Data isolation method and device, electronic equipment and computer readable medium
By generating and processing data channels and performing release verification methods, the problem of incomplete isolation of environments in manual sorting out service dependence and environment construction is solved, and the isolation and efficiency of the test environment are improved.
Patent Information
- Application Number
- CN202310807636.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-07-03
- Publication Date
- 2025-01-07
AI Technical Summary
In the prior art, manual service dependence and environment construction dependence are large, and configuration items are easily missed, resulting in incomplete isolation of the test environment, affecting processing efficiency and accuracy.
By responding to the playback test request, the traffic and remote identification are obtained, the first data channel is generated, and the system function is called to obtain the target address, the second data channel is generated based on the proxy server and the target address, the target data channel is determined, and the data packet is read and executed Release the verification, process the traffic according to the verification results to ensure environmental isolation.
It realizes complete isolation of the test environment and improves the processing efficiency and accuracy of the test business.
Smart Images
Figure CN119271566A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a data isolation method, device, electronic device and computer-readable medium. Background Art
[0002] Replay is to run the business logic again with the recorded parameters. This solves the problem that the online data cannot be affected during the playback process. If the write interface is directly replayed without any control, it may pollute the online data. Therefore, these tools require users to import the recorded traffic into a service isolated from the online environment and then run the playback for testing. Manually combing service dependencies and setting up environment dependencies is very labor-intensive, and it is easy to miss a configuration item. It cannot ensure that the environment is completely isolated, resulting in low processing efficiency and accuracy for the corresponding test business. Summary of the invention
[0003] In view of this, the embodiments of the present application provide a data isolation method, device, electronic device and computer-readable medium, which can solve the problems of high workload in the existing manual sorting of service dependencies and building environment dependencies, easy omission of certain configuration items, and failure to ensure complete isolation of the environment, resulting in low processing efficiency and accuracy of the corresponding test business.
[0004] To achieve the above objective, according to one aspect of an embodiment of the present application, a data isolation method is provided, including:
[0005] In response to the playback test request, obtain the corresponding outgoing traffic and remote identifier, forward the outgoing traffic to the proxy server, and generate a first data channel;
[0006] Calling a system function to obtain a target address based on a remote identifier, and then generating a second data channel based on the proxy server and the target address;
[0007] Determining a target data channel based on the first data channel and the second data channel;
[0008] Read the data packet transmitted on the target data channel, and perform release verification based on the data packet to obtain verification result data;
[0009] Perform corresponding data processing on the outflow according to the verification result data.
[0010] Optionally, generating a first data channel includes:
[0011] Invoke a forwarding program to change the corresponding address to a forwarding address based on the remote identifier;
[0012] An application address corresponding to the playback test request is obtained, and a first data channel is generated according to the application address and the forwarding address.
[0013] Optionally, generating a second data channel includes:
[0014] The proxy address of the proxy server is obtained, and the proxy address is connected with the target address to generate a second data channel.
[0015] Optionally, determining a target data channel includes:
[0016] The application address, forwarding address, and target address are bound to generate a target data channel.
[0017] Optionally, a release check is performed based on the data packet to obtain check result data, including:
[0018] Get the identity corresponding to the data packet;
[0019] Perform release verification based on the identity tag to obtain verification result data.
[0020] Optionally, a release check is performed according to the identity identifier to obtain check result data, including:
[0021] In response to the identity identifier corresponding to the root user, it is determined that the verification result data is verification passed.
[0022] Optionally, a release check is performed according to the identity identifier to obtain check result data, including:
[0023] In response to the identity identifier corresponding to the unknown middleware, it is determined that the verification result data is a verification failure.
[0024] Optionally, after determining that the verification result data is a verification failure, the method further includes:
[0025] Execute traffic interception procedures based on outgoing traffic.
[0026] In addition, the present application also provides a data isolation device, including:
[0027] A first data channel generating unit is configured to, in response to a playback test request, obtain corresponding outgoing traffic and a remote identifier, forward the outgoing traffic to a proxy server, and generate a first data channel;
[0028] The second data channel generating unit is configured to call a system function to obtain a target address based on a remote identifier, and then generate a second data channel based on the proxy server and the target address;
[0029] a target data channel determining unit, configured to determine the target data channel based on the first data channel and the second data channel;
[0030] A verification unit is configured to read a data packet transmitted on a target data channel, and perform a release verification based on the data packet to obtain verification result data;
[0031] The data processing unit is configured to perform corresponding data processing on the outgoing flow according to the verification result data.
[0032] Optionally, the first data channel generating unit is further configured to:
[0033] Invoke a forwarding program to change the corresponding address to a forwarding address based on the remote identifier;
[0034] An application address corresponding to the playback test request is obtained, and a first data channel is generated according to the application address and the forwarding address.
[0035] Optionally, the second data channel generating unit is further configured to:
[0036] The proxy address of the proxy server is obtained, and the proxy address is connected with the target address to generate a second data channel.
[0037] Optionally, the target data channel determination unit is further configured to:
[0038] The application address, forwarding address, and target address are bound to generate a target data channel.
[0039] Optionally, the verification unit is further configured to:
[0040] Get the identity corresponding to the data packet;
[0041] Perform release verification based on the identity tag to obtain verification result data.
[0042] Optionally, the verification unit is further configured to:
[0043] In response to the identity identifier corresponding to the root user, it is determined that the verification result data is verification passed.
[0044] Optionally, the verification unit is further configured to:
[0045] In response to the identity identifier corresponding to the unknown middleware, it is determined that the verification result data is a verification failure.
[0046] Optionally, the data isolation device further includes a traffic interception unit configured to:
[0047] Execute traffic interception procedures based on outgoing traffic.
[0048] In addition, the present application also provides a data isolation electronic device, including: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by one or more processors, the one or more processors implement the data isolation method as described above.
[0049] In addition, the present application also provides a computer-readable medium on which a computer program is stored, and when the program is executed by a processor, the data isolation method as described above is implemented.
[0050] One embodiment of the above invention has the following advantages or beneficial effects: the application obtains the corresponding outgoing traffic and remote identifier in response to the playback test request, forwards the outgoing traffic to the proxy server, and generates a first data channel; calls a system function to obtain the target address based on the remote identifier, and then generates a second data channel based on the proxy server and the target address; determines the target data channel based on the first data channel and the second data channel; reads the data packet transmitted on the target data channel, performs release verification based on the data packet to obtain verification result data; performs corresponding data processing on the outgoing traffic according to the verification result data. Thereby, it is possible to ensure that the test environment is completely isolated and improve the processing efficiency and accuracy of the corresponding test business.
[0051] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS
[0052] The accompanying drawings are used to better understand the present application and do not constitute an improper limitation on the present application.
[0053] Figure 1 It is a schematic diagram of the main process of the data isolation method provided according to an embodiment of the present application;
[0054] Figure 2 It is a schematic diagram of the main process of the data isolation method provided according to an embodiment of the present application;
[0055] Figure 3 This is a schematic diagram of an application scenario of a data isolation method provided according to an embodiment of the present application;
[0056] Figure 4 is a schematic diagram of main units of a data isolation device according to an embodiment of the present application;
[0057] Figure 5 is an exemplary system architecture diagram to which the embodiments of the present application can be applied;
[0058] Figure 6 It is a structural diagram of a computer system of a terminal device or server suitable for implementing an embodiment of the present application. DETAILED DESCRIPTION
[0059] The following is an explanation of the exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the technical solution of the present disclosure, the collection, collection, update, analysis, processing, use, transmission, storage and other aspects of user personal information involved are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Take necessary measures for user personal information to prevent illegal access to user personal information data and maintain user personal information security, network security and national security.
[0060] Figure 1 is a schematic diagram of the main process of the data isolation method provided according to an embodiment of the present application, such as Figure 1 As shown, data isolation methods include:
[0061] Step S101, in response to a playback test request, obtain the corresponding outgoing traffic and remote identifier, forward the outgoing traffic to a proxy server, and generate a first data channel.
[0062] In this embodiment, the execution subject of the data isolation method (for example, it can be a server) can detect whether a playback test request is received by means of a wired connection or a wireless connection. After the execution subject receives the playback test request, the outgoing traffic and the remote identifier corresponding to the request can be obtained. Among them, the outgoing traffic refers to the traffic of the data packet sent by the user accessing the device or website. The remote identifier, for example, can be the address of the device or website that the user wants to access. The embodiment of the present application does not specifically limit the remote identifier. When the execution subject receives the playback test request, the corresponding outgoing traffic can be forwarded to the proxy server. Specifically, the proxy server can be a server for forwarding traffic. Before forwarding the outgoing traffic to the proxy server, the user application will first establish a connection with the proxy server to obtain a connection channel, that is, the first data channel. It can be understood that the timing of generating the first data channel can be before forwarding the outgoing traffic to the proxy server, or it can be while forwarding the outgoing traffic to the proxy server. The embodiment of the present application does not specifically limit the timing of generating the first data channel. For example, the first data channel may be: 127.0.0.1:23456-127.0.0.1:8888, wherein 127.0.0.1:23456 may be a user application address, and 127.0.0.1:8888 may be an address of a proxy server.
[0063] Step S102, calling a system function to obtain a target address based on a remote identifier, and then generating a second data channel based on the proxy server and the target address.
[0064] Specifically, generating the second data channel includes: acquiring a proxy address of the proxy server, and connecting the proxy address with the target address to generate the second data channel.
[0065] In an embodiment of the present application, the system function may be, for example, getsockopt. Specifically, the getsockopt() function is used to obtain the current value of an option for an interface of any type and any state. The remote identifier may be, for example, the address of a device or website that a user wants to access, and the embodiment of the present application does not specifically limit the remote identifier. Through the remote identifier, the execution subject may obtain the corresponding target address, such as 10.0.3.2:22000. Then, the execution subject may establish a second data channel to the target address based on an address of a proxy server, such as 127.0.0.1:34567, so as to forward traffic to the remote end corresponding to the target address. For example, the second data channel may be, for example, 127.0.0.1:34567-10.0.3.2:22000.
[0066] Step S103: determining a target data channel based on the first data channel and the second data channel.
[0067] By binding the first data channel and the second data channel, one address of the proxy server, such as 127.0.0.1:34567 included in the second data channel, can be ignored to determine the target data channel.
[0068] Step S104, reading the data packet transmitted on the target data channel, and performing a release check based on the data packet to obtain check result data.
[0069] Specifically, performing a release check based on a data packet to obtain verification result data includes: obtaining an identity identifier corresponding to the data packet; and performing a release check according to the identity identifier to obtain verification result data.
[0070] In the embodiment of the present application, when the proxy server runs as root, the outgoing traffic sent by the proxy server will not be intercepted by iptables, that is, the verification result data at this time is verification passed. When the proxy server does not run as root, the verification result data at this time is verification failed.
[0071] Step S105, performing corresponding data processing on the outflow according to the verification result data.
[0072] When the verification result data is that the verification is passed, the operation of forwarding the outgoing traffic from the proxy server to the target address is executed. When the verification result data is that the verification is not passed, the outgoing traffic sent by the proxy server is intercepted.
[0073] This embodiment obtains the corresponding outgoing traffic and remote identifier in response to the playback test request, forwards the outgoing traffic to the proxy server, and generates a first data channel; calls a system function to obtain the target address based on the remote identifier, and then generates a second data channel based on the proxy server and the target address; determines the target data channel based on the first data channel and the second data channel; reads the data packet transmitted on the target data channel, performs release verification based on the data packet to obtain verification result data; and performs corresponding data processing on the outgoing traffic according to the verification result data. In this way, it is possible to ensure that the test environment is completely isolated and improve the processing efficiency and accuracy of the corresponding test business.
[0074] Figure 2 FIG. 1 is a schematic diagram of the main flow of a data isolation method provided according to an embodiment of the present application. Figure 2 As shown, data isolation methods include:
[0075] Step S201, in response to a playback test request, obtain the corresponding outgoing traffic and remote identifier, and forward the outgoing traffic to a proxy server.
[0076] Step S202, calling a forwarding program to change the corresponding address to a forwarding address based on the remote identifier.
[0077] When forwarding the outgoing traffic to the proxy server to establish the first data channel, due to iptables forwarding, the original remote service 10.0.3.2:22000 is changed to the forwarding address 127.0.0.1:8888. The specific change logic can be preset and will not be elaborated in this application.
[0078] Step S203: Obtain an application address corresponding to the playback test request, and generate a first data channel according to the application address and the forwarding address.
[0079] The application address corresponding to the playback test request may be, for example, 127.0.0.1:23456. The first data channel 127.0.0.1:23456-127.0.0.1:8888 is generated according to the application address 127.0.0.1:23456 and the forwarding address 127.0.0.1:8888.
[0080] Step S204, calling a system function to obtain a target address based on the remote identifier, and then generating a second data channel based on the proxy server and the target address.
[0081] Step S205: determining a target data channel based on the first data channel and the second data channel.
[0082] Specifically, determining the target data channel includes: binding the application address, the forwarding address, and the target address to generate the target data channel.
[0083] For example, the first data channel is 127.0.0.1:23456-127.0.0.1:8888, and the second data channel is 127.0.0.1:34567-10.0.3.2:22000. The application address is 127.0.0.1:23456, the forwarding address is 127.0.0.1:8888, and the target address is 10.0.3.2:22000, so the target data channel is 10.0.3.1:23456-127.0.0.1:8888-10.0.3.2:22000.
[0084] Step S206, reading the data packet transmitted on the target data channel, and performing a release check based on the data packet to obtain check result data.
[0085] Specifically, performing release verification according to the identity identifier to obtain verification result data includes: in response to the identity identifier corresponding to the root user, determining that the verification result data is verification passed.
[0086] For example, if the identity identifier is root, then it corresponds to the root user. When the identity identifier corresponds to the root user, it can be determined that the verification result data is verification passed.
[0087] Specifically, performing release verification according to the identity identifier to obtain verification result data includes: in response to the identity identifier corresponding to the unknown middleware, determining that the verification result data is a verification failure.
[0088] Specifically, after determining that the verification result data is a verification failure, the method further includes: executing a traffic interception program based on the outgoing traffic.
[0089] For example, a proxy server is run in the container running the playback application. The built-in firewall iptables of the Linux system is used to intercept all outgoing traffic and forward it to the proxy server. The proxy server understands how the traffic is generated by parsing the data packets and determines whether it should be released according to the release rules. All outgoing traffic generated by unknown middleware is intercepted and verification failure information is returned.
[0090] Step S207, performing corresponding data processing on the outgoing flow according to the verification result data.
[0091] When the verification result data is that the verification is passed, the operation of forwarding the outgoing traffic from the proxy server to the target address is executed. When the verification result data is that the verification is not passed, the outgoing traffic sent by the proxy server is intercepted.
[0092] The embodiments of the present application can ensure that the test environment is completely isolated and improve the processing efficiency and accuracy of the corresponding test business.
[0093] Figure 3This is a schematic diagram of the application scenario of the data isolation method provided according to an embodiment of the present application. In the embodiment of the present application, iptables: the built-in firewall of the Linux operating system can configure rules to control the inbound / outbound traffic. Container: contains everything needed for the software to run, and can realize the rapid construction and deployment of the software. The data isolation method of the embodiment of the present application can be applied to a scenario of traffic security isolation in the context of using traffic recording and playback for testing. By injecting a transparent proxy into the container during the deployment process, an environment for playback testing can be easily built. The specific steps are as follows: When pulling up the preset container, the proxy server program is automatically injected, running as the root user, as a daemon process resident in the background, and listening to port 8888 of the local machine. Add iptables rules to forward the outbound traffic to the proxy server listening port 8888. Among them, the content contained in the iptables rules may include: releasing root user traffic, global proxy, and forwarding to the global proxy. Assume that the user application needs to access the service at the remote 10.0.3.2:22000 (i.e. the target address). All outgoing traffic will be forwarded to the proxy server first. At this time, the application will first establish a connection with the proxy server, assuming that the channel is 127.0.0.1:23456-127.0.0.1:8888. When the connection is established in this step, due to iptables forwarding, the original remote service 10.0.3.2:22000 is changed to 127.0.0.1:8888, so it is necessary to call the system function getsockopt to obtain the target address 10.0.3.2:22000 before forwarding. Then establish a connection from the proxy server to the original target address, assuming that the channel is 127.0.0.1:34567-10.0.3.2:22000. Bind these two channels to generate the data channel 10.0.3.1:23456-127.0.0.1:8888-10.0.3.2:22000. Since the proxy server runs as root, the traffic sent by the proxy server will not be intercepted by iptables. After the target data channel is established, the data packets transmitted on the channel can be read in the proxy server. According to the content of the data packet, it can be determined whether it is the traffic that should be released. Otherwise, the traffic is directly blocked at the proxy server level to ensure that no pollution is caused to the online data. The transparent proxy based on iptables uses iptables to forward the outgoing traffic. The source-proxy and proxy-destination channels are connected in the proxy to achieve refined outgoing traffic control.
[0094] Figure 4 Schematic diagram of the main units of the data isolation device according to an embodiment of the present application. Figure 4As shown, the data isolation device 400 includes a first data channel generating unit 401 , a second data channel generating unit 402 , a target data channel determining unit 403 , a checking unit 404 and a data processing unit 405 .
[0095] The first data channel generating unit 401 is configured to obtain the corresponding outgoing traffic and remote identifier in response to the playback test request, forward the outgoing traffic to the proxy server, and generate the first data channel;
[0096] The second data channel generating unit 402 is configured to call a system function to obtain a target address based on a remote identifier, and then generate a second data channel based on the proxy server and the target address;
[0097] The target data channel determining unit 403 is configured to determine the target data channel based on the first data channel and the second data channel;
[0098] The verification unit 404 is configured to read the data packet transmitted on the target data channel, and perform a release verification based on the data packet to obtain verification result data;
[0099] The data processing unit 405 is configured to perform corresponding data processing on the outgoing traffic according to the verification result data.
[0100] In some embodiments, the first data channel generation unit 401 is further configured to: call a forwarding program to change the corresponding address to a forwarding address based on a remote identifier; obtain an application address corresponding to the playback test request, and generate a first data channel according to the application address and the forwarding address.
[0101] In some embodiments, the second data channel generating unit 402 is further configured to: obtain a proxy address of the proxy server, and connect the proxy address with the target address to generate the second data channel.
[0102] In some embodiments, the target data channel determination unit 403 is further configured to: bind the application address, the forwarding address and the target address to generate the target data channel.
[0103] In some embodiments, the verification unit 404 is further configured to: obtain an identity identifier corresponding to the data packet; and perform a release verification according to the identity identifier to obtain verification result data.
[0104] In some embodiments, the verification unit 404 is further configured to: in response to the identity identifier corresponding to the root user, determine that the verification result data is verification passed.
[0105] In some embodiments, the verification unit 404 is further configured to: in response to the identity identifier corresponding to the unknown middleware, determine that the verification result data is a verification failure.
[0106] In some embodiments, the data isolation device further includes Figure 4 The traffic interception unit not shown in the figure is configured to: execute a traffic interception program based on the outgoing traffic.
[0107] It should be noted that the data isolation method and the data isolation device of the present application have a corresponding relationship in terms of specific implementation contents, so the repeated contents will not be described again.
[0108] Figure 5 An exemplary system architecture 500 is shown to which the data isolation method or data isolation device according to the embodiment of the present application can be applied.
[0109] like Figure 5 As shown, system architecture 500 may include terminal devices 501, 502, 503, a network 504 and a server 505. Network 504 is used to provide a medium for communication links between terminal devices 501, 502, 503 and server 505. Network 504 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.
[0110] Users can use terminal devices 501, 502, 503 to interact with server 505 through network 504 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 501, 502, 503, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).
[0111] The terminal devices 501 , 502 , and 503 may be various electronic devices having a data isolation processing screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.
[0112] Server 505 can be a server that provides various services, such as a background management server that provides support for playback test requests submitted by users using terminal devices 501, 502, and 503 (only as an example). The background management server can respond to the playback test request, obtain the corresponding outgoing traffic and remote identification, forward the outgoing traffic to the proxy server, and generate a first data channel; call the system function to obtain the target address based on the remote identification, and then generate a second data channel based on the proxy server and the target address; determine the target data channel based on the first data channel and the second data channel; read the data packet transmitted on the target data channel, perform release verification based on the data packet to obtain verification result data; perform corresponding data processing on the outgoing traffic according to the verification result data. In this way, it is possible to ensure that the test environment is completely isolated and improve the processing efficiency and accuracy of the corresponding test business.
[0113] It should be noted that the data isolation method provided in the embodiment of the present application is generally executed by the server 505 , and accordingly, the data isolation device is generally set in the server 505 .
[0114] It should be understood that Figure 5 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.
[0115] Reference below Figure 6 , which shows a schematic diagram of the structure of a computer system 600 of a terminal device suitable for implementing an embodiment of the present application. Figure 6 The terminal device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.
[0116] like Figure 6 As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the computer system 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.
[0117] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.
[0118] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present application are executed.
[0119] It should be noted that the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. Computer-readable storage media may include, for example, but are not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.
[0120] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.
[0121] The units involved in the embodiments described in the present application may be implemented by software or hardware. The units described may also be arranged in a processor, for example, may be described as: a processor includes a first data channel generation unit, a second data channel generation unit, a target data channel determination unit, a verification unit, and a data processing unit. The names of these units do not, in some cases, constitute limitations on the units themselves.
[0122] As another aspect, the present application also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs. When the above one or more programs are executed by a device, the device responds to the playback test request, obtains the corresponding outgoing traffic and remote identifier, forwards the outgoing traffic to the proxy server, and generates a first data channel; calls a system function to obtain the target address based on the remote identifier, and then generates a second data channel based on the proxy server and the target address; determines the target data channel based on the first data channel and the second data channel; reads the data packet transmitted on the target data channel, performs release verification based on the data packet to obtain verification result data; performs corresponding data processing on the outgoing traffic according to the verification result data.
[0123] According to the technical solution of the embodiment of the present application, it is possible to ensure that the test environment is completely isolated and improve the processing efficiency and accuracy of the corresponding test business.
[0124] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.
Claims
1. A data isolation method, characterized in that: include: In response to the playback test request, obtaining the corresponding outgoing traffic and remote identifier, forwarding the outgoing traffic to the proxy server, and generating a first data channel; Calling a system function to obtain a target address based on the remote identifier, and then generating a second data channel based on the proxy server and the target address; Determining a target data channel based on the first data channel and the second data channel; Reading a data packet transmitted on the target data channel, and performing a release check based on the data packet to obtain check result data; Corresponding data processing is performed on the outflow according to the verification result data.
2. The method according to claim 1, characterized in that The generating of the first data channel comprises: Invoking a forwarding program to change the corresponding address to a forwarding address based on the remote identifier; An application address corresponding to the playback test request is obtained, and a first data channel is generated according to the application address and the forwarding address.
3. The method according to claim 1, characterized in that The generating of the second data channel comprises: The proxy address of the proxy server is obtained, and the proxy address is connected to the target address to generate a second data channel.
4. The method according to claim 2, characterized in that: The determining of the target data channel comprises: The application address, the forwarding address and the target address are bound to generate a target data channel.
5. The method according to claim 1, characterized in that The performing release verification based on the data packet to obtain verification result data includes: Obtaining an identity corresponding to the data packet; A release check is performed according to the identity identifier to obtain check result data.
6. The method according to claim 1, characterized in that The performing release verification according to the identity identifier to obtain verification result data includes: In response to the identity identifier corresponding to the root user, it is determined that the verification result data is verification passed.
7. The method according to claim 1, characterized in that The performing release verification according to the identity identifier to obtain verification result data includes: In response to the identity identifier corresponding to unknown middleware, it is determined that the verification result data is a verification failure.
8. The method according to claim 7, characterized in that After determining that the verification result data is a verification failure, the method further includes: A traffic interception procedure is performed based on the outgoing traffic.
9. A data isolation device, characterized in that: include: A first data channel generating unit is configured to obtain corresponding outgoing traffic and remote identifier in response to a playback test request, forward the outgoing traffic to a proxy server, and generate a first data channel; A second data channel generating unit is configured to call a system function to obtain a target address based on the remote identifier, and then generate a second data channel based on the proxy server and the target address; a target data channel determining unit, configured to determine a target data channel based on the first data channel and the second data channel; a verification unit, configured to read a data packet transmitted on the target data channel, and perform a release verification based on the data packet to obtain verification result data; The data processing unit is configured to perform corresponding data processing on the outflow according to the verification result data.
10. The device according to claim 9, characterized in that The first data channel generating unit is further configured to: Invoking a forwarding program to change the corresponding address to a forwarding address based on the remote identifier; An application address corresponding to the playback test request is obtained, and a first data channel is generated according to the application address and the forwarding address.
11. A data isolation electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 8.
12. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.