Terminal traffic proxy method, device, system, electronic device and storage medium

Abstract

The present application discloses a terminal traffic proxy method, device, system, electronic device and readable storage medium, which are applied to the field of network security technology. The method is applied to a user terminal that has a data packet capture driver module pre-installed in the kernel space protocol stack, including: when a target traffic data packet is captured, the target address of the target traffic data packet is obtained; the target traffic data packet is filtered according to whether the target address is a tunnel port, and the target traffic data packet that is not a tunnel port is encapsulated, and all traffic data packets of the user terminal are forwarded through the tunnel port, thereby effectively ensuring the stability, flexibility and compatibility of the traffic proxy tunnel.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a terminal traffic proxy method, device, system, electronic device and readable storage medium. Background Art

[0002] With the gradual popularization of zero-trust technology, network traffic management has faced the coexistence of VPN (Virtual Private Network) and zero-trust terminals for a long time. However, the network traffic management modes are different in different application scenarios or users. For example, user A requires that all traffic of the customer must be collected and audited on the server when the customer accesses remotely, user B requires that the Internet cannot be accessed during remote access, and user C has no requirements. Correspondingly, high requirements are also placed on the flexibility and compatibility of the terminal traffic proxy mode.

[0003] Related technologies In terminal traffic proxy, the application traffic that needs to be proxied is directed to the virtual network card through routing settings. At the same time, there is an application process in the user space that receives the traffic of the virtual network card and encapsulates and forwards it to the server. This model has the following disadvantages:

[0004] First of all, because the routing settings can only be targeted at IPs but not ports, for the traffic of the tunnel server, if there are other ports besides the tunnel port providing services to the outside, in order to avoid an infinite loop caused by forwarding the traffic to the protocol stack after tunnel encapsulation, the traffic of the tunnel server is often released directly. This will cause the traffic outside the tunnel port to be unable to be uniformly encapsulated into the tunnel port. On the one hand, it will increase the exposure of the tunnel server port, and on the other hand, it will be impossible to encrypt and encapsulate the traffic of other ports through tunnels, which poses a channel security risk.

[0005] Secondly, in the process of implementing traffic proxy, in addition to routing settings, it is often necessary to create a virtual network card, set the virtual network card IP, set the DNS (Domain Name Syste), adjust the network card priority, etc. Taking the Windows 7 operating system as an example, traditional technology needs to adapt to 26 system versions. These operations require calling the operating system's commands and interfaces, and these settings often vary greatly in different versions of the operating system, resulting in a large workload for operating system version adaptation.

[0006] Finally, in scenarios with many back-end business systems, setting up more routing entries will result in a slower startup speed. If the setting is changed to a network segment method, it may affect the use of other traffic proxy terminals, causing compatibility issues with the user terminal traffic proxy software.

[0007] In view of this, how to ensure the stability, flexibility and compatibility of the terminal traffic proxy tunnel is a technical problem that technical personnel in the relevant field need to solve. Summary of the invention

[0008] The present application provides a terminal traffic proxy method, device, system, electronic device and readable storage medium, which can effectively ensure the stability, flexibility and compatibility of the traffic proxy tunnel.

[0009] To solve the above technical problems, the embodiments of the present invention provide the following technical solutions:

[0010] An embodiment of the present invention provides a terminal traffic proxy method, which is applied to a user terminal in which a data packet capture driver module is pre-installed in a kernel space protocol stack, and includes:

[0011] When a target traffic data packet is captured, a target address of the target traffic data packet is obtained;

[0012] The target traffic data packets are filtered according to whether the target address is a tunnel port, and the target traffic data packets that are not tunnel ports are encapsulated to forward all traffic data packets of the user terminal through the tunnel port.

[0013] Optionally, filtering the target traffic data packet according to whether the target address is a tunnel port, and encapsulating the target traffic data packet that is not a tunnel port, includes:

[0014] If the target address is a tunnel port of a tunnel server, the target traffic data packet is directly forwarded to the tunnel server through the tunnel port;

[0015] If the target address is not a tunnel port, the target traffic data packet is forwarded to the user space for data packet encapsulation, and the encapsulated traffic data packet is forwarded to the tunnel server through the tunnel port.

[0016] Optionally, after the target traffic data packet is forwarded to the user space for data packet encapsulation, the method further includes:

[0017] The data traffic packet encapsulated in the user space is sent to the protocol stack in the kernel space.

[0018] Optionally, after forwarding all traffic data packets of the user terminal through the tunnel port, the method further includes:

[0019] The tunnel server receives the target traffic data packet and forwards it to the corresponding target business system according to the destination address of the target traffic data packet.

[0020] Optionally, forwarding the target traffic data packet to a corresponding target service system according to the destination address thereof includes:

[0021] If the tunnel service is deployed in a gateway device, the target traffic data packets belonging to the transparent proxy will be directly forwarded to the corresponding target business system.

[0022] Optionally, forwarding the target traffic data packet to a corresponding target service system according to the destination address thereof includes:

[0023] If the target traffic data packet is the traffic of port NAT, the target traffic data packet is forwarded to the corresponding target business system through the NAT service.

[0024] Optionally, forwarding the target traffic data packet to a corresponding target service system according to the destination address thereof includes:

[0025] If the target traffic data packet is the traffic of a reverse proxy, the target traffic data packet is forwarded to the corresponding target business system through the reverse proxy process.

[0026] Another aspect of the present invention provides a terminal traffic proxy device, which is applied to a user terminal and includes:

[0027] The driver has a pre-built-in module for installing the packet capture driver module in the kernel space protocol stack;

[0028] An address acquisition module, used for acquiring a target address of a target traffic data packet when a target traffic data packet is captured;

[0029] The traffic filtering and forwarding module is used to filter the target traffic data packets according to whether the target address is a tunnel port, and encapsulate the target traffic data packets that are not tunnel ports to forward all traffic data packets of the user terminal through the tunnel port.

[0030] An embodiment of the present invention also provides an electronic device, which is applied to a user terminal in which a data packet capture driver module is pre-installed in a kernel space protocol stack, and includes a processor, which is used to implement the steps of the terminal traffic proxy method as described in any of the preceding items when executing a computer program stored in a memory.

[0031] An embodiment of the present invention also provides a readable storage medium, which is applied to a user terminal that has pre-installed a data packet capture driver module in the kernel space protocol stack. A computer program is stored on the readable storage medium, and when the computer program is executed by a processor, the steps of the terminal traffic proxy method described in any of the preceding items are implemented.

[0032] Finally, the embodiment of the present invention further provides a terminal traffic proxy system, including a user terminal and a tunnel server;

[0033] Wherein, the user terminal and the tunnel server transmit traffic data packets through the tunnel port;

[0034] The user terminal is used to implement the steps of the terminal traffic proxy method as described in any of the preceding items when executing the computer program stored in the memory.

[0035] The advantage of the technical solution provided by the present application is that, instead of adopting the terminal traffic proxy method of virtual network card and routing mode in the related technology, it filters, forwards and releases the terminal traffic at the operating system kernel protocol stack level based on the captured network data packets, unifies the terminal traffic ports, reduces the exposure of the traffic proxy ports, and does not need to be adapted to the operating system or matched with the terminal traffic proxy software, thereby effectively ensuring the stability, flexibility and compatibility of the traffic proxy tunnel.

[0036] In addition, the embodiments of the present invention also provide corresponding implementation devices, systems, electronic devices and readable storage media for the terminal traffic proxy method, which further makes the method more practical, and the devices, systems, electronic devices and readable storage media have corresponding advantages.

[0037] It should be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present invention or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 A flow chart of a terminal traffic proxy method provided by an embodiment of the present invention;

[0040] Figure 2 A schematic diagram of a framework of an exemplary application scenario provided for an embodiment of the present invention;

[0041] Figure 3 A structural diagram of a specific implementation of the terminal traffic proxy device provided by an embodiment of the present invention;

[0042] Figure 4 A structural diagram of a specific implementation of an electronic device provided by an embodiment of the present invention;

[0043] Figure 5 A structural diagram of a specific implementation of the terminal traffic proxy system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to enable those skilled in the art to better understand the scheme of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0045] The terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but may include steps or units that are not listed. Various non-limiting embodiments of the present application are described in detail below.

[0046] See first Figure 1 , Figure 1 A flow chart of a terminal traffic proxy method provided by an embodiment of the present invention is applied to a user terminal, that is, the execution subject of this embodiment is a user terminal. In the user terminal of this embodiment, a data packet capture driver module is pre-installed in the kernel space protocol stack, for example, the data packet capture driver module can be installed in the lower layer of the kernel space protocol stack. The data packet capture driver module can support traffic filtering and forwarding based on the destination address, port and protocol, and replace the traditional routing settings with built-in filtering rules to distinguish ports and protocols, so as to realize direct forwarding of traffic whose destination address is a tunnel port, and forwarding non-tunnel traffic to the user space for data packet encapsulation (that is, encapsulation into traffic of the tunnel port) and then forwarding. The embodiment of the present invention may include the following contents:

[0047] S101: When a target traffic data packet is captured, a target address of the target traffic data packet is obtained.

[0048] In this embodiment, the target traffic data packet is any traffic data packet captured by the data packet capture driver module. For the convenience of description, the traffic data packet currently entering the kernel space of the user terminal, that is, the traffic data packet currently to be processed, is called the target traffic data packet. The target address of this embodiment is used to indicate whether the target traffic data packet is sent out through a port or a non-port such as a protocol.

[0049] S102: Filter the target traffic data packets according to whether the target address is a tunnel port, and encapsulate the target traffic data packets that are not tunnel ports, so as to forward all traffic data packets of the user terminal through the tunnel port.

[0050] In this step, filtering is used to identify the traffic data packets whose target addresses are not the tunnel port, so as to be used for subsequent encapsulation processing. The so-called encapsulation refers to encapsulating the traffic data packets whose target addresses are not the tunnel port into traffic data packets whose target addresses are the tunnel port. In this way, regardless of whether the traffic data packet itself is to be sent out through the tunnel port, it can be sent out through a unified tunnel port, and four-layer (IP+port) traffic capture and forwarding can be achieved at the operating system kernel protocol stack level, which can solve the compatibility problem of traffic proxy terminals, especially for operation and maintenance personnel. There is no need to open multiple VPNs or zero-letter terminals to connect to the customer environment to assist in solving problems. Solving compatibility problems can reduce the frequent exit and startup of these traffic proxy software. The work of system configuration is processed by internal logic, which greatly reduces the workload caused by operating system adaptation and solves the compatibility problem of operating system versions.

[0051] In the technical solution provided in the embodiment of the present invention, instead of the terminal traffic proxy method using a virtual network card and routing mode in the related technology, the terminal traffic is filtered, forwarded and released at the operating system kernel protocol stack level based on the captured network data packets, the terminal traffic ports are unified, and the exposure of the traffic proxy ports is reduced. Moreover, it does not need to be adapted to the operating system or matched with the terminal traffic proxy software, thereby effectively ensuring the stability, flexibility and compatibility of the traffic proxy tunnel.

[0052] It should be noted that there is no strict order of execution between the steps in this application. As long as they comply with the logical order, these steps can be executed simultaneously or in a certain preset order. Figure 1 This is just a schematic and does not mean that this is the only execution order.

[0053] In the above embodiment, there is no limitation on how to execute step S102. In this embodiment, an optional implementation is provided, which may include the following steps:

[0054] If the target address is the tunnel port of the tunnel server, the target traffic data packet is directly forwarded to the tunnel server through the tunnel port;

[0055] If the target address is not a tunnel port, the target traffic data packet is forwarded to the user space for data packet encapsulation, and the encapsulated traffic data packet is forwarded to the tunnel server through the tunnel port. After the target traffic data packet is forwarded to the user space for data packet encapsulation, the encapsulated data traffic packet in the user space can also be sent to the protocol stack in the kernel space.

[0056] by Figure 2 For example, the traffic data packet of the client host enters the kernel space, such as Figure 2 Node 1 of the data packet, the traffic data packet flows to the data packet capture program corresponding to the data packet capture driver module, such as Figure 2 Node 2 in the kernel space. The traffic data packet is filtered in the kernel space, and the traffic data packet whose destination address is the tunnel server and the tunnel port is directly forwarded, such as Figure 2 In node 3, the traffic data packets whose destination address is not the tunnel port are forwarded to the user space data encapsulation program for processing, such as Figure 2 At node 3-1 in the user space, the computer program for executing data encapsulation is called to encapsulate the traffic data packet, that is, the traffic data packet is processed accordingly using a tunnel encryption method, and then put back into the protocol stack after processing, such as Figure 2 Node 2. The traffic flow that finally completes the tunnel encapsulation flows into the tunnel server through the tunnel port, such as Figure 2 Middle node 4.

[0057] This embodiment solves the problem of unifying the gateway port traffic, uniformly uses tunnel encryption methods, reduces exposure, and ensures port security and channel security.

[0058] The above embodiments do not impose any limitation on how the tunnel server sends the received traffic data packet to the corresponding business system after receiving the traffic data packet through the tunnel port. Figure 2 An optional implementation is also provided, which may include:

[0059] The tunnel server receives the target traffic data packet and forwards it to the corresponding target business system according to the destination address of the target traffic data packet.

[0060] The destination address refers to the address of the business system where the traffic data packet finally arrives. If the tunnel service is deployed in the gateway device, the target traffic data packet belonging to the transparent proxy will be directly forwarded to the corresponding target business system. If the target traffic data packet is the traffic of the port NAT (Network Address Translation), the target traffic data packet is forwarded to the corresponding target business system through the NAT service. If the target traffic data packet is the traffic of the reverse proxy, the target traffic data packet is forwarded to the corresponding target business system through the reverse proxy process.

[0061] In the tunnel service, packets are forwarded to different target services according to their destination addresses. If the tunnel service is deployed in a gateway device, the transparent proxy traffic will be directly forwarded to the business system, such as Figure 2 In node 5, the traffic of port NAT is forwarded to the business system through the NAT service, such as Figure 2 In nodes 6 and 6-1, the reverse proxy traffic is forwarded to the business system through the reverse proxy process. Figure 2 Midpoints 7 and 7-1.

[0062] The embodiment of the present invention also provides a corresponding device for the terminal traffic proxy method, which is applied to a user terminal that has pre-installed a data packet capture driver module in the kernel space protocol stack, further making the method more practical. Among them, the device can be described from the perspective of functional modules and hardware. The terminal traffic proxy device provided by the embodiment of the present invention is introduced below. The terminal traffic proxy device described below and the terminal traffic proxy method described above can be referred to each other.

[0063] From the perspective of functional modules, see Figure 3 , Figure 3 A structural diagram of a terminal traffic proxy device provided in an embodiment of the present invention in a specific implementation manner, the device may include:

[0064] The driver pre-built-in module 301 is used to install a data packet capture driver module in the kernel space protocol stack;

[0065] The address acquisition module 302 is used to acquire the target address of the target traffic data packet when the target traffic data packet is captured;

[0066] The traffic filtering and forwarding module 303 is used to filter the target traffic data packets according to whether the target address is a tunnel port, and encapsulate the target traffic data packets that are not tunnel ports to forward all traffic data packets of the user terminal through the tunnel port.

[0067] Optionally, in some implementations of this embodiment, the traffic filtering and forwarding module 303 may be further used to:

[0068] If the target address is the tunnel port of the tunnel server, the target traffic data packet is directly forwarded to the tunnel server through the tunnel port;

[0069] If the target address is not a tunnel port, the target traffic data packet is forwarded to the user space for data packet encapsulation, and the encapsulated traffic data packet is forwarded to the tunnel server through the tunnel port.

[0070] As an optional implementation of the above embodiment, the above device may also include a storage module for sending the data traffic packet encapsulated in the user space to the protocol stack of the kernel space.

[0071] Optionally, in some other implementations of this embodiment, the above-mentioned device may further include a traffic sending module, which is used for the tunnel server to receive the target traffic data packet and forward it to the corresponding target business system according to the destination address of the target traffic data packet.

[0072] As an optional implementation of the above embodiment, the above traffic sending module can also be used for: if the tunnel service is deployed in a gateway device, the target traffic data packet belonging to the transparent proxy is directly forwarded to the corresponding target business system.

[0073] As another optional implementation of the above embodiment, the above traffic sending module can be further used for: if the target traffic data packet is the traffic of the port NAT, the target traffic data packet is forwarded to the corresponding target business system through the NAT service.

[0074] As another optional implementation of the above embodiment, the above traffic sending module can be further used for: if the target traffic data packet is the traffic of the reverse proxy, the target traffic data packet is forwarded to the corresponding target business system through the reverse proxy process.

[0075] The functions of the functional modules of the terminal traffic proxy device in the embodiment of the present invention can be specifically implemented according to the method in the above method embodiment. The specific implementation process can refer to the relevant description of the above method embodiment, which will not be repeated here.

[0076] It can be seen from the above that the embodiments of the present invention can effectively ensure the stability, flexibility and compatibility of the traffic proxy tunnel.

[0077] The terminal traffic proxy device mentioned above is described from the perspective of a functional module. Furthermore, the present application also provides an electronic device, which is described from the perspective of hardware. Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application in one implementation manner. Figure 4As shown, the electronic device includes a memory 40 for storing a computer program; and a processor 41 for implementing the steps of the terminal traffic proxy method mentioned in any of the above embodiments when executing the computer program.

[0078] Among them, the processor 41 may include one or more processing cores, such as a 4-core processor, an 8-core processor, and the processor 41 may also be a controller, a microcontroller, a microprocessor or other data processing chip. The processor 41 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 41 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 41 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 41 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0079] The memory 40 may include one or more computer-readable storage media, which may be non-transitory. The memory 40 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices and flash storage devices. In some embodiments, the memory 40 may be an internal storage unit of an electronic device, such as a hard disk of a server. In other embodiments, the memory 40 may also be an external storage device of an electronic device, such as a plug-in hard disk equipped on a server, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. Further, the memory 40 may also include both an internal storage unit of an electronic device and an external storage device. The memory 40 can not only be used to store application software and various types of data installed in the electronic device, such as: the code of the program in the process of executing the terminal traffic proxy method, but also can be used to temporarily store data that has been output or is to be output. In this embodiment, the memory 40 is at least used to store the following computer program 401, wherein, after the computer program is loaded and executed by the processor 41, the relevant steps of the terminal traffic proxy method disclosed in any of the aforementioned embodiments can be implemented. In addition, the resources stored in the memory 40 may also include an operating system 402 and data 403, and the storage method may be temporary storage or permanent storage. The operating system 402 may include Windows, Unix, Linux, etc. The data 403 may include but is not limited to data corresponding to the terminal traffic proxy result.

[0080] In some embodiments, the electronic device may further include a display screen 42, an input / output interface 43, a communication interface 44 or a network interface, a power supply 45 and a communication bus 46. Among them, the display screen 42 and the input / output interface 43 such as a keyboard belong to the user interface, and the optional user interface may also include a standard wired interface, a wireless interface, etc. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an OLED (Organic Light-Emitting Diode) touch device, etc. The display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the electronic device and to display a visual user interface. The communication interface 44 may optionally include a wired interface and / or a wireless interface, such as a WI-FI interface, a Bluetooth interface, etc., which is usually used to establish a communication connection between the electronic device and other electronic devices. The communication bus 46 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0081] Those skilled in the art will understand that Figure 4 The structure shown in the figure does not constitute a limitation on the electronic device, and may include more or fewer components than those shown in the figure, for example, it may also include a sensor 47 for realizing various functions.

[0082] The functions of the functional modules of the electronic device in the embodiment of the present invention can be specifically implemented according to the method in the above method embodiment. The specific implementation process can refer to the relevant description of the above method embodiment, which will not be repeated here.

[0083] It can be seen from the above that the embodiments of the present invention can effectively ensure the stability, flexibility and compatibility of the traffic proxy tunnel.

[0084] It is understandable that if the terminal traffic proxy method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium to execute all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), electrically erasable programmable ROM, register, hard disk, multimedia card, card-type memory (such as SD or DX memory, etc.), magnetic memory, removable disk, CD-ROM, disk or optical disk, etc. Various media that can store program codes.

[0085] Based on this, an embodiment of the present invention further provides a readable storage medium storing a computer program, and when the computer program is executed by a processor, the steps of the terminal traffic proxy method in any of the above embodiments are performed.

[0086] The present invention also provides a terminal traffic proxy system, see Figure 5 The system may include a user terminal 501 and a tunnel server 502; the user terminal 501 and the tunnel server 502 transmit traffic data packets through a tunnel port.

[0087] The user terminal 501 can be any user terminal device such as a PC, a server, a tablet, etc. The user terminal 501 has a built-in computer program that implements any of the above terminal traffic proxy method embodiments, and implements the steps of any of the above terminal traffic proxy methods when executing the computer program stored in the memory.

[0088] The functions of the functional modules of the terminal traffic proxy system of the embodiment of the present invention can be specifically implemented according to the method in the above method embodiment. The specific implementation process can refer to the relevant description of the above method embodiment, which will not be repeated here.

[0089] It can be seen from the above that the embodiments of the present invention can effectively ensure the stability, flexibility and compatibility of the traffic proxy tunnel.

[0090] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the hardware disclosed in the embodiments, including devices and electronic devices, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part.

[0091] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0092] The above is a detailed introduction to a terminal traffic proxy method, device, system, electronic device and readable storage medium provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A terminal traffic proxy method, characterized in that: Applicable to user terminals that pre-install the packet capture driver module in the kernel space protocol stack, including: When a target traffic data packet is captured, a target address of the target traffic data packet is obtained; If the target address is the tunnel port of the tunnel server, the target traffic data packet is directly forwarded to the tunnel server through the tunnel port; if the target address is not a tunnel port, the target traffic data packet is forwarded to the user space for data packet encapsulation, and the encapsulated traffic data packet is forwarded to the tunnel server through the tunnel port, so as to forward all traffic data packets of the user terminal through the tunnel port.

2. The terminal traffic proxy method according to claim 1, characterized in that: After the target traffic data packet is forwarded to the user space for data packet encapsulation, the method further includes: The data traffic packet encapsulated in the user space is sent to the protocol stack in the kernel space.

3. The terminal traffic proxy method according to claim 1 or 2, characterized in that: After forwarding all traffic data packets of the user terminal through the tunnel port, the method further includes: The tunnel server receives the target traffic data packet and forwards it to the corresponding target business system according to the destination address of the target traffic data packet.

4. The terminal traffic proxy method according to claim 3, characterized in that: The forwarding of the target traffic data packet to the corresponding target service system according to the destination address thereof includes: If the tunnel service is deployed in a gateway device, the target traffic data packets belonging to the transparent proxy will be directly forwarded to the corresponding target business system.

5. The terminal traffic proxy method according to claim 3, characterized in that: The forwarding of the target traffic data packet to the corresponding target service system according to the destination address thereof includes: If the target traffic data packet is the traffic of port NAT, the target traffic data packet is forwarded to the corresponding target business system through the NAT service.

6. The terminal traffic proxy method according to claim 3, characterized in that: The forwarding of the target traffic data packet to the corresponding target service system according to the destination address thereof includes: If the target traffic data packet is the traffic of a reverse proxy, the target traffic data packet is forwarded to the corresponding target business system through the reverse proxy process.

7. A terminal traffic proxy device, characterized in that: Applied to user terminals, including: The driver has a pre-built-in module for installing the packet capture driver module in the kernel space protocol stack; An address acquisition module, used for acquiring a target address of a target traffic data packet when a target traffic data packet is captured; A traffic filtering and forwarding module is used to forward the target traffic data packet directly to the tunnel server through the tunnel port if the target address is the tunnel port of the tunnel server; if the target address is not a tunnel port, forward the target traffic data packet to the user space for data packet encapsulation, and forward the encapsulated traffic data packet to the tunnel service through the tunnel port, so as to forward all traffic data packets of the user terminal through the tunnel port.

8. An electronic device, characterized in that: A user terminal applied to pre-install a data packet capture driver module in a kernel space protocol stack comprises a processor and a memory, wherein the processor is used to implement the steps of the terminal traffic proxy method as claimed in any one of claims 1 to 6 when executing a computer program stored in the memory.

9. A readable storage medium, characterized in that: Applied to a user terminal in which a data packet capture driver module is pre-installed in a kernel space protocol stack, the readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the terminal traffic proxy method as described in any one of claims 1 to 6 are implemented.

10. A terminal traffic proxy system, characterized in that: It includes a user terminal and a tunnel server; Wherein, the user terminal and the tunnel server transmit traffic data packets through the tunnel port; The user terminal is used to implement the steps of the terminal traffic proxy method as claimed in any one of claims 1 to 6 when executing the computer program stored in the memory.

Images