Data Transmission Method, Device, Electronic Device and Computer Readable Storage Medium

Abstract

The present application provides a data transmission method, apparatus, electronic device, and computer-readable storage medium. Among them, the method includes: loading a pre-defined obfuscation description file, where the obfuscation protocol for obfuscation processing is recorded in the obfuscation description file; using the obfuscation protocol to perform obfuscation processing on the message to be sent to obtain an obfuscated message; and sending the obfuscated message to the server.

Description

Technical Field

[0001] This application relates to the field of data transmission technologies, and more particularly, to a data transmission method, apparatus, electronic device, and computer-readable storage medium. Background Art

[0002] Protocol mimicry in a network environment refers to disguising one network protocol as another common network protocol, making it difficult for attackers to identify the disguised protocol from a large amount of normal communication traffic, so as to achieve the purpose of protecting secure communication. However, the current method of protocol mimicry is implemented using hard coding, resulting in a relatively large overhead for protocol changes. Summary of the Invention

[0003] In view of this, the purpose of the embodiments of this application is to provide a data transmission method, apparatus, electronic device, and computer-readable storage medium to improve the existing protocol mimicry implemented using hard coding, which results in a relatively large overhead for protocol changes.

[0004] In a first aspect, an embodiment of this application provides a data transmission method, including: loading a pre-defined obfuscation description file, where the obfuscation description file records an obfuscation protocol for obfuscation processing; using the obfuscation protocol to perform obfuscation processing on a message to be sent to obtain an obfuscated message; and sending the obfuscated message to a server.

[0005] In the above embodiment, since the obfuscation description file is pre-defined based on the protocol description, different protocols can be quickly adapted without hard coding, and the mimicry is more realistic. Since it is presented in the form of an obfuscation description file, the overhead required for protocol updates and new additions can also be smaller, reducing the resource cost of data obfuscation.

[0006] In an optional implementation manner, the step of using the obfuscation protocol to perform obfuscation processing on a message to be sent to obtain an obfuscated message includes: configuring a message header for the message to be sent according to the obfuscation protocol, where the message header includes: a message sequence number, a first timestamp, and a message identification code; and forming an obfuscated message based on the message to be sent and the message header.

[0007] In an optional implementation manner, before the step of using the obfuscation protocol to perform obfuscation processing on a message to be sent to obtain an obfuscated message, the method further includes: saving the message to be sent; constructing an obfuscated handshake message according to the obfuscation protocol; and performing a handshake with the server through the obfuscated handshake message.

[0008] In an optional implementation manner, the obfuscation protocol records a message construction method for the handshake stage; the obfuscated handshake message includes a first obfuscated handshake message.

[0009] Constructing the obfuscated handshake message according to the obfuscation protocol includes: generating a socket identification number according to the message construction method; obtaining the initial sequence number and the second timestamp of the message; and forming a first obfuscated handshake message according to the socket identification number, the initial sequence number, and the second timestamp.

[0010] In an optional embodiment, the obfuscated handshake message includes a second obfuscated handshake message;

[0011] The method further includes: receiving the authentication cookie and the target IP address sent by the server; updating the initial sequence number to obtain the current sequence number; obtaining the third timestamp of the message; forming a second obfuscated handshake message according to the socket identification number, the current sequence number, and the third timestamp; and performing a handshake with the server using the second obfuscated handshake message.

[0012] In an optional embodiment, before loading the predefined obfuscation protocol, the method further includes: establishing a session with the server; wherein, sending the obfuscated message to the server includes: sending the obfuscated message to the server according to the proposed session.

[0013] In an optional embodiment, establishing the session with the server includes: if the communication protocol with the server is the Transmission Control Protocol, establishing a session with the server by performing handshakes with the server multiple times; if the communication protocol with the server is the User Datagram Protocol, triggering the establishment of a session with the server by a message with a payload.

[0014] In an optional embodiment, the obfuscation protocol includes: an attribute protocol, an object protocol, an action protocol, a dynamic protocol, and an overall protocol;

[0015] The content defined in the attribute protocol includes: the protocol name, the multi-layer protocol type, and the version information corresponding to the obfuscation protocol;

[0016] The content defined in the object protocol includes: the configuration information and action information of multiple stages between the client and the server, wherein the multiple stages include: the initialization stage, during the communication process, and the communication end stage;

[0017] The content defined in the action protocol includes: the differential processing of different protocols when the communication state changes;

[0018] The content defined in the dynamic protocol includes: variables set during the packet encapsulation process, external function calls, and context-related calculations;

[0019] The content defined in the overall protocol includes: the format order of the packets.

[0020] In the above implementation, the extensibility of protocol obfuscation can be greatly improved by defining various contents in the obfuscation description file, enabling support for custom tag extension and wide compatibility with the obfuscation of binary and text protocols.

[0021] In an optional implementation, the loading of the predefined obfuscation description file includes: loading the predefined obfuscation description file; constructing an obfuscation processing engine according to the obfuscation description file; and the using of the obfuscation protocol to perform obfuscation processing on the message to be sent to obtain an obfuscated message, including: using the obfuscation processing engine to perform obfuscation processing on the message to be sent to obtain an obfuscated message.

[0022] In a second aspect, an embodiment of the present application provides a data transmission device, including:

[0023] A loading module, configured to load a predefined obfuscation description file, where the obfuscation protocol for obfuscation processing is recorded in the obfuscation description file;

[0024] A processing module, configured to use the obfuscation protocol to perform obfuscation processing on the message to be sent to obtain an obfuscated message;

[0025] A sending module, configured to send the obfuscated message to the server.

[0026] In a third aspect, an embodiment of the present application provides an electronic device, including: a processor and a memory, where the memory stores machine-readable instructions executable by the processor, and when the electronic device runs, the machine-readable instructions are executed by the processor to perform the steps of the above method.

[0027] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is run by a processor, it performs the steps of the above method.

[0028] To make the above objects, features, and advantages of the present application more obvious and understandable, specific embodiments are hereinafter given, and detailed descriptions are made in conjunction with the accompanying drawings as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] To more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can be obtained based on these drawings without creative efforts.

[0030] Figure 1 A schematic diagram of the interaction between the server and the client terminal provided by the embodiment of the present application;

[0031] Figure 2 A block diagram of the electronic device provided by the embodiment of the present application;

[0032] Figure 3 A flowchart of the data transmission method provided by the embodiment of the present application;

[0033] Figure 4 Another flowchart of the data transmission method provided by the embodiment of the present application;

[0034] Figure 5 Yet another flowchart of the data transmission method provided by the embodiment of the present application;

[0035] Figure 6 A schematic diagram of the functional modules of the data transmission device provided by the embodiment of the present application. Detailed implementation manners

[0036] Next, the technical solutions in the embodiments of the present application will be described with reference to the accompanying drawings in the embodiments of the present application.

[0037] It should be noted that: Similar reference numerals and letters denote similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of the present application, the terms "first", "second", etc. are only used for distinguishing descriptions and cannot be understood as indicating or implying relative importance.

[0038] Currently, with the development of information technology and the popularization of network applications, various different information services can be transmitted through the network, and the supervision of network communication traffic has become a major concern. It is difficult to protect the traffic characteristics of the information in the segment format, packet format, and frame format used in the information data transmission process through encryption and other means. Usually, it is necessary to intercept the protocols and traffic in the communication process through deep packet inspection, traffic classification based on transmission behavior, or machine learning technology, and then process the abnormal traffic, and finally achieve the management and control of the communication traffic.

[0039] For the traffic supervision technology, many different types of evasion tools have been derived to avoid some important security packets from being misintercepted and improve the transmission success rate of the packets. For traffic supervision, the transmission of packets is mainly achieved through two aspects: encryption and obfuscation. Among them, the obfuscation of protocols is divided into three ways: randomization, tunneling, and protocol mimicry. Protocol mimicry aims to obfuscate the traffic characteristics of the target protocol and the original protocol, so as to increase the difficulty of detecting this traffic. Protocol mimicry in the network environment means disguising one network protocol (source protocol) as another common network protocol (target protocol), making it difficult for attackers to identify the disguised protocol from a large amount of communication traffic, so as to achieve the purpose of secure and effective communication.

[0040] Some of the current traffic supervision technologies mainly include: One processing method is to hide the target address, which requires the use of a camouflage algorithm. For protocols similar to HTTPS, information such as the CA digital certificate signature public key, identity information, random number, and quantum key also needs to be carried. This processing method has the risk of exposing features; Another processing method is to use a database to store protocol and system features, and the focus of mimicry is on the operating system rather than the application layer communication protocol; There is also a processing method that SimpleObfs provides a point-to-point obfuscation proxy for third-party applications as a plugin. FTEProxy uses regular expression technology to template the obfuscation protocol and can convert the TCP communication of external applications into a supported obfuscation protocol. This processing method is implemented by hard coding, and the protocol update and new addition have relatively large overheads.

[0041] Based on the above research, a data transmission method, device, electronic device, and computer-readable storage medium provided by this application can pre-define an obfuscation description file based on protocol descriptions, which can make the overhead required for protocol updates and new additions smaller and reduce the resource cost of data obfuscation.

[0042] To facilitate the understanding of this embodiment, first, a detailed introduction to the operating environment for executing a data transmission method disclosed in this application embodiment is provided.

[0043] As Figure 1 shown, it is a schematic diagram of the interaction between the server 110 and the client terminal 120 provided by this application embodiment. The server 110 is communicatively connected to one or more client terminals 120 through a network for data communication or interaction. The server 110 can be a network server, a database server, etc. The local terminal can be a personal computer (PC), a tablet computer, a smart phone, a personal digital assistant (PDA), etc.

[0044] In this embodiment, a client can run in the client terminal 120, and a pre-obfuscator can run in the client. Through the pre-obfuscator, the message to be transmitted can be obfuscated to improve the success rate of message transmission.

[0045] In this embodiment, the above pre-obfuscator is a set of pre-obfuscators constructed based on protocol descriptions. The pre-obfuscator mainly consists of four components: an obfuscation description file, a parser, an assembler, and an executor. Each parser, assembler, and executor is used to perform obfuscation processing at each stage. Among them, the execution standards for the parser, assembler, and executor to perform obfuscation processing can be defined in the obfuscation description file.

[0046] A server can run in Server 110. The server can be used to receive data from a client and parse the received message in a manner agreed upon in the pre - obfuscator to obtain the original message.

[0047] As Figure 2 shown, it is a block diagram of an electronic device. The electronic device 200 can include a memory 211 and a processor 213. Those of ordinary skill in the art can understand that Figure 2 the structure shown is only illustrative and does not limit the structure of the electronic device 200. For example, the electronic device 200 may further include more or fewer components than Figure 2 shown, or have a different configuration from Figure 2 shown.

[0048] Exemplarily, Figure 1 the server 110 and the client terminal 120 shown can include Figure 2 the components of the electronic device 200 shown. Of course, if there are more functional requirements, the server 110 and the client terminal 120 can also include more components than Figure 2 the electronic device 200 shown.

[0049] The above - mentioned memory 211 and the processor 213 are directly or indirectly electrically connected to each other to achieve data transmission or interaction. For example, these elements can be electrically connected to each other through one or more communication buses or signal lines. The above - mentioned processor 213 is used to execute the executable module stored in the memory.

[0050] Among them, the memory 211 can be, but is not limited to, random access memory (Random Access Memory, abbreviated as RAM), read - only memory (Read Only Memory, abbreviated as ROM), programmable read - only memory (Programmable Read - Only Memory, abbreviated as PROM), erasable programmable read - only memory (Erasable Programmable Read - Only Memory, abbreviated as EPROM), electrically erasable programmable read - only memory (Electric Erasable Programmable Read - Only Memory, abbreviated as EEPROM), etc. Among them, the memory 211 is used to store a program. After receiving an execution instruction, the processor 213 executes the program. The method executed by the electronic device 200 defined in any embodiment of the present application can be applied to the processor 213 or implemented by the processor 213.

[0051] The above-mentioned processor 213 may be an integrated circuit chip with signal processing capabilities. The above-mentioned processor 213 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. It can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0052] The electronic device 200 in this embodiment can be used to execute each step in the various methods provided in the embodiments of the present application. The implementation process of the data transmission method will be described in detail through several embodiments below.

[0053] Please refer to Figure 3 , which is a flowchart of the data transmission method provided in the embodiments of the present application. The data transmission method provided in this embodiment can be applied to Figure 2 the electronic device shown. The following will elaborate in detail on Figure 3 the specific process shown.

[0054] Step 320, load a pre-defined obfuscation description file.

[0055] The obfuscation description file records an obfuscation protocol for obfuscation processing.

[0056] In this embodiment, a pre-defined obfuscation description file can be loaded, and then an obfuscation processing engine can be constructed according to the obfuscation description file.

[0057] In the electronic device that executes the steps in the data transmission method of this embodiment, a client can run. The client has a data transmission requirement. After each startup of the client, a pre-defined obfuscation description file can be loaded, and an obfuscation processing engine can be constructed according to the obfuscation description file.

[0058] The obfuscation processing engine can implement the obfuscation-related processing of the messages during the data transmission process. Exemplarily, the obfuscation processing engine may mainly include three components, a parser, an assembler, and an executor.

[0059] Among them, the parser is used to implement the parsing of protocol formats, the parsing of obfuscated communication processes and actions; the assembler is used to implement the encapsulation of data packets; the executor is used to send the obfuscated message according to the agreed actions.

[0060] Step 340, use this obfuscation protocol to obfuscate the message to be sent to obtain an obfuscated message.

[0061] The constructed obfuscation processing engine can be used to obfuscate the message to be sent to obtain an obfuscated message.

[0062] Exemplarily, a message header can be configured for the message to be sent according to this obfuscation protocol. The message header includes: a message sequence number, a first timestamp, and a message identification code.

[0063] Then, according to the message to be sent and this message header, an obfuscated message is formed. Exemplarily, the message to be sent and the message header of the message to be sent can be encapsulated.

[0064] This obfuscated message can be the message to be sent with a message header added.

[0065] In the above example, the encapsulation of the message to be sent and the message header of the message to be sent can be implemented through the assembler in the obfuscation processing engine.

[0066] Among them, according to different protocols, the types of this message header are different. Taking the User Datagram Protocol (UDP)-based Data Transfer Protocol (UDT) protocol as an example, the message header added to the message to be sent can be the data message header of UDT.

[0067] Among them, the obfuscation parameters included in this message header can include a message sequence number, a first timestamp, and a message identification code.

[0068] This message identification code is the unique identification code of the message to be sent, and this unique identification code can remain unchanged.

[0069] This message sequence number can be set according to the number of messages transmitted after the client starts. For example, for each message sent by the client, the message header of each message contains a sequence number, and this sequence number can be the number sent by the real-time client. For example, if the message to be sent is the third message transmitted after the client starts, then this message sequence number can be 2.

[0070] In one example, the message header in this obfuscated data can be implemented in the following way:

[0071]

[0072] Step 360, send the obfuscated message to the server.

[0073] In the above example, the obfuscated message can be sent to the server through the executor in the obfuscation processing engine.

[0074] In the above embodiment, based on the protocol description, an obfuscation description file is predefined, so that different protocols can be quickly adapted without hard coding, and the mimicry is more realistic. Since it is presented in the form of an obfuscation description file, the overhead required for protocol update and addition can be smaller, reducing the resource cost of data obfuscation.

[0075] Under some protocols, handshaking is involved in the obfuscation process. Based on this, before obfuscating the message to be sent, it is possible to first check whether a handshake with the server is required. Before step 340, as Figure 4 shown, the data transmission method may further include: steps 331 to 333.

[0076] Step 331, save the message to be sent.

[0077] After completing the handshake with the server, the message to be sent can be obtained and processed.

[0078] Step 332, construct an obfuscated handshake message according to the obfuscation protocol.

[0079] Step 333, perform a handshake with the server through the obfuscated handshake message.

[0080] Exemplarily, the constructed obfuscation processing engine can be used to construct the obfuscated handshake message; perform a handshake with the server through the obfuscated handshake message.

[0081] In this embodiment, the obfuscation protocol records the message construction method in the handshake phase; the obfuscated handshake message includes a first obfuscated handshake message.

[0082] Exemplarily, the obfuscation protocol may include an overall protocol, which may contain the message construction method in the handshake phase. The message construction method in the handshake phase partially defines the message structure and variable information involved in the handshake phase.

[0083] Taking the UDT protocol as an example, it mainly defines control messages, data messages, and the control information fields of control messages in the handshake phase.

[0084] This step 332 may include: generating a socket identification number according to the message construction method; obtaining the initial sequence number and the second timestamp of the message; forming a first obfuscated handshake message according to the socket identification number, the initial sequence number, and the second timestamp.

[0085] In one example, the initial sequence number can be set to 0. The second timestamp can be the formation time of the first obfuscated handshake message.

[0086] Exemplarily, the type specification can be 0x0000 for a handshake packet. The socket identification number (socketid) can be randomly generated or can be the socket descriptor used for communication between the client and the server.

[0087] In one example, it can be through <funset>and <set>Set the relevant content of the first obfuscated handshake message. In the obfuscation protocol, this part of the definition can be implemented through the following example:

[0088]

[0089] In this embodiment, the obfuscated handshake message includes a second obfuscated handshake message. After step 333, the following steps may also be included.

[0090] Step 334, receive the authentication cookie and the target IP address sent by the server.

[0091] After step 333 is completed, it is possible to wait for the server to complete the response to the previous step. After the server responds, the authentication cookie and the target IP address sent by the server can be received. The target IP address may be the IP address of the peer.

[0092] Step 335, update the initial sequence number to obtain the current sequence number.

[0093] Exemplarily, the current sequence number can be incremented based on the initial sequence number. For example, if the initial sequence number is 0, then the current sequence number can be 1.

[0094] Step 336, obtain the third timestamp of the message; according to the socket identification number, the current sequence number, and the third timestamp, form a second obfuscated handshake message.

[0095] Step 337, use the second obfuscated handshake message to perform a handshake with the server.

[0096] Exemplarily, when performing the second handshake with the server through steps 335 to 337, the control information parameters remain unchanged, and a handshake is performed with the server again.

[0097] In one example, the second obfuscated handshake message is used to perform a second handshake with the server again. In the obfuscation protocol, this part of the definition can be implemented through the following example:

[0098]

[0099] Before data transmission, it is possible to first propose a meeting with the server. Based on this, before step 320, as Figure 5 shown, the data transmission method of this embodiment further includes: step 310, establish a session with the server.

[0100] After the session is established, the above step 360 may include: sending the obfuscated message to the server according to the proposed session.

[0101] Due to the differences in the communication protocols between the client and the server, the methods for establishing sessions may also be different.

[0102] Optionally, if the communication protocol with the server is the Transmission Control Protocol, a session with the server is established by performing handshakes with the server multiple times.

[0103] Optionally, if the communication protocol with the server is the User Datagram Protocol, the establishment of a session with the server is triggered by a packet with a payload.

[0104] In this embodiment, the obfuscation protocol includes: an Attributes protocol, an Object protocol, an Action protocol, a Dynamic protocol, and a Format protocol.

[0105] The content in the Attributes protocol can represent the attributes of the current obfuscation protocol. The content defined in this Attributes protocol includes: the protocol name, the multi-layer protocol type, and the version information corresponding to the obfuscation protocol. The multi-layer protocol type can be a three-layer protocol type, for example, the TCP protocol, the UDP protocol, etc. The version information corresponding to the obfuscation protocol can be the version number corresponding to the obfuscation protocol.

[0106] The Object protocol is mainly used to describe the actions and configurations in the initialization stage, during the communication process, and at the end of the communication process between the client and the server. It can define whether to include handshakes, external dependency loading, variable parameter lists, etc. Exemplarily, the content defined in this Object protocol includes: the configuration information and action information in multiple stages between the client and the server, where the multiple stages include: the initialization stage, during the communication process, and at the end of the communication process.

[0107] The content defined in the Action protocol can be used to represent the differential processing of different protocols when the communication state changes. Exemplarily, the content defined in this Action protocol includes: the differential processing of different protocols when the communication state changes. For example, the communication state change can be communication close, or the communication state change can be an error, etc.

[0108] The content defined in the Dynamic protocol includes: variables set during the packet encapsulation process, external function calls, and context-related calculations.

[0109] The content defined in the overall protocol can be used to represent the complete protocol format. Exemplarily, the content defined in the overall protocol includes: the format sequence of packets. Each part of the complete protocol format supports the extension of optional attributes (options) and private tag items. The complete protocol format can at least include a content part, which is used to agree to fill the obfuscated protocol header on the original traffic header to be sent. For protocols with handshakes (such as tls, ws, quic), it can include two parts: handshake-head and handshake-data.

[0110] Taking the UDT protocol as an example, the content of this overall protocol part can be shown as follows:

[0111]

[0112]

[0113]

[0114] In the above example, the overall protocol part defines the packet structure and variable information involved in the handshake stage and the data transmission stage. In the above UDT protocol example, it mainly includes control packets, data packets, and the control information fields of control packets in the handshake stage.

[0115] Taking the UDT protocol as an example, the content of this object protocol part can be shown as follows:

[0116]

[0117] In the object protocol in the above example, taking the client direction as an example, it describes the operation method of binding variables to key fields during the obfuscation process: for example, sequence is randomly generated by the client during the client handshake, and subsequent communication data gradually increases; the control information option field variables cookie and ipaddr are generated by the server, and are initialized to empty in the client direction, and need to be set after parsing the server handshake packet. In addition to the variable part, the object protocol also defines the reference to external dependent functions, which assign values to variables during execution. In the above example, random number generation and time acquisition functions are used to generate related fields during the initialization handshake process and the data communication process.

[0118] Exemplarily, the obfuscation protocol may further include a field: <obfs protocol="udt" type="udp" version="4.0">, where protocol="udt", type="udp", and version="4.0" respectively represent the name of the obfuscation protocol udt represented by the current description file, the three-layer communication protocol type udp, and the protocol version number 4.0 supported currently.

[0119] In the embodiments of the present application, a general description method for the obfuscation protocol is proposed, which can solve the problem of consistent processing of the obfuscation protocol, can adapt to different protocols relatively faster without using hard-coding, and the mimicry is more realistic. The pre-obfuscator mentioned in the embodiments of the present application can be applied to the application obfuscation between nodes in network communication applications and can support the obfuscation of TCP and UDP protocols.

[0120] Based on the same inventive concept, the embodiments of the present application also provide a data transmission device corresponding to the data transmission method. Since the principle of solving problems by the device in the embodiments of the present application is similar to that of the foregoing data transmission method embodiments, the implementation of the device in this embodiment can refer to the description in the method embodiments above, and the repeated parts will not be elaborated.

[0121] Please refer to Figure 6 , which is a schematic diagram of the functional modules of the data transmission device provided by the embodiments of the present application. Each module in the data transmission device in this embodiment is used to execute each step in the above method embodiments. The data transmission device includes: a loading module 410, a processing module 420, and a sending module 430; the content of each module is as follows:

[0122] The loading module 410 is used to load a pre-defined obfuscation description file, and the obfuscation protocol for obfuscation processing is recorded in the obfuscation description file;

[0123] The processing module 420 is used to obfuscate the message to be sent using the obfuscation protocol to obtain an obfuscated message;

[0124] The sending module 430 is used to send the obfuscated message to the server.

[0125] In a possible implementation manner, the processing module 420 is used to configure a message header for the message to be sent according to the obfuscation protocol. The message header includes: a message sequence number, a first timestamp, and a message identification code; an obfuscated message is formed according to the message to be sent and the message header.

[0126] In a possible implementation manner, the data transmission device of this embodiment may further include: a handshake module, configured to save the message to be sent; construct a confused handshake message according to the confusion protocol; and perform a handshake with the server through the confused handshake message.

[0127] In a possible implementation manner, the message construction method in the handshake stage is recorded in the confusion protocol; the confused handshake message includes a first confused handshake message.

[0128] The handshake module is configured to generate a socket identification number according to the message construction method; obtain the initial sequence number and the second timestamp of the message; and form a first confused handshake message according to the socket identification number, the initial sequence number, and the second timestamp.

[0129] In a possible implementation manner, the confused handshake message includes a second confused handshake message.

[0130] The above-mentioned handshake module is further configured to receive the authentication cookie and the target IP address sent by the server; update the initial sequence number to obtain the current sequence number; obtain the third timestamp of the message; form a second confused handshake message according to the socket identification number, the current sequence number, and the third timestamp; and perform a handshake with the server using the second confused handshake message.

[0131] In a possible implementation manner, the data transmission device of this embodiment further includes: an establishment module, configured to establish a session with the server; and the above-mentioned sending module 430, configured to send the confused message to the server according to the established session.

[0132] In a possible implementation manner, the above-mentioned establishment module is configured to, if the communication protocol with the server is the Transmission Control Protocol, establish a session with the server by performing handshakes with the server multiple times; if the communication protocol with the server is the User Datagram Protocol, trigger the establishment of a session with the server by a message with a payload.

[0133] In a possible implementation manner, the confusion protocol includes: an attribute protocol, an object protocol, an action protocol, a dynamic protocol, and an overall protocol.

[0134] The content defined in the attribute protocol includes: the protocol name, the multi-layer protocol type, and the version information corresponding to the confusion protocol.

[0135] The content defined in the object protocol includes: the configuration information and action information in multiple stages between the client and the server, where the multiple stages include: the initialization stage, the communication process, and the communication end stage.

[0136] The content defined in the action protocol includes: the differential processing of different protocols when the communication state changes.

[0137] The content defined in this dynamic protocol includes: variables set during the packet encapsulation process, external function calls, and context - related calculations;

[0138] The content defined in this overall protocol includes: the format sequence of the packet.

[0139] In a possible implementation manner, the above - mentioned loading module 410 is used to load a pre - defined obfuscation description file; and construct an obfuscation processing engine according to this obfuscation description file;

[0140] The above - mentioned processing module 420 is used to use this obfuscation processing engine to perform obfuscation processing on the message to be sent, so as to obtain an obfuscated message.

[0141] In addition, an embodiment of the present application also provides a computer - readable storage medium, on which a computer program is stored. When the computer program is run by a processor, it executes the steps of the data transmission method described in the above - mentioned method embodiment.

[0142] The computer program product of the data transmission method provided by the embodiment of the present application includes a computer - readable storage medium storing program code. The instructions included in the program code can be used to execute the steps of the data transmission method described in the above - mentioned method embodiment. For details, refer to the above - mentioned method embodiment, and details will not be repeated here.

[0143] In several embodiments provided by the present application, it should be understood that the disclosed device and method can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of the device, method, and computer program product according to multiple embodiments of the present application. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, and the module, program segment, or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementation manners, the functions marked in the blocks may occur in a different order from that marked in the accompanying drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes they can also be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware - based system for performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0144] In addition, in each embodiment of the present application, the functional modules can be integrated together to form an independent part, or each module can exist alone, or two or more modules can be integrated to form an independent part.

[0145] If the above-mentioned functions are implemented in the form of software function modules and sold or used as an independent product, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present application. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical discs that can store program codes. It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the term "including", "comprising", or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article, or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such a process, method, article, or device. Without further limitations, the elements defined by the statement "including..." do not exclude the existence of additional identical elements in the process, method, article, or device including the said elements.

[0146] The foregoing are only the preferred embodiments of the present application and are not used to limit the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included within the protection scope of the present application. It should be noted that similar reference numerals and letters denote similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0147] The above is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present application, and all should be covered by the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.< / set> < / funset>

Claims

1. A data transmission method, characterized in that, Including: Loading a pre-defined obfuscation description file, in which an obfuscation protocol for obfuscation processing is recorded; Using the obfuscation protocol to perform obfuscation processing on the message to be sent to obtain an obfuscated message, including: configuring a message header for the message to be sent according to the obfuscation protocol, where the message header includes: a message sequence number, a first timestamp, and a message identification code; forming an obfuscated message according to the message to be sent and the message header; Sending the obfuscated message to the server; The obfuscation protocol includes: an attribute protocol, an object protocol, an action protocol, a dynamic protocol, and an overall protocol; The content defined in the attribute protocol includes: a protocol name, a multi-layer protocol type, and version information corresponding to the obfuscation protocol; The content defined in the object protocol includes: configuration information and action information for multiple stages between the client and the server, where the multiple stages include: an initialization stage, during communication, and an end-of-communication stage; The content defined in the action protocol includes: differential processing of different protocols when the communication state changes; The content defined in the dynamic protocol includes: variables set during the packet encapsulation process, external function calls, and context-related calculations; The content defined in the overall protocol includes: the format order of the packet; 2. The method according to claim 1, wherein Before using the obfuscation protocol to perform obfuscation processing on the message to be sent to obtain an obfuscated message, the method further includes: Saving the message to be sent; Constructing an obfuscation handshake message according to the obfuscation protocol; Performing a handshake with the server through the obfuscation handshake message; 3. The method according to claim 2, characterized in that, The obfuscation protocol records the message construction method for the handshake stage; The obfuscation handshake message includes a first obfuscation handshake message; The constructing an obfuscation handshake message according to the obfuscation protocol includes: Generating a socket identification number according to the message construction method; Obtaining an initial sequence number and a second timestamp of the message; Forming a first obfuscation handshake message according to the socket identification number, the initial sequence number, and the second timestamp; 4. The method according to claim 3, characterized in that, The obfuscation handshake message includes a second obfuscation handshake message; The method further includes: Receiving an authentication cookie and a target IP address sent by the server; Updating the initial sequence number to obtain the current sequence number; Obtaining a third timestamp of the message; Forming a second obfuscation handshake message according to the socket identification number, the current sequence number, and the third timestamp; Performing a handshake with the server using the second obfuscation handshake message; 5. The method according to claim 1, wherein Before loading the pre-defined obfuscation protocol, the method further includes: Establishing a session with the server; Wherein, the sending the obfuscated message to the server includes: sending the obfuscated message to the server according to the recommended session; 6. The method according to claim 5, wherein The establishing a session with the server includes: If the communication protocol with the server is the Transmission Control Protocol, establishing a session with the server by performing handshakes with the server multiple times; If the communication protocol with the server is the User Datagram Protocol, triggering the establishment of a session with the server through a message with a payload; 7. The method according to any one of claims 1 to 6, characterized in that, The loading the pre-defined obfuscation description file includes: Loading the pre-defined obfuscation description file; Construct a confusion processing engine according to the described confusion description file; The step of using the confusion protocol to perform confusion processing on the message to be sent to obtain a confused message includes: Use the confusion processing engine to perform confusion processing on the message to be sent to obtain a confused message.

8. A data transmission device, characterized in that, It includes: A loading module for loading a pre-defined confusion description file, where the confusion protocol for confusion processing is recorded in the confusion description file; A processing module for using the confusion protocol to perform confusion processing on the message to be sent to obtain a confused message; A sending module for sending the confused message to the server; The processing module is used to configure a message header for the message to be sent according to the confusion protocol. The message header includes: a message sequence number, a first timestamp, and a message identification code; according to the message to be sent and the message header, a confused message is formed; The confusion protocol includes: an attribute protocol, an object protocol, an action protocol, a dynamic protocol, and an overall protocol; The content defined in the attribute protocol includes: the protocol name, the multi-layer protocol type, and the version information corresponding to the confusion protocol; The content defined in the object protocol includes: the configuration information and action information in multiple stages between the client and the server. Among them, the multiple stages include: the initialization stage, during communication, and the communication end stage; The content defined in the action protocol includes: the differential processing of different protocols when the communication state changes; The content defined in the dynamic protocol includes: variables set during the packet encapsulation process, external function calls, and context-related calculations; The content defined in the overall protocol includes: the format order of the packet; 9. An electronic device, characterized in that, It includes: A processor and a memory. The memory stores machine-readable instructions executable by the processor. When the electronic device runs, when the machine-readable instructions are executed by the processor, the steps of the method according to any one of claims 1 to 7 are executed.

10. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium. When the computer program is run by the processor, the steps of the method according to any one of claims 1 to 7 are executed.

Images