Processing method and device of access request and electronic equipment

Abstract

The application provides a processing method and device of an access request and electronic equipment, which can be used in the technical field of network security. The method comprises the following steps: receiving an access request and at least one data packet sent by an external device; processing the at least one data packet to obtain a second port number corresponding to the at least one data packet; if it is determined that a first port number in the access request is consistent with the second port number corresponding to the at least one data packet, the access request is sent to a first service; if it is determined that the first port number in the access request is inconsistent with the second port number corresponding to the at least one data packet, the access request is sent to a second service. The method of the application can improve the security of business services, and does not need to set software or hardware of a third party, thereby reducing the operation and maintenance cost.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus and electronic device for processing access requests. Background Technology

[0002] When a server provides business services to users on external devices, an authentication mechanism needs to be set up to authenticate each access request sent by the external device in order to ensure the security of the server.

[0003] In the prior art, a third-party proxy gateway is pre-configured to transmit access requests from external devices to the proxy gateway for authentication processing. The proxy gateway then transmits the access requests from the authenticated external devices to the corresponding target server.

[0004] However, the above methods require the deployment of third-party software or hardware to establish a proxy gateway, which poses a risk that access requests can be easily tampered with, affecting server security. Furthermore, setting up third-party software or hardware also increases maintenance costs. Summary of the Invention

[0005] This application provides a method, apparatus, and electronic device for processing access requests, in order to solve the problem of reduced server security caused by the need to configure third-party software or hardware to deploy a proxy gateway.

[0006] In a first aspect, this application provides a method for processing access requests, the method being applied to an electronic device, the electronic device having deployed a first service and a second service, the first service being an available business service, and the second service being a service for processing requests that do not conform to knock authentication; the method includes:

[0007] The system receives an access request and at least one data packet from an external device; wherein the access request is for requesting access to a first service, and the access request carries a first port number of the first service; the data packet includes encapsulated field data; and the first port number represents the communication identifier of the first service.

[0008] The at least one data packet is processed to obtain a second port number corresponding to the at least one data packet; wherein the second port number represents the communication identifier of the first service;

[0009] If it is determined that the first port number in the access request matches the second port number corresponding to the at least one data packet, then the access request is sent to the first service; wherein, the first service is used to process the access request.

[0010] If it is determined that the first port number in the access request is inconsistent with the second port number corresponding to the at least one data packet, the access request is sent to the second service; wherein the second service is used to process the access request.

[0011] In one example, each data packet has a reception time, which represents the time when the data packet was received;

[0012] Processing the at least one data packet to obtain the second port number corresponding to the at least one data packet includes:

[0013] For each receiving time, the data packets received at that receiving time are processed to obtain the data sequence corresponding to that receiving time;

[0014] Based on the time sequence of the at least one receiving time, the data sequences corresponding to each receiving time are combined to obtain the second port number.

[0015] In one example, for each received time, the data packets received at that time are processed to obtain the data sequence corresponding to that received time, including:

[0016] Determine the number of data packets received at each of the aforementioned reception times;

[0017] For each receiving time, the number of data packets received at that receiving time and the number of data packets received at that receiving time are calculated to obtain the data sequence corresponding to that receiving time.

[0018] In one example, processing the at least one data packet to obtain the second port number corresponding to the at least one data packet includes:

[0019] Determine the frequency information and the number information of the at least one data packet; wherein the frequency information represents the receiving frequency of the received data packet; and the number information represents the total number of data packets received.

[0020] The frequency information and the number information are calculated and processed to obtain the second port number.

[0021] In one example, each of the data packets has type information, which characterizes the type of the data packet;

[0022] The second port number is obtained by calculating and processing the frequency information and the number information, including:

[0023] The frequency information, the number information, and each type information are calculated and processed to obtain the port number corresponding to the at least one data packet.

[0024] In one example, after sending the access request to the second service, the process further includes:

[0025] Based on the second service, the access request is parsed and processed to obtain a processing result; wherein, the processing result indicates whether the access behavior corresponding to the access request is malicious behavior;

[0026] If it is determined that the processing result indicates that the behavior corresponding to the access request is malicious, then a prompt message is generated based on the access request; wherein, the prompt message indicates that the behavior corresponding to the access request is malicious, and the prompt message is used to prompt business personnel to process the access request;

[0027] If it is determined that the processing result indicates that the behavior corresponding to the access request is not malicious, then an access record is generated based on the access request; wherein the access record indicates the access behavior corresponding to the access request.

[0028] In one example, based on the second service, the access request is parsed and processed to obtain the processing result, including:

[0029] Based on the second service, the request field format of the access request is compared with the preset field format;

[0030] If it is determined that the request field format of the access request is inconsistent with the preset field format, then it is determined that the processing result indicates that the behavior corresponding to the access request is malicious behavior;

[0031] If it is determined that the request field format of the access request is consistent with the preset field format, then it is determined that the processing result indicates that the behavior corresponding to the access request is not malicious.

[0032] In one example, the method further includes:

[0033] For each of the data packets, if it is determined that the network protocol address of the data packet does not match the network protocol address of the access request, then the data packet is deleted from the at least one data packet.

[0034] Secondly, this application provides an access request processing apparatus, the apparatus being applied to an electronic device, the electronic device having a first service and a second service deployed thereon, the first service being an available business service, and the second service being a service for processing requests that do not conform to knock authentication; the apparatus includes:

[0035] A receiving unit is configured to receive an access request and at least one data packet sent by an external device; wherein the access request is for requesting access to a first service, and the access request carries a first port number of the first service; the data packet includes encapsulated field data; and the first port number represents the communication identifier of the first service.

[0036] A processing unit is configured to process the at least one data packet to obtain a second port number corresponding to the at least one data packet; wherein the second port number represents the communication identifier of the first service;

[0037] The first sending unit is configured to send the access request to the first service if it is determined that the first port number in the access request is consistent with the second port number corresponding to the at least one data packet; wherein the first service is configured to process the access request.

[0038] The second sending unit is configured to send the access request to the second service if it is determined that the first port number in the access request is inconsistent with the second port number corresponding to the at least one data packet; wherein the second service is configured to process the access request.

[0039] In one example, each data packet has a reception time, which represents the time when the data packet was received;

[0040] The receiving unit includes:

[0041] The first processing module is used to perform calculations on the data packets received at each receiving time to obtain the data sequence corresponding to that receiving time.

[0042] The combination module is used to combine the data sequences corresponding to each of the at least one receiving time according to the time order of the receiving time to obtain the second port number.

[0043] In one example, the first processing module includes:

[0044] The first processing submodule is used to determine the number of data packets received at each receiving time.

[0045] The determination submodule is used to calculate and process the data packets received at each receiving time and the number of data packets received at that receiving time to obtain the data sequence corresponding to that receiving time.

[0046] In one example, the processing unit includes:

[0047] The first determining module is used to determine the frequency information and the number information of the at least one data packet; wherein the frequency information represents the receiving frequency of the received data packet; and the number information represents the total number of data packets received.

[0048] The second processing module is used to calculate and process the frequency information and the number information to obtain the second port number.

[0049] In one example, each of the data packets has type information, which characterizes the type of the data packet;

[0050] The second processing module includes:

[0051] The second processing submodule is used to calculate and process the frequency information, the number information, and each type information to obtain the port number corresponding to the at least one data packet.

[0052] In one example, after the second sending unit sends the access request to the second service, the method further includes:

[0053] The parsing unit is used to parse the access request based on the second service to obtain a processing result; wherein the processing result indicates whether the access behavior corresponding to the access request is malicious behavior;

[0054] The first generation unit is configured to generate a prompt message based on the access request if it is determined that the processing result indicates that the behavior corresponding to the access request is malicious; wherein the prompt message indicates that the behavior corresponding to the access request is malicious, and the prompt message is used to prompt business personnel to process the access request;

[0055] The second generation unit is used to generate an access record based on the access request if it is determined that the processing result indicates that the behavior corresponding to the access request is not malicious; wherein the access record indicates the access behavior corresponding to the access request.

[0056] In one example, the parsing unit includes:

[0057] The comparison module is used to compare the request field format of the access request with a preset field format based on the second service;

[0058] The second determining module is used to determine that if the format of the request field of the access request is inconsistent with the preset field format, the processing result indicates that the behavior corresponding to the access request is malicious behavior.

[0059] The third determining module is used to determine that if the format of the request field of the access request is consistent with the preset field format, the processing result indicates that the behavior corresponding to the access request is not malicious.

[0060] In one example, the device further includes:

[0061] The deletion unit is configured to delete each data packet from the at least one data packet if it is determined that the network protocol address of the data packet does not match the network protocol address of the access request.

[0062] Thirdly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0063] The memory stores computer-executed instructions;

[0064] The processor executes computer execution instructions stored in the memory to implement the method described in the first aspect.

[0065] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method described in the first aspect.

[0066] Fifthly, this application provides a computer program product comprising: a computer program stored in a readable storage medium, wherein at least one processor of an electronic device can read the computer program from the readable storage medium, and the at least one processor executes the computer program to cause the electronic device to perform the method described in the first aspect.

[0067] The access request processing method, apparatus, and electronic device provided in this application, by simultaneously deploying available business services and services for handling requests that do not meet the knock authentication criteria, performs knock authentication on the received return request. Specifically, based on a preset knock authentication algorithm, the received data packet is processed to obtain the corresponding port number. The port number carried in the access request is compared with the calculated port number. If they match, the access request is sent to the available business service for processing; otherwise, it is sent to another deployed service to handle the access request that does not meet the knock authentication criteria. This improves the security of the deployed available business services and eliminates the need for third-party software or hardware, thereby reducing operational costs. Attached Figure Description

[0068] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0069] Figure 1 This application provides an illustration of an application scenario.

[0070] Figure 2 A flowchart illustrating an access request processing method provided in an embodiment of this application;

[0071] Figure 3 A flowchart illustrating another method for processing access requests provided in an embodiment of this application;

[0072] Figure 4 A schematic diagram of the structure of an access request processing device provided in an embodiment of this application;

[0073] Figure 5 A schematic diagram of another access request processing apparatus provided in an embodiment of this application;

[0074] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application;

[0075] Figure 7 This is a block diagram illustrating an electronic device according to an exemplary embodiment.

[0076] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0077] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0078] First, let me explain the terms used in this application:

[0079] Honeypot technology is a technique that attracts cyber attackers to access a real system. By deploying decoy hosts, network services, or information, it induces cyber attackers to launch attacks, thereby allowing the capture and analysis of attack behavior, understanding the tools and methods used by the cyber attackers, and enhancing the security capabilities of the real system through technical means.

[0080] Port knock authentication: This is a computer equivalent to a combination of digital locks. The appropriate combination of digital locks unlocks specific transmission protocol services to enable remote access.

[0081] Figure 1 This is a schematic diagram illustrating an application scenario provided in this application. For example... Figure 1 As shown, this scenario includes an external device 101 and an electronic device 102. A user can send an access request to the electronic device 102 via the external device 101, and the electronic device 102 will process the access request upon receiving it.

[0082] When a server provides business services to users on external devices, an authentication mechanism needs to be set up to authenticate each access request sent by the external device in order to ensure the security of the server.

[0083] In one example, a third-party proxy gateway is pre-configured to forward access requests from external devices to the proxy gateway for authentication. The proxy gateway then forwards the access requests from the authenticated external devices to the corresponding target server.

[0084] However, the above methods require the deployment of third-party software or hardware to establish a proxy gateway, which poses a risk that access requests can be easily tampered with, affecting server security. Furthermore, setting up third-party software or hardware also increases maintenance costs.

[0085] The access request processing method, apparatus, and electronic device provided in this application are intended to solve the above-mentioned technical problems of the prior art.

[0086] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0087] It should be noted that the method, apparatus, and electronic device for processing access requests in this application can be used in the field of network security technology, or in any field other than network security technology. The application field of the method, apparatus, and electronic device for processing access requests in this application is not limited.

[0088] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0089] Figure 2 A flowchart illustrating an access request processing method provided in an embodiment of this application is shown below. Figure 2 As shown, this method is applied to an electronic device, which has a first service and a second service deployed thereon. The first service is an available business service, and the second service is a service for handling requests that do not meet the knock authentication requirements. The method includes:

[0090] S101, Receive an access request and at least one data packet sent by an external device; wherein, the access request is used to request access to a first service, and the access request carries a first port number of the first service; the data packet includes encapsulated field data; the first port number represents the communication identifier of the first service.

[0091] For example, the execution subject of this embodiment can be an electronic device. First, to improve the security of the electronic device, an available business service, namely the first service, and a service for handling requests that do not meet the knock-on authentication criteria, namely the second service, are pre-deployed based on the electronic device. For example, a service system based on honeypot technology is provided externally by the same electronic device, reducing the intervention of proxies and eliminating the presence of a trusted third party. Users can generate access requests through external devices to request access to available business services. The access request carries the communication identifier of the available business service, namely the first port number. The external device first encapsulates the field data used for knock-on authentication processing to obtain N data packets, and sends these N data packets and the access request to the electronic device. The electronic device receives these N data packets and the access request sent by the external device. Here, N is an integer greater than or equal to 1.

[0092] S102. Process at least one data packet to obtain a second port number corresponding to at least one data packet; wherein the second port number represents the communication identifier of the first service.

[0093] For example, in order to improve the security of electronic devices, a knock-on authentication processing method for processing data packets is preset. For the received N data packets, the N data packets are processed based on the preset knock-on authentication processing method, and the parsed data corresponding to these N data packets can be obtained, that is, the second port number corresponding to these N data packets is obtained. The port number represents the communication identifier of the available business service deployed on the electronic device.

[0094] S103. If it is determined that the first port number in the access request is consistent with the second port number corresponding to at least one data packet, the access request is sent to the first service; wherein the first service is used to process based on the access request.

[0095] For example, to improve the security of electronic devices, a knock authentication processing method for processing data packets is pre-set based on the electronic devices; then, the port number obtained from processing all received data packets is compared with the port number carried in the received access request. If the two port numbers are found to be consistent, it indicates that the user who issued the return request is the target user served by the available business service. The electronic device will provide a port, which will send the received access request to the deployed available business service, and the business service will process the access request accordingly.

[0096] S104. If it is determined that the first port number in the access request is inconsistent with the second port number corresponding to at least one data packet, the access request is sent to the second service; wherein the second service is used to process the access request.

[0097] For example, to improve the security of electronic devices, a knock-on authentication method for processing data packets is pre-set on the electronic device. Then, the port number obtained from processing all received data packets is compared with the port number carried in the received access request. If the two port numbers are determined to be inconsistent, the access request has failed the knock-on authentication, indicating that the user who issued the return request is not the target user served by the real and available business service. To improve the security of the services deployed on the electronic device, it is necessary to capture some abnormal access requests and further analyze these access requests. The electronic device will provide a port that will send the received access requests to the deployed second service, that is, the service used to handle requests that do not meet the knock-on authentication, such as a service deployed based on honeypot technology. This service will process the access request accordingly, such as detecting the return request and setting some access control conditions based on the detection results to block some abnormal access requests.

[0098] This embodiment provides a method for processing access requests. By simultaneously deploying available business services and a service for handling requests that do not meet the knock authentication criteria, the received return request is knocked for authentication. Specifically, based on a preset knock authentication algorithm, the received data packet is processed to obtain the corresponding port number. The port number carried in the access request is compared with the calculated port number. If the two match, the access request is sent to the available business service for processing. If the two do not match, the access request is sent to the other deployed service to handle the access request that does not meet the knock authentication criteria. This improves the security of the deployed available business services and eliminates the need for third-party software or hardware, thereby reducing operation and maintenance costs.

[0099] Figure 3 A flowchart illustrating another method for processing access requests provided in this application embodiment is shown below. Figure 3 As shown, this method is applied to an electronic device, which has a first service and a second service deployed thereon. The first service is an available business service, and the second service is a service for handling requests that do not meet the knock authentication requirements. The method includes:

[0100] S201. Receive an access request and at least one data packet sent by an external device; wherein the access request is used to request access to a first service, and the access request carries a first port number of the first service; the data packet includes encapsulated field data; the first port number represents the communication identifier of the first service.

[0101] For example, this step can be referred to step 101, and will not be repeated here.

[0102] S202. For each data packet, if it is determined that the network protocol address of the data packet does not match the network protocol address of the access request, then the data packet is deleted from at least one data packet.

[0103] For example, in order to prevent the received data packets from being abnormally tampered with during transmission, thereby affecting the security of the actual usable business services, it is necessary to filter the received N data packets. For each of the N data packets, the network protocol address of the data packet is extracted. The network protocol address of each data packet is compared with the network protocol address of the received access request. If it is found that the network protocol address of the data packet is inconsistent with the network protocol address of the access request, the data packet is deleted, resulting in the remaining M data packets, where N is an integer greater than or equal to 1, and M is an integer greater than or equal to 1 and less than or equal to N.

[0104] After step S202, step S203 or step S205 can be executed.

[0105] S203. For each receiving time, perform calculations on the data packets received at that receiving time to obtain the data sequence corresponding to that receiving time.

[0106] In one example, each data packet has a reception time, which represents the time when the data packet was received.

[0107] For example, after step S202, based on the electronic device, when each data packet is received, the time of receiving each data packet is recorded. For the receiving time of each data packet, based on a preset door knocking authentication algorithm, the data packet received at each receiving time is calculated and processed to obtain the data sequence corresponding to each receiving time.

[0108] In one example, step S203 includes the following steps:

[0109] The first step of step S203 is to determine the number of data packets received at each receiving time.

[0110] The second step of step S203 is to calculate the number of data packets received at each receiving time and the number of data packets received at that receiving time to obtain the data sequence corresponding to that receiving time.

[0111] For example, based on an electronic device, when each data packet is received, the time of receiving each data packet is recorded. For each data packet receiving time, the number of data packets received at each receiving time is recorded. Based on a preset knock authentication algorithm, the data packets received at each receiving time and the number of data packets at that receiving time are calculated and processed to obtain the data sequence corresponding to each receiving time.

[0112] S204. Based on the time sequence of at least one receiving time, combine the data sequences corresponding to each receiving time to obtain the second port number.

[0113] For example, the reception times recorded when each data packet is received are sorted in chronological order, such as from early to late or from late to early. Based on this sorting, the data sequences corresponding to each reception time are sorted and combined to obtain the port numbers corresponding to the N received data packets, i.e., the second port numbers.

[0114] S205. Determine the frequency information and the number information of at least one data packet; wherein, the frequency information represents the receiving frequency of the received data packet; and the number information represents the total number of data packets received.

[0115] For example, after step S202, based on the electronic device, after receiving N data packets, the receiving frequency corresponding to all N data packets can be determined based on the number of times and time intervals of receiving these N data packets, i.e., frequency information, and the total number of data packets received can be determined, i.e., number information, such as N.

[0116] S206. Calculate and process the frequency information and the number information to obtain the second port number.

[0117] For example, based on the receiving frequency corresponding to the N received data packets and the total number N of the received data packets, the electronic device calculates and processes the two pieces of information corresponding to these N data packets using a preset knocking algorithm to obtain the port number corresponding to the N received data packets, i.e., the second port number.

[0118] In one example, each data packet has type information, which represents the type of the data packet.

[0119] In one example, step S206 includes: calculating and processing the frequency information, the number information, and the information of each type to obtain the port number corresponding to at least one data packet.

[0120] For example, the type of each data packet received by the electronic device, i.e., the type information, can be the same or different. Based on the receiving frequency corresponding to the N data packets, the total number of data packets N received, and the type of each data packet, the electronic device calculates and processes the receiving frequency corresponding to the N data packets, the total number of data packets N received, and the type of each data packet using a preset knocking algorithm to obtain the port number corresponding to the N data packets received, i.e., the second port number.

[0121] S207. If it is determined that the first port number in the access request is consistent with the second port number corresponding to at least one data packet, the access request is sent to the first service; wherein the first service is used to process based on the access request.

[0122] For example, this step can be referred to as step 103, and will not be repeated here.

[0123] S208. If it is determined that the first port number in the access request is inconsistent with the second port number corresponding to at least one data packet, the access request is sent to the second service; wherein the second service is used to process the access request.

[0124] For example, this step can be referred to as step 104, and will not be repeated here.

[0125] S209. Based on the second service, the access request is parsed and processed to obtain the processing result; wherein, the processing result indicates whether the access behavior corresponding to the access request is malicious behavior.

[0126] For example, in order to determine whether an access request that fails the knock-on authentication is an abnormal access request, such as a malicious access, the captured access request is parsed and processed according to a pre-deployed second service, which is used to handle requests that do not meet the knock-on authentication, and the processing result is obtained, so that it can be known whether the access behavior corresponding to the access request is a malicious behavior.

[0127] In one example, step S209 includes the following steps:

[0128] The first step of step S209 is to compare the request field format of the access request with the preset field format based on the second service.

[0129] The second step of step S209 is: if it is determined that the request field format of the access request is inconsistent with the preset field format, then the processing result indicates that the behavior corresponding to the access request is malicious.

[0130] In the third step of step S209, if it is determined that the request field format of the access request is consistent with the preset field format, then it is determined that the processing result indicates that the behavior corresponding to the access request is not malicious.

[0131] For example, to determine whether an access request that fails the knock-on authentication is an abnormal access request, such as a malicious access, a pre-deployed second service, which handles requests that do not meet the knock-on authentication criteria, parses and processes the captured access request to obtain a processing result. This result indicates whether the access behavior corresponding to the request is malicious. Specifically, the request field format of the captured access request is compared with a pre-set preset field format. If the request field format is inconsistent with the preset field format, the processing result indicates that the behavior corresponding to the access request is malicious. If the request field format is consistent with the preset field format, the processing result indicates that the behavior corresponding to the access request is not malicious.

[0132] S210. If it is determined that the processing result indicates that the behavior corresponding to the access request is malicious, then a prompt message is generated based on the access request; wherein, the prompt message indicates that the behavior corresponding to the access request is malicious, and the prompt message is used to prompt business personnel to process the access request.

[0133] For example, after parsing and processing the captured access request, if it is determined that the processing result indicates that the behavior corresponding to the access request is malicious, the access data obtained from parsing the access request is recorded to generate a prompt message to indicate that the behavior corresponding to the access request is malicious. Based on the interface of a preset electronic device, the prompt message is output to prompt business personnel to further process the access request. For example, business personnel may set up a corresponding network full protection system for the deployed and available business services based on the prompt message.

[0134] S211. If it is determined that the processing result indicates that the behavior corresponding to the access request is not malicious, then an access record is generated based on the access request; wherein the access record indicates the access behavior corresponding to the access request.

[0135] For example, after parsing the captured access request, if it is determined that the processing result indicates that the behavior corresponding to the access request is malicious, then the access data obtained by parsing the access request is recorded as an access record to record the access behavior corresponding to the access request.

[0136] In this embodiment, based on the above embodiments, firstly, by simultaneously deploying available business services and services for handling requests that do not meet the knock authentication criteria, knock authentication is performed on the received return requests. That is, based on a preset knock authentication algorithm, the received data packets are processed to obtain the corresponding port number, and the port number carried by the access request is compared with the calculated port number. If the two are found to be consistent, the access request is sent to the available business service for processing. If the two are found to be inconsistent, the access request is sent to another deployed service to handle the access request that does not meet the knock authentication criteria. This improves the security of the deployed available business services and eliminates the need for third-party software or hardware, thereby reducing operation and maintenance costs. On the other hand, filtering the received data packets can prevent malicious tampering of data packets during transmission, thus improving the security of the deployed available business services.

[0137] Figure 4 A schematic diagram of the structure of an access request processing device provided in an embodiment of this application is shown below. Figure 4 As shown, the device is applied to an electronic device, which has a first service and a second service deployed thereon. The first service is an available business service, and the second service is a service for processing requests that do not meet the knock authentication requirements. The device 300 includes:

[0138] The receiving unit 301 is configured to receive an access request and at least one data packet sent by an external device; wherein the access request is used to request access to a first service, and the access request carries a first port number of the first service; the data packet includes encapsulated field data; and the first port number represents the communication identifier of the first service.

[0139] The processing unit 302 is configured to process at least one data packet to obtain a second port number corresponding to at least one data packet; wherein the second port number represents the communication identifier of the first service;

[0140] The first sending unit 303 is configured to send the access request to the first service if it is determined that the first port number in the access request is consistent with the second port number corresponding to at least one data packet; wherein the first service is configured to process the access request.

[0141] The second sending unit 304 is configured to send the access request to the second service if it is determined that the first port number in the access request is inconsistent with the second port number corresponding to at least one data packet; wherein the second service is configured to process the access request.

[0142] The apparatus in this embodiment can execute the technical solutions in the above method. Its specific implementation process and technical principles are the same, and will not be repeated here.

[0143] Figure 5 A schematic diagram of another access request processing apparatus provided in an embodiment of this application is shown below. Figure 5 As shown, the device is applied to an electronic device, which has a first service and a second service deployed thereon. The first service is an available business service, and the second service is a service for processing requests that do not meet the knock authentication requirements. The device 400 includes:

[0144] The receiving unit 401 is configured to receive an access request and at least one data packet sent by an external device; wherein the access request is used to request access to a first service, and the access request carries a first port number of the first service; the data packet includes encapsulated field data; and the first port number represents the communication identifier of the first service.

[0145] The processing unit 402 is configured to process at least one data packet to obtain a second port number corresponding to at least one data packet; wherein the second port number represents the communication identifier of the first service;

[0146] The first sending unit 403 is configured to send the access request to the first service if it is determined that the first port number in the access request is consistent with the second port number corresponding to at least one data packet; wherein the first service is configured to process the access request.

[0147] The second sending unit 404 is configured to send the access request to the second service if it is determined that the first port number in the access request is inconsistent with the second port number corresponding to at least one data packet; wherein the second service is configured to process the access request.

[0148] In one example, each data packet has a reception time, which represents the time when the data packet was received;

[0149] Processing unit 402 includes:

[0150] The first processing module 4021 is used to perform calculations on the data packets received at each receiving time to obtain the data sequence corresponding to that receiving time.

[0151] The combination module 4022 is used to combine the data sequences corresponding to each receiving time according to the time sequence of at least one receiving time to obtain the second port number.

[0152] In one example, the first processing module 4021 includes:

[0153] The first processing submodule is used to determine the number of data packets received at each receiving moment;

[0154] The determination submodule is used to calculate and process the data packets received at each receiving time and the number of data packets received at that receiving time to obtain the data sequence corresponding to that receiving time.

[0155] In one example, processing unit 402 includes:

[0156] The first determining module 4023 is used to determine the frequency information and the number information of at least one data packet; wherein, the frequency information represents the receiving frequency of the received data packet; and the number information represents the total number of data packets received.

[0157] The second processing module 4024 is used to calculate and process the frequency information and the number information to obtain the second port number.

[0158] In one example, each data packet has type information, which represents the type of the data packet;

[0159] The second processing module 4024 includes:

[0160] The second processing submodule is used to calculate and process the frequency information, the number information, and the information of various types to obtain the port number corresponding to at least one data packet.

[0161] In one example, after the second sending unit 404 sends the access request to the second service, it also includes:

[0162] The parsing unit 405 is used to parse and process the access request based on the second service to obtain the processing result; wherein, the processing result indicates whether the access behavior corresponding to the access request is malicious behavior;

[0163] The first generation unit 406 is used to generate a prompt message based on the access request if it is determined that the processing result indicates that the behavior corresponding to the access request is malicious; wherein, the prompt message indicates that the behavior corresponding to the access request is malicious, and the prompt message is used to prompt business personnel to process the access request.

[0164] The second generation unit 407 is used to generate an access record based on the access request if it is determined that the behavior corresponding to the access request is not malicious. The access record represents the access behavior corresponding to the access request.

[0165] In one example, parsing unit 405 includes:

[0166] The comparison module 4051 is used to compare the request field format of the access request with the preset field format based on the second service.

[0167] The second determining module 4052 is used to determine that if the format of the request field of the access request is inconsistent with the preset field format, the processing result indicates that the behavior corresponding to the access request is malicious.

[0168] The third determining module 4053 is used to determine that if the format of the request field of the access request is consistent with the preset field format, the processing result indicates that the behavior corresponding to the access request is not malicious.

[0169] In one example, device 400 also includes:

[0170] The deletion unit 408 is used to delete the data packet from at least one data packet if it is determined that the network protocol address of the data packet does not match the network protocol address of the access request.

[0171] The apparatus in this embodiment can execute the technical solutions in the above method. Its specific implementation process and technical principles are the same, and will not be repeated here.

[0172] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application, such as... Figure 6 As shown, the electronic device 500 includes: a memory 501 and a processor 502; the memory 501 is a memory for storing executable instructions of the processor 502.

[0173] The processor 502 is configured to perform the method provided in the above embodiments.

[0174] The electronic device 500 also includes a receiver 503 and a transmitter 504. The receiver 503 is used to receive instructions and data sent by other devices, and the transmitter 504 is used to send instructions and data to external devices.

[0175] In one example, electronic device 500 deploys a real service system and a honeypot-based service system. The real service system provides available business services, while the honeypot-based service system is used to process requests that do not meet the knock authentication requirements.

[0176] Figure 7 This is a block diagram illustrating an electronic device 800 according to an exemplary embodiment. The electronic device 800 may be a mobile phone, computer, digital broadcasting terminal, messaging device, game console, tablet device, medical device, fitness equipment, personal digital assistant, etc.

[0177] Electronic device 800 may include one or more of the following components: processing component 802, memory 804, power supply component 806, multimedia component 808, audio component 810, input / output interface 812, sensor component 814, and communication component 816.

[0178] Processing component 802 typically controls the overall operation of electronic device 800, such as operations associated with display, telephone calls, data communication, camera operation, and recording operations. Processing component 802 may include one or more processors 820 to execute instructions to complete all or part of the steps of the methods described above. Furthermore, processing component 802 may include one or more modules to facilitate interaction between processing component 802 and other components. For example, processing component 802 may include a multimedia module to facilitate interaction between multimedia component 808 and processing component 802.

[0179] Memory 804 is configured to store various types of data to support the operation of electronic device 800. Examples of this data include instructions for any application or method operating on electronic device 800, contact data, phonebook data, messages, pictures, videos, etc. Memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic storage, flash memory, magnetic disk, or optical disk.

[0180] Power supply component 806 provides power to various components of electronic device 800. Power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to electronic device 800.

[0181] Multimedia component 808 includes a screen that provides an output interface between electronic device 800 and user. In some embodiments, the screen may include a liquid crystal display and a touch panel. If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 808 includes a front-facing camera and / or a rear-facing camera. When electronic device 800 is in an operating mode, such as a shooting mode or video mode, the front-facing camera and / or rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

[0182] Audio component 810 is configured to output and / or input audio signals. For example, audio component 810 includes a microphone configured to receive external audio signals when electronic device 800 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 804 or transmitted via communication component 816. In some embodiments, audio component 810 also includes a speaker for outputting audio signals.

[0183] Input / output interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.

[0184] Sensor assembly 814 includes one or more sensors for providing status information for various aspects of electronic device 800. For example, sensor assembly 814 can detect the on / off state of electronic device 800, the relative positioning of components such as the display and keypad of electronic device 800, changes in position of electronic device 800 or one of its components, the presence or absence of user contact with electronic device 800, orientation or acceleration / deceleration of electronic device 800, and temperature changes of electronic device 800. Sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 814 may also include a light sensor for use in imaging applications. In some embodiments, sensor assembly 814 may also include an accelerometer, gyroscope, magnetometer, pressure sensor, or temperature sensor.

[0185] Communication component 816 is configured to facilitate wired or wireless communication between electronic device 800 and other devices. Electronic device 800 can access wireless networks based on communication standards. In one exemplary embodiment, communication component 816 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 816 also includes a near-field communication module to facilitate short-range communication. For example, the near-field communication module may be implemented based on radio frequency identification (RFID), infrared data association (IRA) technology, ultra-wideband (UWB) technology, Bluetooth technology, and other technologies.

[0186] In an exemplary embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits, digital signal processors, digital signal processing devices, programmable logic devices, field-programmable gate arrays, controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.

[0187] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, which can be executed by a processor 820 of an electronic device 800 to perform the above-described method. For example, the non-transitory computer-readable storage medium may be a random access memory, magnetic tape, floppy disk, or optical data storage device, etc.

[0188] This application also provides a non-transitory computer-readable storage medium, which, when the instructions in the storage medium are executed by the processor of an electronic device, enables the electronic device to perform the above-described method.

[0189] According to an embodiment of this application, this application also provides a computer program product, which includes: a computer program stored in a readable storage medium, at least one processor of an electronic device can read the computer program from the readable storage medium, and the at least one processor executes the computer program to cause the electronic device to perform the solution provided in any of the above embodiments.

[0190] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0191] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for processing access requests, characterized in that, The method is applied to an electronic device, which has a first service and a second service deployed thereon. The first service is an available business service, and the second service is a service deployed based on honeypot technology for processing requests that do not meet the knock-on authentication criteria. The method includes: The system receives an access request and at least one data packet from an external device. The access request and the at least one data packet are two independent message entities. The access request requests access to a first service and is only allowed to be processed after door-knocking authentication is completed on the at least one data packet. The access request carries a first port number of the first service. The at least one data packet includes encapsulated field data used to calculate a second port number representing the communication identifier of the first service through a door-knocking authentication algorithm. The first port number represents the communication identifier of the first service. The encapsulated field data contained in the at least one data packet is parsed, and a calculation is performed based on a preset door-knock authentication algorithm to obtain a second port number corresponding to the at least one data packet; wherein, the second port number represents the communication identifier of the first service; each data packet has a reception time, and the reception time represents the time when the data packet is received; the step of parsing the encapsulated field data contained in the at least one data packet and performing a calculation based on the preset door-knock authentication algorithm to obtain the second port number corresponding to the at least one data packet includes: for each reception time, performing a calculation on the data packet received at that reception time to obtain a data sequence corresponding to that reception time; and combining the data sequences corresponding to each reception time according to the time order of the at least one reception time to obtain the second port number; If it is determined that the first port number in the access request matches the second port number corresponding to the at least one data packet, then the access request is sent to the first service; wherein, the first service is used to process the access request. If it is determined that the first port number in the access request is inconsistent with the second port number corresponding to the at least one data packet, the access request is sent to the second service; wherein the second service is used to process the access request.

2. The method according to claim 1, characterized in that, For each received time, the data packets received at that time are processed to obtain the data sequence corresponding to that received time, including: Determine the number of data packets received at each of the aforementioned reception times; For each receiving time, the number of data packets received at that receiving time and the number of data packets received at that receiving time are calculated to obtain the data sequence corresponding to that receiving time.

3. The method according to claim 1, characterized in that, The encapsulated field data contained in the at least one data packet is parsed, and a calculation is performed based on a preset door-knock authentication algorithm to obtain the second port number corresponding to the at least one data packet, including: Determine the frequency information and the number information of the at least one data packet; wherein the frequency information represents the receiving frequency of the received data packet; and the number information represents the total number of data packets received. The frequency information and the number information are calculated and processed to obtain the second port number.

4. The method according to claim 3, characterized in that, Each of the data packets has type information, which represents the type of the data packet; The second port number is obtained by calculating and processing the frequency information and the number information, including: The frequency information, the number information, and each type information are calculated and processed to obtain the port number corresponding to the at least one data packet.

5. The method according to any one of claims 1-4, characterized in that, After sending the access request to the second service, the process also includes: Based on the second service, the access request is parsed and processed to obtain a processing result; wherein, the processing result indicates whether the access behavior corresponding to the access request is malicious behavior; If it is determined that the processing result indicates that the behavior corresponding to the access request is malicious, then a prompt message is generated based on the access request; wherein, the prompt message indicates that the behavior corresponding to the access request is malicious, and the prompt message is used to prompt business personnel to process the access request; If it is determined that the processing result indicates that the behavior corresponding to the access request is not malicious, then an access record is generated based on the access request; wherein the access record indicates the access behavior corresponding to the access request.

6. The method according to claim 5, characterized in that, Based on the second service, the access request is parsed and processed to obtain the processing result, including: Based on the second service, the request field format of the access request is compared with the preset field format; If it is determined that the request field format of the access request is inconsistent with the preset field format, then it is determined that the processing result indicates that the behavior corresponding to the access request is malicious behavior; If it is determined that the request field format of the access request is consistent with the preset field format, then it is determined that the processing result indicates that the behavior corresponding to the access request is not malicious.

7. The method according to any one of claims 1-4, characterized in that, The method further includes: For each of the data packets, if it is determined that the network protocol address of the data packet does not match the network protocol address of the access request, then the data packet is deleted from the at least one data packet.

8. An access request processing apparatus, characterized in that, The device is applied to an electronic device, which deploys a first service and a second service. The first service is an available business service, and the second service is a service deployed based on honeypot technology for processing requests that do not meet the knock-on authentication criteria. The device includes: A receiving unit is configured to receive an access request and at least one data packet sent by an external device; wherein the access request and the at least one data packet are two independent message entities, the access request is used to request access to a first service, and is a request that is only allowed to be processed after door-knocking authentication is completed on the at least one data packet, and the access request carries a first port number of the first service; the at least one data packet includes encapsulated field data used to calculate a second port number representing the communication identifier of the first service through a door-knocking authentication algorithm; the first port number represents the communication identifier of the first service; A processing unit is configured to parse the encapsulated field data contained in the at least one data packet and perform calculations based on a preset door-knocking authentication algorithm to obtain a second port number corresponding to the at least one data packet; wherein the second port number represents the communication identifier of the first service; each data packet has a receiving time, the receiving time representing the time when the data packet is received; the processing unit includes: a first processing module, configured to perform calculations on the data packet received at each receiving time to obtain a data sequence corresponding to that receiving time; and a combination module, configured to combine the data sequences corresponding to each receiving time according to the time order of the at least one receiving time to obtain the second port number; The first sending unit is configured to send the access request to the first service if it is determined that the first port number in the access request is consistent with the second port number corresponding to the at least one data packet; wherein the first service is configured to process the access request. The second sending unit is configured to send the access request to the second service if it is determined that the first port number in the access request is inconsistent with the second port number corresponding to the at least one data packet; wherein the second service is configured to process the access request.

9. The apparatus according to claim 8, characterized in that, The first processing module includes: The first processing submodule is used to determine the number of data packets received at each receiving time. The determination submodule is used to calculate and process the data packets received at each receiving time and the number of data packets received at that receiving time to obtain the data sequence corresponding to that receiving time.

10. The apparatus according to claim 8, characterized in that, The processing unit includes: The first determining module is used to determine the frequency information and the number information of the at least one data packet; wherein the frequency information represents the receiving frequency of the received data packet; and the number information represents the total number of data packets received. The second processing module is used to calculate and process the frequency information and the number information to obtain the second port number.

11. The apparatus according to claim 10, characterized in that, Each of the data packets has type information, which represents the type of the data packet; The second processing module includes: The second processing submodule is used to calculate and process the frequency information, the number information, and each type information to obtain the port number corresponding to the at least one data packet.

12. The apparatus according to any one of claims 8-11, characterized in that, After the second sending unit sends the access request to the second service, the method further includes: The parsing unit is used to parse the access request based on the second service to obtain a processing result; wherein the processing result indicates whether the access behavior corresponding to the access request is malicious behavior; The first generation unit is configured to generate a prompt message based on the access request if it is determined that the processing result indicates that the behavior corresponding to the access request is malicious; wherein the prompt message indicates that the behavior corresponding to the access request is malicious, and the prompt message is used to prompt business personnel to process the access request; The second generation unit is used to generate an access record based on the access request if it is determined that the processing result indicates that the behavior corresponding to the access request is not malicious; wherein the access record indicates the access behavior corresponding to the access request.

13. The apparatus according to claim 12, characterized in that, The parsing unit includes: The comparison module is used to compare the request field format of the access request with a preset field format based on the second service; The second determining module is used to determine that if the format of the request field of the access request is inconsistent with the preset field format, the processing result indicates that the behavior corresponding to the access request is malicious behavior. The third determining module is used to determine that if the request field format of the access request is consistent with the preset field format, the processing result indicates that the behavior corresponding to the access request is not malicious.

14. The apparatus according to any one of claims 8-11, characterized in that, The device further includes: The deletion unit is configured to delete each data packet from the at least one data packet if it is determined that the network protocol address of the data packet does not match the network protocol address of the access request.

15. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 7.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 7.

Images