A protocol conversion method, apparatus, device, and computer-readable storage medium

Abstract

This invention relates to the field of data transmission technology, and in particular to a protocol conversion method, apparatus, device, and computer-readable storage medium. The method involves parsing client traffic to determine its type. When the traffic type falls under a predefined interception and forwarding type, version parsing is performed to determine the client's protocol version. A security engine parsing and detection program matching the client's protocol version is selected to perform security checks on the client traffic. When the client traffic is non-attack traffic, the server's protocol version is determined based on the address and port information of the server accessed by the client. Based on the client and server protocol versions, the client traffic is converted into data conforming to the server's protocol version and transmitted to the server. The server's response information is converted into information conforming to the client's protocol version and fed back to the client. This enables interoperability between devices with different protocol versions.

Description

Technical Field

[0001] This invention relates to the field of data transmission technology, and in particular to a protocol conversion method, apparatus, device, and computer-readable storage medium. Background Technology

[0002] Hypertext Transfer Protocol (HTTP) is a lightweight communication protocol. Over time, the HTTP protocol has been continuously improved and optimized, evolving from the initial HTTP 1.0 to HTTP 1.1, and now to HTTP 2.0. Compared to the commonly used HTTP 1.1, HTTP 2.0 reduces network latency and improves client-side page loading speed through measures such as data compression in header fields, multiplexing of data transmission, and server-side push.

[0003] HTTP / 1.1 and HTTP / 2.0 protocols are fundamentally different in data transmission format and communication mechanism, making them incompatible for direct communication. While current technologies can proxy and forward HTTP / 1.1 and HTTP / 2 protocols, they cannot perform protocol conversion between HTTP / 2 and HTTP / 1.1. This prevents smooth communication between clients and servers using different protocol versions. For example, if a client uses HTTP / 1.1 and a server uses HTTP / 2, current text parsing-based inspection methods are not suitable for HTTP / 2, which transmits data in binary format, thus preventing communication between the client and server.

[0004] It is evident that how to achieve interoperability between devices with different protocol versions is a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of this invention is to provide a protocol conversion method, apparatus, device, and computer-readable storage medium that enables interoperability between devices with different protocol versions.

[0006] To address the aforementioned technical problems, embodiments of the present invention provide a protocol conversion method applicable to proxy devices, the method comprising:

[0007] The acquired client traffic is parsed to determine the traffic type of the client traffic;

[0008] If the traffic type of the client traffic belongs to the set interception and forwarding type, the client traffic is parsed to determine the client protocol version of the client traffic;

[0009] Select a security engine parsing and detection program that matches the client protocol version to perform security detection on the client traffic in order to determine whether the client traffic is attack traffic;

[0010] If the client traffic is non-attack traffic, the server protocol version supported by the server is determined based on the address and port information of the server accessed by the client.

[0011] Based on the client protocol version and the server protocol version, the client traffic is converted into data conforming to the server protocol version and transmitted to the server. The response information fed back by the server is converted into information conforming to the client protocol version and fed back to the client.

[0012] On the one hand, a security engine parsing and detection program matching the client protocol version is selected to perform security detection on the client traffic to determine whether the client traffic belongs to attack traffic, including:

[0013] If the client protocol version is not HTTP / 2, a text-based security engine parsing and detection program will parse and detect the client traffic to determine the detection result.

[0014] If the client protocol version is HTTP / 2, the security engine parsing and detection program based on binary format parsing decodes, statistically analyzes and detects the request data frames of the client traffic to determine the detection results.

[0015] If the detection results show abnormal traffic content, abnormal traffic data volume, abnormal traffic source, and / or abnormal traffic pattern, the client traffic is determined to be attack traffic.

[0016] On the one hand, it also includes:

[0017] If the client traffic is considered attack traffic, the transmission of the client traffic to the server will be blocked.

[0018] On the one hand, based on the client protocol version and the server protocol version, converting the client traffic into data conforming to the server protocol version and transmitting the data to the server, and converting the response information returned by the server into information conforming to the client protocol version and returning the information to the client, includes:

[0019] When the client protocol version is HTTP / 1 and the server protocol version does not support HTTP / 2, or when the client protocol version is HTTP / 2 and the server protocol version supports HTTP / 2, the client traffic is transmitted to the server according to the client's protocol version, and the response information transmitted by the server is fed back to the client.

[0020] If the client protocol version is HTTP / 2 and the server protocol version does not support HTTP / 2, the client traffic is converted to HTTP / 1 compliant client traffic and transmitted to the server; upon receiving a response from the server, the response is converted to HTTP / 2 compliant response and fed back to the client.

[0021] If the client protocol version is HTTP / 2 and the server protocol version does not support HTTP / 2, the client traffic is converted to HTTP / 1 compliant client traffic and transmitted to the server. Upon receiving a response from the server, the response is converted to HTTP / 2 compliant response and sent back to the client.

[0022] On the one hand, based on the address and port information of the server accessed by the client, the server protocol versions supported by the server are determined to include:

[0023] Obtain the address and port information of the server accessed by the client;

[0024] The protocol version matching the address information and port information is queried from the stored protection site configuration information; wherein the protection site configuration information records the address information, port information and supported protocol versions of different servers.

[0025] On the one hand, the acquired client traffic is parsed to determine the traffic type of the client traffic, including:

[0026] When client traffic is acquired, the header information of the client traffic data packets is parsed.

[0027] Based on the header information of the data packet, the traffic type of the client traffic is determined.

[0028] On the one hand, it also includes:

[0029] If the traffic type belongs to the Transmission Control Protocol (TCP), perform version parsing on the client traffic to determine the client protocol version of the client traffic;

[0030] If the traffic type does not belong to the Transmission Control Protocol (TCP), the client traffic will be either passed through or discarded.

[0031] This invention also provides a protocol conversion device suitable for proxy devices. The device includes a type parsing unit, a version parsing unit, a security detection unit, a determination unit, and a conversion unit.

[0032] The type parsing unit is used to parse the acquired client traffic to determine the traffic type of the client traffic;

[0033] The version parsing unit is used to perform version parsing on the client traffic when the traffic type of the client traffic belongs to a set interception and forwarding type, so as to determine the client protocol version of the client traffic;

[0034] The security detection unit is used to select a security engine parsing and detection program that matches the client protocol version to perform security detection on the client traffic in order to determine whether the client traffic is attack traffic.

[0035] The determining unit is used to determine the server protocol version supported by the server based on the address information and port information of the server accessed by the client, when the client traffic is non-attack traffic.

[0036] The conversion unit is used to convert the client traffic into data conforming to the server protocol version and transmit the data to the server according to the client protocol version and the server protocol version, and to convert the response information fed back by the server into information conforming to the client protocol version and feed the information back to the client.

[0037] On the one hand, the security detection unit includes a first detection subunit, a second detection subunit, and a determination subunit;

[0038] The first detection subunit is used to parse and detect the client traffic based on a text-based security engine parsing and detection program when the client protocol version does not belong to the HTTP / 2 protocol, so as to determine the detection result;

[0039] The second detection subunit is used to perform decoding, statistical analysis, and detection of the request data frames of the client traffic based on the security engine parsing and detection program, which is based on binary format parsing, when the client protocol version belongs to the HTTP / 2 protocol, so as to determine the detection result;

[0040] The determination subunit is used to determine that the client traffic belongs to attack traffic when the detection result shows abnormal traffic content, abnormal traffic data volume, abnormal traffic source and / or abnormal traffic pattern.

[0041] On the one hand, it also includes blocking units;

[0042] The blocking unit is used to block the transmission of client traffic to the server when the client traffic is considered to be attack traffic.

[0043] On the one hand, the conversion unit is used to transmit the client traffic to the server according to the client's protocol version when the client protocol version is HTTP / 1 and the server protocol version does not support HTTP / 2, or when the client protocol version is HTTP / 2 and the server protocol version supports HTTP / 2, and to feed back the response information transmitted by the server to the client.

[0044] If the client protocol version is HTTP / 2 and the server protocol version does not support HTTP / 2, the client traffic is converted to HTTP / 1 compliant client traffic and transmitted to the server; upon receiving a response from the server, the response is converted to HTTP / 2 compliant response and fed back to the client.

[0045] If the client protocol version is HTTP / 2 and the server protocol version does not support HTTP / 2, the client traffic is converted to HTTP / 1 compliant client traffic and transmitted to the server. Upon receiving a response from the server, the response is converted to HTTP / 2 compliant response and sent back to the client.

[0046] On the one hand, the determining unit includes an acquisition subunit and a query subunit;

[0047] The acquisition subunit is used to acquire the address information and port information of the server accessed by the client;

[0048] The query subunit is used to query the protocol version that matches the address information and the port information from the stored protection site configuration information; wherein, the protection site configuration information records the address information, port information and supported protocol versions of different servers.

[0049] On the one hand, the type parsing unit is used to parse the data packet header information of the client traffic when it is acquired; and to determine the traffic type of the client traffic based on the data packet header information.

[0050] On the one hand, it also includes a discard unit;

[0051] The version resolution unit is used to perform version resolution on the client traffic to determine the client protocol version of the client traffic when the traffic type belongs to the Transmission Control Protocol.

[0052] The discarding unit is used to pass through or discard the client traffic when the traffic type does not belong to the transmission control protocol.

[0053] This invention also provides a protocol conversion device, comprising:

[0054] Memory, used to store computer programs;

[0055] A processor for executing the computer program to implement the steps of the protocol conversion method described above.

[0056] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the protocol conversion method described above.

[0057] As can be seen from the above technical solution, the acquired client traffic is parsed to determine its type. If the client traffic falls under the set interception and forwarding type, version parsing is performed to determine the client protocol version. Different protocol versions use different security detection methods; therefore, a security engine parsing and detection program matching the client protocol version is selected to perform security checks on the client traffic to determine if it is attack traffic. If the client traffic is not attack traffic, the server protocol version supported by the server can be determined based on the address and port information of the server accessed by the client. Based on the client and server protocol versions, the client traffic is converted into data conforming to the server protocol version and transmitted to the server. The server's response information is converted into information conforming to the client protocol version and fed back to the client. This technical solution not only meets the security protection requirements for data between different protocol versions but also effectively solves the access failure problem caused by inconsistencies between client and server protocol versions. Attached Figure Description

[0058] To more clearly illustrate the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 A flowchart of a protocol conversion method provided in an embodiment of the present invention;

[0060] Figure 2 This is a schematic diagram illustrating the process of security protection and protocol conversion for a proxy device, as provided in an embodiment of the present invention.

[0061] Figure 3 This is a schematic diagram of the structure of a protocol conversion device provided in an embodiment of the present invention;

[0062] Figure 4 This is a structural diagram of a protocol conversion device provided in an embodiment of the present invention. Detailed Implementation

[0063] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the present invention.

[0064] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0065] Since both HTTP / 1.0 and HTTP / 1.1 use text-based data transmission, for ease of explanation, they can be collectively referred to as HTTP / 1. Compared to HTTP / 1, HTTP / 2 offers significant performance improvements. HTTP / 2 boasts numerous advantages such as multiplexing, header compression, server push, and binary framing, which can significantly increase the transmission speed of network devices and greatly enhance device performance.

[0066] Many products now support HTTP / 2 proxy communication, such as Nginx and F5 proxy communication devices. Taking Nginx as an example: when a client accesses the server via the HTTP / 1.1 protocol, Nginx forwards the request via HTTP / 1.1; when a client accesses the server via the HTTP / 2 protocol, Nginx forwards the request via HTTP / 2. However, current proxy technologies cannot inspect and protect HTTP / 2 traffic, nor can they perform protocol conversion between HTTP / 2 and HTTP / 1 protocols, making them unsuitable for firewall products.

[0067] Therefore, embodiments of the present invention provide a protocol conversion method, apparatus, device, and computer-readable storage medium. By identifying the client protocol version and selecting a security engine parsing and detection program that matches the client protocol version to perform security detection on client traffic, the security of data transmitted to the server can be ensured. By further identifying the server protocol version, the proxy device can convert client traffic and server response information into a protocol format recognizable by the peer device, effectively solving the access failure problem caused by inconsistencies between client and server protocol versions.

[0068] Next, a protocol conversion method provided by an embodiment of the present invention will be described in detail. Figure 1 A flowchart of a protocol conversion method provided in this embodiment of the invention, applicable to proxy devices, includes:

[0069] S101: Perform type parsing on the acquired client traffic to determine the traffic type of the client traffic.

[0070] When a client interacts with a server, the client traffic it transmits flows through a proxy device. When the proxy device receives the client traffic, it can parse the header information of the client traffic data packets and determine the traffic type of the client traffic based on the header information.

[0071] In this embodiment of the invention, the proxy device may be a firewall product.

[0072] S102: If the traffic type of the client traffic belongs to the set interception and forwarding type, perform version parsing on the client traffic to determine the client protocol version of the client traffic.

[0073] The configured interception and forwarding type can be any type of traffic that the proxy device needs to detect.

[0074] In practical applications, proxy devices primarily intercept and analyze Transmission Control Protocol (TCP) traffic. Therefore, when the traffic type belongs to TCP, version parsing can be performed on the client traffic to determine the client's protocol version. When the traffic type does not belong to TCP, the client traffic can be passed through or discarded.

[0075] S103: Select a security engine parsing and detection program that matches the client protocol version to perform security detection on the client traffic in order to determine whether the client traffic is attack traffic.

[0076] The security engine parsing and detection program is used to identify and block attack traffic, protecting the security of web applications. Attack traffic poses a threat to system security; in this embodiment of the invention, attack traffic may also be referred to as threat traffic.

[0077] In practical applications, traffic can be identified and blocked based on a predefined set of rules. Considering that different protocol versions have different security detection methods, a corresponding security engine parsing and detection program can be set up for each different protocol version.

[0078] If the client's protocol version is not HTTP / 2, a security engine parsing and detection program based on the text protocol can be used to parse and detect the client's traffic to determine the detection result.

[0079] When the client protocol version is HTTP / 2, a security engine based on binary format parsing can decode, statistically analyze, and detect the request data frames of the client traffic to determine the detection results.

[0080] HTTP / 2 protocol messages use a binary format, which is more difficult to parse than the text format of HTTP / 1. Therefore, security engine parsing and detection programs suitable for HTTP / 2 protocol need to add support for HTTP / 2 framing and flow control mechanisms in order to accurately parse and inspect message content.

[0081] In terms of security engine performance optimization, HTTP / 2 supports multiplexing and header compression. Compared to the HTTP / 1 protocol, proxy devices need to adapt to these features when analyzing and identifying traffic to ensure that normal traffic is not misjudged and malicious traffic is allowed.

[0082] Regarding server-side push, HTTP / 2 allows servers to proactively push resources. Proxy devices need to identify and analyze these requests to prevent the push of malicious resources.

[0083] Attack traffic exhibits a variety of attack characteristics, commonly including the following four aspects:

[0084] 1. Abnormal traffic content: The traffic contains illegal characters such as SQL injection statements, XSS attacks, CSRF and other malicious code.

[0085] 2. Abnormal traffic volume: such as a DDoS attack, where a large amount of traffic suddenly appears in a short period of time, far exceeding the normal level.

[0086] 3. Abnormal traffic source: such as from overseas countries or uncommon geographical location IPs.

[0087] 4. Abnormal traffic patterns: such as CC attacks, frequent requests to the same page in a short period of time or sending multiple requests in a short period of time.

[0088] Therefore, if the detection results show abnormal traffic content, abnormal traffic data volume, abnormal traffic source, and / or abnormal traffic pattern, it can be determined that the client traffic belongs to attack traffic.

[0089] In cases where client traffic constitutes attack traffic, in order to reduce the adverse impact of attack traffic on the server, proxy devices can block the transmission of client traffic to the server.

[0090] S104: When the client traffic is non-attack traffic, determine the server protocol version supported by the server based on the address and port information of the server accessed by the client.

[0091] When configuring protection sites, customers can choose whether to enable or disable the HTTP / 2 protocol for the servers protected by the proxy device. The configuration information in these sites determines whether the servers protected by the proxy device support the HTTP / 2 protocol. In practical applications, the address information, port information, and supported protocol versions of different servers can be recorded in the protection site configuration information.

[0092] After obtaining the address and port information of the server accessed by the client, the protocol version that matches the address and port information can be queried from the stored protection site configuration information.

[0093] S105: Based on the client protocol version and the server protocol version, convert the client traffic into data that conforms to the server protocol version and transmit the data to the server. Convert the response information returned by the server into information that conforms to the client protocol version and return the information to the client.

[0094] When the client and server protocol versions are the same, communication with the server can proceed according to the client's original protocol. When the client and server protocol versions are different, the proxy device, upon receiving client traffic, can convert it to traffic conforming to the server's protocol version before transmitting it to the server; similarly, upon receiving a response from the server, it needs to convert the response information to information conforming to the client's protocol version before transmitting it to the client.

[0095] Figure 2 This is a schematic diagram illustrating the security protection and protocol conversion process of a proxy device according to an embodiment of the present invention. The proxy device acquires client traffic transmitted by the client and determines whether the client traffic belongs to TCP traffic. If the client traffic does not belong to TCP traffic, it is either passed through or discarded. If the client traffic belongs to TCP traffic, it is further determined whether the client traffic is HTTP / 2 traffic. If the client traffic is HTTP / 2 traffic, it means that the client supports the HTTP / 2 protocol version. Then, the security engine parsing and detection program based on binary format parsing decodes and statistically analyzes the request data frames of the client traffic to identify whether it belongs to threat traffic. That is, the security engine decodes and statistically analyzes the request data frames of the traffic sent by the client based on the binary protocol. If the client traffic is not HTTP / 2 traffic, it means that the client does not support the HTTP / 2 protocol version. Then, the security engine parsing and detection program based on the text protocol parses and detects the client traffic to identify whether it belongs to threat traffic. That is, the security engine performs packet parsing and detection on the traffic sent by the client based on the text protocol.

[0096] Detection can identify whether client traffic is threatening. Threatening traffic can be blocked directly. For non-threat traffic, it can be further determined whether the server supports HTTP / 2.

[0097] When the client protocol version is HTTP / 1 and the server protocol version does not support HTTP / 2, or when both the client and server protocols support HTTP / 2, the proxy device transmits client traffic to the server according to the client's protocol version and sends the server's response information back to the client. In other words, the proxy device can use the client's existing protocol to communicate with the server and return the received server response information to the client.

[0098] If the client protocol version is HTTP / 2 but the server protocol version does not support HTTP / 2, the client traffic is converted to HTTP / 1 compliant client traffic and transmitted to the server. Upon receiving a response from the server, the response is converted to HTTP / 2 compliant response and sent back to the client.

[0099] When the client protocol version is HTTP / 2 but the server protocol version does not support HTTP / 2, the client traffic is converted to HTTP / 1 compliant client traffic and transmitted to the server. Upon receiving a response from the server, the response is converted to HTTP / 2 compliant response information and sent back to the client. The HTTP / 1 compliant version can be either HTTP / 1.0 or HTTP / 1.1. HTTP / 1.1 is currently the most widely used communication protocol, so it is used by default for communication with the server. However, HTTP / 1.0 can also be chosen.

[0100] In this embodiment of the invention, through a proxy device, clients can successfully access servers that do not support the HTTP / 2 protocol using the HTTP / 2 protocol. It can simultaneously detect, intercept, and protect HTTP / 1 and HTTP / 2 protocol traffic. It is applicable to transparent proxy, reverse proxy, and routing redirection modes. By setting up the proxy device provided in this embodiment of the invention, the implementation and deployment of HTTP / 2 communication are greatly facilitated. Existing programs can achieve HTTP / 2 protocol communication with virtually no code adjustments. The development of new programs does not need to consider whether the selected programming language can implement HTTP / 2 communication or the ease of implementation; it only needs to consider which programming language is most suitable for implementing the business logic. This reduces the development workload of HTTP / 2 protocol communication programs, decouples programs, and lowers the difficulty of program development. On the other hand, the security detection and protection function based on the HTTP / 2 protocol also fills the gaps in business security of HTTP / 2 protocol communication, meeting the security requirements of HTTP / 2 protocol in data transmission.

[0101] As can be seen from the above technical solution, the acquired client traffic is parsed to determine its type. If the client traffic falls under the set interception and forwarding type, version parsing is performed to determine the client protocol version. Different protocol versions use different security detection methods; therefore, a security engine parsing and detection program matching the client protocol version is selected to perform security checks on the client traffic to determine if it is attack traffic. If the client traffic is not attack traffic, the server protocol version supported by the server can be determined based on the address and port information of the server accessed by the client. Based on the client and server protocol versions, the client traffic is converted into data conforming to the server protocol version and transmitted to the server. The server's response information is converted into information conforming to the client protocol version and fed back to the client. This technical solution not only meets the security protection requirements for data between different protocol versions but also effectively solves the access failure problem caused by inconsistencies between client and server protocol versions.

[0102] Figure 3 This is a schematic diagram of a protocol conversion device provided in an embodiment of the present invention. It is applicable to proxy devices and includes a type parsing unit 31, a version parsing unit 32, a security detection unit 33, a determination unit 34, and a conversion unit 35.

[0103] Type parsing unit 31 is used to parse the acquired client traffic to determine the traffic type of the client traffic;

[0104] Version parsing unit 32 is used to perform version parsing on client traffic when the traffic type of the client traffic belongs to the set interception and forwarding type, so as to determine the client protocol version of the client traffic;

[0105] Security detection unit 33 is used to select a security engine parsing and detection program that matches the client protocol version to perform security detection on the client traffic in order to determine whether the client traffic is attack traffic;

[0106] The determining unit 34 is used to determine the server protocol version supported by the server based on the address and port information of the server accessed by the client when the client traffic is non-attack traffic.

[0107] The conversion unit 35 is used to convert client traffic into data that conforms to the server protocol version and transmit the data to the server according to the client protocol version and the server protocol version, and to convert the response information fed back by the server into information that conforms to the client protocol version and feed the information back to the client.

[0108] In some embodiments, the security detection unit includes a first detection subunit, a second detection subunit, and a determination subunit;

[0109] The first detection subunit is used to parse and detect client traffic based on a text-based security engine parsing and detection program when the client protocol version does not belong to the HTTP / 2 protocol, so as to determine the detection result.

[0110] The second detection subunit is used to decode, statistically analyze, and detect the request data frames of the client traffic based on the security engine parsing program, which is based on binary format parsing, when the client protocol version belongs to the HTTP / 2 protocol, so as to determine the detection result.

[0111] The determination subunit is used to determine whether client traffic is attack traffic when the detection results show abnormal traffic content, abnormal traffic data volume, abnormal traffic source, and / or abnormal traffic pattern.

[0112] In some embodiments, a blocking unit is also included;

[0113] The blocking unit is used to block the transmission of client traffic to the server when the client traffic is considered to be attack traffic.

[0114] In some embodiments, the conversion unit is used to transmit client traffic to the server according to the client's protocol version when the client protocol version is HTTP / 1 and the server protocol version does not support HTTP / 2, or when the client protocol version is HTTP / 2 and the server protocol version supports HTTP / 2, and to send the response information transmitted by the server back to the client.

[0115] If the client protocol version is HTTP / 2 and the server protocol version does not support HTTP / 2, the client traffic is converted to HTTP / 1 compliant client traffic and transmitted to the server; upon receiving the response information from the server, the response information is converted to HTTP / 2 compliant response information and sent back to the client.

[0116] If the client protocol version is HTTP / 2 but the server protocol version does not support HTTP / 2, the client traffic is converted to HTTP / 1 compliant client traffic and transmitted to the server. Upon receiving a response from the server, the response is converted to HTTP / 2 compliant response and sent back to the client.

[0117] In some embodiments, the determining unit includes an acquisition subunit and a query subunit;

[0118] The acquisition sub-unit is used to obtain the address and port information of the server accessed by the client;

[0119] The query subunit is used to query the protocol version that matches the address and port information from the stored protection site configuration information; the protection site configuration information records the address information, port information, and supported protocol versions of different servers.

[0120] In some embodiments, the type resolution unit is used to parse the packet header information of the client traffic when the client traffic is acquired; and to determine the traffic type of the client traffic based on the packet header information.

[0121] In some embodiments, a discarding unit is also included;

[0122] The version resolution unit is used to perform version resolution on client traffic when the traffic type belongs to Transmission Control Protocol, in order to determine the client protocol version of the client traffic;

[0123] The discard unit is used to pass through or discard client traffic when the traffic type does not belong to the Transmission Control Protocol.

[0124] Figure 3 The description of the features in the corresponding embodiments can be found in [reference needed]. Figure 1 The relevant descriptions of the corresponding embodiments will not be repeated here.

[0125] As can be seen from the above technical solution, the acquired client traffic is parsed to determine its type. If the client traffic falls under the set interception and forwarding type, version parsing is performed to determine the client protocol version. Different protocol versions use different security detection methods; therefore, a security engine parsing and detection program matching the client protocol version is selected to perform security checks on the client traffic to determine if it is attack traffic. If the client traffic is not attack traffic, the server protocol version supported by the server can be determined based on the address and port information of the server accessed by the client. Based on the client and server protocol versions, the client traffic is converted into data conforming to the server protocol version and transmitted to the server. The server's response information is converted into information conforming to the client protocol version and fed back to the client. This technical solution not only meets the security protection requirements for data between different protocol versions but also effectively solves the access failure problem caused by inconsistencies between client and server protocol versions.

[0126] Figure 4 A structural diagram of a protocol conversion device provided in an embodiment of the present invention is shown below. Figure 4 As shown, the protocol conversion device includes: a memory 40 for storing computer programs;

[0127] The processor 41 is used to implement the steps of the protocol conversion method as described in the above embodiments when executing a computer program.

[0128] The protocol conversion device provided in this embodiment may include, but is not limited to, smartphones, tablets, laptops, or desktop computers.

[0129] The processor 41 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 41 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 41 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 41 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 41 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0130] The memory 40 may include one or more computer-readable storage media, which may be non-transitory. The memory 40 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In this embodiment, the memory 40 is used to store at least the following computer program 401, which, after being loaded and executed by the processor 41, is capable of implementing the relevant steps of the protocol conversion method disclosed in any of the foregoing embodiments. In addition, the resources stored in the memory 40 may also include an operating system 402 and data 403, and the storage method may be temporary or permanent storage. The operating system 402 may include Windows, Unix, Linux, etc. The data 403 may include, but is not limited to, client traffic, security engine parsing and detection programs, etc.

[0131] In some embodiments, the protocol conversion device may further include a display screen 42, an input / output interface 43, a communication interface 44, a power supply 45, and a communication bus 46.

[0132] Those skilled in the art will understand that Figure 4 The structure shown does not constitute a limitation on the protocol conversion device and may include more or fewer components than illustrated.

[0133] It is understood that if the protocol conversion method in the above embodiments is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the methods in the various embodiments of this application. The aforementioned storage medium includes: USB flash drive, mobile hard disk, read-only memory (ROM), random access memory (RAM), electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, magnetic disk, or optical disk, and other media capable of storing program code.

[0134] Based on this, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the protocol conversion method described above.

[0135] The functions of each functional module of the computer-readable storage medium described in the embodiments of the present invention can be specifically implemented according to the methods in the above method embodiments. The specific implementation process can be referred to the relevant descriptions in the above method embodiments, which will not be repeated here.

[0136] The foregoing has provided a detailed description of a protocol conversion method, apparatus, device, and computer-readable storage medium provided in the embodiments of this application. The various embodiments are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0137] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0138] The foregoing has provided a detailed description of a protocol conversion method, apparatus, device, and computer-readable storage medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of the invention. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and core ideas of the invention. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from the principles of the invention, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A protocol conversion method, characterized in that, Applicable to agent devices, the method includes: The acquired client traffic is parsed to determine the traffic type of the client traffic; If the traffic type of the client traffic belongs to the set interception and forwarding type, the client traffic is parsed to determine the client protocol version of the client traffic; Select a security engine parsing and detection program that matches the client protocol version to perform security detection on the client traffic in order to determine whether the client traffic is attack traffic; If the client traffic is non-attack traffic, the server protocol version supported by the server is determined based on the address and port information of the server accessed by the client. Based on the client protocol version and the server protocol version, the client traffic is converted into data conforming to the server protocol version and transmitted to the server. The response information from the server is converted into information conforming to the client protocol version and fed back to the client.

2. The protocol conversion method according to claim 1, characterized in that, Selecting a security engine parsing and detection program that matches the client protocol version to perform security checks on the client traffic, in order to determine whether the client traffic is attack traffic, includes: If the client protocol version is not HTTP / 2, a text-based security engine parsing and detection program will parse and detect the client traffic to determine the detection result. If the client protocol version is HTTP / 2, the security engine parsing and detection program based on binary format parsing decodes, statistically analyzes and detects the request data frames of the client traffic to determine the detection results. If the detection results show abnormal traffic content, abnormal traffic data volume, abnormal traffic source, and / or abnormal traffic pattern, the client traffic is determined to be attack traffic.

3. The protocol conversion method according to claim 2, characterized in that, Also includes: If the client traffic is considered attack traffic, the transmission of that client traffic to the server will be blocked.

4. The protocol conversion method according to claim 1, characterized in that, Based on the client protocol version and the server protocol version, converting the client traffic into data conforming to the server protocol version and transmitting the data to the server, and converting the response information from the server into information conforming to the client protocol version and transmitting the information back to the client, includes: When the client protocol version is HTTP / 1 and the server protocol version does not support HTTP / 2, or when the client protocol version is HTTP / 2 and the server protocol version supports HTTP / 2, the client traffic is transmitted to the server according to the client's protocol version, and the response information transmitted by the server is fed back to the client. If the client protocol version is HTTP / 2 and the server protocol version does not support HTTP / 2, the client traffic is converted to HTTP / 1 compliant client traffic and transmitted to the server; upon receiving a response from the server, the response is converted to HTTP / 2 compliant response and fed back to the client. If the client protocol version is HTTP / 2 and the server protocol version does not support HTTP / 2, the client traffic is converted to HTTP / 1 compliant client traffic and transmitted to the server. Upon receiving a response from the server, the response is converted to HTTP / 2 compliant response and sent back to the client.

5. The protocol conversion method according to claim 1, characterized in that, Based on the address and port information of the server accessed by the client, the server protocol versions supported by the server are determined to include: Obtain the address and port information of the server accessed by the client; The protocol version matching the address information and port information is queried from the stored protection site configuration information; wherein the protection site configuration information records the address information, port information and supported protocol versions of different servers.

6. The protocol conversion method according to claim 1, characterized in that, The acquired client traffic is parsed to determine the traffic type, which includes: When client traffic is acquired, the header information of the client traffic data packets is parsed. Based on the header information of the data packet, the traffic type of the client traffic is determined.

7. The protocol conversion method according to claim 6, characterized in that, Also includes: If the traffic type belongs to the Transmission Control Protocol (TCP), perform version parsing on the client traffic to determine the client protocol version of the client traffic; If the traffic type does not belong to the Transmission Control Protocol (TCP), the client traffic will be either passed through or discarded.

8. A protocol conversion device, characterized in that, Applicable to proxy devices, the device includes a type parsing unit, a version parsing unit, a security detection unit, a determination unit, and a conversion unit; The type parsing unit is used to parse the acquired client traffic to determine the traffic type of the client traffic; The version parsing unit is used to perform version parsing on the client traffic when the traffic type of the client traffic belongs to a set interception and forwarding type, so as to determine the client protocol version of the client traffic; The security detection unit is used to select a security engine parsing and detection program that matches the client protocol version to perform security detection on the client traffic in order to determine whether the client traffic is attack traffic. The determining unit is used to determine the server protocol version supported by the server based on the address information and port information of the server accessed by the client, when the client traffic is non-attack traffic. The conversion unit is configured to convert the client traffic into data conforming to the server protocol version and transmit the data to the server, based on the client protocol version and the server protocol version, and to convert the response information fed back by the server into information conforming to the client protocol version and feed the information back to the client.

9. A protocol conversion device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the protocol conversion method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the protocol conversion method as described in any one of claims 1 to 7.

Images