Communication data processing protection method and terminal

Abstract

The application discloses a communication data processing protection method and a terminal. Protocol data is received, and it is judged whether the protocol data is abnormal data according to a preset judgment condition. If yes, a virtual machine is created, the protocol structure of the protocol data is copied into the virtual machine, and corresponding virtual machine callback is entered according to the protocol structure. Otherwise, the protocol structure of the protocol data is acquired, and corresponding server callback is entered according to the protocol structure. The protocol structure of abnormal protocol data is copied into the virtual machine, and corresponding virtual machine callback is entered according to the protocol structure. Even if the abnormal data is malicious data which can affect the content corresponding to the real protocol, the data can only be trapped in the virtual machine and cannot affect the content corresponding to the real protocol, so that the data security is ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data protection, in particular to a communication data processing protection method and terminal. BACKGROUND

[0002] In some existing distributed systems, the protocol data transmission between different nodes checks the protocol content rather than the protocol header information. Once the header information is maliciously tampered with or forged, it may lead to the data packet being incorrectly routed, parsed or processed, thus providing convenient conditions for the exploitation of protocol vulnerabilities. After illegal protocol data is transmitted and processed by the next node, it will harm the content corresponding to the real protocol due to the close coupling between the protocol and the data. Once a problem occurs at the protocol level, its impact will quickly spread to the data level, leading to data leakage, tampering, damage or even system crash and other serious consequences. This "pull a hair and the whole body moves" effect not only increases the difficulty of data protection, but also greatly threatens the overall security of the information system. SUMMARY

[0003] The technical problem to be solved by the present application is to provide a communication data processing protection method and terminal to avoid the impact of malicious protocol data on the content corresponding to the real protocol and ensure data security.

[0004] To solve the above technical problems, the technical scheme adopted by the present application is:

[0005] A communication data processing protection method, comprising the following steps:

[0006] S1, receiving protocol data, judging whether the protocol data is abnormal data according to a preset judgment condition, if yes, executing step S2, otherwise executing step S3;

[0007] S2, creating a virtual machine, copying the protocol structure of the protocol data into the virtual machine, and entering the corresponding virtual machine callback according to the protocol structure;

[0008] S3, obtaining the protocol structure of the protocol data, and entering the corresponding server callback according to the protocol structure.

[0009] To solve the above technical problems, another technical scheme adopted by the present application is:

[0010] A communication data processing protection terminal, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0011] S1, receiving protocol data, judging whether the protocol data is abnormal data according to a preset judgment condition, if yes, executing step S2, otherwise executing step S3;

[0012] S2, create a virtual machine, copy the protocol structure of the protocol data into the virtual machine, and enter the corresponding virtual machine callback according to the protocol structure;

[0013] S3, obtain the protocol structure of the protocol data, and enter the corresponding server callback according to the protocol structure.

[0014] The application has the beneficial effect that a communication data processing protection method and terminal are provided, after receiving protocol data, it is preliminarily judged whether the protocol data is abnormal data, if yes, the protocol structure of the protocol data is copied into a virtual machine, and the corresponding virtual machine callback is entered according to the protocol structure, so that even if the abnormal data is malicious data that can affect the content corresponding to the real protocol, it will only be trapped in the virtual machine and will not affect the content corresponding to the real protocol, thereby ensuring data security. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 It is a step schematic diagram of a communication data processing protection method of the application.

[0016] Figure 2 It is a data flow chart of the protocol data of a communication data processing protection method related to an embodiment of the application.

[0017] Figure 3 It is a system block diagram of a communication data processing protection terminal of the application.

[0018] Label explanation:

[0019] 1, a communication data processing protection terminal; 2, a memory; 3, a processor. DETAILED DESCRIPTION

[0020] In order to explain the technical content, the purpose and the effect of the application in detail, the following will be explained in combination with the embodiments and the drawings.

[0021] Please refer to Figure 1 and Figure 2 A communication data processing protection method, comprising the following steps:

[0022] S1, receiving protocol data, judging whether the protocol data is abnormal data according to a preset judgment condition, if yes, executing step S2, otherwise executing step S3;

[0023] S2, create a virtual machine, copy the protocol structure of the protocol data into the virtual machine, and enter the corresponding virtual machine callback according to the protocol structure;

[0024] S3, obtaining a protocol structure of the protocol data, and entering a corresponding server callback according to the protocol structure.

[0025] From the above description, the beneficial effects of the present application are that after receiving the protocol data, it is preliminarily judged whether the protocol data is abnormal data, if so, the protocol structure of the protocol data is copied into the virtual machine, and the corresponding virtual machine callback is entered according to the protocol structure, so that even if the abnormal data is malicious data that will affect the content corresponding to the real protocol, it will only be trapped in the virtual machine and will not affect the content corresponding to the real protocol, thereby ensuring data security.

[0026] Further, the step S2 further comprises:

[0027] According to the virtual machine callback, a processing response is generated, if the processing response is to allow to continue to acquire, the protocol content of the protocol structure is returned from the virtual machine;

[0028] If the processing response is to prevent continuing to acquire, the protocol content of the protocol structure is saved in the virtual machine.

[0029] From the above description, it can be known that whether the abnormal data is malicious data can be judged through the virtual machine callback, and then it is selected whether to allow to continue to acquire or to prevent to continue to acquire, if it is malicious data, the subsequent content can be saved in the virtual machine, thereby ensuring the data security of the real protocol.

[0030] Further, judging whether the protocol data is abnormal data according to a preset judgment condition specifically comprises:

[0031] Judging whether the protocol content of the protocol data meets a preset standard and whether the data size of the protocol data is equal to a preset value, if both conditions are met, the protocol data is normal data, if only one of the two conditions is met, the protocol data is abnormal data.

[0032] From the above description, it can be known that the conditions of the corresponding protocol content and data size are set to accurately judge whether the current protocol content is abnormal and quickly screen the protocol content.

[0033] Further, the step S1 further comprises:

[0034] If both conditions are not met, the corresponding virtual machine callback is directly entered.

[0035] From the above description, when the protocol content cannot meet the two judgment conditions, it is indicated that the protocol content is obviously malicious data or unqualified data, and the virtual machine callback is directly triggered, thereby reducing the data processing pressure of the virtual protocol part.

[0036] Further, the step S2 further comprises:

[0037] The virtual machine callback comprises a protocol content parsing callback and a protocol structure parsing callback.

[0038] The protocol content is acquired from the protocol structure, different protocol content parsing callbacks are created according to the protocol content, and a corresponding response event is created for each protocol content parsing callback.

[0039] The protocol structure is classified, and the corresponding protocol structure parsing callback is created according to the category to which the protocol structure belongs.

[0040] As can be seen from the above description, the virtual machine callback comprises a protocol content parsing callback and a protocol structure parsing callback, the protocol content parsing callback and the response event are pre-customized, and can be directly triggered after meeting the conditions, and the protocol structure parsing callback needs to be matched and created according to the actual protocol content, and the combination of the two modes can improve the flexibility and rationality of the virtual machine callback.

[0041] Please refer to Figure 3 A communication data processing protection terminal 1 comprises a memory 2, a processor 3, and a computer program stored in the memory 2 and capable of running on the processor 3, and the processor 3 implements the following steps when executing the computer program:

[0042] S1, receiving protocol data, judging whether the protocol data is abnormal data according to a preset judgment condition, if yes, executing step S2, otherwise executing step S3;

[0043] S2, creating a virtual machine, copying the protocol structure of the protocol data into the virtual machine, and entering the corresponding virtual machine callback according to the protocol structure;

[0044] S3, acquiring the protocol structure of the protocol data, and entering the corresponding server callback according to the protocol structure.

[0045] As can be seen from the above description, the beneficial effects of the present application are that after receiving the protocol data, it is preliminarily judged whether the protocol data is abnormal data, if yes, the protocol structure of the protocol data is copied into the virtual machine, and the corresponding virtual machine callback is entered according to the protocol structure, so that even if the abnormal data is malicious data that can affect the content corresponding to the real protocol, it will only be trapped in the virtual machine and will not affect the content corresponding to the real protocol, thereby ensuring data security.

[0046] Further, the step S2 further comprises:

[0047] According to the virtual machine callback, a processing response is generated, if the processing response is to allow to continue to acquire, the protocol content of the protocol structure is returned from the virtual machine;

[0048] If the processing response is to prevent to continue to acquire, the protocol content of the protocol structure is saved in the virtual machine.

[0049] From the above description, it can be known that whether the abnormal data is malicious data can be judged through the virtual machine callback, and then whether to allow to continue to acquire or to prevent to continue to acquire is selected, if the data is malicious data, the subsequent content can be saved in the virtual machine, and the data security of the real protocol is ensured.

[0050] Further, judging whether the protocol data is abnormal data according to a preset judgment condition specifically includes:

[0051] Judging whether the protocol content of the protocol data meets a preset standard and whether the data size of the protocol data is equal to a preset value, if both conditions are met, the protocol data is normal data, if only one of the two conditions is met, the protocol data is abnormal data.

[0052] From the above description, it can be known that the conditions of the protocol content and the data size are set to accurately judge whether the current protocol content is abnormal and quickly screen the protocol content.

[0053] Further, the step S1 further includes:

[0054] If both conditions are not met, the corresponding virtual machine callback is directly entered.

[0055] From the above description, it can be known that when the protocol content cannot meet the two judgment conditions, it is indicated that the protocol content is obviously malicious data or unqualified data, and the virtual machine callback is directly triggered, so as to reduce the data processing pressure of the virtual protocol part.

[0056] Further, the step S2 further includes:

[0057] The virtual machine callback includes a protocol content analysis callback and a protocol structure analysis callback;

[0058] The protocol content is acquired from the protocol structure, different protocol content analysis callbacks are created according to the protocol content matching, and a corresponding response event is matched and created for each protocol content analysis callback;

[0059] The protocol structure is classified, and the corresponding protocol structure analysis callback is created according to the category to which the protocol structure belongs.

[0060] From the above description, the virtual machine callback includes protocol content analysis callback and protocol structure analysis callback, the protocol content analysis callback and response event are pre-customized, and after meeting the conditions, triggering can be directly performed, and the protocol structure analysis callback needs to be matched and created according to actual protocol content, and the two modes are combined to improve the flexibility and rationality of the virtual machine callback.

[0061] Please refer to Figure 1 and Figure 2 , the embodiment one of the present application is:

[0062] A communication data processing protection method, comprising the following steps:

[0063] S1, receiving protocol data, judging whether the protocol data is abnormal data according to a preset judgment condition, if yes, executing step S2, otherwise executing step S3;

[0064] In the embodiment, whether the protocol content of the protocol data meets the preset standard and whether the data size of the protocol data is equal to the preset value are judged, if both conditions are met, the protocol data is normal data, if only one of the two conditions is met, the protocol data is abnormal data, if both conditions are not met, the corresponding virtual machine callback is directly entered; refer to table 1 protocol information configuration table:

[0065] [Request-Line) POST / b78090a0-5f82-46b6-abe6-8033efecfe8f / HTTP / 1.1 Cache-Control no-cache Connection Close Pragma no-cache Content-Type application / soap+xm User-Agent WSDAPI Host 192.168.249.72:5357 Content-Length 733

[0066] Table 1 protocol information configuration table

[0067] Among them, the data size can select 733 as the judgment standard value, and the preset standard can include content type (Content-Type) and the like.

[0068] In the embodiment, the protocol structure of the received protocol data can be copied into two copies, such as protocol A and protocol B, the virtual machine callback is created for protocol A, the normal data callback is configured for protocol B, and then the above judgment process is performed.

[0069] S2, creating a virtual machine, copying the protocol structure of the protocol data into the virtual machine, and entering the corresponding virtual machine callback according to the protocol structure;

[0070] The virtual machine callback includes a protocol content analysis callback and a protocol structure analysis callback; the protocol content is obtained from the protocol structure when setting the protocol content analysis callback, different protocol content analysis callbacks are created according to protocol content matching, for example: 1, return the corresponding error of a webpage such as 403, 404; 2, return websocket, successful; 3, return the success / error attribute of the corresponding software. Then, the corresponding response event is matched and created for each protocol content analysis callback; the response event includes but is not limited to: generating text content, generating picture content, generating data content, and returning corresponding data content according to software success / error.

[0071] When creating the protocol structure analysis callback, the protocol structure is classified, and the corresponding protocol structure analysis callback is created according to the category to which the protocol structure belongs. The specific protocol structure categories are: HTTP common error types, HTTP common type return callbacks, Socket common error types, and Socket common type return callbacks, and the corresponding protocol structure analysis callbacks are: protocol content analysis callbacks generated by HTTP, protocol content analysis callbacks generated by Socket, and protocol content analysis callbacks generated by other protocols of software. In addition, the SDK interface can be registered on the virtual machine to facilitate the installation of other unknown type callbacks.

[0072] In addition, in order to ensure that the virtual machine callback can be triggered, for some protocol data whose data size does not meet the preset value, the data size can be increased by adding a plurality of spaces at the tail of the data.

[0073] In the embodiment, according to the virtual machine callback, a processing response is generated, if the processing response is to allow to continue to acquire, the protocol content of the protocol structure is returned from the virtual machine; if the processing response is to prevent to continue to acquire, the protocol content of the protocol structure is saved in the virtual machine to prevent it from affecting the data of the real protocol.

[0074] S3, the protocol structure of the protocol data is obtained, and the corresponding server callback is entered according to the protocol structure.

[0075] Please refer to Figure 3 , the second embodiment of the present application is:

[0076] A communication data processing protection terminal 1, comprising a memory 2, a processor 3 and a computer program stored on the memory 2 and executable on the processor 3, the processor 3 executes the computer program to realize the communication data processing protection method of the first embodiment.

[0077] In summary, the application provides a communication data processing protection method and terminal, after receiving protocol data, it is judged whether the protocol data is abnormal data, if yes, the protocol structure of the protocol data is copied to the virtual machine, and the corresponding virtual machine callback is entered according to the protocol structure, so that even if the abnormal data is malicious data which can affect the content corresponding to the real protocol, it will only be trapped in the virtual machine and will not affect the content corresponding to the real protocol, and if the protocol data is not malicious data, it can be returned to the server through the corresponding virtual machine callback, and multiple virtual machine callback modes are set to flexibly cope with different protocol data and protect data security.

[0078] The above is only an embodiment of the application, and does not limit the patent scope of the application, and any equivalent transformation, direct or indirect application in the related technical field by using the content of the specification and drawings of the application is also included in the patent protection scope of the application.

Claims

1. A communication data processing protection method, characterized by, The method comprises the following steps: S1, receiving protocol data, judging whether the protocol data is abnormal data according to preset judgment conditions, if yes, executing step S2, otherwise executing step S3; S2, creating a virtual machine, copying the protocol structure of the protocol data into the virtual machine, and entering the corresponding virtual machine callback according to the protocol structure; S3, obtaining the protocol structure of the protocol data, and entering the corresponding server callback according to the protocol structure; The step S2 further comprises: The virtual machine callback comprises protocol content analysis callback and protocol structure analysis callback; Obtaining protocol content from the protocol structure, creating different protocol content analysis callbacks according to the protocol content, and matching corresponding response events for each protocol content analysis callback; Classifying the protocol structure, and creating corresponding protocol structure analysis callbacks according to the category to which the protocol structure belongs.

2. The communication data processing protection method of claim 1, wherein, The step S2 further comprises: According to the virtual machine callback, generating a processing response, if the processing response is to allow continuous acquisition, returning the protocol content of the protocol structure from the virtual machine; If the processing response is to prevent continuous acquisition, saving the protocol content of the protocol structure in the virtual machine.

3. The communication data processing protection method of claim 1, wherein, According to the preset judgment conditions, whether the protocol data is abnormal data specifically comprises: Judging whether the protocol content of the protocol data meets the preset standard and whether the data size of the protocol data is equal to the preset value, if both conditions are met, the protocol data is normal data, if only one of the two conditions is met, the protocol data is abnormal data.

4. The communication data processing protection method of claim 3, wherein, The step S1 further comprises: If both conditions are not met, directly enter the corresponding virtual machine callback.

5. A communication data processing protection terminal comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the computer program, the following steps are realized: S1, receiving protocol data, judging whether the protocol data is abnormal data according to preset judgment conditions, if yes, executing step S2, otherwise executing step S3; S2, creating a virtual machine, copying the protocol structure of the protocol data into the virtual machine, and entering the corresponding virtual machine callback according to the protocol structure; S3, obtaining the protocol structure of the protocol data, and entering the corresponding server callback according to the protocol structure; The step S2 further comprises: The virtual machine callback comprises protocol content analysis callback and protocol structure analysis callback; Obtaining protocol content from the protocol structure, creating different protocol content analysis callbacks according to the protocol content, and matching corresponding response events for each protocol content analysis callback; Classifying the protocol structure, and creating corresponding protocol structure analysis callbacks according to the category to which the protocol structure belongs.

6. The communication data processing protection terminal according to claim 5, wherein The step S2 further comprises: According to the virtual machine callback, generating a processing response, if the processing response is to allow continuous acquisition, returning the protocol content of the protocol structure from the virtual machine; If the processing response is to prevent continuous acquisition, saving the protocol content of the protocol structure in the virtual machine.

7. The communication data processing protection terminal according to claim 5, wherein According to the preset judgment conditions, whether the protocol data is abnormal data specifically comprises: The protocol content of the protocol data is judged whether to conform to preset standard and whether the data size of the protocol data is equal to preset value, if both conditions are satisfied, the protocol data is normal data, if only one of the two conditions is satisfied, the protocol data is abnormal data.

8. The communication data processing protection terminal according to claim 7, wherein Step S1 further includes: If both conditions are not satisfied, directly entering corresponding virtual machine callback.

Images