Communication data processing protection method and terminal

Abstract

The invention discloses a communication data processing protection method and a terminal, and the method comprises the steps: receiving protocol data, judging whether the protocol data is abnormal data or not according to a preset judgment condition, if yes, creating a virtual machine, copying a protocol structure of the protocol data into the virtual machine, and entering a corresponding virtual machine callback according to the protocol structure. And otherwise, acquiring a protocol structure of the protocol data, and entering a corresponding server for callback according to the protocol structure. According to the method, the protocol structure of the abnormal protocol data is copied into the virtual machine, and the corresponding virtual machine is called back according to the protocol structure, so that even if the abnormal data is malicious data which can influence the content corresponding to the real protocol, the abnormal data is only trapped in the virtual machine and cannot influence the content corresponding to the real protocol; and the data security is ensured.

Description

Technical Field

[0001] The present invention relates to the field of data protection technology, and in particular to a communication data processing protection method and terminal. Background Art

[0002] In some existing distributed systems, protocol data transmission between different nodes verifies the protocol content rather than the protocol header information. Once the header information is maliciously tampered with or forged, it may cause the data packet to be incorrectly routed, parsed or processed, thus providing convenient conditions for the exploitation of protocol vulnerabilities. After the illegal protocol data is transmitted and processed by the next node and problems occur, it will endanger the content corresponding to the real protocol. The tight coupling between the protocol and the data; once a problem occurs at the protocol level, its impact often spreads rapidly to the data level, resulting in serious consequences such as data leakage, tampering, damage and even system crashes. This "ripple effect" effect not only increases the difficulty of data protection, but also greatly threatens the overall security of the information system. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide a communication data processing protection method and terminal to prevent malicious protocol data from affecting the content corresponding to the real protocol and ensure data security.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0005] A communication data processing protection method comprises the following steps:

[0006] S1, receiving protocol data, and judging whether the protocol data is abnormal data according to a preset judgment condition, if so, executing step S2, otherwise executing step S3;

[0007] S2. Create a virtual machine, copy the protocol structure of the protocol data into the virtual machine, and enter the corresponding virtual machine callback according to the protocol structure;

[0008] S3. Obtain the protocol structure of the protocol data, and enter the corresponding server callback according to the protocol structure.

[0009] In order to solve the above technical problems, another technical solution adopted by the present invention is:

[0010] A communication data processing protection terminal comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0011] S1, receiving protocol data, and judging whether the protocol data is abnormal data according to a preset judgment condition, if so, executing step S2, otherwise executing step S3;

[0012] S2. Create a virtual machine, copy the protocol structure of the protocol data into the virtual machine, and enter the corresponding virtual machine callback according to the protocol structure;

[0013] S3. Obtain the protocol structure of the protocol data, and enter the corresponding server callback according to the protocol structure.

[0014] The beneficial effects of the present invention are: providing a communication data processing protection method and terminal, after receiving the protocol data, preliminarily judging whether the protocol data is abnormal data, if so, copying the protocol structure of the protocol data into the virtual machine, and entering the corresponding virtual machine callback according to the protocol structure, so that even if the abnormal data is malicious data that will affect the content corresponding to the real protocol, it will only be trapped in the virtual machine and will not affect the content corresponding to the real protocol, thereby ensuring data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A schematic diagram of the steps of a communication data processing protection method of the present invention;

[0016] Figure 2 A data trend diagram of protocol data of a communication data processing protection method involved in an embodiment of the present invention;

[0017] Figure 3 The present invention is a system block diagram of a communication data processing protection terminal.

[0018] Description of labels:

[0019] 1. A communication data processing protection terminal; 2. A memory; 3. A processor. DETAILED DESCRIPTION

[0020] In order to explain the technical content, achieved objectives and effects of the present invention in detail, the following is an explanation in combination with the implementation modes and the accompanying drawings.

[0021] Please refer to Figure 1 and Figure 2 , a communication data processing protection method, comprising the following steps:

[0022] S1, receiving protocol data, and judging whether the protocol data is abnormal data according to a preset judgment condition, if so, executing step S2, otherwise executing step S3;

[0023] S2. Create a virtual machine, copy the protocol structure of the protocol data into the virtual machine, and enter the corresponding virtual machine callback according to the protocol structure;

[0024] S3. Obtain the protocol structure of the protocol data, and enter the corresponding server callback according to the protocol structure.

[0025] From the above description, it can be seen that the beneficial effect of the present invention is that after receiving the protocol data, it is preliminarily determined whether the protocol data is abnormal data. If so, the protocol structure of the protocol data is copied to the virtual machine, and the corresponding virtual machine callback is entered according to the protocol structure. In this way, even if the abnormal data is malicious data that will affect the content corresponding to the real protocol, it will only be trapped in the virtual machine and will not affect the content corresponding to the real protocol, thereby ensuring data security.

[0026] Furthermore, the step S2 further includes:

[0027] Generate a processing response according to the virtual machine callback, and if the processing response allows continued acquisition, return the protocol content of the protocol structure from the virtual machine;

[0028] If the processing response is to prevent further acquisition, the protocol content of the protocol structure is saved in the virtual machine.

[0029] From the above description, it can be seen that through the virtual machine callback, it can be determined whether the abnormal data is malicious data, and then choose whether to allow continued acquisition or prevent continued acquisition. If it is malicious data, all its subsequent contents can be saved in the virtual machine, thereby ensuring the data security of the real protocol.

[0030] Further, judging whether the protocol data is abnormal data according to a preset judgment condition specifically includes:

[0031] It is determined whether the protocol content of the protocol data meets the preset standard and whether the data size of the protocol data is equal to the preset value. If both conditions are met, the protocol data is normal data; if only one of the two conditions is met, the protocol data is abnormal data.

[0032] From the above description, it can be seen that the conditions corresponding to the protocol content and data size are set up to accurately determine whether there is an abnormality in the current protocol content and quickly screen the protocol content.

[0033] Furthermore, step S1 further includes:

[0034] If both conditions are not met, the corresponding virtual machine callback is directly entered.

[0035] From the above description, it can be seen that when the protocol content cannot meet the two judgment conditions, it means that the protocol content is obviously malicious data or unqualified data, and the virtual machine callback is directly triggered to reduce the data processing pressure of the virtual protocol part.

[0036] Furthermore, the step S2 further includes:

[0037] The virtual machine callback includes a protocol content parsing callback and a protocol structure parsing callback;

[0038] Acquire the protocol content from the protocol structure, create different protocol content parsing callbacks according to the protocol content matching, and create a corresponding response event for each protocol content parsing callback matching;

[0039] The protocol structure is classified, and a corresponding protocol structure parsing callback is created according to the category to which the protocol structure belongs.

[0040] From the above description, it can be seen that the virtual machine callback includes the protocol content parsing callback and the protocol structure parsing callback. The protocol content parsing callback and the response event are pre-customized and can be directly triggered after meeting the conditions, while the protocol structure parsing callback needs to be matched and created according to the actual protocol content. The combination of the two methods can improve the flexibility and rationality of the virtual machine callback.

[0041] Please refer to Figure 3 A communication data processing protection terminal 1 includes a memory 2, a processor 3, and a computer program stored in the memory 2 and executable on the processor 3. When the processor 3 executes the computer program, the following steps are implemented:

[0042] S1, receiving protocol data, and judging whether the protocol data is abnormal data according to a preset judgment condition, if so, executing step S2, otherwise executing step S3;

[0043] S2. Create a virtual machine, copy the protocol structure of the protocol data into the virtual machine, and enter the corresponding virtual machine callback according to the protocol structure;

[0044] S3. Obtain the protocol structure of the protocol data, and enter the corresponding server callback according to the protocol structure.

[0045] From the above description, it can be seen that the beneficial effect of the present invention is that after receiving the protocol data, it is preliminarily determined whether the protocol data is abnormal data. If so, the protocol structure of the protocol data is copied to the virtual machine, and the corresponding virtual machine callback is entered according to the protocol structure. In this way, even if the abnormal data is malicious data that will affect the content corresponding to the real protocol, it will only be trapped in the virtual machine and will not affect the content corresponding to the real protocol, thereby ensuring data security.

[0046] Furthermore, the step S2 further includes:

[0047] Generate a processing response according to the virtual machine callback, and if the processing response allows continued acquisition, return the protocol content of the protocol structure from the virtual machine;

[0048] If the processing response is to prevent further acquisition, the protocol content of the protocol structure is saved in the virtual machine.

[0049] From the above description, it can be seen that through the virtual machine callback, it can be determined whether the abnormal data is malicious data, and then choose whether to allow continued acquisition or prevent continued acquisition. If it is malicious data, all its subsequent contents can be saved in the virtual machine, thereby ensuring the data security of the real protocol.

[0050] Further, judging whether the protocol data is abnormal data according to a preset judgment condition specifically includes:

[0051] It is determined whether the protocol content of the protocol data meets the preset standard and whether the data size of the protocol data is equal to the preset value. If both conditions are met, the protocol data is normal data; if only one of the two conditions is met, the protocol data is abnormal data.

[0052] From the above description, it can be seen that the conditions corresponding to the protocol content and data size are set up to accurately determine whether there is an abnormality in the current protocol content and quickly screen the protocol content.

[0053] Furthermore, step S1 further includes:

[0054] If both conditions are not met, the corresponding virtual machine callback is directly entered.

[0055] From the above description, it can be seen that when the protocol content cannot meet the two judgment conditions, it means that the protocol content is obviously malicious data or unqualified data, and the virtual machine callback is directly triggered to reduce the data processing pressure of the virtual protocol part.

[0056] Furthermore, the step S2 further includes:

[0057] The virtual machine callback includes a protocol content parsing callback and a protocol structure parsing callback;

[0058] Acquire the protocol content from the protocol structure, create different protocol content parsing callbacks according to the protocol content matching, and create a corresponding response event for each protocol content parsing callback matching;

[0059] The protocol structure is classified, and a corresponding protocol structure parsing callback is created according to the category to which the protocol structure belongs.

[0060] From the above description, it can be seen that the virtual machine callback includes the protocol content parsing callback and the protocol structure parsing callback. The protocol content parsing callback and the response event are pre-customized and can be directly triggered after meeting the conditions, while the protocol structure parsing callback needs to be matched and created according to the actual protocol content. The combination of the two methods can improve the flexibility and rationality of the virtual machine callback.

[0061] Please refer to Figure 1 and Figure 2 , Embodiment 1 of the present invention is:

[0062] A communication data processing protection method comprises the following steps:

[0063] S1, receiving protocol data, judging whether the protocol data is abnormal data according to preset judgment conditions, if so, executing step S2, otherwise executing step S3;

[0064] In this embodiment, it is determined whether the protocol content of the protocol data meets the preset standard and whether the data size of the protocol data is equal to the preset value. If both conditions are met, the protocol data is normal data. If only one of the two conditions is met, the protocol data is abnormal data. If both conditions are not met, the corresponding virtual machine callback is directly entered; refer to Table 1 Protocol Information Configuration Table as shown:

[0065] [Request-Line) POST / b78090a0-5f82-46b6-abe6-8033efecfe8f / HTTP / 1.1 Cache-Control no-cache Connection Close Pragma no-cache Content-Type application / soap+xm User-Agent WSDAPI Host 192.168.249.72:5357 Content-Length 733

[0066] Table 1 Protocol information configuration table

[0067] Among them, the data size can select 733 as the judgment standard value, and the preset standard can include content type (Content-Type) and the like.

[0068] In this embodiment, the protocol structure of the received protocol data may be copied into two copies in advance, such as protocol A and protocol B, and a virtual machine callback is created for protocol A and a normal data callback is configured for protocol B, and then the above judgment process is performed.

[0069] S2. Create a virtual machine, copy the protocol structure of the protocol data into the virtual machine, and enter the corresponding virtual machine callback according to the protocol structure;

[0070] Among them, the virtual machine callback includes the protocol content parsing callback and the protocol structure parsing callback; when setting the protocol content parsing callback, the protocol content is obtained from the protocol structure, and different protocol content parsing callbacks are created according to the protocol content matching, for example: 1. Return the error corresponding to the web page, such as 403, 404; 2. Return websocket, successful; 3. Return the success / error attributes of the corresponding software, etc. Then create a corresponding response event for each protocol content parsing callback match; the response time includes but is not limited to: generating text content, generating image content, generating data content, and returning the corresponding data content according to the success or error of the software.

[0071] When creating a protocol structure parsing callback, the protocol structure is classified, and the corresponding protocol structure parsing callback is created according to the category to which the protocol structure belongs. The specific protocol structure categories are: HTTP common error types, HTTP common type return callbacks, Socket common error types, and Socket common type return callbacks. The corresponding protocol structure parsing callbacks are the protocol content parsing callbacks generated by HTTP, the protocol content parsing callbacks generated by Socket, and the protocol content parsing callbacks generated by other software protocols. In addition, the SDK interface can also be registered on the virtual machine to facilitate the installation of callbacks of other unknown types.

[0072] In addition, in order to ensure that the virtual machine callback can be triggered, for some protocol data whose data size does not meet the preset value, the data size can be increased by adding several spaces at the end of the data.

[0073] In this embodiment, a processing response is generated based on the virtual machine callback. If the processing response is to allow continued acquisition, the protocol content of the protocol structure is returned from the virtual machine; if the processing response is to prevent continued acquisition, the protocol content of the protocol structure is saved in the virtual machine to prevent it from affecting the data of the real protocol.

[0074] S3. Obtain the protocol structure of the protocol data, and enter the corresponding server callback according to the protocol structure.

[0075] Please refer to Figure 3 , Embodiment 2 of the present invention is:

[0076] A communication data processing protection terminal 1 includes a memory 2, a processor 3, and a computer program stored in the memory 2 and executable on the processor 3. When the processor 3 executes the computer program, a communication data processing protection method of embodiment 1 is implemented.

[0077] In summary, the present invention provides a communication data processing protection method and terminal. After receiving the protocol data, it is preliminarily determined whether the protocol data is abnormal data. If so, the protocol structure of the protocol data is copied to the virtual machine, and the corresponding virtual machine callback is entered according to the protocol structure. In this way, even if the abnormal data is malicious data that will affect the content corresponding to the real protocol, it will only be trapped in the virtual machine and will not affect the content corresponding to the real protocol. If the protocol data is not malicious data, it can be returned to the server through the corresponding virtual machine callback. At the same time, multiple virtual machine callback methods are set to flexibly respond to different protocol data and ensure data security.

[0078] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A communication data processing protection method, characterized in that: The steps include: S1, receiving protocol data, and judging whether the protocol data is abnormal data according to a preset judgment condition, if so, executing step S2, otherwise executing step S3; S2. Create a virtual machine, copy the protocol structure of the protocol data into the virtual machine, and enter the corresponding virtual machine callback according to the protocol structure; S3. Obtain the protocol structure of the protocol data, and enter the corresponding server callback according to the protocol structure.

2. A communication data processing protection method according to claim 1, characterized in that: The step S2 further comprises: Generate a processing response according to the virtual machine callback, and if the processing response allows continued acquisition, return the protocol content of the protocol structure from the virtual machine; If the processing response is to prevent further acquisition, the protocol content of the protocol structure is saved in the virtual machine.

3. A communication data processing protection method according to claim 1, characterized in that: Determining whether the protocol data is abnormal data according to the preset judgment condition specifically includes: It is determined whether the protocol content of the protocol data meets the preset standard and whether the data size of the protocol data is equal to the preset value. If both conditions are met, the protocol data is normal data; if only one of the two conditions is met, the protocol data is abnormal data.

4. A communication data processing protection method according to claim 3, characterized in that: Step S1 also includes: If both conditions are not met, the corresponding virtual machine callback is directly entered.

5. A communication data processing protection method according to claim 3, characterized in that: The step S2 further comprises: The virtual machine callback includes a protocol content parsing callback and a protocol structure parsing callback; Acquire the protocol content from the protocol structure, create different protocol content parsing callbacks according to the protocol content matching, and create a corresponding response event for each protocol content parsing callback matching; The protocol structure is classified, and a corresponding protocol structure parsing callback is created according to the category to which the protocol structure belongs.

6. A communication data processing protection terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the following steps are implemented: S1, receiving protocol data, and judging whether the protocol data is abnormal data according to a preset judgment condition, if so, executing step S2, otherwise executing step S3; S2. Create a virtual machine, copy the protocol structure of the protocol data into the virtual machine, and enter the corresponding virtual machine callback according to the protocol structure; S3. Obtain the protocol structure of the protocol data, and enter the corresponding server callback according to the protocol structure.

7. A communication data processing protection terminal according to claim 6, characterized in that: The step S2 further comprises: Generate a processing response according to the virtual machine callback, and if the processing response allows continued acquisition, return the protocol content of the protocol structure from the virtual machine; If the processing response is to prevent further acquisition, the protocol content of the protocol structure is saved in the virtual machine.

8. A communication data processing protection terminal according to claim 6, characterized in that: Determining whether the protocol data is abnormal data according to the preset judgment condition specifically includes: It is determined whether the protocol content of the protocol data meets the preset standard and whether the data size of the protocol data is equal to the preset value. If both conditions are met, the protocol data is normal data; if only one of the two conditions is met, the protocol data is abnormal data.

9. A communication data processing protection terminal according to claim 8, characterized in that: Step S1 also includes: If both conditions are not met, the corresponding virtual machine callback is directly entered.

10. A communication data processing protection terminal according to claim 8, characterized in that: The step S2 further comprises: The virtual machine callback includes a protocol content parsing callback and a protocol structure parsing callback; Acquire the protocol content from the protocol structure, create different protocol content parsing callbacks according to the protocol content matching, and create a corresponding response event for each protocol content parsing callback matching; The protocol structure is classified, and a corresponding protocol structure parsing callback is created according to the category to which the protocol structure belongs.

Images