Network protocol-based communication transmission method and device, equipment and storage medium

Abstract

The application discloses a network protocol-based communication transmission method and device, electronic equipment and storage medium, and comprises the following steps: receiving and analyzing an access request to obtain a TCP message; determining whether the TCP payload belongs to an application security enhancement protocol message, if yes, obtaining ten-tuple data from the TCP payload; calling an access control system based on the ten-tuple data to perform access verification on the access request to obtain a verification result; when the verification is passed, splicing all TCP payloads corresponding to the TCP messages to obtain a complete application security enhancement protocol message; extracting an HTTP message, a TLS message or an SSL message of the access request from the application security enhancement protocol message, so that a request receiving service node responds to the access request. The scheme can enhance the network communication security between service nodes of a micro-service architecture application, improve the fineness of access control, and reduce the consumption of access control processing.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a communication transmission method, apparatus, electronic device and storage medium based on a network protocol. Background Technology

[0002] Microservice architecture is a software system design pattern in which an application is broken down into a set of small, autonomous service nodes. These service nodes can be deployed, scaled, and managed independently, and interact with each other through lightweight communication mechanisms, typically relying on network protocols. When building application systems with a microservice architecture, security measures at the network protocol layer mainly include: 1. Detecting and blocking malicious behaviors and attacks at the network protocol layer through intrusion detection and prevention systems. 2. Monitoring and managing network traffic through firewalls, implementing access control and traffic filtering by inspecting network protocol headers and packet content.

[0003] While these security measures can protect network communication security from different perspectives, they also have some shortcomings: 1. Intrusion detection systems (IDS) and intrusion prevention systems (IPS) can extract traffic statistics between service nodes and match them with intrusion patterns in a knowledge base to intercept attack traffic. However, if a hacker controls one or more service nodes and sends unauthorized access requests through these controlled nodes, it is difficult for IDS and IPS to intercept them. Furthermore, the knowledge base-dependent nature of IDS and IPS makes them less effective at intercepting some protocol-level zero-day attacks. 2. Firewalls can use application proxies to scan the seventh layer of the Open System Interconnection (OSI) model, inspecting the entire business data packet content, enabling granular access control at the application layer. However, this method breaks the "client / server" access pattern between service nodes. The firewall, acting as a "man in the middle," needs to unpack the protocol packets from the requesting node layer by layer, analyze them, and then repackage the content layer by layer before sending it to the receiving node. This process involves significant computation. When there are frequent calls between services in a microservice architecture, this method can impact system performance. Summary of the Invention

[0004] This application provides a communication transmission method, apparatus, electronic device, and storage medium based on a network protocol, which can enhance the security of network communication between service nodes in a microservice architecture application, improve the granularity of access control, and reduce the overhead of access control processing.

[0005] In a first aspect, this application provides a communication transmission method based on a network protocol, applied to a request-receiving service node, wherein the request-receiving service node includes an application security enhancement protocol, a protocol software development kit, and an access control system. The method includes: The system receives the access request sent by the service node and parses the access request to obtain the Transmission Control Protocol (TCP) message. Determine whether the TCP payload in the TCP packet belongs to the application security enhancement protocol packet. If it does, obtain the 10-tuple data from the TCP payload. Based on the 10-tuple data, the access control system is invoked to verify the access request and obtain the verification result. When the verification result is successful, the TCP payloads corresponding to all the received TCP packets are concatenated to obtain a complete application security enhancement protocol packet. Extract the Hypertext Transfer Protocol (HTTP) message, Transport Layer Security (TLS) message, or Secure Sockets Layer (SSL) message of the access request from the application security enhancement protocol message, so that the request receiving service node responds to the access request based on the HTTP message, the TLS message, or the SSL message.

[0006] Furthermore, before determining whether the TCP payload in the TCP packet belongs to the application security enhancement protocol packet, the method further includes: determining the sequence number of the TCP packet; determining whether the TCP packet is the first TCP packet based on the sequence number; if so, then performing the operation of determining whether the TCP payload in the TCP packet belongs to the application security enhancement protocol packet.

[0007] Furthermore, determining whether the TCP payload in the TCP packet belongs to the application security enhancement protocol packet includes: determining the offset position of the first header in the TCP packet within the data area of ​​the TCP packet; obtaining the corresponding TCP payload from the TCP packet based on the offset position; determining whether the content at a preset byte position in the TCP payload is a preset protocol identifier; if it is a preset protocol identifier, then determining that the TCP payload belongs to the application security enhancement protocol packet; if it is not a preset protocol identifier, then determining that the TCP payload does not belong to the application security enhancement protocol packet.

[0008] Furthermore, obtaining the 10-tuple data from the TCP payload includes: extracting the second header of the application security enhancement protocol from the TCP payload; determining the signature length and 10-tuple data length of the application security enhancement protocol based on the second header; determining whether a preset number of first TCP packets, each containing the header of the application security enhancement protocol, have been received based on the number of bytes in the TCP payload, the signature length, and the 10-tuple data length; if all the first TCP packets have been received, calculating the storage location of the 10-tuple data in the TCP payload based on the signature length and the 10-tuple data length; obtaining the encrypted 10-tuple data from the TCP payload based on the storage location; and decrypting the encrypted 10-tuple data using the private key of the request receiving service node to obtain the 10-tuple data.

[0009] Furthermore, determining whether a preset number of first TCP packets have been received based on the number of bytes in the TCP payload, the signature length, and the decennial data length includes: determining whether the difference between the number of bytes in the TCP payload and the signature length and the decennial data length is greater than a preset number of bytes; if not, continuing to receive the next TCP packet, extracting the next TCP payload of the next TCP packet, and concatenating the next TCP payload into the TCP payload to obtain a new TCP payload, and repeating the operation of determining whether the difference between the number of bytes in the TCP payload and the signature length and the decennial data length is greater than a preset number of bytes; if greater, determining that all the first TCP packets have been received.

[0010] Furthermore, before extracting the HTTP, TLS, or SSL message of the access request from the application security enhancement protocol message, the method further includes: obtaining the public key of the request initiating service node; verifying the signature of the ten-tuple data and upper-layer protocol message data in the application security enhancement protocol message based on the public key to obtain a signature verification result; if the signature verification result is incorrect, discarding the application security enhancement protocol message and disconnecting the communication connection with the request initiating service node; if the signature verification result is correct, extracting the HTTP, TLS, or SSL message of the access request from the application security enhancement protocol message.

[0011] Furthermore, the request initiating service node includes an application security enhancement protocol and a protocol software development kit (SDK). The SSD in the request initiating service node determines the TCP packet in the following manner: It acquires an HTTP request, collects 10-tuple information from the HTTP request, and encodes the 10-tuple information to obtain 10-tuple data; when establishing a communication connection with the request receiving service node, it acquires an HTTP packet, a TLS packet, or an SSL packet; it acquires the public key of the request receiving service node, encrypts the 10-tuple data based on the public key to obtain encrypted 10-tuple data, and determines the first byte array of the encrypted 10-tuple data; it concatenates the encrypted 10-tuple data with the HTTP packet, the TLS packet, or the SSL packet to obtain a second byte array, and signs the second byte array based on the private key of the request initiating service node to obtain a third byte array; it then uses the packet format of the application security enhancement protocol to compose the first byte array and the third byte array to obtain a TCP packet.

[0012] Secondly, this application provides a network protocol-based communication transmission device integrated into a request receiving service node, wherein the request receiving service node includes an application security enhancement protocol, a protocol software development kit, and an access control system. The device includes: The request parsing module is used to receive the access request sent by the request initiating service node and parse the access request to obtain TCP packets; The data acquisition module is used to determine whether the TCP payload in the TCP packet belongs to the application security enhancement protocol packet. If it does, the module obtains the 10-tuple data from the TCP payload. The access verification module is used to call the access control system based on the decimal data to perform access verification on the access request and obtain the verification result. The message determination module is used to concatenate the TCP payloads corresponding to all the received TCP messages when the verification result is passed, so as to obtain a complete application security enhancement protocol message. The request processing module is used to extract the HTTP message, TLS message, or SSL message of the access request from the application security enhancement protocol message, so that the request receiving service node responds to the access request based on the HTTP message, the TLS message, or the SSL message.

[0013] Thirdly, this application provides an electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the network protocol-based communication transmission method described in any embodiment of this application.

[0014] Fourthly, this application provides a computer-readable storage medium storing computer instructions that, when executed by a processor, implement the network protocol-based communication transmission method described in any embodiment of this application.

[0015] To address the shortcomings of existing technologies, this application provides a network protocol-based communication transmission method. This method offers the following advantages: This application provides an application security enhancement protocol based on a business scenario, along with a supporting protocol software development kit and access control system. When a service node, acting as the request initiator, initiates an access request, it encapsulates HTTP, TLS, or SSL protocol messages according to the application security enhancement protocol before sending them to the request receiver. Upon receiving the access request, the service node, acting as the request receiver, extracts the application security enhancement protocol header and 10-tuple data from the TCP message. The access control system then performs access verification and receives the remaining TCP messages in parallel. For access requests that do not conform to the access control policy, the TCP message is discarded directly, and the communication connection with the request initiating service node is disconnected, without waiting for the reception of all TCP protocol messages. For access requests that conform to the access control policy, after all TCP protocol messages are received, a complete application security enhancement protocol message is concatenated, and after unpacking to obtain the HTTP, TLS, or SSL protocol message, it is handed over to the microservice program of the request receiver for processing. This application can enhance the security of network communication between service nodes in a microservice architecture application, solve the performance problems of application layer data scanning and access control, improve the efficiency of application system in processing access requests, and reduce system processing overhead.

[0016] It should be noted that the aforementioned computer instructions may be stored, in whole or in part, on a computer-readable storage medium. This computer-readable storage medium may be packaged together with the processor of the network protocol-based communication transmission device, or it may be packaged separately from the processor of the network protocol-based communication transmission device; this application does not impose any limitations on this.

[0017] The descriptions of the second, third, and fourth aspects in this application can be referenced to the detailed description of the first aspect; and the beneficial effects described in the second, third, and fourth aspects can be referenced to the analysis of the beneficial effects of the first aspect, which will not be repeated here.

[0018] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description.

[0019] It is understood that before using the technical solutions disclosed in the various embodiments of this application, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this application in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 A schematic diagram illustrating the location of application security enhancement protocols within the OSI seven-layer model; Figure 2 A schematic diagram of the message format for applying the security enhancement protocol; Figure 3 This is a diagram illustrating one deployment method for an application system based on a microservice architecture. Figure 4 A flowchart illustrating a communication transmission method based on a network protocol, provided for an embodiment of this application; Figure 5 A schematic diagram of a network protocol-based communication transmission device provided in an embodiment of this application; Figure 6 This is a block diagram of an electronic device used to implement a network protocol-based communication transmission method according to an embodiment of this application. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0023] It should be noted that the terms "first," "second," "target," and "original," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in sequences other than those illustrated or described herein. Furthermore, the terms "comprising," "having," and any variations thereof are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] Before introducing the embodiments of this application, the application security enhancement protocol provided in this application will be explained. For example... Figure 1 The diagram illustrates the position of the Application Security Enhancement Protocol (ASEP) in the OSI seven-layer model. ASEP belongs to the session layer and operates below the TLS / SSL protocol and above the TCP transport layer. Figure 2 The image shows the message format of the Application Security Enhancement Protocol (ASIP). The message header is 12 bytes long and includes the protocol identifier, protocol version, encryption algorithm, decimal encoding, signature length, decimal data length, and message length. The message body of the ASIP is variable in length and includes the signature, decimal data, and upper-layer protocol message data.

[0025] The protocol identifier identifies the application security enhancement protocol message; it is 2 bytes long and its value is fixed at 0xCECE. The protocol version identifies the current protocol version number; it is 1 byte long. The encryption algorithm indicates the asymmetric encryption algorithm used for encrypting and digitally signing the message; it is 1 byte long, with a value of 0 indicating ECC and a value of 1 indicating SM2. The decimal encoding specifies the encoding method for the decimal data; it is 1 byte long, with a value of 0 indicating JSON encoding and a value of 1 indicating protobuf encoding. The signature length records the length of the signature string obtained after digitally signing the decimal data and the upper-layer protocol message data using the algorithm specified by the "encryption algorithm" attribute; it is 1 byte long. The decimal data length records the length of the string obtained after encrypting the decimal data using the algorithm specified by the "encryption algorithm" attribute; it is 2 bytes long. The message length records the length of the upper-layer protocol message data; it is 4 bytes long. The signature is a string obtained by digitally signing the 10-tuple data and the upper-layer protocol message data using the algorithm specified in the "Encryption Algorithm" attribute of the message header. This signature is used to prevent the 10-tuple data and the upper-layer protocol message data from being forged or tampered with. The 10-tuple data is a string obtained by encrypting the 10-tuple data using the algorithm specified in the "Encryption Algorithm" attribute of the message header. The upper-layer protocol message data is either a Hypertext Transfer Protocol (HTTP) message or a Transport Layer Security (TLS) / Secure Sockets Layer (SSL) message for this access request.

[0026] To complement the aforementioned application security enhancement protocol, this application also includes: a protocol software development kit (SDK) and an access control system. The SSD is integrated and invoked by each service node of the application system. Upon startup of each service node, the SSD initializes the network components used by the service node and provides a custom socket for encapsulating and decapsulating inbound and outbound HTTP / HTTPS requests using the application security enhancement protocol. The access control system provides a programming interface invoked by the SSD and is responsible for determining whether an access request conforms to the access control policy based on the ten-tuple content.

[0027] like Figure 3The diagram illustrates one deployment method for an application system based on a microservice architecture. It assumes the application system consists of n microservices, each containing a protocol software development kit (SDK). Each microservice package and the access policy control system package are deployed on the same physical server or virtual machine, forming a service node. Multiple service nodes communicate with each other via Ethernet. Simultaneously, each service node should connect to available identity authentication systems, certificate authority systems, and application system front-end programs via the network to obtain user authentication and certificate management services. The specific implementation of the identity authentication system and certificate authority system is beyond the scope of this invention.

[0028] Figure 4 This is a flowchart illustrating a network protocol-based communication transmission method provided in this application embodiment. This embodiment is applicable to situations where each service node in a microservice architecture software system performs network communication. The network protocol-based communication transmission method provided in this embodiment can be executed by the network protocol-based communication transmission device provided in this application embodiment. This device can be implemented through software and / or hardware and integrated into the electronic device executing the method. Preferably, the electronic device in this application embodiment can be a service node in a microservice architecture. This method is applied to a request-receiving service node, which includes an application security enhancement protocol, a protocol software development kit, and an access control system.

[0029] See Figure 4 The method in this embodiment includes, but is not limited to, the following steps: S110. Receive the access request sent by the request initiating service node, and parse the access request to obtain the Transmission Control Protocol (TCP) message.

[0030] A microservice architecture includes multiple service nodes. If service node A sends an access request to service node B, then service node A is the request initiating service node, and service node B is the request receiving service node. The access request includes TCP packets.

[0031] In this embodiment of the application, the request initiating service node sends an access request to the request receiving service node. The request receiving service node receives the access request through a custom Socket in the protocol software development kit, and parses the access request to obtain the TCP segment in the access request. It can also parse the sequence number of the TCP segment and the segment header (denoted as the first segment header) in the TCP segment.

[0032] S120. Determine whether the TCP payload in the TCP packet belongs to the application security enhancement protocol packet. If it does, obtain the 10-tuple data from the TCP payload.

[0033] Furthermore, before executing this step S120, the process includes: parsing the access request to obtain the sequence number of the TCP packet; determining whether the TCP packet is the first TCP packet based on the sequence number; if so, then executing this step S120.

[0034] Specifically, determining whether the TCP payload belongs to an application security enhancement protocol message includes: parsing the access request to obtain the first header of the TCP message and determining the offset position of the first header in the data area of ​​the TCP message; retrieving the corresponding TCP payload from the TCP message based on the offset position; determining whether the content at the preset byte position in the TCP payload is a preset protocol identifier; if it is not a preset protocol identifier, the TCP payload is determined not to belong to an application security enhancement protocol message, and the protocol software development kit discards the TCP message and disconnects the communication connection with the request-initiating service node; if it is a preset protocol identifier, the TCP payload is determined to belong to an application security enhancement protocol message. The preset byte can be the first two bytes.

[0035] Once it is determined that the TCP payload belongs to the Application Security Enhancement Protocol (ASEP) message, the 12-byte data is obtained from the TCP payload. Specifically, this involves: extracting the ASEP header (denoted as the second header) from the TCP payload of the first TCP message, i.e., the first 12 bytes of the TCP payload; obtaining the ASEP signature length and 12-byte data length from the content of the second header; determining whether to receive a predetermined number of first TCP messages based on the number of bytes in the TCP payload, signature length, and 12-byte data length, where the first TCP message refers to the message containing the ASEP header; if not all first TCP messages have been received, it indicates that the complete ASEP header has not yet been received, and more first TCP messages need to be received; if all first TCP messages have been received, calculating the storage location of the 12-byte data in the TCP payload based on the signature length and 12-byte data length; obtaining the 12-byte encrypted data from the TCP payload based on the storage location; and obtaining the local private key (i.e., the requesting service node) from the local keystore using the protocol software development kit (SDK), and decrypting the 12-byte encrypted data using the local private key to obtain the 12-byte data.

[0036] The process of determining whether a preset number of first TCP packets have been received is based on the number of bytes in the TCP payload, the signature length, and the 10-tuple data length. Specifically, this involves: determining whether the difference between the number of bytes in the TCP payload and the signature length and the 10-tuple data length is greater than a preset number of bytes (e.g., 12 bytes); if not, continuing to receive the next TCP packet via a customized socket, extracting the next TCP payload from the next TCP packet, and appending the next TCP payload to the end of the currently received TCP payload to obtain a new TCP payload, and repeating the operation of determining whether the difference between the number of bytes in the new TCP payload and the signature length and the 10-tuple data length is greater than the preset number of bytes; if it is greater, it is determined that all first TCP packets have been received; if it is still not greater, continuing to receive the next TCP packet via a customized socket, repeating this method until all first TCP packets have been received, ultimately obtaining the complete application security enhancement protocol header.

[0037] S130. Based on the decimal data, the access control system is invoked to verify the access request and obtain the verification result.

[0038] The 10-tuple data is a set of attributes defined in the application security enhancement protocol to describe the service request context. The 10-tuple data includes version number, source device network protocol (Internet Protocol, IP) address, source application name, target application name, target interface, access token, user identifier (Identity Document, ID), link tracing ID, request timestamp, and business extension information. The specific contents are shown in Table 1. Table 1. Details of the ten-tuple data It should be noted that while existing solutions using protocols such as HTTP, TLS, or SSL can ensure the confidentiality and integrity of communication data between service nodes, they lack business scenario information at the protocol level. If a hacker gains control of one or more service nodes, they can use the controlled nodes to send unauthorized access requests, which are undetectable at the HTTP, TLS, or SSL protocol level. The application security enhancement protocol in this application contains the necessary business attributes in its ten-tuple data. The access control system can make access control judgments related to the business scenario based on the ten-tuple data, achieving an effect similar to OSI layer 7 content scanning. Provided the identity authentication system and certificate authority system are effective, it can effectively prevent unauthorized access through forged and tampered messages. Furthermore, traditional access control lists in existing solutions filter and authorize based on factors such as IP address, port number, and protocol type. Hackers can bypass this by forging relevant information in network protocol packets. The access control system in this application makes access control judgments based on configuration policies and ten-tuple data, without relying on intrusion pattern matching from a knowledge base. This compensates for the shortcomings of intrusion detection systems and intrusion prevention systems in intercepting zero-day attacks at the protocol level.

[0039] In this embodiment, the protocol software development kit calls the interface of the access control system to send a ten-tuple data to the access control system to verify the access request. If the ten-tuple data conforms to the access control policy, it can be determined that the access request has passed the verification; if the ten-tuple data does not conform to the access control policy, it can be determined that the access request has failed the verification. In this case, the protocol software development kit discards the TCP packet and disconnects the communication connection with the service node that initiated the request.

[0040] According to the format definition of the Application Security Enhancement Protocol (ASEP), the access control system can begin access control judgments as soon as it obtains the ASEP header and 10-tuple data, without waiting for the upper-layer protocol message data to be fully received. This means that access control judgments can be performed in parallel with protocol message reception, improving system processing speed. For requests that do not conform to the access policy, the connection can be immediately closed without waiting for the subsequent message content to be received, reducing system processing overhead and the risk of attacks using subsequent message content.

[0041] S140. When the verification result is successful, the TCP payloads corresponding to all the received TCP packets are concatenated to obtain a complete application security enhancement protocol packet.

[0042] In this embodiment, when the access request verification result is successful, a customized Socket is used to determine whether all TCP packets have been received. If not, the remaining TCP packets are received until all are received. Then, the protocol software development kit sequentially concatenates the TCP payloads corresponding to all the received TCP packets according to their sequence numbers, thereby obtaining a complete application security enhancement protocol packet.

[0043] The application security enhancement protocol in this application, operating as a session layer protocol under the TLS / SSL protocol, verifies application security enhancement protocol messages and performs access control using ten-tuple data without requiring unpacking and repackaging of TLS / SSL protocol messages. On one hand, this reduces message encryption / decryption operations, improving system performance; on the other hand, it does not break the "client / server" access pattern between service nodes at the TLS / SSL protocol level, avoiding the security risks caused by introducing "man-in-the-middle" attacks. It's important to explain that the term "man-in-the-middle" originates from the network security terminology of a "man-in-the-middle attack," which intercepts normal network communication data and performs data tampering and sniffing without the knowledge of the communicating parties. Since firewalls use the same method to scan OSI layer 7 protocol content as "man-in-the-middle attacks," the firewall itself becomes a vulnerability. Once the firewall is compromised, attackers can easily use it to launch man-in-the-middle attacks on all clients and servers. Furthermore, firewalls scanning OSI layer 7 protocol content require layer-by-layer unpacking and repackaging, resulting in significant computational overhead.

[0044] S150. Extract the HTTP, TLS, or SSL message of the access request from the application security enhancement protocol message, so that the request receiving service node responds to the access request based on the HTTP, TLS, or SSL message.

[0045] Furthermore, before executing step S150, the process includes: the protocol software development kit obtaining the public key of the request initiating service node from the certificate authority system; verifying the signature of the ten-tuple data in the application security enhancement protocol message and the upper-layer protocol message data based on the public key to obtain the signature verification result; if the signature verification result is incorrect, discarding the application security enhancement protocol message and disconnecting the communication connection with the request initiating service node; if the signature verification result is correct, executing step S150.

[0046] In this embodiment of the application, the protocol software development kit extracts the HTTP, TLS, or SSL message of the current access request from the application security enhancement protocol message, and sends the HTTP, TLS, or SSL message to the microservice program. The microservice program continues to process the response to the access request, and the receiving process of the current access request ends.

[0047] The technical solution provided in this embodiment receives an access request sent by a request initiating service node, parses the access request to obtain a TCP packet; determines whether the TCP payload in the TCP packet belongs to an application security enhancement protocol packet; if so, obtains the ten-tuple data from the TCP payload; calls the access control system based on the ten-tuple data to verify the access request and obtain the verification result; when the verification result is successful, concatenates the TCP payloads corresponding to all received TCP packets to obtain a complete application security enhancement protocol packet; extracts the HTTP, TLS, or SSL packets of the access request from the application security enhancement protocol packet, so that the request receiving service node responds to the access request based on the HTTP, TLS, or SSL packets. This application provides an application security enhancement protocol based on a business scenario, as well as a supporting protocol software development kit and access control system. When a service node, acting as the request initiator, initiates an access request, it encapsulates the HTTP, TLS, or SSL protocol packets according to the application security enhancement protocol before sending them to the request receiver. Upon receiving an access request, the service node acting as the request receiver extracts the application security enhancement protocol header and 10-tuple data from the TCP packet. The access control system then performs access verification and receives the remaining TCP packets in parallel. For access requests that do not conform to the access control policy, the TCP packet is discarded, and the communication connection with the requesting service node is terminated without waiting for the reception of all TCP packets. For access requests that conform to the access control policy, after all TCP packets have been received, a complete application security enhancement protocol packet is assembled. After unpacking to obtain the HTTP, TLS, or SSL protocol packet, it is handed over to the microservice program of the request receiver for processing. This application can ensure the security of network communication between service nodes in a microservice architecture application, solve the performance problems of application-layer data scanning and access control, improve the efficiency of the application system in processing access requests, reduce system processing overhead, and reduce the risk of attacks using subsequent packet content.

[0048] The following explains the process of sending access requests from the request initiating service node. The request initiating service node includes an application security enhancement protocol and a protocol software development kit (SDK). The SSD in the request initiating service node determines the TCP packet as follows: When the request initiating service node initiates an HTTP request, the SSD uses a dynamic proxy to intercept and obtain the HTTP request, collects 10-tuple related information from the HTTP request, and encodes the 10-tuple data according to the specified 10-tuple encoding method to obtain the 10-tuple data; the SSD establishes a communication connection with the request receiving service node through a customized Socket and obtains the HTTP packet, TLS packet, or SSL packet of this access request; when establishing a communication connection with the request receiving service node, it obtains the HTTP packet, TLS packet, or SSL packet; the SSD uses a certificate authority... The system obtains the public key of the requesting service node, encrypts the 10-tuple data based on the public key to obtain encrypted 10-tuple data, and determines the first byte array of the obtained encrypted 10-tuple data. The protocol software development kit (SDK) concatenates the encrypted 10-tuple data with an HTTP message, TLS message, or SSL message to obtain the second byte array. The SSD retrieves the private key of the local machine (i.e., the requesting service node) from the local keystore, and signs the second byte array based on the local private key to obtain the third byte array. The SSD compiles the first byte array and the third byte array based on the message format of the application security enhancement protocol to obtain a TCP message. The SSD sends the TCP message to the requesting service node through a customized socket and waits for a response. At this point, the access request sending process ends.

[0049] Figure 5 This application provides a schematic diagram of a network protocol-based communication transmission device, integrated into a request receiving service node. The request receiving service node includes an application security enhancement protocol, a protocol software development kit, and an access control system, such as... Figure 5 As shown, the device 500 may include: The request parsing module 510 is used to receive the access request sent by the request initiating service node and parse the access request to obtain a TCP packet; The data acquisition module 520 is used to determine whether the TCP payload in the TCP packet belongs to the application security enhancement protocol packet. If it does, the 10-tuple data is obtained from the TCP payload. The access verification module 530 is used to call the access control system to perform access verification on the access request based on the decimal data, and obtain the verification result. The message determination module 540 is used to concatenate the TCP payloads corresponding to each of the received TCP messages when the verification result is passed, so as to obtain a complete application security enhancement protocol message. The request processing module 550 is used to extract the HTTP message, TLS message, or SSL message of the access request from the application security enhancement protocol message, so that the request receiving service node responds to the access request based on the HTTP message, the TLS message, or the SSL message.

[0050] Furthermore, the aforementioned data acquisition module 520 also includes a message judgment unit and a data acquisition unit; The message determination unit is used to determine the sequence number of the TCP message before determining whether the TCP payload in the TCP message belongs to the application security enhancement protocol message; determine whether the TCP message is the first TCP message based on the sequence number; if so, perform the operation of determining whether the TCP payload in the TCP message belongs to the application security enhancement protocol message.

[0051] Furthermore, the message judgment unit is also used to determine the offset position of the first message header in the TCP message within the data area of ​​the TCP message; obtain the corresponding TCP payload from the TCP message based on the offset position; determine whether the content at a preset byte position in the TCP payload is a preset protocol identifier; if it is a preset protocol identifier, then determine that the TCP message belongs to the application security enhancement protocol message; if it is not a preset protocol identifier, then determine that the TCP message does not belong to the application security enhancement protocol message.

[0052] The data acquisition unit is configured to extract the second header of the application security enhancement protocol from the TCP payload; determine the signature length and decimal data length of the application security enhancement protocol based on the second header; determine whether a preset number of first TCP packets, each containing the header of the application security enhancement protocol, have been received based on the number of bytes in the TCP payload, the signature length, and the decimal data length; if all first TCP packets have been received, calculate the storage location of the decimal data in the TCP payload based on the signature length and the decimal data length; obtain the decimal encrypted data from the TCP payload based on the storage location; and decrypt the decimal encrypted data using the private key of the request receiving service node to obtain the decimal data.

[0053] The data acquisition unit is specifically used to determine whether the difference between the number of bytes in the TCP payload and the signature length and the decimal data length is greater than a preset number of bytes; if it is not greater, it continues to receive the next TCP packet, extracts the next TCP payload of the next TCP packet, and concatenates the next TCP payload into the TCP payload to obtain a new TCP payload, and repeats the operation of determining whether the difference between the number of bytes in the TCP payload and the signature length and the decimal data length is greater than the preset number of bytes; if it is greater, it is determined that all the first TCP packets have been received.

[0054] Furthermore, the aforementioned network protocol-based communication transmission device may also include: a data verification module; The data signature verification module is used to obtain the public key of the request initiating service node before extracting the HTTP, TLS, or SSL message of the access request from the application security enhancement protocol message; to verify the signature of the ten-tuple data and upper-layer protocol message data in the application security enhancement protocol message based on the public key; if the signature verification result is incorrect, the application security enhancement protocol message is discarded and the communication connection with the request initiating service node is disconnected; if the signature verification result is correct, the HTTP, TLS, or SSL message of the access request is extracted from the application security enhancement protocol message.

[0055] Optionally, the request initiating service node includes an application security enhancement protocol and a protocol software development kit; Furthermore, the aforementioned network protocol-based communication transmission device may also include: a TCP packet generation module; The TCP packet generation module is used to acquire an HTTP request, collect 10-tuple information from the HTTP request, and encode the 10-tuple information to obtain 10-tuple data; when establishing a communication connection with the request receiving service node, acquire an HTTP packet, a TLS packet, or an SSL packet; acquire the public key of the request receiving service node, encrypt the 10-tuple data based on the public key to obtain encrypted 10-tuple data, and determine the first byte array of the encrypted 10-tuple data; concatenate the encrypted 10-tuple data with the HTTP packet, TLS packet, or SSL packet to obtain a second byte array, sign the second byte array based on the private key of the request initiating service node to obtain a third byte array; and write the first byte array and the third byte array based on the packet format of the application security enhancement protocol to obtain a TCP packet.

[0056] The network protocol-based communication transmission device provided in this embodiment can be applied to any of the network protocol-based communication transmission methods provided in the above embodiments, and has corresponding functions and beneficial effects.

[0057] Figure 6 This is a block diagram of an electronic device used to implement a network protocol-based communication transmission method according to embodiments of this application. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present application described and / or claimed herein.

[0058] like Figure 6 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0059] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0060] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as network protocol-based communication transmission methods.

[0061] In some embodiments, the network protocol-based communication transmission method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the network protocol-based communication transmission method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the network protocol-based communication transmission method by any other suitable means (e.g., by means of firmware).

[0062] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0063] Computer programs used to implement the methods of this application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0064] In the context of this application, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0065] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0066] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0067] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through a communication network. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0068] Note that the above are merely preferred embodiments and technical principles applied in this application. Those skilled in the art will understand that this application is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of this application. For example, those skilled in the art can use the various forms of processes shown above to reorder, add, or delete steps; the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired results of the technical solution of this application can be achieved, and no limitations are imposed herein.

[0069] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A communication transmission method based on a network protocol, characterized in that, The method is applied to a request receiving service node, which includes an application security enhancement protocol, a protocol software development kit, and an access control system. The application security enhancement protocol is a session layer protocol, operating below Transport Layer Security (TLS) or Secure Sockets Layer (SSL) and above Transmission Control Protocol (TCP). The header content of the application security enhancement protocol includes at least a 10-tuple encoding, and the body content includes at least a signature and 10-tuple data. Receive the access request sent by the service node and parse the access request to obtain a TCP packet; Determine whether the TCP payload in the TCP packet belongs to the application security enhancement protocol packet. If it does, obtain the 10-tuple data from the TCP payload. Based on the 10-tuple data, the access control system is invoked to verify the access request and obtain the verification result. When the verification result is successful, the TCP payloads corresponding to all the received TCP packets are concatenated to obtain a complete application security enhancement protocol packet. Extract the Hypertext Transfer Protocol (HTTP) message, TLS message, or SSL message of the access request from the application security enhancement protocol message, so that the request receiving service node responds to the access request based on the HTTP message, the TLS message, or the SSL message; The protocol software development kit in the request initiating service node determines the TCP packet in the following manner: It acquires an HTTP request, collects 10-tuple information from the HTTP request, and encodes the 10-tuple information to obtain 10-tuple data; when establishing a communication connection with the request receiving service node, it acquires an HTTP packet, a TLS packet, or an SSL packet; it acquires the public key of the request receiving service node, encrypts the 10-tuple data based on the public key to obtain encrypted 10-tuple data, and determines the first byte array of the encrypted 10-tuple data; it concatenates the encrypted 10-tuple data with the HTTP packet, the TLS packet, or the SSL packet to obtain a second byte array, and signs the second byte array based on the private key of the request initiating service node to obtain a third byte array; it then uses the first byte array and the third byte array based on the packet format of the application security enhancement protocol to compose the TCP packet.

2. The communication transmission method based on network protocols according to claim 1, characterized in that, Before determining whether the TCP payload in the TCP packet belongs to an application security enhancement protocol packet, the method further includes: Determine the sequence number of the TCP segment; Determine whether the TCP packet is the first TCP packet based on the sequence number; If so, then perform the operation of determining whether the TCP payload in the TCP packet belongs to the application security enhancement protocol packet.

3. The communication transmission method based on network protocols according to claim 1, characterized in that, The step of determining whether the TCP payload in the TCP packet belongs to an application security enhancement protocol packet includes: Determine the offset position of the first header in the TCP segment within the data area of ​​the TCP segment; The corresponding TCP payload is obtained from the TCP packet based on the offset position; Determine whether the content at the preset byte position in the TCP payload is a preset protocol identifier; If it is a preset protocol identifier, then the TCP payload is determined to belong to the application security enhancement protocol message; If it is not a preset protocol identifier, then the TCP payload is determined not to belong to the application security enhancement protocol message.

4. The communication transmission method based on network protocols according to claim 1, characterized in that, The step of obtaining the 10-tuple data from the TCP payload includes: Extract the second header of the application security enhancement protocol from the TCP payload; The signature length and decimal data length of the application security enhancement protocol are determined based on the second message header; Based on the number of bytes in the TCP payload, the signature length, and the ten-tuple data length, it is determined whether a preset number of first TCP packets have been received. The first TCP packets contain the header of the application security enhancement protocol. If all of the first TCP packets have been received, the storage location of the tuple data in the TCP payload is calculated based on the signature length and the tuple data length. The decimal encrypted data is obtained from the TCP payload based on the storage location; The decimal data is obtained by decrypting the encrypted decimal data using the private key of the request receiving service node.

5. The communication transmission method based on network protocols according to claim 4, characterized in that, The determination of whether a preset number of first TCP packets have been received based on the number of bytes in the TCP payload, the signature length, and the 10-tuple data length includes: Determine whether the difference between the number of bytes in the TCP payload and the signature length and the decimal data length is greater than a preset number of bytes; If it is not greater than, then continue to receive the next TCP packet, extract the next TCP payload of the next TCP packet, and concatenate the next TCP payload into the TCP payload to obtain the new TCP payload, and repeat the operation of judging whether the difference between the number of bytes of the TCP payload minus the signature length and the decimal data length is greater than the preset number of bytes. If the value is greater than the value, then it is determined that all of the first TCP packets have been received.

6. The communication transmission method based on network protocols according to claim 1, characterized in that, Before extracting the HTTP, TLS, or SSL message of the access request from the application security enhancement protocol message, the method further includes: Obtain the public key of the service node that initiated the request; Based on the public key, the signature is verified by the ten-tuple data in the application security enhancement protocol message and the upper-layer protocol message data to obtain the signature verification result. If the signature verification result is incorrect, the application security enhancement protocol message is discarded, and the communication connection with the request initiating service node is disconnected. If the signature verification result is correct, then the HTTP message, TLS message, or SSL message of the access request is extracted from the application security enhancement protocol message.

7. A communication transmission device based on a network protocol, characterized in that, For implementing the network protocol-based communication transmission method as described in claim 1, integrated into a request receiving service node, wherein the request receiving service node includes an application security enhancement protocol, a protocol software development kit, and an access control system, the apparatus includes: The request parsing module is used to receive the access request sent by the request initiating service node and parse the access request to obtain TCP packets; The data acquisition module is used to determine whether the TCP payload in the TCP packet belongs to the application security enhancement protocol packet. If it does, the module obtains the 10-tuple data from the TCP payload. The access verification module is used to call the access control system based on the decimal data to perform access verification on the access request and obtain the verification result. The message determination module is used to concatenate the TCP payloads corresponding to all the received TCP messages when the verification result is passed, so as to obtain a complete application security enhancement protocol message. The request processing module is used to extract the HTTP message, TLS message, or SSL message of the access request from the application security enhancement protocol message, so that the request receiving service node responds to the access request based on the HTTP message, the TLS message, or the SSL message.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the network protocol-based communication transmission method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the network protocol-based communication transmission method according to any one of claims 1 to 6.

Images