SDK processing method and device

Abstract

The invention provides an SDK (Software Development Kit) processing method and device, and the method comprises the steps: constructing a UDP (User Datagram Protocol) knock packet and a TCP (Transmission Control Protocol) TLS (Transport Layer Security) knock packet through an SDK, and carrying out the single packet verification based on the UDP knock packet and the TCP TLS knock packet; after the single packet passes the verification, establishing a management channel, and performing token authentication; when the token authentication is successful, issuing an anti-leakage strategy to the SDK through the server, and executing the anti-leakage strategy; the method comprises the following steps: receiving an anti-leakage strategy sent by a user, caching the anti-leakage strategy to obtain a local caching strategy, executing the local caching strategy when the network fluctuation of the user exceeds a predetermined standard, and performing single packet verification through a UDP (User Datagram Protocol) knock packet and a TLS (Transport Layer Server) knock packet, thereby effectively avoiding the problems of SPA port amplification and performance bottleneck, and improving the security of the SPA port by caching the anti-leakage strategy. And the reliability of the anti-leakage strategy execution process is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to an SDK processing method and device. Background Art

[0002] SDK, or "Software Development Kit", provides functions such as single-package authentication and data leakage prevention. It is used in conjunction with client integration. In actual application scenarios, it is often used to replace VPN scenarios to empower third-party APPs. It can access the VPN network through SDK. Specific scenarios include a. The company has its own IM software and does not want employees to install too many terminal software. It provides VPN access capabilities through IM and SDK integration, which can not only solve VPN access to the intranet, but also improve employee experience; b. Police recorders need to access a private network for real-time video upload. Police recorder manufacturers can directly integrate SDK to use VPN capabilities to access the private network; at the same time, it can also play a role in controlling and deterring employee behavior. Specific applications include a. Employees often come into contact with sensitive company content in their daily office work. After the file is leaked, it cannot be traced. Watermarks can be used for deterrence, combined with screenshot / screen recording protection functions to prevent sensitive content from being leaked; b. When employees come into contact with sensitive content or sensitive content involving users' personal information, avoid losses to the company and individuals, and do not allow data to leave the APP.

[0003] The current mainstream SDK tunnel connection design is to complete SPA through UDP or TCP. After the user completes SPA, he obtains a token. The user uses the obtained token for authentication, and the server returns to pull the tunnel configuration information and connects the tunnel. If the user switches off the network or reconnects after a network disconnection, the tunnel automatically reconnects. After the app sinks to the background, the tunnel connection is normal. However, the above SDK tunnel connection design has the following disadvantages: (1) The UDP protocol SPA has a port amplification problem, and the introduction of the TCP protocol SPA has a performance bottleneck. (2) After the token expires, there is no refresh mechanism, the tunnel connection will be disconnected, and the user experience is poor. At the same time, the current mainstream SDK anti-leakage solution design is to configure the anti-leakage policy content in the management background. After the SDK completes the token authentication, it pulls the anti-leakage policy configured in the management background. According to the anti-leakage policy, the app is covered with a watermark, screenshots and screen recordings are prohibited, or the screenshots or screen recordings are turned black. If the policy pulling fails, the SDK built-in policy is executed. However, the above mainstream SDK anti-leakage solution design also has certain shortcomings: it does not implement anti-leakage policy caching and provide a default policy interface. When the anti-leakage policy pulling fails, the anti-leakage policy can only follow the built-in policy. Summary of the invention

[0004] In order to overcome the deficiencies of the prior art, the present invention provides an SDK processing method and device to solve the port amplification or performance bottleneck existing in the SDK tunnel connection process in the prior art, and the problem of low reliability when executing the anti-leakage strategy.

[0005] One embodiment of the present invention provides an SDK processing method, comprising the following steps:

[0006] Construct a UDP knocking package and a TCP TLS knocking package through the SDK, and perform single packet verification based on the UDP knocking package and the TCP TLS knocking package;

[0007] When the single package verification passes, a management channel is established and token authentication is performed;

[0008] When the token authentication succeeds, the server sends the anti-leakage strategy to the SDK and executes the anti-leakage strategy;

[0009] The anti-leakage strategy is cached to obtain a local cache strategy, and when the network fluctuation of the user exceeds a predetermined standard, the local cache strategy is executed.

[0010] In one embodiment, a UDP knocking package and a TCP TLS knocking package are constructed by SDK, and single packet verification is performed based on the UDP knocking package and the TCP TLS knocking package, including:

[0011] Construct a UDP knock packet through the SDK, and send the UDP knock packet to the server;

[0012] Verify the UDP knocking packet through the server, and open the TCP port to the SDK after successful verification;

[0013] Constructing a TCP TLS knocking packet, and sending the TCP TLS knocking packet to the server through the TCP port within a predetermined time;

[0014] The TCP TLS knocking packet is verified by the server to complete the single packet verification process.

[0015] In one embodiment, the method further comprises:

[0016] When the token authentication succeeds, start the timer and determine whether the token expiration time is less than the scheduled expiration time;

[0017] When the token expiration time is less than the scheduled expiration time, a new token is exchanged with the current token through the refresh token.

[0018] In one embodiment, the method further comprises:

[0019] Obtain a whitelist preset by the user, and determine the target page in the whitelist;

[0020] Determining whether the page accessed by the user is the target page;

[0021] When the page accessed by the user is the target page, the anti-leakage strategy is disabled in the target page.

[0022] In one embodiment, the anti-leakage strategy is cached to obtain a local cache strategy, and when the user's network fluctuation exceeds a predetermined standard, the local cache strategy is executed, further comprising:

[0023] When the user's network fluctuation exceeds a predetermined standard and the local cache strategy is not obtained, the pre-configured SDK default strategy is executed.

[0024] In one embodiment, the method further comprises:

[0025] If the SDK default policy is not detected, the SDK's built-in policy is executed.

[0026] In one embodiment, after the single packet verification is passed, before the management channel is established and token authentication is performed, the following steps are also included:

[0027] Generate a token and freshtoken on the client, and send the token and freshtoken to the SDK.

[0028] One embodiment of the present invention further provides an SDK processing device, including:

[0029] A single-packet verification module, used to construct a UDP knocking package and a TCP TLS knocking package through the SDK, and perform single-packet verification based on the UDP knocking package and the TCP TLS knocking package;

[0030] Token authentication module, which is used to establish a management channel and perform token authentication after a single package is verified;

[0031] The policy execution module is used to send the anti-leakage policy to the SDK through the server and execute the anti-leakage policy after the token authentication succeeds;

[0032] The local policy cache module is used to cache the anti-leakage policy to obtain a local cache policy, and execute the local cache policy when the user's network fluctuation exceeds a predetermined standard.

[0033] One embodiment of the present invention further provides a readable storage medium, in which a computer program is stored. The computer program includes program instructions. When the program instructions are executed by a processor of an electronic device, the processor executes the steps of any one of the SDK processing methods described above.

[0034] One of the embodiments of the present invention further provides an electronic device, comprising: a processor and a memory, the memory being used to store computer program code, the computer program code comprising computer instructions, and when the processor executes the computer instructions, the electronic device executes the steps of any one of the SDK processing methods described above.

[0035] By applying the above technical solution, an SDK processing method is provided, comprising the following steps: constructing a UDP knocking package and a TCP TLS knocking package through the SDK, and performing single-package verification based on the UDP knocking package and the TCP TLS knocking package; when the single-package verification passes, establishing a management channel, and performing token authentication; when the token authentication succeeds, sending an anti-leakage strategy to the SDK through the server, and executing the anti-leakage strategy; caching the anti-leakage strategy to obtain a local cache strategy, and when the user's network fluctuation exceeds a predetermined standard, executing the local cache strategy, performing single-package verification through the UDP knocking package and the TLS knocking package, effectively avoiding the problems of SPA port amplification and performance bottlenecks, and improving the reliability of the anti-leakage strategy execution process by caching the anti-leakage strategy. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0037] Figure 1 It is a schematic flow diagram of the method of the present invention;

[0038] Figure 2 It is a schematic diagram of the process of UDP+TCP authentication of the present invention;

[0039] Figure 3 It is a flowchart of the token update process of the present invention;

[0040] Figure 4 It is a flowchart of the whitelist setting process of the present invention;

[0041] Figure 5 It is a flowchart of the execution process of the anti-leakage strategy of the present invention;

[0042] Figure 6 It is a schematic diagram of the structure of the device of the present invention;

[0043] Figure 7 It is a structural schematic diagram of the electronic device of the present invention. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] It should be noted that if the embodiments of the present invention involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components in a certain specific posture. If the specific posture changes, the directional indication will also change accordingly.

[0046] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present invention, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features limited to "first" and "second" may explicitly or implicitly include at least one of the features. In addition, if "and / or" or "and / or" appears in the full text, its meaning includes three parallel solutions. Taking "A and / or B" as an example, it includes solution A, solution B, or solutions that satisfy both A and B. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the ability of ordinary technicians in this field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0047] First, the abbreviations in the following embodiments of the present invention are explained.

[0048] ZTNA SDK provides single-package authentication, data leakage prevention and other functions, and is used in conjunction with client integration.

[0049] SPA (Single Packet Authorization) is a new generation of port knocking technology. It stores the authentication message in the Packet data and transmits it to the server. By setting a series of rules, it dynamically adjusts the firewall policy or executes specific commands.

[0050] The ZTNA gateway is a zero-trust gateway that provides identity management, application resource management, access policy, behavior auditing, data leakage prevention, terminal management and other functions.

[0051] ZTNA Token is a token issued by the ZTNA gateway and is used to call the SDK interface.

[0052] ZTNA RefreshToken is used together with ZTNA Token to obtain a new ZTNA Token to avoid frequent expiration and requiring users to log in.

[0053] The management channel is a TCP long connection established after the client and ZTNA gateway are successfully authenticated, and is used to send management and control configuration information and report logs.

[0054] The whitelist means that when adding watermarks, preventing screenshots and recordings, and preventing copying and pasting, you can specify certain interfaces that do not add anti-leakage policies.

[0055] like Figure 1 One embodiment of the present invention provides an SDK processing method, comprising the following steps:

[0056] S100. Construct a UDP knocking package and a TCP TLS knocking package through SDK, and perform single package verification based on the UDP knocking package and the TCP TLS knocking package.

[0057] Specifically, SDK is the abbreviation of Software Development Kit, which means software development kit in Chinese. Software development kits are generally a collection of development tools used by software engineers to build application software for specific software packages, software frameworks, hardware platforms, operating systems, etc. UDP knocking verification is performed first in a predetermined order, and then TCP TLS knocking verification is performed. After completing the two verifications, the single packet verification is ended. Since the SPA of the UDP protocol has a port amplification problem and the introduction of the TCP protocol SPA has a performance bottleneck, this solution adopts the TCP+UDP dual protocol stack mechanism to implement SPA single packet authentication, which avoids SPA port amplification and performance bottlenecks and improves the reliability and security of the SPA single packet authentication process.

[0058] S200: After the single packet verification is passed, a management channel is established and token authentication is performed.

[0059] Specifically, the management channel refers to the TCP long connection established after the client and gateway are successfully authenticated, which is used to send management and control configuration information and report logs, etc. Among them, the management channel specifically refers to the tunnel. By improving the security of the SPA single-package authentication process, it also further enhances the user experience of using the tunnel function. After the management channel is established, the token authentication process is carried out.

[0060] S300: When the token authentication is successful, the server sends an anti-leakage strategy to the SDK, and the anti-leakage strategy is executed.

[0061] Specifically, in actual work scenarios, employees often come into contact with sensitive company content in their daily office work, and the file leak cannot be traced. Watermarks can be used for deterrence, and combined with screenshot / screen recording protection functions, sensitive content can be prevented from being leaked. When employees come into contact with sensitive content or sensitive content involving users' personal information, losses to the company and individuals are avoided, and data is not allowed to leave the APP. The terminals used by employees on a daily basis may be risky, and when accessing business systems, risks may spread or become a breakthrough. Therefore, the adoption of anti-leakage strategies can avoid the leakage of the above-mentioned sensitive information. The anti-leakage strategy refers to pulling the anti-leakage strategy through the SDK to cover the app with a watermark, prohibit screenshots, screen recordings, or turn screenshots or screen recordings black.

[0062] S400: Cache the anti-leakage strategy to obtain a local cache strategy, and execute the local cache strategy when the user's network fluctuation exceeds a predetermined standard.

[0063] Specifically, since the existing technology can only execute the built-in strategy when the anti-leakage strategy fails to be pulled, resulting in insufficient reliability of the anti-leakage strategy, this solution caches the pulled anti-leakage strategy, and when the network fluctuation is too large, the cached local cache strategy is executed in time to ensure the stable implementation of the anti-leakage strategy and improve the execution reliability of the anti-leakage strategy.

[0064] In one embodiment, a UDP knocking package and a TCP TLS knocking package are constructed by SDK, and single packet verification is performed based on the UDP knocking package and the TCP TLS knocking package, including:

[0065] Construct a UDP knock packet through the SDK, and send the UDP knock packet to the server;

[0066] Verify the UDP knocking packet through the server, and open the TCP port to the SDK after successful verification;

[0067] Constructing a TCP TLS knocking packet, and sending the TCP TLS knocking packet to the server through the TCP port within a predetermined time;

[0068] The TCP TLS knocking packet is verified by the server to complete the single packet verification process.

[0069] Specifically, in this embodiment, Figure 2As shown, the SDK builds a UDP knocking package and sends the UDP knocking package to the server. After receiving the UDP knocking package, the server verifies the UDP knocking package. When the verification is successful, the TCP port is opened within a predetermined time. The predetermined time can be flexibly set according to the specific situation. For example, it can be set to 60s to ensure data security. After opening the TCP port, the SDK builds a TCP TLS knocking package and sends the TCP TLS knocking package to the server. After the server successfully verifies the TCP TLS knocking package, a management channel is established. At the same time, after opening the TCP port, the SDK needs to send the TCP TLS knocking package to the server within 60s, otherwise the TCP port will be closed and the above process needs to be re-executed.

[0070] By adopting the above technical solution, the TCP+UDP dual protocol stack mechanism realizes SPA single packet authentication, avoiding SPA port amplification and performance bottleneck.

[0071] In one embodiment, after the single packet verification is passed, before the management channel is established and token authentication is performed, the following steps are also included:

[0072] Generate a token and freshtoken on the client, and send the token and freshtoken to the SDK.

[0073] In one embodiment, the method further comprises:

[0074] When the token authentication succeeds, start the timer and determine whether the token expiration time is less than the scheduled expiration time;

[0075] When the token expiration time is less than the scheduled expiration time, a new token is exchanged with the current token through the refresh token.

[0076] Specifically, Figure 3 As shown, the customer generates a refresh token and a token, and passes them to the SDK. After the SDK completes the token authentication, it starts the timer. When the token expiration time is less than the preset expiration time, for example, 300S, the refresh token and the current token are exchanged for a new token. Through the above steps, the problem of the prior art that there is no refresh mechanism after the token expires, the tunnel connection will be disconnected, and the user experience is poor is solved. Through the refresh token+token mechanism, the function of automatically exchanging a new token when the token is about to expire is realized.

[0077] In some embodiments, the method further comprises:

[0078] Obtain a whitelist preset by the user, and determine the target page in the whitelist;

[0079] Determining whether the page accessed by the user is the target page;

[0080] When the page accessed by the user is the target page, the anti-leakage strategy is disabled in the target page.

[0081] Specifically, since in actual application scenarios, users need not execute anti-leakage strategies in certain usage scenarios or pages, the present application sets up a whitelist, which is pre-set. The target page is set through the whitelist, and the target page is a secure page, that is, the information in the page will not affect data or information security. Therefore, when the user visits a new page, it is first determined whether the new page is the target page. If it is the target page, the anti-leakage strategy is disabled in the page to implement the customized function of the target page and improve the user experience.

[0082] In some embodiments, the anti-leakage strategy is cached to obtain a local cache strategy, and when the user's network fluctuation exceeds a predetermined standard, the local cache strategy is executed, further comprising:

[0083] When the user's network fluctuation exceeds a predetermined standard and the local cache strategy is not obtained, the pre-configured SDK default strategy is executed.

[0084] In this embodiment, Figure 5 As shown in the figure, after the SDK completes the token authentication, it pulls the anti-leakage policy and stores the pulled policy locally. If the network fluctuation is too large later, resulting in the failure of pulling the anti-leakage policy, the local cache policy will be executed. The SDK provides a default policy configuration method. If the network fluctuation causes the failure of pulling the anti-leakage policy and there is no cached policy locally, the SDK default policy will be used if the customer's developer has not configured the default policy.

[0085] In some embodiments, the method further comprises:

[0086] If the SDK default policy is not detected, the SDK's built-in policy is executed.

[0087] In this embodiment, if the customer's developer does not configure the default policy, the SDK's built-in policy will be used.

[0088] Applying the above technical solution, an SDK processing method and device are proposed, including the following steps: constructing a UDP knocking package and a TCP TLS knocking package through the SDK, and performing single packet verification based on the UDP knocking package and the TCP TLS knocking package; when the single packet verification passes, establishing a management channel, and performing token authentication; when the token authentication succeeds, sending an anti-leakage strategy to the SDK through the server, and executing the anti-leakage strategy; caching the anti-leakage strategy to obtain a local cache strategy, and when the user's network fluctuation exceeds a predetermined standard, executing the local cache strategy, performing single packet verification through the UDP knocking package and the TLS knocking package, effectively avoiding the problems of SPA port amplification and performance bottlenecks, and improving the reliability of the anti-leakage strategy execution process by caching the anti-leakage strategy.

[0089] One embodiment of the present invention further provides an SDK processing device, such as Figure 6 ,include:

[0090] The single packet verification module 100 is used to construct a UDP knocking packet and a TCP TLS knocking packet through the SDK, and perform single packet verification based on the UDP knocking packet and the TCP TLS knocking packet;

[0091] Token authentication module 200, used to establish a management channel and perform token authentication after a single packet verification is passed;

[0092] The policy execution module 300 is used to send the anti-leakage policy to the SDK through the server and execute the anti-leakage policy after the token authentication is successful;

[0093] The local policy cache module 400 is used to cache the anti-leakage policy to obtain a local cache policy, and execute the local cache policy when the user's network fluctuation exceeds a predetermined standard.

[0094] The advantages of the present invention are as follows:

[0095] (1) The present invention adopts the TCP+UDP dual protocol stack mechanism to implement SPA single packet authentication, avoiding SPA port amplification and performance bottleneck.

[0096] (2) Through the refresh token+token mechanism, the function of automatically exchanging a token for a new one can be realized when the token is about to expire.

[0097] (3) Provides a leak prevention whitelist mechanism, allowing users to customize certain pages so that the leak prevention function is not displayed.

[0098] (4) Cache the anti-leakage policy and provide a default policy configuration interface. When the user network fluctuates greatly, a better anti-leakage policy can be provided to the customer.

[0099] One embodiment of the present invention further provides a readable storage medium, in which a computer program is stored. The computer program includes program instructions. When the program instructions are executed by a processor of an electronic device, the processor executes the steps of any one of the SDK processing methods described above.

[0100] One of the embodiments of the present invention further provides an electronic device, comprising: a processor and a memory, the memory being used to store computer program code, the computer program code comprising computer instructions, and when the processor executes the computer instructions, the electronic device executes the steps of any one of the SDK processing methods described above.

[0101] See also Figure 7 , Figure 7 A schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention.

[0102] The electronic device 2 includes a processor 21, a memory 22, an input device 23, and an output device 24. The processor 21, the memory 22, the input device 23, and the output device 24 are coupled via a connector, and the connector includes various interfaces, transmission lines, or buses, etc., which are not limited in the embodiments of the present invention. It should be understood that in various embodiments of the present invention, coupling refers to mutual connection in a specific manner, including direct connection or indirect connection through other devices, for example, through various interfaces, transmission lines, buses, etc.

[0103] The processor 21 may be one or more central processing units (CPUs). When the processor 21 is a CPU, the CPU may be a single-core CPU or a multi-core CPU. Optionally, the processor 21 may be a processor group consisting of multiple CPUs, and the multiple processors are coupled to each other through one or more buses. Optionally, the processor may also be other types of processors, etc., which are not limited in the embodiments of the present invention.

[0104] The memory 22 can be used to store computer program instructions and various computer program codes including program codes for executing the scheme of the present invention. Optionally, the memory includes but is not limited to random access memory (RAM), read-only memory (ROM), erasable programmable read only memory (EPROM), or portable read only memory (CD-ROM), which is used for related instructions and data.

[0105] The input device 23 is used to input data and / or signals, and the output device 24 is used to output data and / or signals. The output device 23 and the input device 24 can be independent devices or an integrated device.

[0106] It is understandable that in the embodiment of the present invention, the memory 22 is not only used to store related instructions, and the embodiment of the present invention does not limit the specific data stored in the memory.

[0107] Understandably, Figure 7 Only a simplified design of an electronic device is shown. In practical applications, the electronic device may also include other necessary components, including but not limited to any number of input / output devices, processors, memories, etc., and all video analysis devices that can implement the embodiments of the present invention are within the protection scope of the present invention.

[0108] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0109] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. Those skilled in the art can also clearly understand that the descriptions of the various embodiments of the present invention have different focuses. For the convenience and brevity of description, the same or similar parts may not be repeated in different embodiments. Therefore, for parts not described or not described in detail in a certain embodiment, refer to the records of other embodiments.

[0110] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0111] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0112] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0113] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program to be sealed. The computer program to be sealed includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media integrations. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0114] A person skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by a computer program to instruct the relevant hardware, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the above-mentioned method embodiments. The aforementioned storage medium includes: a read-only memory (ROM) or a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0115] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. All equivalent structural changes made by using the contents of the present invention specification and drawings under the inventive concept of the present invention, or directly / indirectly applied in other related technical fields are included in the patent protection scope of the present invention.

Claims

1. A SDK processing method, characterized in that: The following steps are involved: Construct a UDP knocking package and a TCP TLS knocking package through the SDK, and perform single packet verification based on the UDP knocking package and the TCP TLS knocking package; When the single package verification passes, a management channel is established and token authentication is performed; When the token authentication succeeds, the server sends the anti-leakage strategy to the SDK and executes the anti-leakage strategy; The anti-leakage strategy is cached to obtain a local cache strategy, and when the network fluctuation of the user exceeds a predetermined standard, the local cache strategy is executed.

2. The SDK processing method according to claim 1, wherein: Build UDP knocking package and TCP TLS knocking package through SDK, and perform single package verification based on the UDP knocking package and TCP TLS knocking package, including: Construct a UDP knock packet through the SDK, and send the UDP knock packet to the server; Verify the UDP knocking packet through the server, and open the TCP port to the SDK after successful verification; Constructing a TCP TLS knocking packet, and sending the TCP TLS knocking packet to the server through the TCP port within a predetermined time; The TCP TLS knocking packet is verified by the server to complete the single packet verification process.

3. The SDK processing method according to claim 2, characterized in that: The method further comprises: When the token authentication succeeds, start the timer and determine whether the token expiration time is less than the scheduled expiration time; When the token expiration time is less than the scheduled expiration time, a new token is exchanged with the current token through the refresh token.

4. The SDK processing method according to claim 1, wherein: The method further comprises: Obtain a whitelist preset by the user, and determine the target page in the whitelist; Determining whether the page accessed by the user is the target page; When the page accessed by the user is the target page, the anti-leakage strategy is disabled in the target page.

5. The SDK processing method according to claim 1, wherein: The anti-leakage strategy is cached to obtain a local cache strategy, and when the network fluctuation of the user exceeds a predetermined standard, the local cache strategy is executed, further comprising: When the user's network fluctuation exceeds a predetermined standard and the local cache strategy is not obtained, the pre-configured SDK default strategy is executed.

6. The SDK processing method according to claim 5, characterized in that: The method further comprises: If the SDK default policy is not detected, the SDK's built-in policy is executed.

7. The SDK processing method according to claim 3, characterized in that: After the single packet verification is passed, the management channel is established and before token authentication is performed, it also includes: Generate a token and freshtoken on the client, and send the token and freshtoken to the SDK.

8. An SDK processing device, characterized in that: include: A single-packet verification module, used to construct a UDP knocking package and a TCP TLS knocking package through the SDK, and perform single-packet verification based on the UDP knocking package and the TCP TLS knocking package; Token authentication module, which is used to establish a management channel and perform token authentication after a single package is verified; The policy execution module is used to send the anti-leakage policy to the SDK through the server and execute the anti-leakage policy after the token authentication succeeds; The local policy cache module is used to cache the anti-leakage policy to obtain a local cache policy, and execute the local cache policy when the user's network fluctuation exceeds a predetermined standard.

9. An electronic device, comprising: A processor and a memory, wherein the memory is used to store computer program codes, the computer program codes include computer instructions, and when the processor executes the computer instructions, the electronic device executes the steps of the SDK processing method as described in any one of claims 1-7.

10. A readable storage medium having a computer program stored therein, characterized in that: The computer program includes program instructions, and when the program instructions are executed by a processor of an electronic device, the processor executes the steps of the SDK processing method as described in any one of claims 1-7.

Images