Application connection method and device, medium, electronic equipment and program product

Abstract

The invention discloses an application connection method and device, a medium, electronic equipment and a program product. In response to a DNS request initiated by the terminal, determining domain name information corresponding to the DNS request; when the domain name information is a preset domain name corresponding to the target application, a preset mark is added to a service request message of the target application through a preset application process, the preset mark is used for identifying that the terminal is a preset authorization terminal corresponding to the target application, and the preset application process is an application process deployed on the preset authorization terminal; and sending the service request message added with the preset mark to the target server, so that the target server establishes connection with the target application according to the preset mark. The preset mark is added to the service request message from the target application based on the preset application process, so that the traffic data including the APP end and the webpage end of the target application can be completely captured in the equipment dimension, and the target server can control the terminal equipment logging in the target application by identifying the preset mark.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular, to an application connection method, device, medium, electronic device and program product. Background Art

[0002] The rapid development of informatization has made information security issues more and more important. For enterprises, in order to avoid data leakage, employees are usually required to log in to their corporate accounts on designated devices, and the login of personal accounts and other corporate accounts on the designated devices is restricted.

[0003] The related technology can only restrict the account of the user logging in through the APP, but cannot restrict the login account on the web page, resulting in the risk of data leakage. Summary of the invention

[0004] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] In a first aspect, the present disclosure provides an application connection method, the method comprising: In response to a terminal initiating a domain name system DNS request, determining domain name information corresponding to the DNS request; In the case where the domain name information is a preset domain name corresponding to the target application, a preset mark is added to the service request message of the target application through a preset application process, wherein the preset mark is used to identify the terminal as a preset authorized terminal corresponding to the target application, and the preset application process is an application process deployed on the preset authorized terminal; The service request message added with the preset mark is sent to the target server corresponding to the target application, so that the target server establishes a connection with the target application according to the preset mark.

[0006] In a second aspect, the present disclosure provides an application connection device, the device comprising: A determination module, configured to determine domain name information corresponding to a domain name system DNS request in response to a terminal initiating a DNS request; a marking module, configured to, when the domain name information is a preset domain name corresponding to the target application, add a preset mark to the service request message of the target application through a preset application process, wherein the preset mark is used to identify the terminal as a preset authorized terminal corresponding to the target application, and the preset application process is an application process deployed on the preset authorized terminal; The connection module is used to send the service request message with the preset mark added to the target server corresponding to the target application, so that the target server establishes a connection with the target application according to the preset mark.

[0007] In a third aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the method described in the first aspect of the present disclosure.

[0008] In a fourth aspect, the present disclosure provides an electronic device, including: a storage device having a computer program stored thereon; A processing device is used to execute the computer program in the storage device to implement the steps of the method described in the first aspect of the present disclosure.

[0009] In a fifth aspect, the present disclosure provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method described in the first aspect of the present disclosure.

[0010] Through the above technical solution, in response to the terminal initiating a domain name system DNS request, the domain name information corresponding to the DNS request is determined; when the domain name information is the preset domain name corresponding to the target application, a preset tag is added to the service request message of the target application through the preset application process, and the preset tag is used to identify the terminal as the preset authorized terminal corresponding to the target application, and the preset application process is the application process deployed on the preset authorized terminal; the service request message with the preset tag is sent to the target server corresponding to the target application, so that the target server establishes a connection with the target application according to the preset tag. In this way, by deploying the preset application process on the preset authorized terminal of the target application, and adding a preset tag to the service request message from the target application based on the preset application process, it is possible to fully capture the traffic data including the APP end and the web end passing through the target application in the device dimension, and the target server can control the terminal device that logs in to the target application by identifying the preset tag, thereby avoiding data leakage of the target application.

[0011] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings: Figure 1 The figure is a flowchart of an application connection method according to an exemplary embodiment.

[0013] Figure 2 is based on Figure 1 The illustrated embodiment shows a flow chart of an application connection method.

[0014] Figure 3 The figure is a signaling interaction diagram according to an exemplary embodiment of the present disclosure.

[0015] Figure 4 is based on Figure 1 The illustrated embodiment shows a flow chart of an application connection method.

[0016] Figure 5 The figure is a schematic diagram of a process of using MITM to perform data packet coloring according to an exemplary embodiment.

[0017] Figure 6 is based on Figure 1 The illustrated embodiment shows a flow chart of an application connection method.

[0018] Figure 7 is based on Figure 1 The illustrated embodiment shows a flow chart of an application connection method.

[0019] Figure 8 is based on Figure 1 The illustrated embodiment shows a flow chart of an application connection method.

[0020] Fig. 9 is based on Figure 1 The illustrated embodiment shows a flow chart of an application connection method.

[0021] Fig.10 The figure is a block diagram of an application connection device according to an exemplary embodiment.

[0022] Fig.11 is based on Fig.10 The illustrated embodiment shows a block diagram of an application connection device.

[0023] Fig.12 is based on Fig.10 The illustrated embodiment shows a block diagram of an application connection device.

[0024] Fig.13 is based on Fig.10 The illustrated embodiment shows a block diagram of an application connection device.

[0025] Fig.14 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0026] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0027] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0028] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0029] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0030] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0031] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0032] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0033] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0034] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0035] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0036] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0037] The present disclosure is mainly used in scenarios where login accounts are restricted when logging into a target application on a specified device, so as to avoid risks such as data leakage of the enterprise.

[0038] The relevant technology can implement restrictions on user account login and switching on the APP side of the target application. In actual application scenarios, the target application usually also has a web side. Since the web side cannot obtain the unique identifier of the device, it cannot simply implement the restriction function on user account login and switching by specifying the device identifier. In other words, the relevant technology can implement account login restrictions within the APP of the target application, but cannot prevent users from logging in and switching accounts through the web side, which will obviously affect information security and pose a risk of corporate data leakage.

[0039] In order to solve the above problems, the present disclosure provides an application connection method, device, medium, electronic device and program product. The specific implementation of the present disclosure is described in detail below with reference to the accompanying drawings.

[0040] Figure 1 FIG. 1 is a flow chart of an application connection method according to an exemplary embodiment, which can be applied to terminal devices (such as mobile phones, computers, notebooks, tablet computers, etc.). Figure 1 As shown, the method comprises the following steps: In step S101, in response to a terminal initiating a domain name system DNS request, domain name information corresponding to the DNS request is determined.

[0041] In actual application scenarios, after the terminal detects that the user has entered a URL (such as the URL of the web page of the target application) in the browser, it can trigger the DNS (Domain Name System) request to obtain the IP address corresponding to the domain name information based on the DNS request.

[0042] Normally, the DNS request can be sent directly to the DNS server so as to obtain the IP address corresponding to the domain name information based on the DNS server. The present disclosure can obtain the DNS request based on the DNS interception technology through the preset application process deployed on the terminal, and determine the domain name information corresponding to the DNS request based on the preset application process, so that when the domain name information of the DNS request is the preset domain name corresponding to the target application, the preset application process adds a preset tag to the service request message subsequently initiated by the target application. In this way, after sending the service request message to the target server (referring to the service server corresponding to the target application), the target server can determine whether the service request message comes from the preset authorized terminal of the target application based on the preset tag, and after determining that it comes from the preset authorized terminal, establish a connection with the target application, otherwise, refuse the user to log in to the target application.

[0043] The preset application process refers to an application process pre-deployed on a preset authorized terminal of the target application, thereby realizing a terminal device-based tenant switching restriction function and a security reinforcement function. For example, the preset application process may be an LSA (Lark Secure Access) service.

[0044] In this step, in response to the terminal initiating the DNS request, the DNS request can be obtained through the preset application process, and the domain name information can be obtained after the DNS request is parsed.

[0045] In step S102, when the domain name information is a preset domain name corresponding to the target application, a preset tag is added to the service request message of the target application through the preset application process. The preset tag is used to identify the terminal as the preset authorized terminal corresponding to the target application, and the preset application process is an application process deployed on the preset authorized terminal.

[0046] Among them, the preset domain name corresponding to the target application refers to one or more domain names corresponding to the target application that are preset. The target application can be one or more applications that are preset and require tenant login restrictions. The preset authorized terminal refers to a terminal device that is preset and can log in to the target application. In a possible implementation of the present disclosure, the preset application process can be pre-deployed on the preset authorized terminal to authorize the subsequent use of the terminal device to log in to the target application.

[0047] In one implementation, the preset domain name of the target application may be predefined through the accounts domain. When it is determined that the domain name information belongs to a domain name within the accounts domain of the target application, the domain name information is regarded as the preset domain name corresponding to the target application.

[0048] When the domain name information is the preset domain name corresponding to the target application, it represents the current DNS request and the service request message sent based on the IP address returned by the response message of the DNS request. It is the traffic data of the target application that needs to be restricted for tenant login. This part of the traffic data needs to be verified to determine whether it is the traffic data initiated by the preset authorized terminal of the target application to avoid unauthorized devices from logging into the target application and reduce the risk of data leakage.

[0049] In order to verify the traffic data, the present invention can add a preset tag to the service request message of the target application through the preset application process. The preset tag can identify the terminal as a preset authorized terminal corresponding to the target application. In this way, the server can control the terminal device that logs in to the target application by identifying the preset tag.

[0050] In step S103, the service request message with the preset mark added is sent to the target server corresponding to the target application, so that the target server establishes a connection with the target application according to the preset mark.

[0051] The target server refers to a business server that provides services for the target application.

[0052] Since the preset tag is used to identify the terminal as the preset authorized terminal corresponding to the target application, that is, when the target server determines that the received service request message carries the preset tag, it can be considered that the current service request message is sent by the preset authorized terminal of the target application. At this time, the server can respond to the service request message normally, so as to provide a service response to the target application after establishing a connection with the target application. When the target server determines that the service request message does not carry the preset tag, it can be considered that the service request message is initiated by an unauthorized terminal device (that is, a terminal device that does not have the login permission for the target application). At this time, the target server can refuse the user to log in to the target application, that is, not establish a communication connection with the target application.

[0053] By adopting the above method, the preset application process is deployed on the preset authorized terminal of the target application, and a preset tag is added to the business request message from the target application based on the preset application process, so as to achieve complete capture of the traffic data including the APP and web pages passing through the target application in the device dimension, and the target server can control the terminal device that logs in to the target application by identifying the preset tag, thereby avoiding data leakage of the target application.

[0054] In a possible implementation of the present disclosure, the preset application process can be deployed in the system user state, and the preset application process includes a virtual network card and a domain name acquisition thread, and the virtual network card and the domain name acquisition thread are two threads in the preset application process. Among them, the virtual network card can be regarded as a software-defined network interface, which simulates the function of a physical network card, but is usually not dependent on physical hardware. In the architecture of the operating system, the virtual network card is usually integrated in the system network stack. Therefore, the present disclosure can realize interaction with the kernel layer of the operating system based on the virtual network card technology, so as to capture network data packets from the kernel layer of the operating system through the virtual network card, and the network data packets can be transmitted to the application in the system user state, and the data packets in the system user state can also be transmitted to the kernel layer of the operating system through the virtual network card. The domain name acquisition thread refers to a thread that obtains domain name information based on DNS data packets. In addition, the preset application process can further include a local agent (also a thread in the preset application process), and the local agent can be regarded as an intermediate layer between the client of the target application and the target server.

[0055] Figure 2 is based on Figure 1 The embodiment shown is a flow chart of an application connection method. Figure 2 As shown, step S101 includes the following sub-steps: In step S1011, after obtaining a DNS data packet of a DNS request from the operating system kernel layer of the terminal through the virtual network card, the DNS data packet is transmitted to a domain name acquisition thread.

[0056] As described above, the present invention can transmit data packets of the operating system kernel layer to the system user state application through the virtual network card. Therefore, in this step, the DNS data packet of the DNS request can be obtained from the operating system kernel layer of the terminal through the virtual network card, and the DNS data packet can be transmitted to the domain name acquisition thread deployed in the system user state.

[0057] In a possible implementation, the route of the DNS request may be modified, and the DNS data packet may be obtained from the operating system kernel layer through the virtual network card based on the modified route.

[0058] Among them, the DNS request is usually initiated by the target application, and then the DNS request is transmitted from the system user state to the operating system kernel layer. The virtual network card can read the DNS data packet from the operating system kernel layer based on the modified route.

[0059] For example, the DNS list corresponding to the system default network card (such as the system's physical network card) can be queried. The DNS list records the IP address of the DNS server. By modifying the route, the DNS request message flowing to the DNS server IP address can be imported from the operating system kernel layer to the virtual network card.

[0060] In step S1012, the DNS data packet is parsed through the domain name acquisition thread to obtain domain name information.

[0061] In a possible implementation of this step, the domain name acquisition thread can detect whether the DNS data packet is a data packet corresponding to port 53. If it is determined that the data packet belongs to port 53, the domain name information can be obtained after the DNS data packet is parsed based on the DNS protocol. In addition, the DNS data packet is usually a UDP (User Datagram Protocol) type data packet.

[0062] For example, Figure 3 is a schematic diagram of signaling interaction according to an exemplary embodiment of the present disclosure, such as Figure 3 As shown in FIG, the signaling interaction subjects include the terminal and the target server, wherein the terminal is further divided into three interaction sub-subjects: the target application, the operating system kernel layer, and the preset application process. Figure 3 As shown, step S1 can be executed in the preset application process to set the routing table to obtain DNS traffic through the virtual network card. In step S2, the target application initiates a DNS request. After the DNS request is transmitted to the operating system kernel layer, in step S3, the DNS data packet corresponding to the DNS request can be read through the virtual network card, and the DNS data packet can be transmitted to the domain name acquisition thread in the preset application process. The domain name acquisition thread can parse the DNS data packet by executing step S4 to obtain the domain name information.

[0063] In a possible embodiment of the present disclosure, the preset application process can also cache the domain name information and the real destination address corresponding to the domain name information. The real destination address refers to the IP address of the target server. The corresponding relationship can be cached in UDP Nat, such as Figure 3 As shown, the corresponding relationship may be accounts.yuming.cn--abcd, where accounts.yuming.cn is the domain name information of the target application, and abcd is the IP address of the target server.

[0064] It is understandable that before caching the corresponding relationship in UDP Nat, the real destination address needs to be determined first. In order to obtain the real destination address, the terminal can send the DNS request to the DNS server; according to the first response message returned by the DNS server, the real destination address corresponding to the domain name information is determined, so that the domain name information and the real destination address corresponding to the domain name information can be cached.

[0065] It should be noted that, in the process of sending the DNS request to the DNS server, the terminal can use the physical network card of the terminal to send the DNS request to the DNS server based on the bind.before.connect method, so as to avoid the routing loop problem caused by the DNS request being captured by the virtual network card again when the DNS request is sent through the virtual network card. In addition, in order to reduce the load pressure of the virtual network card thread and improve the communication efficiency of data, after using the physical network card of the terminal to send the DNS request to the DNS server, another thread can be started in the preset application process to receive the DNS response message (i.e., the first response message), so as to determine the real destination address corresponding to the domain name information based on the DNS response message, and cache the mapping relationship between the domain name information and the real destination address in the preset application process.

[0066] Figure 4 is based on Figure 1 The embodiment shown is a flowchart of an application connection method, such as Figure 4 As shown, step S102 includes the following sub-steps: In step S1021, a pseudo communication address randomly allocated to the virtual network card is obtained.

[0067] The fake communication address refers to an IP address of a certain network segment randomly assigned to the virtual network card (also called "Fake IP"). By setting the destination address of traffic data (such as the service request message described later) to the fake communication address, the traffic data can be imported into the virtual network card.

[0068] In step S1022, the service request message is transmitted to the local proxy through the virtual network card according to the pseudo communication address.

[0069] The service request message refers to any service request message initiated by the target application with the IP address as the destination address after the target application obtains the IP address based on the DNS request message.

[0070] In this step, a DNS response message of the DNS request can be generated through the local proxy according to the pseudo communication address, and the DNS response message includes the pseudo communication address; the DNS response message is transmitted to the target application through the virtual network card; after obtaining the service request message through the virtual network card according to the pseudo communication address, the service request message is transmitted to the local proxy, and the current destination address of the service request message is the pseudo communication address.

[0071] For example, Figure 3As shown, the local proxy generates a DNS response message based on the Fake IP (71.71.71.101) by executing step S5. Specifically, the DNS response message can be assembled by setting the IP address corresponding to the domain name information accounts.yuming.cn to 71.71.71.101, and the DNS response message is transmitted to the operating system kernel layer based on the virtual network card, and then further transmitted to the target application (such as Figure 3 After obtaining the Fake IP, the target application can initiate the service request message to the Fake IP, such as Figure 3 As shown, in step S7, the target application uses 10.0.0.1:123 as the source address of the service request message and 71.71.71.101 as the destination address to send the service request message. Since 71.71.71.101 is the pseudo communication address of the virtual network card, after the service request message is transmitted to the kernel layer of the operating system, the virtual network card can capture the service request message and send it to the local agent. The above examples are only for illustration and are not limited in this disclosure.

[0072] It should be noted that the present invention returns the pseudo communication address of the virtual network card to the target application, so that the service request message initiated by the target application can be captured by the virtual network card, so that after the service request message is transmitted to the local agent through the virtual network card, a preset tag is added to the service request message through the local agent.

[0073] In step S1023, a preset tag is added to the service request message through the local agent.

[0074] In this step, the service request message can be parsed by the local proxy to obtain the plain text of the service request message, and then the preset mark is added to the header of the plain text. Figure 3 As shown, the service request message can be added with a preset tag by executing step S12.

[0075] In the process of parsing the service request message, the local proxy can parse the service request message based on the MITM (Man-in-the-Middle Attack) technology to obtain the plain text, and after adding a preset tag, send the service request message with the preset tag to the target server (such as Figure 3 , step S13 in the above process).

[0076] Among them, the data packet corresponding to the service request message can be an HTTPS type data packet, which is usually in the form of ciphertext. In order to add a preset mark to the service request message, the present invention can use MITM technology to convert the ciphertext of the HTTPS data packet into plaintext and then add the preset mark therein.

[0077] For example, Figure 5 FIG. 1 is a schematic diagram of a process of using MITM to color data packets according to an exemplary embodiment. Coloring data packets here refers to the process of adding a preset mark to a service request message. Figure 5 As shown, the service request message transmitted from the target application to the local proxy is an HTTPS data packet in ciphertext form. The MITM in the local proxy is divided into two roles: MITM server and MITM client. The MITM server can establish a connection with the target application as a proxy service of the target server (i.e., execute the TLS handshake process in the HTTPS protocol), and the MITM client can establish a connection with the target server as a proxy service of the target application. In this way, the local proxy can obtain the decryption data (such as a certificate) used to decrypt the service request message based on the data interaction between the MITM server and the MITM client and the target application and the target server, thereby realizing the parsing of the service request message to obtain the plain text. In addition, the present disclosure can also prevent the service request message with a preset tag from being modified by untrusted third-party software based on SSL Pinning technology. The above examples are only illustrative, and the present disclosure is not limited to this.

[0078] In another possible embodiment of the present disclosure, the terminal can also query the domain name information corresponding to the pseudo communication address through the local agent, and determine the real destination address of the target server based on the domain name information, and then record the source address of the service request message and the real destination address corresponding to the source address.

[0079] For example, Figure 3 As shown, step S8 is executed, and the local agent can query the real destination address abcd from UDP Nat. Specifically, Figure 3As shown, the UDP Nat records the correspondence between the domain name information accounts.yuming.cn and the real destination address abcd of the target server. Therefore, the domain name information corresponding to the pseudo communication address 71.71.71.101 can be determined as accounts.yuming.cn, and then the real destination address abcd corresponding to the domain name information accounts.yuming.cn can be queried in the UDP Nat, and the correspondence between the source address 10.0.0.1:123 of the service request message and the real destination address abcd:443 is recorded in the TCP Nat, where port 443 is the port of the http protocol. The example here is only for illustration, and the present disclosure is not limited to this.

[0080] Figure 6 is based on Figure 1 The embodiment shown is a flowchart of an application connection method, such as Figure 6 As shown, step S103 includes the following sub-steps: In step S1031, the source address and the destination address of the service request message are modified according to the real destination address and the proxy address of the local proxy.

[0081] As in the example above, Figure 3 As shown, in step S7, the target application sends the service request message with 10.0.0.1:123 as the source address of the service request message and 71.71.71.101 as the destination address. In order to send the service request message with a preset tag to the target server, and the second response message of the target server to the service request message can also be returned to the local agent, it is necessary to modify the source address and destination address of the service request message.

[0082] For example, Figure 3 As shown, by executing step S9, the source address of the service request message is changed from 10.0.0.1:123 to the proxy address 10.0.0.1:4443 of the local proxy, and the destination address of the service request message is changed from 71.71.71.101 to the real destination address abcd:443 of the target server.

[0083] In step S1032, based on the modified source address and the modified destination address, the service request message with the preset tag added is sent to the target server.

[0084] By executing this step, the service request message with a preset mark can be sent to the target server through the local proxy, so that the target server can identify whether the target request message is initiated by the preset authorized terminal of the target application based on the preset mark. It should be noted that when executing this step, the terminal can also use the physical network card of the terminal to send the service request message to the target server based on the bind.before.connect method to avoid the routing loop problem caused by the service request message being captured by the virtual network card again when the service request message is sent through the virtual network card.

[0085] It should also be noted that the target application usually initiates the service request message based on TCP (Transmission Control Protocol). After the local agent obtains the service request message and modifies the source address and destination address of the service request message, the TCP type service request message can be returned to the operating system kernel layer for TCP protocol maintenance (such as congestion control, connection control, etc.). After passing through the network stack of the operating system kernel layer, the service request message can upgrade the TCP protocol to the HTTPS protocol. In this way, the local agent can obtain the ciphertext of the HTTPS type data packet (such as Figure 3 Steps S10 and S11 in FIG.

[0086] Figure 7 is based on Figure 1 The embodiment shown is a flowchart of an application connection method, such as Figure 7 As shown, the method further comprises the following steps: In step S104, in response to receiving a second response message returned by the target server in response to the service request message with a preset tag, the destination address of the second response message is modified to the source address to transmit the second response message to the target application.

[0087] Since the source address of the business request message with the preset tag is the proxy address 10.0.0.1:4443 of the local proxy, and the destination address is the real destination address abcd:443 of the target server, the destination address of the second response message returned by the target server to the business request message with the preset tag is the proxy address 10.0.0.1:4443. In order to transmit the second response message to the target application, the destination address of the second response message needs to be modified to the source address 10.0.0.1:123 of the business request message initiated by the target application.

[0088] like Figure 3As shown, after step 14, the local agent of the terminal may receive the second response message, and then the terminal modifies the destination address of the second response message by executing step S15, and then transmits the second response message to the target application based on steps S16 and S17.

[0089] In order to further improve the security mechanism for users logging into the target application through a terminal, the present disclosure can also perform risk detection on the terminal, and send the obtained device risk detection information together with the service request message with a preset tag added to the target server.

[0090] Figure 8 is based on Figure 1 The embodiment shown is a flowchart of an application connection method, such as Figure 8 As shown, the method further comprises the following steps: In step S105, risk detection is performed on the terminal through a preset application process to obtain device risk detection information.

[0091] In this step, the state information of the target security configuration function on the terminal may be obtained, where the target security configuration function is at least one preset security configuration function corresponding to the target application, and the device risk detection information is generated according to the state information.

[0092] Among them, the target security configuration function can be based on the security mechanism for improving the target application login and avoiding the data leakage corresponding to the target application. The target security configuration function can be pre-set based on the target application. The target security configuration function can include one or more of the application signature verification function, lock screen password function, automatic lock screen function, system firewall function, remote login function, automatic login function, and connection to an unencrypted network function. In this way, the terminal can obtain the status information of the target security configuration function through the preset application process. The status information indicates whether the corresponding function is enabled, and the status information of each target security configuration function is used as the device risk detection information.

[0093] In this way, during the execution of step S103, the device risk detection information and the service request message with the preset mark added thereto may be sent to the target server, so that the target server establishes a connection with the target application according to the preset mark and the device risk detection information.

[0094] For example, assuming that the target security configuration function includes a system firewall function and a remote login function, it can be understood that if the system firewall function of the terminal is turned on and the remote login function of the terminal is turned off, the risk of data leakage when the terminal logs in to the target application is low. Therefore, the target server determines that the service request message is initiated by the preset authorized terminal according to the preset mark, and the system firewall function of the preset authorized terminal is turned on and the remote login function is turned off. It can determine to establish a secure connection with the target application, otherwise refuse to log in to the target application at the terminal.

[0095] Based on the above scheme, the DNS traffic can be captured based on the preset application process deployed on the preset authorized terminal of the target application, and after adding a preset tag to the corresponding service request message, the terminal device that logs in to the target application can be controlled. However, for non-natively resolved DNS traffic (such as browser proxy and system proxy), it is impossible to capture DNS traffic based on the preset application process. In order to solve this technical problem, the present disclosure can audit the traffic passing through the terminal physical network card to identify the traffic data corresponding to the target application.

[0096] Fig. 9 is based on Figure 1 The embodiment shown is a flowchart of an application connection method, such as Fig. 9 As shown, the method further comprises the following steps: In step S106, target traffic of a target protocol type sent by a physical network card of the terminal is obtained, where the target protocol type is a protocol type corresponding to a target application.

[0097] In this step, the traffic packets of the physical network card can be captured by libpcap (a library for capturing network packets), and then the target traffic of the target protocol type can be filtered based on BPF (Berkeley Packet Filter, a tool for filtering network packets). For example, the target protocol type can be HTTP.

[0098] For example, the BPF syntax can be used , filtering to obtain the target traffic of HTTP type. Among them, tcp means filtering only TCP packets, tcp[12:1] means accessing the 12th byte of the TCP header, including DO and RSV. Indicates shielding RSV (SYN, ACK), leaving the upper four bits, Indicates the header length represented by a 32-bit word to adjust the bit, divide the previous result by 4 and offset it to the actual TCP header position, Indicates checking whether the first two digits of the TCP header correspond to the ASCII code of CO. Such traffic can be regarded as proxy traffic with connect, and such traffic needs to be audited. The examples here are only for illustration, and the present disclosure does not limit this.

[0099] It should be noted that by filtering the target traffic of the target protocol type, it is possible to avoid unpacking and retrieving the payload of all traffic flowing through the physical network card, thereby improving performance and the efficiency of traffic auditing.

[0100] In step S107, a traffic audit is performed on the target traffic.

[0101] In this step, for each flow in the target traffic, it can be determined whether the data packet content of the flow includes the preset domain name corresponding to the target application. If it is determined that the data packet content of the flow includes the preset domain name, a target log is generated. The target log is used to record that the data packet content of the flow includes the preset domain name.

[0102] For example, it can be determined whether the data packet content of the traffic includes the preset domain name of accounts.yuming.cn. If yes, the traffic is recorded to generate the target log.

[0103] By adopting this method, the traffic of the target application that bypasses the preset application process can be audited, the traffic including the preset domain name in the data packet content can be recorded, and the target log can be generated. Users or developers can perform risk assessment based on the target log.

[0104] Fig.10 is a block diagram of an application connection device according to an exemplary embodiment. Fig.10 As shown, the device comprises: The determination module 1001 is used to determine the domain name information corresponding to the DNS request in response to the terminal initiating a domain name system DNS request; A marking module 1002 is used to add a preset mark to the service request message of the target application through a preset application process when the domain name information is a preset domain name corresponding to the target application, wherein the preset mark is used to identify the terminal as a preset authorized terminal corresponding to the target application, and the preset application process is an application process deployed on the preset authorized terminal; The connection module 1003 is used to send the service request message with the preset tag added to the target server corresponding to the target application, so that the target server establishes a connection with the target application according to the preset tag.

[0105] Optionally, the determination module 1001 is configured to, in response to the terminal initiating the DNS request, obtain the DNS request through the preset application process, and obtain the domain name information after resolving the DNS request.

[0106] Optionally, the preset application process includes a virtual network card and a domain name acquisition thread, and the determination module 1001 is used to obtain the DNS data packet of the DNS request from the operating system kernel layer of the terminal through the virtual network card, and then transmit the DNS data packet to the domain name acquisition thread; and parse the DNS data packet through the domain name acquisition thread to obtain the domain name information.

[0107] Optionally, the determination module 1001 is used to modify the route of the DNS request; and obtain the DNS data packet from the operating system kernel layer through the virtual network card according to the modified route.

[0108] Optionally, Fig.11 is based on Fig.10 The embodiment shown is a block diagram of an application connection device, such as Fig.11 As shown, the device also includes: The cache module 1004 is used to send the DNS request to the DNS server; determine the real destination address corresponding to the domain name information according to the first response message returned by the DNS server; and cache the domain name information and the real destination address corresponding to the domain name information.

[0109] Optionally, the preset application process includes a virtual network card and a local agent; the marking module 1002 is used to obtain a pseudo communication address randomly assigned to the virtual network card; transmit the service request message to the local agent through the virtual network card according to the pseudo communication address; and add the preset tag to the service request message through the local agent.

[0110] Optionally, the marking module 1002 is used to generate a DNS response message of the DNS request through the local agent according to the pseudo communication address, and the DNS response message includes the pseudo communication address; transmit the DNS response message to the target application through the virtual network card; after obtaining the service request message through the virtual network card according to the pseudo communication address, transmit the service request message to the local agent, and the current destination address of the service request message is the pseudo communication address.

[0111] Optionally, the marking module 1002 is used to parse the service request message through the local proxy to obtain the plain text of the service request message; and add the preset mark to the header of the plain text.

[0112] Optionally, the cache module 1004 is also used to query the domain name information corresponding to the pseudo communication address, and determine the real destination address of the target server based on the domain name information; record the source address of the service request message and the real destination address corresponding to the source address.

[0113] Optionally, the connection module 1003 is used to modify the source address and destination address of the service request message according to the real destination address and the proxy address of the local agent; based on the modified source address and the modified destination address, the service request message with the preset tag is sent to the target server.

[0114] Optionally, the connection module 1003 is also used to modify the destination address of the second response message to the source address in response to receiving a second response message returned by the target server to the service request message with the preset tag added, so as to transmit the second response message to the target application.

[0115] Optionally, Fig.12 is based on Fig.10 The embodiment shown is a block diagram of an application connection device, such as Fig.12 As shown, the device also includes: The risk detection module 1005 is used to perform risk detection on the terminal through the preset application process to obtain device risk detection information; The connection module 1003 is used to send the device risk detection information and the service request message with the preset mark added to the target server, so that the target server establishes a connection with the target application according to the preset mark and the device risk detection information.

[0116] Optionally, the risk detection module 1005 is used to obtain status information of a target security configuration function on the terminal, where the target security configuration function is at least one preset security configuration function corresponding to the target application; and generate the device risk detection information according to the status information.

[0117] Optionally, Fig.13 is based on Fig.10 The embodiment shown is a block diagram of an application connection device, such as Fig.13 As shown, the device also includes: The traffic audit module 1006 is used to obtain the target traffic of the target protocol type sent through the physical network card of the terminal, where the target protocol type is the protocol type corresponding to the target application; and perform traffic audit on the target traffic.

[0118] Optionally, the traffic audit module 1006 is used to determine, for each flow in the target traffic, whether the data packet content of the traffic includes the preset domain name; when it is determined that the data packet content of the traffic includes the preset domain name, a target log is generated, and the target log is used to record that the data packet content of the traffic includes the preset domain name.

[0119] Reference below Fig.14 , which shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure. The terminal device in the embodiments of the present disclosure may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0120] like Figure 6 As shown, the electronic device 1400 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1402 or a program loaded from a storage device 1408 to a random access memory (RAM) 1403. In the RAM 1403, various programs and data required for the operation of the electronic device 1400 are also stored. The processing device 1401, the ROM 1402, and the RAM 1403 are connected to each other via a bus 1404. An input / output (I / O) interface 1405 is also connected to the bus 1404.

[0121] Typically, the following devices may be connected to the I / O interface 1405: an input device 1406 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 1407 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 1408 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1409. The communication device 1409 may allow the electronic device 1400 to communicate with other devices wirelessly or by wire to exchange data. Although Fig.14 The electronic device 1400 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0122] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 1409, or installed from a storage device 1408, or installed from a ROM 1402. When the computer program is executed by the processing device 1401, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0123] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0124] In some embodiments, the client can communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0125] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0126] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: determines the domain name information corresponding to the DNS request in response to a terminal initiating a domain name system DNS request; when the domain name information is a preset domain name corresponding to a target application, adds a preset tag to the service request message of the target application through a preset application process, and the preset tag is used to identify the terminal as a preset authorized terminal corresponding to the target application, and the preset application process is an application process deployed on the preset authorized terminal; sends the service request message added with the preset tag to a target server corresponding to the target application, so that the target server establishes a connection with the target application according to the preset tag.

[0127] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0128] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0129] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a module does not limit the module itself in some cases. For example, a determination module may also be described as a "module for determining domain name information".

[0130] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0131] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0132] According to one or more embodiments of the present disclosure, Example 1 provides an application connection method, including: In response to a terminal initiating a domain name system DNS request, determining domain name information corresponding to the DNS request; In the case where the domain name information is a preset domain name corresponding to the target application, a preset mark is added to the service request message of the target application through a preset application process, wherein the preset mark is used to identify the terminal as a preset authorized terminal corresponding to the target application, and the preset application process is an application process deployed on the preset authorized terminal; The service request message added with the preset mark is sent to the target server corresponding to the target application, so that the target server establishes a connection with the target application according to the preset mark.

[0133] According to one or more embodiments of the present disclosure, Example 2 provides the method of Example 1, and in response to the terminal initiating a domain name system DNS request, determining the domain name information corresponding to the DNS request includes: in response to the terminal initiating the DNS request, obtaining the DNS request through the preset application process, and obtaining the domain name information after parsing the DNS request.

[0134] According to one or more embodiments of the present disclosure, Example 3 provides the method of Example 2, wherein the preset application process includes a virtual network card and a domain name acquisition thread, and obtaining the DNS request through the preset application process and parsing the DNS request to obtain the domain name information includes: After obtaining the DNS data packet of the DNS request from the operating system kernel layer of the terminal through the virtual network card, the DNS data packet is transmitted to the domain name acquisition thread; The DNS data packet is parsed through the domain name acquisition thread to obtain the domain name information.

[0135] According to one or more embodiments of the present disclosure, Example 4 provides the method of Example 3, obtaining the DNS data packet of the DNS request from the operating system kernel layer of the terminal through the virtual network card, including: Modifying the routing of the DNS request; The DNS data packet is obtained from the operating system kernel layer through the virtual network card according to the modified route.

[0136] According to one or more embodiments of the present disclosure, Example 5 provides the method of Example 3, wherein the method further includes: Sending the DNS request to a DNS server; Determine the real destination address corresponding to the domain name information according to the first response message returned by the DNS server; The domain name information and the real destination address corresponding to the domain name information are cached.

[0137] According to one or more embodiments of the present disclosure, Example 6 provides the method of Example 1, wherein the preset application process includes a virtual network card and a local agent; adding a preset tag to the service request message of the target application through the preset application process includes: Obtaining a pseudo communication address randomly assigned to the virtual network card; Transmitting the service request message to the local agent through the virtual network card according to the pseudo communication address; The preset tag is added to the service request message through the local agent.

[0138] According to one or more embodiments of the present disclosure, Example 7 provides the method of Example 6, wherein transmitting the service request message to the local agent through the virtual network card according to the pseudo communication address includes: Generate a DNS response message of the DNS request through the local proxy according to the pseudo communication address, wherein the DNS response message includes the pseudo communication address; Transmitting the DNS response message to the target application through the virtual network card; After acquiring the service request message through the virtual network card according to the pseudo communication address, the service request message is transmitted to the local agent, and the current destination address of the service request message is the pseudo communication address.

[0139] According to one or more embodiments of the present disclosure, Example 8 provides the method of Example 6, wherein adding the preset tag to the service request message by the local agent includes: Parsing the service request message through the local agent to obtain a plain text of the service request message; The preset mark is added to the header of the plain text.

[0140] According to one or more embodiments of the present disclosure, Example 9 provides the method of Example 6, wherein the method further includes: Querying the domain name information corresponding to the pseudo communication address, and determining the real destination address of the target server according to the domain name information; The source address of the service request message and the real destination address corresponding to the source address are recorded.

[0141] According to one or more embodiments of the present disclosure, Example 10 provides the method of Example 9, wherein sending the service request message with the preset tag added to the target server corresponding to the target application includes: Modify the source address and the destination address of the service request message according to the real destination address and the proxy address of the local proxy; Based on the modified source address and the modified destination address, the service request message added with the preset tag is sent to the target server.

[0142] According to one or more embodiments of the present disclosure, Example 11 provides the method of Example 9, wherein the method further includes: In response to receiving a second response message returned by the target server in response to the service request message with the preset tag added, the destination address of the second response message is modified to the source address, so as to transmit the second response message to the target application.

[0143] According to one or more embodiments of the present disclosure, Example 12 provides the method of any one of Examples 1-11, wherein the method further includes: Performing risk detection on the terminal through the preset application process to obtain device risk detection information; The device risk detection information and the service request message with the preset mark added thereto are sent to the target server, so that the target server establishes a connection with the target application according to the preset mark and the device risk detection information.

[0144] According to one or more embodiments of the present disclosure, Example 13 provides the method of Example 12, wherein performing risk detection on the terminal through the preset application process to obtain device risk detection information includes: Acquire status information of a target security configuration function on the terminal, where the target security configuration function is at least one preset security configuration function corresponding to the target application; The device risk detection information is generated according to the status information.

[0145] According to one or more embodiments of the present disclosure, Example 14 provides the method of any one of Examples 1-11, wherein the method further includes: Acquire target traffic of a target protocol type sent through a physical network card of the terminal, where the target protocol type is a protocol type corresponding to the target application; Perform a traffic audit on the target traffic.

[0146] According to one or more embodiments of the present disclosure, Example 15 provides the method of Example 14, wherein performing a traffic audit on the target traffic includes: For each flow in the target flow, determining whether the data packet content of the flow includes the preset domain name; In the case where it is determined that the data packet content of the traffic includes the preset domain name, a target log is generated, where the target log is used to record that the data packet content of the traffic includes the preset domain name.

[0147] According to one or more embodiments of the present disclosure, Example 16 provides an application connection device, including: A determination module, configured to determine domain name information corresponding to a domain name system DNS request in response to a terminal initiating a DNS request; a marking module, configured to, when the domain name information is a preset domain name corresponding to the target application, add a preset mark to the service request message of the target application through a preset application process, wherein the preset mark is used to identify the terminal as a preset authorized terminal corresponding to the target application, and the preset application process is an application process deployed on the preset authorized terminal; The connection module is used to send the service request message with the preset mark added to the target server corresponding to the target application, so that the target server establishes a connection with the target application according to the preset mark.

[0148] According to one or more embodiments of the present disclosure, Example 17 provides a computer-readable medium having a computer program stored thereon, which implements the steps of any of the methods described in Examples 1-15 when executed by a processing device.

[0149] According to one or more embodiments of the present disclosure, Example 18 provides an electronic device, including: a storage device having a computer program stored thereon; A processing device is used to execute the computer program in the storage device to implement the steps of the method described in any one of Examples 1-15.

[0150] According to one or more embodiments of the present disclosure, Example 19 provides a computer program product, including a computer program, which implements the steps of any one of the methods described in Examples 1-15 when executed by a processor.

[0151] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0152] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0153] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. An application connection method, characterized in that: The method comprises: In response to a terminal initiating a domain name system DNS request, determining domain name information corresponding to the DNS request; In the case where the domain name information is a preset domain name corresponding to the target application, a preset mark is added to the service request message of the target application through a preset application process, wherein the preset mark is used to identify the terminal as a preset authorized terminal corresponding to the target application, and the preset application process is an application process deployed on the preset authorized terminal; The service request message added with the preset mark is sent to the target server corresponding to the target application, so that the target server establishes a connection with the target application according to the preset mark.

2. The method according to claim 1, characterized in that In response to the terminal initiating a domain name system DNS request, determining the domain name information corresponding to the DNS request includes: In response to the terminal initiating the DNS request, the DNS request is obtained through the preset application process, and the domain name information is obtained after the DNS request is parsed.

3. The method according to claim 2, characterized in that The preset application process includes a virtual network card and a domain name acquisition thread. The obtaining of the DNS request through the preset application process and parsing the DNS request to obtain domain name information includes: After obtaining the DNS data packet of the DNS request from the operating system kernel layer of the terminal through the virtual network card, the DNS data packet is transmitted to the domain name acquisition thread; The DNS data packet is parsed through the domain name acquisition thread to obtain the domain name information.

4. The method according to claim 3, characterized in that Obtaining the DNS data packet of the DNS request from the operating system kernel layer of the terminal through the virtual network card includes: Modifying the routing of the DNS request; The DNS data packet is obtained from the operating system kernel layer through the virtual network card according to the modified route.

5. The method according to claim 3, characterized in that: The method further comprises: Sending the DNS request to a DNS server; Determine the real destination address corresponding to the domain name information according to the first response message returned by the DNS server; The domain name information and the real destination address corresponding to the domain name information are cached.

6. The method according to claim 1, characterized in that The preset application process includes a virtual network card and a local agent; Adding a preset tag to the service request message of the target application through a preset application process includes: Obtaining a pseudo communication address randomly assigned to the virtual network card; Transmitting the service request message to the local agent through the virtual network card according to the pseudo communication address; The preset tag is added to the service request message through the local agent.

7. The method according to claim 6, characterized in that The transmitting the service request message to the local agent through the virtual network card according to the pseudo communication address comprises: Generate a DNS response message of the DNS request through the local proxy according to the pseudo communication address, wherein the DNS response message includes the pseudo communication address; Transmitting the DNS response message to the target application through the virtual network card; After acquiring the service request message through the virtual network card according to the pseudo communication address, the service request message is transmitted to the local agent, and the current destination address of the service request message is the pseudo communication address.

8. The method according to claim 6, characterized in that The adding the preset tag to the service request message by the local agent comprises: Parsing the service request message through the local agent to obtain a plain text of the service request message; The preset mark is added to the header of the plain text.

9. The method according to claim 6, characterized in that The method further comprises: Querying the domain name information corresponding to the pseudo communication address, and determining the real destination address of the target server according to the domain name information; The source address of the service request message and the real destination address corresponding to the source address are recorded.

10. The method according to claim 9, characterized in that The sending of the service request message with the preset tag added to the target server corresponding to the target application includes: Modify the source address and the destination address of the service request message according to the real destination address and the proxy address of the local proxy; Based on the modified source address and the modified destination address, the service request message added with the preset tag is sent to the target server.

11. The method according to claim 9, characterized in that The method further comprises: In response to receiving a second response message returned by the target server in response to the service request message with the preset tag added, the destination address of the second response message is modified to the source address, so as to transmit the second response message to the target application.

12. The method according to any one of claims 1 to 11, characterized in that: The method further comprises: Performing risk detection on the terminal through the preset application process to obtain device risk detection information; The device risk detection information and the service request message with the preset mark added thereto are sent to the target server, so that the target server establishes a connection with the target application according to the preset mark and the device risk detection information.

13. The method according to claim 12, characterized in that The performing risk detection on the terminal through the preset application process to obtain device risk detection information includes: Acquire status information of a target security configuration function on the terminal, where the target security configuration function is at least one preset security configuration function corresponding to the target application; The device risk detection information is generated according to the status information.

14. The method according to any one of claims 1 to 11, characterized in that: The method further comprises: Acquire target traffic of a target protocol type sent through a physical network card of the terminal, where the target protocol type is a protocol type corresponding to the target application; Perform a traffic audit on the target traffic.

15. The method according to claim 14, characterized in that The flow auditing of the target flow includes: For each flow in the target flow, determining whether the data packet content of the flow includes the preset domain name; In the case where it is determined that the data packet content of the traffic includes the preset domain name, a target log is generated, where the target log is used to record that the data packet content of the traffic includes the preset domain name.

16. An application connection device, characterized in that: The device comprises: A determination module, configured to determine domain name information corresponding to a domain name system DNS request in response to a terminal initiating a DNS request; a marking module, configured to, when the domain name information is a preset domain name corresponding to the target application, add a preset mark to the service request message of the target application through a preset application process, wherein the preset mark is used to identify the terminal as a preset authorized terminal corresponding to the target application, and the preset application process is an application process deployed on the preset authorized terminal; The connection module is used to send the service request message with the preset mark added to the target server corresponding to the target application, so that the target server establishes a connection with the target application according to the preset mark.

17. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processing device, the steps of the method according to any one of claims 1 to 15 are implemented.

18. An electronic device, characterized in that: include: a storage device having a computer program stored thereon; A processing device, configured to execute the computer program in the storage device to implement the steps of the method according to any one of claims 1 to 15.

19. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 15 are implemented.

Images