the re-encoded new communication data to be monitored that is transmitted later.

[0091] In this implementation, the updating method may be: deleting some of the encoding methods, adding new encoding methods, replacing some of the encoding methods, etc., which is not limited here.

[0092] Based on the updated at least two encoding methods, if steps 110 to 140 are performed again later, the second device may request the monitoring device for the at least two encoding methods for data decoding. At this time, the staff may not have checked the second device. Therefore, the second device needs to be verified first.

[0093] During the verification, it is possible to query whether the second device has a check record and a corresponding check result. If the check record and the corresponding check result indicate that it has no potential safety hazard, it can be determined to have passed the safety verification. Of course, other feasible verification methods are also possible, which are not limited here.

[0094] If the verification is passed, the updated at least two encoding modes can be synchronized to the second device, so that the second device can process the re-encoded new communication data to be monitored.

[0095] If the verification fails, the updated at least two encoding methods will not be synchronized to the second device.

[0096] In some embodiments, the attacked device may not be the second device, but the first device. In this case, the data transmitted from the first device to the second device may all be unsafe data. At this time, in order to avoid repeated monitoring and processing of unsafe data, the data transmission path between the first device and the second device can be directly released until the first device eliminates the security risk, and then the communication transmission path between the first device and the second device is re-established.

[0097] Therefore, as an optional implementation, the method further includes: when determining that the first device is an unsafe device, generating a protocol release instruction; and sending the protocol release instruction to the second device. For the second device, after receiving the protocol release instruction, the protocol release instruction is confirmed, and if it is confirmed to be correct, the release information is fed back to the monitoring device. Thereby, the monitoring device marks the first device as an unsafe device and deletes the relevant data of the communication data monitoring between the first device and the second device.

[0098] As for the second device, the communication link with the first device is also terminated, that is, data is no longer transmitted with the first device, and the previously negotiated communication protocol is marked as an unavailable communication protocol. Of course, the communication protocol negotiated with other devices is not affected, that is, the communication protocol negotiated with other devices is still retained.

[0099] In some embodiments, when confirming the protocol release instruction, the second device may request manual confirmation, or may directly confirm.

[0100] As an optional implementation, the monitoring method also includes: if the encoding method of the communication data to be monitored is correct, obtaining the decoded data corresponding to the communication data to be monitored; performing a security check on the decoded data according to the preset communication data characteristics; the security check includes: data integrity check, data validity check and data correctness check; the preset communication data characteristics are characteristics of the data transmitted between the first device and the second device; if the security check result indicates that the communication data to be monitored is safe data, marking the communication data to be monitored as safe data and transmitting it to the second device; if the security check result indicates that the communication data to be monitored is unsafe data, marking the communication data to be monitored as unsafe data and transmitting it to the second device.

[0101] In this implementation, if the encoding method of the communication data to be monitored is correct, the monitoring device can perform some conventional checks on the decoded data, including but not limited to: integrity check, validity check and data correctness check, etc. These check methods can refer to mature technologies in the field and will not be described in detail here.

[0102] The preset communication data characteristics are characteristics of data transmitted between the first device and the second device, such as data type, data format, data content, etc., which are not limited here.

[0103] For example, for power grid data, the data transmitted between the power distribution master station and the power distribution terminal should be power grid data, and should have the characteristics of power grid data. For Internet data, the data transmitted between the server and the client should be network data, and should have the characteristics of network data.

[0104] If the security check result indicates that the communication data to be monitored is safe, it is marked as safe data and transmitted to the second device.

[0105] If the security check result indicates that the data to be monitored is unsafe, it is marked as unsafe data and then transmitted to the second device.

[0106] In some embodiments, if it is not possible to determine whether the data to be monitored is safe data, the data may be intercepted first. When the second device requests the intercepted data, it is then transmitted to the second device. Alternatively, after the staff determines the corresponding evaluation result, it is then transmitted to the second device, etc.

[0107] In this way, even if the data to be monitored is determined to be normal in terms of the communication protocol, the security of the communication data can be further guaranteed.

[0108] Through the introduction of the above embodiments, it can be seen that according to the technical solution of the embodiment of the present invention, the communication data is monitored from the perspective of the communication data transmission protocol. For the communication data transmitted between two devices, when the corresponding data transmission protocol is determined, the encoding method of the communication data is also determined. Therefore, first determine whether the encoding method of the communication data is correct. If it is not correct, it means that the communication data may be unsafe data. At this time, the communication data can be re-encoded, and after re-encoding, it is sent to the second device. In this way, on the one hand, if the communication data is unsafe data, by re-encoding, the security risks caused by the communication data to the data recipient can be avoided. On the other hand, if the communication data is safe data, the corresponding encoding method is stored on the second device, and the second device can also decode it by the corresponding decoding method, and then further determine the security of the data. And if the communication data is safe data, by re-encoding, it can also avoid the communication data from being reused by attackers. Therefore, the technical solution can fully guarantee the security of the communication data based on the level of the communication data transmission protocol.

[0109] like Figure 2 As shown, it is a structural schematic diagram of an information communication data monitoring device 200 provided in an embodiment of the present invention, including: an acquisition module 210 and a processing module 220.

[0110] The acquisition module 210 is used to acquire the communication data to be monitored; the communication data to be monitored is data transmitted from the first device to the second device; the processing module 220 is used to: determine whether the encoding method of the communication data to be monitored is correct according to a preset data transmission protocol; the preset data transmission protocol is the data transmission protocol between the first device and the second device; if the encoding method of the communication data to be monitored is incorrect, re-encode the communication data to be monitored according to at least two preset encoding methods; the at least two encoding methods are different from the encoding methods corresponding to the data transmission protocol, and the at least two encoding methods are stored on the second device; mark the re-encoded communication data to be monitored as unsafe data and transmit it to the second device.

[0111] In an embodiment of the present invention, the processing module 220 is specifically used to: decode the communication data to be monitored according to the data decoding methods corresponding to the multiple data transmission protocols stored locally, and determine the decoding method corresponding to the communication data to be monitored; determine whether the data transmission protocol corresponding to the decoding method corresponding to the communication data to be monitored is consistent with the preset data transmission protocol; if the data transmission protocol corresponding to the decoding method corresponding to the communication data to be monitored is consistent with the preset data transmission protocol, determine that the encoding method of the communication data to be monitored is correct; if the data transmission protocol corresponding to the decoding method corresponding to the communication data to be monitored is inconsistent with the preset data transmission protocol, determine that the encoding method of the communication data to be monitored is incorrect.

[0112] In an embodiment of the present invention, the processing module 220 is specifically used to: decode the communication data to be monitored according to a decoding method corresponding to a preset data transmission protocol; if the decoding of the communication data to be monitored is successful, determine that the encoding method of the communication data to be monitored is correct; if the decoding of the communication data to be monitored fails, determine that the decoding method of the communication data to be monitored is incorrect.

[0113] In an embodiment of the present invention, the processing module 220 is specifically used to: obtain the decoded data corresponding to the communication data to be monitored; determine the encoding rules of the preset at least two encoding methods; the encoding rules include: combined encoding, separate encoding and cross encoding; wherein, combined encoding is to encode the decoded data in sequence using the at least two encoding methods, separate encoding is to encode the decoded data using a specified encoding method among the at least two encoding methods, and cross encoding is to encode different parts of the decoded data using different encoding methods among the at least two encoding methods; a plurality of encoding rules are stored on the second device, and the plurality of encoding rules include the encoding rules of the preset at least two encoding methods; the decoded data is encoded according to the encoding rules of the preset at least two encoding methods to obtain the re-encoded communication data to be monitored.

[0114] In an embodiment of the present invention, the acquisition module 210 is also used for: if the encoding method of the communication data to be monitored is correct, obtaining the decoded data corresponding to the communication data to be monitored; the processing module 220 is also used for: performing security verification on the decoded data according to the preset communication data characteristics; the security verification includes: data integrity verification, data validity verification and data correctness verification; the preset communication data characteristics are characteristics of the data transmitted between the first device and the second device; if the security verification result indicates that the communication data to be monitored is safe data, marking the communication data to be monitored as safe data and transmitting it to the second device; if the security verification result indicates that the communication data to be monitored is unsafe data, marking the communication data to be monitored as unsafe data and transmitting it to the second device.

[0115] In an embodiment of the present invention, the acquisition module 210 is also used to: receive the communication data processing result fed back by the second device; the communication data processing result includes: the decoding result of the communication data to be monitored, used to characterize whether the communication data to be monitored is decoded successfully; and the security assessment result obtained by the second device performing a security assessment on the communication data to be monitored; the processing module 220 is also used to: determine whether the first device and the second device need to change the data transmission protocol based on the communication data processing result; if the first device and the second device need to change the data transmission protocol, determine the target data transmission protocol from the multiple data transmission protocols stored locally; synchronize the target data transmission protocol to the first device and the second device, so that the first device and the second device change the data transmission protocol based on the target data transmission protocol.

[0116] In an embodiment of the present invention, the processing module 220 is also used to: determine the similarity between the multiple data transmission protocols and the preset data transmission protocol; determine multiple alternative data transmission protocols whose similarity to the preset data transmission protocol is less than the preset similarity; obtain the usage frequency of the multiple alternative data transmission protocols, and obtain the usage frequency of the preset data transmission protocol; determine the alternative data transmission protocol whose usage frequency is greater than the usage frequency of the preset data transmission protocol and less than the preset usage frequency as the target data transmission protocol.

[0117] In an embodiment of the present invention, the acquisition module 210 is also used to: obtain the replaced data transmission protocol sent by the first device or the second device; the processing module 220 is also used to: determine whether the replaced data transmission protocol belongs to the target data transmission protocol; if the replaced data transmission protocol does not belong to the target data transmission protocol, mark the first device and / or the second device as an unsafe device.

[0118] In an embodiment of the present invention, the processing module 220 is also used to: update the at least two encoding methods so that the updated at least two encoding methods are different from the at least two encoding methods stored on the second device; the updated at least two encoding methods are used to re-encode the new communication data to be monitored; when receiving the encoding method acquisition request sent by the second device, verify the security of the second device; if the second device passes the security verification, synchronize the updated at least two encoding methods to the second device, so that the second device can process the re-encoded new communication data to be monitored that is transmitted later.

[0119] The information communication data monitoring device 200 corresponds to the information communication data monitoring method described above. Therefore, the implementation of each functional module refers to the implementation of the corresponding method described above, and will not be repeated here.

[0120] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0121] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0122] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0123] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0124] The foregoing description of specific exemplary embodiments of the present invention is for the purpose of illustration and demonstration. These descriptions are not intended to limit the present invention to the precise form disclosed, and it is clear that many changes and variations can be made based on the above teachings. The purpose of selecting and describing the exemplary embodiments is to explain the specific principles of the present invention and its practical application, so that those skilled in the art can realize and utilize various different exemplary embodiments of the present invention and various different selections and changes. The scope of the present invention is intended to be limited by the claims and their equivalents.

Claims

1. A method for monitoring information communication data, It is characterized in that include: Acquire communication data to be monitored; The communication data to be monitored is data transmitted from the first device to the second device; Determining whether the encoding method of the communication data to be monitored is correct according to a preset data transmission protocol; the preset data transmission protocol is a data transmission protocol between the first device and the second device; If the encoding method of the communication data to be monitored is incorrect, re-encode the communication data to be monitored according to at least two preset encoding methods; the at least two encoding methods are different from the encoding methods corresponding to the data transmission protocol, and the at least two encoding methods are stored on the second device; The re-encoded communication data to be monitored is marked as unsafe data and transmitted to the second device.

2. The information communication data monitoring method according to claim 1, It is characterized in that The determining whether the encoding method of the communication data to be monitored is correct according to the preset data transmission protocol includes: Decoding the communication data to be monitored according to data decoding methods corresponding to a plurality of data transmission protocols stored locally, and determining a decoding method corresponding to the communication data to be monitored; Determine whether the data transmission protocol corresponding to the decoding method corresponding to the communication data to be monitored is consistent with the preset data transmission protocol; If the data transmission protocol corresponding to the decoding method corresponding to the communication data to be monitored is consistent with the preset data transmission protocol, it is determined that the encoding method of the communication data to be monitored is correct; If the data transmission protocol corresponding to the decoding method corresponding to the communication data to be monitored is inconsistent with the preset data transmission protocol, it is determined that the encoding method of the communication data to be monitored is incorrect.

3. The information communication data monitoring method according to claim 1, It is characterized in that The determining whether the encoding method of the communication data to be monitored is correct according to the preset data transmission protocol includes: Decoding the communication data to be monitored according to a decoding method corresponding to a preset data transmission protocol; If the communication data to be monitored is decoded successfully, it is determined that the encoding method of the communication data to be monitored is correct; If the decoding of the communication data to be monitored fails, it is determined that the decoding method of the communication data to be monitored is incorrect.

4. The information communication data monitoring method according to claim 1, It is characterized in that The re-encoding the communication data to be monitored according to at least two preset encoding modes includes: Obtaining decoded data corresponding to the communication data to be monitored; Determine the encoding rules of the at least two preset encoding methods; the encoding rules include: combined encoding, separate encoding and cross encoding; wherein the combined encoding is to encode the decoded data using the at least two encoding methods in sequence, the separate encoding is to encode the decoded data using a specified encoding method in the at least two encoding methods, and the cross encoding is to encode different parts of the decoded data using different encoding methods in the at least two encoding methods; the second device stores a plurality of encoding rules, and the plurality of encoding rules include the encoding rules of the at least two preset encoding methods; The decoded data is encoded according to the encoding rules of the preset at least two encoding methods to obtain re-encoded communication data to be monitored.

5. The information communication data monitoring method according to claim 1, It is characterized in that The information communication data monitoring method further includes: If the encoding method of the communication data to be monitored is correct, obtaining decoded data corresponding to the communication data to be monitored; Performing a security check on the decoded data according to a preset communication data feature; the security check includes: a data integrity check, a data validity check, and a data correctness check; the preset communication data feature is a feature of data transmitted between the first device and the second device; If the security check result indicates that the communication data to be monitored is safe data, marking the communication data to be monitored as safe data and transmitting the data to the second device; If the security check result indicates that the communication data to be monitored is unsafe data, the communication data to be monitored is marked as unsafe data and transmitted to the second device.

6. The information communication data monitoring method according to claim 1, It is characterized in that The information communication data monitoring method further includes: receiving a communication data processing result fed back by the second device; the communication data processing result includes: a decoding result of the communication data to be monitored, used to indicate whether the communication data to be monitored is decoded successfully; and a security assessment result obtained by the second device performing a security assessment on the communication data to be monitored; Determining whether the first device and the second device need to change the data transmission protocol according to the communication data processing result; If the first device and the second device need to change the data transmission protocol, determine a target data transmission protocol from multiple data transmission protocols stored locally; The target data transmission protocol is synchronized to the first device and the second device, so that the first device and the second device change the data transmission protocol based on the target data transmission protocol.

7. The information communication data monitoring method according to claim 6, It is characterized in that The step of determining a target data transmission protocol from a plurality of locally stored data transmission protocols includes: Determining similarities between the multiple data transmission protocols and the preset data transmission protocol; Determining a plurality of candidate data transmission protocols whose similarity to the preset data transmission protocol is less than a preset similarity; Obtaining usage frequencies of the multiple candidate data transmission protocols, and obtaining usage frequencies of the preset data transmission protocol; An alternative data transmission protocol whose usage frequency is greater than the usage frequency of the preset data transmission protocol and less than the preset usage frequency is determined as the target data transmission protocol.

8. The information communication data monitoring method according to claim 7, It is characterized in that The information communication data monitoring method further includes: Obtaining a changed data transmission protocol sent by the first device or the second device; Determining whether the replaced data transmission protocol belongs to the target data transmission protocol; If the replaced data transmission protocol does not belong to the target data transmission protocol, the first device and / or the second device is marked as an unsafe device.

9. The information communication data monitoring method according to claim 8, It is characterized in that The information communication data monitoring method further includes: Updating the at least two encoding modes so that the updated at least two encoding modes are different from the at least two encoding modes stored on the second device; the updated at least two encoding modes are used to re-encode the new communication data to be monitored; Upon receiving the encoding mode acquisition request sent by the second device, verifying the security of the second device; If the second device passes the security check, the updated at least two encoding modes are synchronized to the second device, so that the second device can process the re-encoded new communication data to be monitored that is transmitted later.

10. An information communication data monitoring device, It is characterized in that include: An acquisition module, used for acquiring communication data to be monitored; The communication data to be monitored is data transmitted from the first device to the second device; Processing modules for: Determining whether the encoding method of the communication data to be monitored is correct according to a preset data transmission protocol; the preset data transmission protocol is a data transmission protocol between the first device and the second device; If the encoding method of the communication data to be monitored is incorrect, re-encode the communication data to be monitored according to at least two preset encoding methods; the at least two encoding methods are different from the encoding methods corresponding to the data transmission protocol, and the at least two encoding methods are stored on the second device; The re-encoded communication data to be monitored is marked as unsafe data and transmitted to the second device.

Images