Data processing method and device

Abstract

The embodiments of the present specification provide a data processing method and device, which include: receiving a network access data packet sent by a data sender, marking the network access data packet that meets the characteristics of the target data packet, and obtaining a marked network access data packet; when it is determined that the marked network access data packet is a public network access data packet, forwarding the marked network access data packet to a target data sending node; using the target data sending node, sending the marked network access data packet to a data to be sent node; using an external access traffic hijacking system deployed in the data to be sent node, sending the marked network access data packet to a target device corresponding to a target public network; modifying the marked network access data packet into a data packet sent by a relay machine, thereby using the external access traffic hijacking system to hijack and process the marked network access data packet to achieve public network access, so that the relay machine becomes a universal relay machine.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of network communication technology, and more particularly to a data processing method and device. Background Art

[0002] The currently provided relay machines are connected to all public network addresses by installing special NAT (Network Address Translation, a technology that converts private network addresses (such as LAN internal addresses) into public network addresses (such as Internet addresses)) client software. The NAT client software can handle connections initiated by the local machine to public network addresses. External users (such as office networks, test networks) cannot initiate access to the public network through the relay machine.

[0003] That is, external users cannot initiate access to the public network through the relay machine. The relay machine is not universal, which limits the scope of application. It can only process access to the public network initiated by this machine and cannot meet diverse needs. Summary of the invention

[0004] In view of this, the embodiments of this specification provide two data processing methods. One or more embodiments of this specification simultaneously involve two data processing devices, a computing device, a computer-readable storage medium, and a computer program product to solve the technical defects existing in the prior art that the transfer machine is not universal, can only process the access to the public network issued by the local machine, and cannot meet the diversified needs.

[0005] According to a first aspect of an embodiment of this specification, a data processing method is provided, including:

[0006] Receiving a network access data packet sent by a data sender, marking the network access data packet that meets the characteristics of the target data packet, and obtaining a marked network access data packet;

[0007] When determining that the marked network access data packet is a public network access data packet, forwarding the marked network access data packet to a target data sending node;

[0008] Using the target data sending node, the marked network access data packet is sent to the data to be sent node;

[0009] The external access traffic hijacking system deployed in the node to be sent is used to send the marked network access data packet to the target device corresponding to the target public network, wherein the external access traffic hijacking system is used for public network access.

[0010] According to a second aspect of an embodiment of this specification, another data processing method is provided, including:

[0011] Receiving a response encapsulated data packet sent by a target device corresponding to a target public network, and sending the response encapsulated data packet to a target entry node, wherein the response encapsulated data packet is generated by the target device processing a marked network access data packet, and the marked network access data packet is determined according to the above-mentioned data processing method;

[0012] Utilizing the external access traffic hijacking system deployed at the target entry node, the response encapsulated data packet is parsed to obtain a response data packet;

[0013] When it is determined that the response data packet meets the characteristics of the target data packet, the response data packet is sent to the data sender according to the attribute information of the response data packet.

[0014] According to a third aspect of an embodiment of this specification, there is provided a data processing device, including:

[0015] A receiving module is configured to receive a network access data packet sent by a data sender, mark the network access data packet that meets the characteristics of the target data packet, and obtain a marked network access data packet;

[0016] a forwarding module configured to forward the marked network access data packet to a target data sending node when determining that the marked network access data packet is a public network access data packet;

[0017] A hijacking module is configured to utilize the target data sending node to send the marked network access data packet to the data to-be-sent node;

[0018] The sending module is configured to utilize the external access traffic hijacking system deployed in the node to be sent to send the marked network access data packet to the target device corresponding to the target public network, wherein the external access traffic hijacking system is used for public network access.

[0019] According to a fourth aspect of an embodiment of this specification, another data processing device is provided, including:

[0020] A receiving module is configured to receive a response encapsulated data packet sent by a target device corresponding to a target public network, and send the response encapsulated data packet to a target entry node, wherein the response encapsulated data packet is generated by the target device processing a marked network access data packet, and the marked network access data packet is determined according to the above-mentioned data processing method;

[0021] A parsing module is configured to parse the response encapsulated data packet using the external access traffic hijacking system deployed by the target entry node to obtain a response data packet;

[0022] The sending module is configured to send the response data packet to the data sender according to the attribute information of the response data packet when it is determined that the response data packet meets the characteristics of the target data packet.

[0023] According to a fifth aspect of an embodiment of this specification, a computing device is provided, including:

[0024] Memory and processor;

[0025] The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions. When the computer programs / instructions are executed by the processor, the steps of the above-mentioned data processing method are implemented.

[0026] According to a sixth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores a computer program / instruction, and the computer program / instruction implements the steps of the above-mentioned data processing method when executed by a processor.

[0027] According to a seventh aspect of the embodiments of this specification, there is provided a computer program product, comprising a computer program / instruction, which implements the steps of the above-mentioned data processing method when executed by a processor.

[0028] The data processing method provided in the embodiments of the present specification can mark the network access data packets that meet the characteristics of the target data packets when receiving the network access data packets sent by the data sender, and hijack the marked network access data packets that access the public network at the target data sending node, and send the hijacked marked network access data packets to the data to be sent node deployed with the external access traffic hijacking system. The data to be sent node receives the network access data packets sent by the relay machine. Therefore, when the marked network access data packets are sent to the data to be sent node, the marked network access data packets are modified into data packets sent by the relay machine, so as to be compatible with the internal external access traffic hijacking system, and the marked network access data packets are sent to the target device corresponding to the target public network by using the external access traffic hijacking system, so that the relay machine can become a universal relay machine that can meet the diverse needs in practical applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a scenario diagram of a data processing method provided by an embodiment of this specification;

[0030] Figure 2 is a flow chart of a data processing method provided by an embodiment of this specification;

[0031] Figure 3is a flow chart of another data processing method provided by an embodiment of this specification;

[0032] Figure 4 It is a processing diagram of a data processing method provided by an embodiment of this specification;

[0033] Figure 5 is a schematic diagram of a processing process of another data processing method provided by an embodiment of this specification;

[0034] Figure 6 is a structural schematic diagram of a data processing device provided by an embodiment of this specification;

[0035] Figure 7 is a schematic diagram of the structure of another data processing device provided by an embodiment of this specification;

[0036] Figure 8 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0037] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0038] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0039] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0040] In addition, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0041] First, the terms involved in one or more embodiments of this specification are explained.

[0042] iptables: is a user space program and tool set provided in the Linux (an operating system) kernel for configuring the ruleset of the kernel firewall (powered by Netfilter). It allows system administrators to define conditions for allowing or denying packets based on characteristics such as source and destination IP addresses, port numbers, network protocols, and the contents of the packet. iptables is widely used for network security and traffic management in Linux systems.

[0043] Netfilter: is a subsystem in the Linux kernel that processes network packets. It provides a general, abstract framework that enables packet filtering, network address translation (NAT), and connection tracking through a series of hook functions. Netfilter's design makes various network-related operations highly flexible and scalable.

[0044] NAT: Network Address Translation, depending on the fields converted, is divided into DNAT (Destination NAT, destination address translation) and SNAT (Source NAT, source address translation).

[0045] Chain: In iptables, a chain is a series of rules that define the checkpoints when a data packet enters, traverses, or leaves the network stack. There are some built-in basic chain types: PreRouting chain, Input chain, Forward chain, PostRouting chain, Output chain, corresponding to the different possible flow directions of data packets to handle the data packets routed through the machine. In addition, users can create custom chains to organize and manage rules.

[0046] When operating data in the network layer, Netfilter will operate on the data at different stages from the five hook points it sets, such as PreRouting, Input, Forward, PostRouting, and Output (when a data packet reaches a hook point, the rules on the chain associated with the hook point will be triggered for processing, and the rules of iptables are actually implemented through hook functions, that is, when reaching a hook point, the hook function corresponding to the hook point is called, and multiple hook functions can be mounted on a hook point. By setting the priority, the calling order of multiple hook functions on each hook point can be determined);

[0047] PreRouting: The data packet just enters the network layer and has not yet been routed. The destination address translation operation is performed here.

[0048] Input: After routing decision, data packets destined for this machine will pass through this point;

[0049] Forward: After the routing decision, the data packets that need to be forwarded by the local machine will pass through this point;

[0050] Output: Data packets sent from this machine will pass through this point;

[0051] PostRouting: Data packets sent from this machine or data packets that need to be forwarded by this machine will pass through this point before leaving the machine, where operations such as source address translation are performed.

[0052] The method of using Netfilter and Iptables to hijack and process data when it passes through the hook point. The hook point selection is after the data packet enters the local machine, there are three possible transmission links according to the flow direction of the data:

[0053] (1) Traffic flowing into this machine: PreRouting—Input;

[0054] (2) Traffic sent by this machine: Output—PostRouting;

[0055] (3) Forwarding traffic: PreRouting—Forward—PostRouting.

[0056] Mark: In the context of iptables, "Mark" is an operation that allows users to mark a packet with a mark that can be referenced in subsequent rules for further processing. The mark itself does not change the packet content, so it is transparent to the transmitted packet. The Mark function is used in conjunction with the mangle table in the Linux kernel, which is used to modify the Quality of Service (QoS) parameters of the packet or for advanced routing decisions. For example, administrators can use Mark to specify that certain packets should take a specific network path or processing queue. This feature is very useful in advanced network configurations such as traffic management, bandwidth allocation, and multipath routing.

[0057] Kernel module: is a component of the Linux kernel that allows kernel functionality to be dynamically added, extended, or removed without restarting the system. These modules can be seen as loadable kernel code fragments that can be inserted into the kernel (loaded) or removed from the kernel (unloaded) while the system is running.

[0058] EIP: Elastic IP Address, an Internet Protocol (IP) address, is a static IP address that can be dynamically assigned to a network interface. It allows users to associate a fixed public IP address with an instance in the cloud, thereby accessing resources in the cloud from the external network.

[0059] In this specification, two data processing methods are provided. This specification also involves two data processing devices, a computing device, a computer-readable storage medium and a computer program product, which are described in detail one by one in the following embodiments.

[0060] See also Figure 1 , Figure 1 A scenario diagram of a data processing method provided according to an embodiment of the present specification is shown.

[0061] The data processing method is applied to a transfer machine, which can be understood as a jump machine or a gateway device for transferring traffic.

[0062] Specifically, the ability of the transit machine to access the public network EIP is based on a specific kernel traffic hijacking system (external access traffic hijacking system). The external access traffic hijacking system hijacks the local machine's external access at the kernel level and forwards it to the system's internal channel for actual communication after special processing.

[0063] In actual applications, the external access traffic hijacking system is deployed on the kernel hook point of Output. Since the traffic sent by the local machine passes through the Output point (the traffic sent by the local machine will pass through link 1 in the figure, the link corresponding to the solid line in the figure), the external access traffic hijacking system deployed on it can process the access to the public network initiated by the local machine. As for the traffic from the outside (such as personal computers in the office network, test servers in the test network, etc.), since it does not belong to the traffic initiated by the relay machine and does not pass through the Output point (the forwarded traffic will pass through link 2 in the figure, the link corresponding to the dotted line in the figure), it cannot be processed normally by the external access traffic hijacking system, and the access to the public network initiated by the relay machine cannot be realized.

[0064] The data processing method provided by the embodiments of the present specification is as follows: when a data sender sends a network access data packet through a network interface, a relay receives the network access data packet sent by the data sender, marks the network access data packet that meets the characteristics of the target data packet, and obtains a marked network access data packet; when it is determined that the marked network access data packet is a public network access data packet, the marked network access data packet is forwarded to a target data sending node (i.e., a PostRouting point); using the target data sending node, the marked network access data packet is sent to a data to-be-sent node (i.e., an Output point); using an external access traffic hijacking system deployed in the data to-be-sent node, the marked network access data packet is sent to a target device corresponding to a target public network, wherein the external access traffic hijacking system is used for public network access.

[0065] The data processing method provided in the embodiments of the present specification can mark the network access data packets that meet the characteristics of the target data packets when receiving the network access data packets sent by the data sender, and hijack the marked network access data packets that access the public network at the target data sending node, and send the hijacked marked network access data packets to the data to be sent node deployed with the external access traffic hijacking system. The data to be sent node receives the network access data packets sent by the relay machine. Therefore, when the marked network access data packets are sent to the data to be sent node, the marked network access data packets are modified into data packets sent by the relay machine, so as to be compatible with the internal external access traffic hijacking system, and the marked network access data packets are sent to the target device corresponding to the target public network by using the external access traffic hijacking system, so that the relay machine can become a universal relay machine that can meet the diverse needs in practical applications.

[0066] See also Figure 2 , Figure 2 A flow chart of a data processing method provided by an embodiment of the present specification is shown, which specifically includes the following steps.

[0067] Specifically, the data processing method is applied to a transfer machine.

[0068] Step 202: Receive a network access data packet sent by a data sender, mark the network access data packet that meets the characteristics of the target data packet, and obtain a marked network access data packet.

[0069] Among them, the data sender can be understood as a device in the intranet environment (such as a computer, server or network device). The intranet environment refers to a private network composed of routers, switches and other network devices. The host in the intranet environment is generally connected to the public network through one or more gateways.

[0070] A network access data packet can be understood as a group of information or data blocks transmitted in a network. The data packet is generated by a source device (such as a computer, server, or network device) and transmitted to a target device through the network.

[0071] The target data packet characteristics can be understood as some specific data packet attribute information. The data packet attribute information includes but is not limited to the data packet's 4-layer protocol number, source IP address, source port number, destination IP address, destination port number and other information. Subsequently, the network access data packets that match the target data packet characteristics are marked, so that the marked network access data packets can be correctly hijacked.

[0072] Marked network access data packets can be understood as network access data packets with a mark, and the marked network access data packets can be hijacked later.

[0073] The relay receives network access data packets sent by devices in the intranet environment, and uses the target data packet characteristics set in the relay to match the received network access data packets, determines whether the network access data packets meet any of the target data packet characteristics, marks the network access data packets that meet the target data packet characteristics, and obtains the marked network access data packets.

[0074] For example, the target data packet characteristics include source IP address 1, destination IP address 2, source port number 3, and destination port number 4. When the source IP address of the network access data packet is source IP address 1, the network access data packet is marked to obtain a marked network access data packet. Subsequently, when the marked network access data packet whose destination IP address is a public network IP address can be hijacked, the hijacked marked network access data packet can be correctly sent to the target device on the public network.

[0075] In one or more embodiments of this specification, by loading the target kernel module provided in the embodiment of this specification in the transfer machine kernel, specific processing logic can be inserted into each kernel hook point, various rules can be set, and the data processing method provided in the embodiment of this specification can be implemented. Specifically, the marking rules at specific points can be set according to the target data packet characteristics defined in the target kernel module. The specific implementation method is as follows:

[0076] The receiving a network access data packet sent by a data sender, marking the network access data packet that meets the characteristics of the target data packet, and obtaining the marked network access data packet includes:

[0077] Loading a target kernel module, and using the target data packet characteristics corresponding to the target kernel module to determine a marking rule for the node to be entered by the data;

[0078] Receive a network access data packet sent by a data sender, send the network access data packet to the node where the data is to enter, and use the marking rule of the node where the data is to enter to mark the network access data packet that meets the characteristics of the target data packet to obtain the marked network access data packet.

[0079] Among them, the target kernel module can be understood as a customized kernel module; the node to be entered by data can be understood as the kernel hook point of PreRouting in the above embodiment (hereinafter referred to as PreRouting point), at which the routing decision has not been made for the network access data packet.

[0080] Marking rules are used to mark network access packets that meet the characteristics of target packets.

[0081] Specifically, the corresponding kernel module code can be written by determining the target data packet characteristics, for example, a hook function is implemented in the kernel module code, and the hook function will be called when the data packet passes a specific point. In the hook function, it is checked whether the data packet meets the predefined target data packet characteristics. If it does, the data packet is marked, and the target kernel module is obtained by compiling the above kernel module code. Of course, in actual applications, the target kernel module can also include other specific functions, which are not limited here.

[0082] In actual applications, by loading the above-mentioned target kernel module into the kernel of the transit machine, the hook function implemented in the target kernel module can be mounted to the PreRouting point, so as to configure the marking rule on the PreRouting chain corresponding to the PreRouting point.

[0083] When the transit machine receives a network access data packet, no matter the destination of the network access data packet is the transit machine itself or forwarded through the transit machine, it must pass through the PreRouting point. By configuring marking rules on the PreRouting chain, it is possible to match the received network access data packets with the characteristics of the target data packets, and mark the network access data packets that meet the characteristics of the target data packets to obtain marked network access data packets. Once the network access data packets are marked, further traffic control operations can be performed based on these marks, such as routing decisions, firewall rule matching, etc.

[0084] The data processing method provided in the embodiment of this specification can configure marking rules in the kernel of the transit machine by loading a custom kernel module, thereby marking network access data packets that meet the characteristics of the target data packets, providing strong support for subsequent data packet processing and flow control.

[0085] In one or more embodiments of the present specification, a feature database can be defined to store target data packet features, so that according to project requirements or upper-level data such as permissions, the user-mode tool can be used to insert the target data packet features of interest into the feature database of the target kernel module. In this way, the feature database can be updated at any time according to actual needs, thereby improving the flexibility of the marking rules. The specific implementation is as follows:

[0086] The step of using the target data packet characteristics corresponding to the target kernel module to determine the marking rule of the node to be entered by the data includes:

[0087] The marking rule of the node to be entered by the data is determined by using the target data packet characteristics in the corresponding characteristic database of the target kernel module, wherein the target data packet characteristics are determined by inserting into the characteristic database of the target kernel module using a user mode tool.

[0088] The feature database may be a data structure in memory (such as a hash table, a linked list, or a tree), or may be a persistent storage (such as a database file), which is not limited here.

[0089] In actual applications, when loading the target kernel module, it is necessary to install the user-space user-space tool that matches the target kernel module for configuration management and status acquisition. According to the upper-layer data, the user-space tool can be used to insert the target data packet features into the feature database of the target kernel module, thereby configuring the marking rules in the PreRouting chain of Iptables to mark the data packets of interest.

[0090] The data processing method provided in the embodiments of this specification can accurately and flexibly configure marking rules according to actual needs by using a user-mode tool to insert target data packet features into a feature database of a target kernel module.

[0091] Step 204: When it is determined that the marked network access data packet is a public network access data packet, the marked network access data packet is forwarded to a target data sending node.

[0092] The public network access data packet can be understood as a data packet used for public network access. The target data sending node can be understood as a kernel hook point of PostRouting (hereinafter referred to as PostRouting point).

[0093] Specifically, when it is determined that the marked network access data packet is a public network access data packet, it can be determined that the marked network access data packet is a forwarding data packet, so the marked network access data packet is sent to the PostRouting point through the PreRouting—Forward—PostRouting link.

[0094] In one or more embodiments of the present specification, at the PreRouting point (i.e., the node where data is to be entered), the destination address conversion can be performed on the network access data packet, and the destination address in the network access data packet can be converted into the destination address of the real destination corresponding to the network access data packet, so that the network access data packet can be correctly forwarded to the next hook point according to the destination address of the real destination. For example, when the destination address of the real destination corresponding to the network access data packet is the IP address of the transit machine, the network access data packet is sent to the Input point, and when the destination address of the real destination corresponding to the network access data packet is not the IP address of the transit machine, the network access data packet is sent to the PostRouting point through the Forward point. The specific implementation is as follows:

[0095] The step of determining that the marked network access data packet is a public network access data packet includes:

[0096] According to the destination address conversion rule, the destination transit machine address of the marked network access data packet is converted into a destination identification address, wherein the data processing method is applied to a transit machine, the transit machine is used to process and forward data packets, the target transit machine address is the identification address of the transit machine, and the data sender sends the network access data packet to the transit machine according to the destination transit machine address;

[0097] In the case where it is determined that the destination identification address of the marked network access data packet is a public network identification address, the marked network access data packet is determined to be a public network access data packet.

[0098] The destination identification address may be understood as a destination address that marks the network access data packet corresponding to the real destination.

[0099] Specifically, the data sender (also known as the access source) initiates access to the public network through the IP address and port exposed by the relay machine. Therefore, when the relay machine receives a network access data packet, the destination address of the network access data packet is the IP address of the relay machine (i.e., the destination relay machine address). For marked network access data packets with a tag, the tag does not change the content of the network access data packet, so the destination address of the marked network access data packet is also the IP address of the relay machine.

[0100] By performing DNAT on the marked network access data packet using various DNAT (destination address translation) conversion rules at the PreRouting point, the destination transit machine address corresponding to the marked network access data packet is converted into a destination identification address. By determining whether the destination identification address is a public network identification address, it can be determined whether the marked network access data packet is a public network access data packet. That is, when the destination identification address is a public network identification address, the marked network access data packet is determined to be a public network access data packet.

[0101] The data processing method provided in the embodiments of this specification performs correct destination address conversion on the marked network access data packet at the PreRouting point, determines the destination identification address corresponding to the marked network access data packet, and thereby accurately determines whether the marked network access data packet is a public network access data packet based on the destination identification address, and subsequently hijacks the public network access data packet, and utilizes the external access traffic hijacking system deployed in the node where the data is to be sent to achieve access to the public network.

[0102] In one or more embodiments of the present specification, at the target data sending node (i.e., PostRouting point), the source identification address of the marked network access data packet is converted to the identification address (IP address) of the transit machine, and the marked network access data packet is simulated as a data packet sent by the transit machine, so that the marked network access data packet is hijacked by the external access traffic hijacking system with the external identification address of the transit machine, thereby achieving access to the public network. The specific implementation method is as follows:

[0103] After forwarding the marked network access data packet to the target data sending node, the method further includes:

[0104] At the target data sending node, the source identification address of the marked network access data packet is converted into a destination transit machine address.

[0105] Specifically, the source identification address of the marked network access data packet is the IP address of the data sender. Since the external access traffic hijacking system hijacks the public network access data packets sent by the transit machine, in order to enable the marked network access data packets to be hijacked by the external access traffic hijacking system, the source identification address of the marked network access data packet needs to be converted into the identification address of the transit machine, so as to simulate the marked network access data packet to be sent by the transit machine.

[0106] The data processing method provided in the embodiments of this specification performs source address translation (SNAT) on marked network access data packets to disguise the IP address and port of the actual data sender, so that the marked network access data packets can be correctly hijacked by the external access traffic hijacking system.

[0107] Step 206: Using the target data sending node, send the marked network access data packet to the data to-be-sent node.

[0108] The node where data is to be sent can be understood as the kernel hook point of the Output (hereinafter referred to as the Output point), through which the traffic sent by the relay machine will pass.

[0109] Specifically, by utilizing the target data sending node, the marked network access data packet is sent to the data to-be-sent node (Output point), so that the marked network access data packet can be hijacked by the external access traffic hijacking system deployed at the Output point and processed correctly.

[0110] In one or more embodiments of the present specification, by loading a target kernel module, a hijacking processing function is registered on the target data sending node, so that when the marked network access data packet flows through the target data sending node and is sent to the network interface, the marked network access data packet with a mark is hijacked by using the hijacking processing function, and the marked network access data packet is forwarded to the node to be sent. The specific implementation is as follows:

[0111] The step of using the target data sending node to send the marked network access data packet to the data to be sent node includes:

[0112] In the process of the marked network access data packet flowing through the target data sending node and being sent to the network interface, the hijacking processing function of the target data sending node is used to hijack the marked network access data packet and send the marked network access data packet to the data to be sent node, wherein the hijacking processing function loads the target kernel module and is registered on the target data sending node.

[0113] The hijacking processing function can be understood as a hook function, which is used to hijack the marked network access data packet and send it to the node where the data is to be sent.

[0114] Specifically, the hook point already exists in the system kernel, and the hook function is registered at the hook point that already exists in the system kernel. Specifically, the kernel has an entry to register the hook function. When the target kernel module is loaded, it will call the hook registration function to register the entry function, hook point, and priority of the target kernel module to the system kernel. When the data packet flows through the hook point, the system kernel will call these hook functions in sequence to process the data packet.

[0115] In actual applications, the hijacking processing function is registered to the PostRouting point by loading the target kernel module, so that when the marked network access data packet flows through the PostRouting point and is sent to the network interface, the hijacking processing function on the PostRouting point is used to hijack the marked network access data packet and send the marked network access data packet to the node where the data is to be sent.

[0116] The data processing method provided in the embodiments of this specification, by registering the hijacking processing function to the PostRouting point, enables the marked network access data packet to be accurately hijacked by the hijacking processing function and sent to the data to be sent node when flowing through the PostRouting point, thereby allowing the marked network access data packet to be correctly hijacked by the external access traffic hijacking system deployed on the data to be sent node.

[0117] In one or more embodiments of this specification, since multiple hook functions can be mounted on a hook point, it is necessary to set a priority for the hook function. When a data packet flows through the hook point, the hook functions are called in sequence according to the priorities of the multiple hook functions to process the data packet. The specific implementation is as follows:

[0118] The method of utilizing the hijacking processing function of the target data sending node to hijack the marked network access data packet and sending the marked network access data packet to the data to be sent node includes:

[0119] Determining a target priority of the hijacking processing function;

[0120] When it is determined that the target data sending node has other processing functions except the hijacking processing function, and the function priority of the other processing functions is higher than the target priority of the hijacking processing function, the marked network access data is processed by using the other processing functions to obtain the target marked network access data;

[0121] According to the target priority, the hijacking processing function of the target data sending node is used to hijack the target mark network access data packet, and the target mark network access data packet is sent to the data to be sent node.

[0122] Among them, the target priority of the hijacking processing function can be the lowest processing priority, that is, at the hook point, the hijacking processing function is called last to hijack the marked network access data packet. The target priority of the hijacking processing function can also be the highest processing priority, that is, at the hook point, the hijacking processing function is called first to hijack the marked network access data packet. Of course, in actual applications, the target priority of the hijacking processing function is set according to actual needs.

[0123] Specifically, when there are other processing functions besides the hijacking processing function at the PostRouting point, the priority relationship between the hijacking processing function and the other processing functions is determined, that is, the target priority of the hijacking processing function is compared with the function priority of other processing functions, and the calling order of multiple processing functions at the hook point is determined according to the priority between the processing functions at the PostRouting point. Therefore, when the function priority of other processing functions is higher than the target priority of the hijacking processing function, the other processing functions are called first, and the marked network access data is processed by the other processing functions to obtain the target marked network access data, and then the hijacking processing function is called according to the target priority, and the hijacking processing function is used to hijack the above-obtained target marked network access data, so as to send the target marked network access data to the node to be sent.

[0124] Taking the target priority of the hijacking processing function as the lowest processing priority as an example, when the marked network access data packet passes through the PostRouting point, at the PostRouting point, other processing functions are first called to process the marked network access data packet, and the hijacking processing function is called with the lowest processing priority, that is, lastly to hijack the marked network access data packet, and the processed target marked network access data packet is simulated as being directly sent out by the transit machine, so that the target marked network access data packet passes through the Output chain and its hook point in the kernel, so that the target marked network access data packet can be hijacked and processed by the external access traffic hijacking system mounted on the kernel.

[0125] The data processing method provided in the embodiments of this specification can ensure that the hijacking processing function is called after the existing hook function by setting the target priority of the hijacking processing function to the lowest processing priority, that is, the hijacking processing function can perform further processing based on the data packets that have been processed by other hook functions without interfering with or destroying the existing network processing flow.

[0126] Step 208: Utilize the external access traffic hijacking system deployed in the node to be sent to send the data, and send the marked network access data packet to the target device corresponding to the target public network, wherein the external access traffic hijacking system is used for public network access.

[0127] The target device may be understood as a device corresponding to a destination identification address corresponding to a marked network access data packet.

[0128] Specifically, when the external access traffic hijacking system is used for public network access, the external access traffic hijacking system is used to send a marked network access data packet to a target device corresponding to the target public network.

[0129] In one or more embodiments of the present specification, the external access traffic hijacking system can hijack a public network access data packet whose source identification address is the identification address of the transit machine. Therefore, when the source identification address of the marked network access data packet is converted to the identification address of the transit machine, the marked network access data packet is modified into a public network access data packet issued by the transit machine, thereby correctly sending the marked network access data packet to the target device corresponding to the destination identification address in the target public network. The specific implementation method is as follows:

[0130] The method of utilizing the external access traffic hijacking system deployed in the data to be sent node to send the marked network access data packet to the target device corresponding to the target public network includes:

[0131] Utilizing the external access traffic hijacking system deployed in the node to be sent out, a marked network access data packet whose source identification address is the identification address of the transfer machine is obtained;

[0132] Sending the marked network access data packet to a target device corresponding to a destination identification address in a target public network;

[0133] Among them, the external access traffic hijacking system is used to hijack the public network access data packet when the public network access data packet flows through the data to be sent node to the target data sending node, and forward the public network access data packet to the target device corresponding to the target public network through an internal channel to achieve public network access.

[0134] Specifically, since the external access traffic hijacking system can hijack the external access of the transit machine at the kernel level and forward it to the channel inside the system after special processing to realize actual communication, when the external access traffic hijacking system determines whether the network access data packet is sent by the transit machine based on whether the source identification address of the network access data packet is the identification address of the transit machine, the source identification address of the marked network access data packet is converted into the identification address of the transit machine. This can achieve that on the basis of sending the marked network access data packet to the node where the data is to be sent, the external access traffic hijacking system deployed at the node where the data is to be sent can correctly hijack it, that is, through the external access traffic hijacking system, the marked network access data packet whose source identification address is the identification address of the transit machine is obtained, and then the internal channel of the external access traffic hijacking system is used to send the marked network access data packet to the target device corresponding to the destination identification address in the target public network.

[0135] In actual applications, the destination address of the marked network access data packet is converted at the node where the data is to enter, and the destination identification address of the marked network access data packet is determined. Therefore, when the marked network access data packet is sent to the target public network, the destination identification address of the marked network access data packet can be used to correctly send it to the target device of the destination identification address.

[0136] The data processing method provided in the embodiments of this specification can modify the marked network access data packets into public network access data packets issued by the transit machine by performing source address conversion on the marked network access data packets in the previous step, so that at the node where the data is to be sent, the external access traffic hijacking system deployed therein can accurately hijack the marked network access data packets and correctly send the marked network access data packets to the target device of the destination identification address.

[0137] The data processing method provided in the embodiments of this specification is that since external devices (devices other than the relay machine, such as personal computers in the office network, test servers in the test network, etc.) cannot access the public network through the relay machine, the relay machine can hijack the local machine's access to the external public network at the kernel level through the external access traffic hijacking system and forward it to the channel inside the system after special processing to achieve actual communication; therefore, the network access data packets sent by the external side that are of interest can be marked, and the marked network access data packets with marks that access the public network can be hijacked, and the hijacked marked network access data packets can be sent to the hook point where the external access traffic hijacking system is deployed, so as to modify the marked network access data packets into data packets sent by the relay machine, thereby being compatible with the internal external access traffic hijacking system, and using the external access traffic hijacking system to send the marked network access data packets to the target device corresponding to the target public network, so that the relay machine can become a universal relay machine that can meet the diverse needs in actual applications.

[0138] See also Figure 3 , Figure 3 A flowchart of another data processing method provided by an embodiment of the present specification is shown, which specifically includes the following steps.

[0139] Specifically, the data processing method is also applied to a relay machine. The data processing method is applied to a scenario where an external access traffic hijacking system hijacks traffic to complete access to a public network, and a response encapsulated data packet of the public network arrives at the relay machine.

[0140] Step 302: Receive a response encapsulated data packet sent by a target device corresponding to a target public network, and send the response encapsulated data packet to a target entry node, wherein the response encapsulated data packet is generated by processing a marked network access data packet by the target device, and the marked network access data packet is determined according to the above-mentioned data processing method.

[0141] Among them, the target entry node can be understood as the kernel hook point of Input (hereinafter referred to as Input point).

[0142] Specifically, since the marked network access data packet converts the source identification address into the identification address of the relay machine, after the access to the public network is completed by hijacking the traffic through the external access traffic hijacking system, the destination identification address corresponding to the response encapsulation data packet of the public network is the identification address of the relay machine.

[0143] The response encapsulated data packet sent by the target device corresponding to the target public network is received through the network interface (network card). After the response encapsulated data packet is processed by the PreRouting chain corresponding to the PreRouting point, it is determined that the response encapsulated data packet is a data packet sent to the transit machine. Therefore, according to the PreRouting—Input link, the response encapsulated data packet is sent to the Input point.

[0144] Step 304: utilizing the external access traffic hijacking system deployed at the target entry node to parse the response encapsulated data packet and obtain a response data packet.

[0145] The response data packet can be understood as the original communication data packet obtained by parsing the response encapsulated data packet and can be processed by the relay machine.

[0146] Utilize the external access traffic hijacking system deployed at the Input point to correctly capture the response encapsulated data packets and parse and process them, so that the response encapsulated data packets can be restored to the original communication data packets that can be processed by the transit machine, and strip or restore the modifications made to the data packets by the external access traffic hijacking system.

[0147] Step 306: When it is determined that the response data packet meets the characteristics of the target data packet, the response data packet is sent to the data sender according to the attribute information of the response data packet.

[0148] The attribute information of the response data packet may be understood as the destination IP address of the response data packet.

[0149] Specifically, by loading the target kernel module, response data packets that meet the target data packet characteristics in the feature database of this target kernel module are hijacked at the input point with the lowest processing priority. These response data packets are generated in response to the network access data packets sent by the data sender. Therefore, the destination IP address of the response data packet is the IP address of the data sender. The response data packet is sent to the data sender through the destination IP address of the response data packet.

[0150] In one or more embodiments of the present specification, since the response data packet that meets the target data packet characteristics will be returned to the data sender, and the link for sending the response data packet to the data sender is different from the link for sending the response data packet to the relay, the response data packet that meets the target data packet characteristics is resent to the in-queue of the network interface, so that the response data packet that meets the target data packet characteristics is sent to the data sender according to the link for sending the response data packet to the data sender. The specific implementation is as follows:

[0151] When it is determined that the response data packet meets the characteristics of the target data packet, sending the response data packet to the data sender according to the attribute information of the response data packet includes:

[0152] In the case where it is determined that the response data packet meets the target data packet characteristics, sending the response data packet to an in-queue of the network interface;

[0153] When the response data packet is obtained from the incoming queue of the network interface, restoring the destination identification address of the response data packet back to the initial identification address;

[0154] According to the initial identification address, the response data packet is sent to a data sender corresponding to the initial identification address.

[0155] The destination identification address of the response data packet can be understood as the destination IP address of the response data packet, and the initial identification address can be understood as the IP address of the data sender.

[0156] Specifically, when it is determined that the response data packet meets the characteristics of the target data packet, the response data packet is re-added to the in-queue of the network interface so that the response data packet looks the same as it has just been received. At this time, the response data packet will be processed again by the PreRouting chain on the PreRouting point, and the destination address conversion is performed on the response data packet at the PreRouting point. The destination IP address of the response data packet is restored to the IP address of the data sender, and then passed through the Forward-PostRouting link, and finally the response data packet is correctly sent to the data sender based on the IP address of the data sender.

[0157] The data processing method provided in the embodiment of this specification receives a response encapsulated data packet sent by a target device corresponding to a target public network, and sends the response encapsulated data packet to a target entry node. At the target entry node, the response encapsulated data packet is parsed using an external access traffic hijacking system deployed at the target entry node to obtain a response data packet that can be processed by a relay machine. For a response data packet that meets the characteristics of a target data packet, it can be determined that it is a response data packet corresponding to a network access data packet sent by a data sender. Therefore, the response data packet is correctly sent to the data sender using the attribute information of the response data packet. This achieves that, based on the above-mentioned data processing method being able to modify the external traffic of concern into traffic sent by this machine, the data processing method can correctly process the reply traffic returned by the external public network, is compatible with the internal external access traffic hijacking system, and enables the relay machine to become a universal jump server or access gateway.

[0158] See also Figure 4 , Figure 4 A schematic diagram of a processing process of a data processing method provided by an embodiment of this specification is shown.

[0159] Specifically, the data processing method is applied to a scenario where an intranet device initiates access to a public network.

[0160] Pre-configuration phase:

[0161] Install the target kernel module in the kernel according to the project configuration. The target kernel module manages the internal configuration, inserts special processing logic at each kernel hook point, and installs the corresponding user space user mode tools for configuration management and status acquisition.

[0162] According to the upper-level data such as projects and permissions, user-mode tools are used to insert the target packet features (such as 4-layer protocol number, source IP address, source port, destination IP address, and destination port information) of the packet of interest into the feature database of the target kernel module.

[0163] On the PreRouting chain, the Mark rule is configured according to the target data packet characteristics in the feature database (i.e., the marking rule in the above embodiment, if any feature in the feature information corresponding to the data packet meets the target data packet characteristics, the data packet is marked), and at the kernel hook point corresponding to the PostRouting chain, the traffic hijacking system with the lowest processing priority is configured.

[0164] Specific processing process:

[0165] The relay machine receives a network access data packet sent by an access source (i.e., the data sender in the above embodiment) through a network interface. The network access data packet is a data packet corresponding to the access source's request to access the public network, and the destination IP address of the network access data packet is the IP address of the relay machine, that is, the access source initiates access to the public network through the IP address and port exposed by the relay machine.

[0166] When the network interface receives a network access data packet, the network access data packet enters the network stack, that is, a series of protocol layers used by the operating system to process network communications (such as the layers in the TCP / IP model). Specifically, in the network stack, the network access data packet is first sent to the kernel hook point corresponding to PreRouting. In the PreRouting chain, the network access data packet is marked using the marking rule, that is, the network access data packet that meets the marking rule is actually marked in the PreRouting chain to obtain a marked network access data packet. Various DNAT processes may exist in each system on the PreRouting chain. For example, in the embodiment of this specification, the destination IP address of the marked network access data packet is converted into an actual destination IP address according to the destination address conversion rule. The actual destination IP address is the IP address of the target device in the public network that the access source wants to access.

[0167] By marking the actual destination IP address corresponding to the marked network access data packet, it can be determined that the marked network access data packet is a public network access data packet. The marked network access data packet is forwarded to the PostRouting chain through Forward. In the PostRouting chain, each system may have various SNAT processing. In the embodiment of this specification, the source IP address of the marked network access data packet is converted into the IP address of the transit machine.

[0168] At the kernel hook point corresponding to the PostRouting chain, the marked network access data packet is hijacked according to the lowest processing priority and using the traffic hijacking system provided in the embodiment of this specification (i.e., the hijacking processing function in the above embodiment), and the hijacked marked network access data packet is sent to the Output chain and its hook point in the kernel.

[0169] An external access traffic hijacking system is deployed at the Output point, which hijacks marked network access data packets to achieve access to the public network.

[0170] The data processing method provided in the embodiments of this specification can mark the network access data packets sent externally that are of concern, hijack the marked network access data packets that access the public network, and send the hijacked marked network access data packets to the hook point where the external access traffic hijacking system is deployed, so as to modify the marked network access data packets into data packets sent by the relay machine, thereby being compatible with the internal external access traffic hijacking system, and using the external access traffic hijacking system to send the marked network access data packets to the target device corresponding to the target public network, so that the relay machine can become a universal relay machine that can meet the diverse needs in actual applications.

[0171] See also Figure 5 , Figure 5 A schematic diagram of the processing process of another data processing method provided by an embodiment of this specification is shown.

[0172] Specifically, the data processing method is applied to a scenario where a response from a public network is returned to a relay machine.

[0173] Pre-configuration phase:

[0174] Insert the target data packet features corresponding to the data packets of interest into the feature database of the target kernel module; and configure the traffic hijacking system with a lower priority than the external access traffic hijacking system at the kernel hook point corresponding to the Input chain.

[0175] Specific processing process:

[0176] The relay machine receives the response encapsulated data packets returned from the public network through the network interface. The destination IP address of these response encapsulated data packets is the IP address of the relay machine. Through the PreRouting chain, the response encapsulated data packets are sent to the Input chain.

[0177] In the Input chain, the external access traffic hijacking system is used to hijack the response encapsulated data packets, and the response encapsulated data packets are restored to response data packets that can be processed by the transit machine.

[0178] At the kernel hook point corresponding to the Input chain, the traffic hijacking system provided in the embodiment of this specification (implemented using the hijacking processing function) is used to hijack the response data packets that meet the characteristics of the target data packets in the feature database, and the hijacked response data packets are re-added to the in-queue of the network interface, so that these response data packets are processed again by the PreRouting chain.

[0179] In the PreRouting chain, the destination IP address of the response data packet is converted into the IP address of the access source according to the destination address translation rule, and after being processed by the Forward and PostRouting chains, the response data packet is correctly returned to the access source.

[0180] The data processing method provided in the embodiment of this specification receives a response encapsulated data packet sent by a target device corresponding to a target public network, and sends the response encapsulated data packet to a target entry node. At the target entry node, the response encapsulated data packet is parsed using an external access traffic hijacking system deployed at the target entry node to obtain a response data packet that can be processed by a relay machine. For a response data packet that meets the characteristics of a target data packet, it can be determined that it is a response data packet corresponding to a network access data packet sent by a data sender. Therefore, the response data packet is correctly sent to the data sender using the attribute information of the response data packet. This achieves that, based on the above-mentioned data processing method being able to modify the external traffic of concern into traffic sent by this machine, the data processing method can correctly process the reply traffic returned by the external public network, is compatible with the internal external access traffic hijacking system, and enables the relay machine to become a universal jump server or access gateway.

[0181] Corresponding to the above method embodiment, this specification also provides a data processing device embodiment, Figure 6 FIG. 1 is a schematic diagram showing the structure of a data processing device provided by an embodiment of the present specification. Figure 6 As shown, the device comprises:

[0182] The receiving module 602 is configured to receive a network access data packet sent by a data sender, mark the network access data packet that meets the characteristics of the target data packet, and obtain a marked network access data packet;

[0183] The forwarding module 604 is configured to forward the marked network access data packet to a target data sending node when determining that the marked network access data packet is a public network access data packet;

[0184] The hijacking module 606 is configured to utilize the target data sending node to send the marked network access data packet to the data to-be-sent node;

[0185] The sending module 608 is configured to utilize the external access traffic hijacking system deployed in the node to be sent to send the marked network access data packet to the target device corresponding to the target public network, wherein the external access traffic hijacking system is used for public network access.

[0186] Optionally, the receiving module 602 is further configured to:

[0187] Loading a target kernel module, and using the target data packet characteristics corresponding to the target kernel module to determine a marking rule for the node to be entered by the data;

[0188] Receive a network access data packet sent by a data sender, send the network access data packet to the node where the data is to enter, and use the marking rule of the node where the data is to enter to mark the network access data packet that meets the characteristics of the target data packet to obtain the marked network access data packet.

[0189] Optionally, the forwarding module 604 is further configured to:

[0190] According to the destination address conversion rule, the destination transit machine address of the marked network access data packet is converted into a destination identification address, wherein the data processing method is applied to a transit machine, the transit machine is used to process and forward data packets, the target transit machine address is the identification address of the transit machine, and the data sender sends the network access data packet to the transit machine according to the destination transit machine address;

[0191] In the case where it is determined that the destination identification address of the marked network access data packet is a public network identification address, the marked network access data packet is determined to be a public network access data packet.

[0192] The device further includes: a conversion module configured to convert the source identification address of the marked network access data packet into a destination transit machine address at the target data sending node.

[0193] Optionally, the hijacking module 606 is further configured to:

[0194] In the process of the marked network access data packet flowing through the target data sending node and being sent to the network interface, the hijacking processing function of the target data sending node is used to hijack the marked network access data packet and send the marked network access data packet to the data to be sent node, wherein the hijacking processing function loads the target kernel module and is registered on the target data sending node.

[0195] Optionally, the hijacking module 606 is further configured to:

[0196] Determining a target priority of the hijacking processing function;

[0197] When it is determined that the target data sending node has other processing functions except the hijacking processing function, and the function priority of the other processing functions is higher than the target priority of the hijacking processing function, the marked network access data is processed by using the other processing functions to obtain the target marked network access data;

[0198] According to the target priority, the hijacking processing function of the target data sending node is used to hijack the target mark network access data packet, and the target mark network access data packet is sent to the data to be sent node.

[0199] Optionally, the sending module 608 is further configured to:

[0200] Utilizing the external access traffic hijacking system deployed in the node to be sent out, obtaining a marked network access data packet whose source identification address is the identification address of the transfer machine;

[0201] Sending the marked network access data packet to a target device corresponding to a destination identification address in a target public network;

[0202] Among them, the external access traffic hijacking system is used to hijack the public network access data packet when the public network access data packet flows through the data to be sent node to the target data sending node, and forward the public network access data packet to the target device corresponding to the target public network through an internal channel to achieve public network access.

[0203] Optionally, the receiving module 602 is further configured to:

[0204] The marking rule of the node to be entered by the data is determined by using the target data packet characteristics in the corresponding characteristic database of the target kernel module, wherein the target data packet characteristics are determined by inserting into the characteristic database of the target kernel module using a user mode tool.

[0205] The data processing device provided in the embodiments of the present specification can mark the network access data packets sent from the outside that are of concern, hijack the marked network access data packets with the marks that access the public network, and send the hijacked marked network access data packets to the hook point where the external access traffic hijacking system is deployed, so as to modify the marked network access data packets into data packets sent by the relay machine, so as to be compatible with the internal external access traffic hijacking system, and use the external access traffic hijacking system to send the marked network access data packets to the target device corresponding to the target public network, so that the relay machine can become a universal relay machine that can meet the diverse needs in practical applications.

[0206] The above is a schematic scheme of a data processing device of this embodiment. It should be noted that the technical scheme of the data processing device and the technical scheme of the above data processing method belong to the same concept, and the details not described in detail in the technical scheme of the data processing device can be referred to the description of the technical scheme of the above data processing method.

[0207] Corresponding to the above method embodiment, this specification also provides another data processing device embodiment, Figure 7FIG. 2 shows a schematic diagram of the structure of another data processing device provided by an embodiment of the present specification. Figure 7 As shown, the device comprises:

[0208] The receiving module 702 is configured to receive a response encapsulated data packet sent by a target device corresponding to a target public network, and send the response encapsulated data packet to a target entry node, wherein the response encapsulated data packet is generated by the target device processing a marked network access data packet, and the marked network access data packet is determined according to the above-mentioned data processing method;

[0209] The parsing module 704 is configured to parse the response encapsulated data packet using the external access traffic hijacking system deployed by the target entry node to obtain a response data packet;

[0210] The sending module 706 is configured to send the response data packet to the data sender according to the attribute information of the response data packet when it is determined that the response data packet meets the target data packet characteristics.

[0211] Optionally, the sending module 706 is further configured to:

[0212] In the case where it is determined that the response data packet meets the target data packet characteristics, sending the response data packet to an in-queue of the network interface;

[0213] When the response data packet is obtained from the incoming queue of the network interface, restoring the destination identification address of the response data packet back to the initial identification address;

[0214] According to the initial identification address, the response data packet is sent to a data sender corresponding to the initial identification address.

[0215] The data processing device provided in the embodiment of the present specification receives a response encapsulated data packet sent by a target device corresponding to a target public network, and sends the response encapsulated data packet to a target entry node. At the target entry node, the response encapsulated data packet is parsed by using an external access traffic hijacking system deployed at the target entry node to obtain a response data packet that can be processed by a relay machine. For a response data packet that meets the characteristics of a target data packet, it can be determined that it is a response data packet corresponding to a network access data packet sent by a data sender. Therefore, the response data packet is correctly sent to the data sender using the attribute information of the response data packet, thereby achieving that on the basis of using the above-mentioned data processing method to modify the external traffic of concern to be sent by this machine, the present data processing method can correctly process the reply traffic returned by the external public network, and is compatible with the internal external access traffic hijacking system, so that the relay machine can become a universal jump server or access gateway.

[0216] The above is a schematic scheme of a data processing device of this embodiment. It should be noted that the technical scheme of the data processing device and the technical scheme of the above data processing method belong to the same concept, and the details of the technical scheme of the data processing device that are not described in detail can be referred to the description of the technical scheme of the above data processing method.

[0217] Figure 8 The structure block diagram of a computing device 800 provided according to an embodiment of the present specification is shown. The components of the computing device 800 include but are not limited to a memory 810 and a processor 820. The processor 820 is connected to the memory 810 via a bus 830, and the database 850 is used to store data.

[0218] The computing device 800 also includes an access device 840 that enables the computing device 800 to communicate via one or more networks 860. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 840 may include one or more of any type of network interface (e.g., a network interface card (NIC)) of wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a world-wide interoperability for microwave access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, and a near field communication (NFC).

[0219] In one embodiment of the present specification, the above components of the computing device 800 and Figure 8 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 8 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0220] The computing device 800 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 800 may also be a mobile or stationary server.

[0221] The processor 820 is used to execute the following computer program / instructions, which implement the steps of the above-mentioned data processing method when executed by the processor.

[0222] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computing device embodiment, since it is basically similar to the data processing method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the data processing method embodiment.

[0223] An embodiment of the present specification further provides a computer-readable storage medium storing a computer program / instruction, which implements the steps of the above-mentioned data processing method when executed by a processor.

[0224] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computer-readable storage medium embodiment, since it is basically similar to the data processing method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the data processing method embodiment.

[0225] An embodiment of the present specification also provides a computer program product, including a computer program / instruction, which implements the steps of the above data processing method when executed by a processor.

[0226] The above is a schematic scheme of a computer program product of this embodiment. It should be noted that the technical scheme of the computer program product and the technical scheme of the above data processing method belong to the same concept, and the details not described in detail in the technical scheme of the computer program product can be referred to the description of the technical scheme of the above data processing method.

[0227] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0228] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0229] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0230] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0231] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A data processing method, applied to a transfer machine, wherein the transfer machine is used to process and forward data packets, comprising: Receiving a network access data packet sent by a data sender, marking the network access data packet that meets the characteristics of the target data packet, and obtaining a marked network access data packet; When it is determined that the marked network access data packet is a public network access data packet, forwarding the marked network access data packet to a target data sending node, wherein the target data sending node is a kernel hook point of PostRouting set in the Linux kernel; In the process of the marked network access data packet flowing through the target data sending node and being sent to the network interface, the marked network access data packet is hijacked by using the hijacking processing function of the target data sending node, and the marked network access data packet is sent to the data to be sent node, The data to be sent node is a kernel hook point of Output set in the Linux kernel, and the hijacking processing function is used to hijack the marked network access data packet and send it to the data to be sent node by loading the target kernel module and registering it on the target data sending node, so that the marked network access data packet can be hijacked by the external access traffic hijacking system deployed on the data to be sent node; The external access traffic hijacking system deployed in the node to be sent is used to send the marked network access data packet to the target device corresponding to the target public network, wherein the external access traffic hijacking system is used for public network access.

2. The data processing method according to claim 1, wherein receiving a network access data packet sent by a data sender, marking the network access data packet that meets the characteristics of the target data packet, and obtaining the marked network access data packet comprises: Loading a target kernel module, and using the target data packet characteristics corresponding to the target kernel module to determine a marking rule for the node to be entered by the data; Receive a network access data packet sent by a data sender, send the network access data packet to the node where the data is to enter, and use the marking rule of the node where the data is to enter to mark the network access data packet that meets the characteristics of the target data packet to obtain the marked network access data packet.

3. The data processing method according to claim 1, wherein determining that the marked network access data packet is a public network access data packet comprises: According to the destination address conversion rule, the destination transfer machine address of the marked network access data packet is converted into a destination identification address, wherein the destination transfer machine address is the identification address of the transfer machine, and the data sender sends the network access data packet to the transfer machine according to the destination transfer machine address; In the case where it is determined that the destination identification address of the marked network access data packet is a public network identification address, the marked network access data packet is determined to be a public network access data packet.

4. The data processing method according to claim 1, after forwarding the marked network access data packet to the target data sending node, further comprising: At the target data sending node, the source identification address of the marked network access data packet is converted into a destination transit machine address.

5. The data processing method according to claim 1, wherein the hijacking processing function of the target data sending node is used to hijack the marked network access data packet and send the marked network access data packet to the data to be sent node, comprising: Determining a target priority of the hijacking processing function; When it is determined that the target data sending node has other processing functions except the hijacking processing function, and the function priority of the other processing functions is higher than the target priority of the hijacking processing function, the marked network access data is processed by using the other processing functions to obtain the target marked network access data; According to the target priority, the hijacking processing function of the target data sending node is used to hijack the target mark network access data packet, and the target mark network access data packet is sent to the data to be sent node.

6. The data processing method according to claim 1, wherein the step of utilizing the external access traffic hijacking system deployed in the node to be sent data to send the marked network access data packet to the target device corresponding to the target public network comprises: Utilizing the external access traffic hijacking system deployed in the node to be sent out, a marked network access data packet whose source identification address is the identification address of the transfer machine is obtained; Sending the marked network access data packet to a target device corresponding to a destination identification address in a target public network; Among them, the external access traffic hijacking system is used to hijack the public network access data packet when the public network access data packet flows through the data to be sent node to the target data sending node, and forward the public network access data packet to the target device corresponding to the target public network through an internal channel to achieve public network access.

7. The data processing method according to claim 2, wherein the step of determining a marking rule for a node to be entered by using the target data packet characteristics corresponding to the target kernel module comprises: The marking rule of the node to be entered by the data is determined by using the target data packet characteristics in the corresponding characteristic database of the target kernel module, wherein the target data packet characteristics are determined by inserting into the characteristic database of the target kernel module using a user mode tool.

8. A data processing method, comprising: Receiving a response encapsulated data packet sent by a target device corresponding to a target public network, and sending the response encapsulated data packet to a target entry node, wherein the response encapsulated data packet is generated by processing a marked network access data packet by the target device, and the marked network access data packet is sent to the target device corresponding to the target public network by the data processing method of claim 1; Utilizing the external access traffic hijacking system deployed at the target entry node, the response encapsulated data packet is parsed to obtain a response data packet; When it is determined that the response data packet meets the characteristics of the target data packet, the response data packet is sent to the data sender according to the attribute information of the response data packet.

9. The data processing method according to claim 8, when it is determined that the response data packet meets the characteristics of the target data packet, sending the response data packet to the data sender according to the attribute information of the response data packet, comprising: In the case where it is determined that the response data packet meets the target data packet characteristics, sending the response data packet to an in-queue of the network interface; When the response data packet is obtained from the incoming queue of the network interface, restoring the destination identification address of the response data packet back to the initial identification address; According to the initial identification address, the response data packet is sent to a data sender corresponding to the initial identification address.

10. A data processing device, applied to a transfer machine, the transfer machine is used to process and forward data packets, comprising: A receiving module is configured to receive a network access data packet sent by a data sender, mark the network access data packet that meets the characteristics of the target data packet, and obtain a marked network access data packet; a forwarding module configured to forward the marked network access data packet to a target data sending node when determining that the marked network access data packet is a public network access data packet, wherein the target data sending node is a kernel hook point of PostRouting set in the Linux kernel; The hijacking module is configured to hijack the marked network access data packet by using the hijacking processing function of the target data sending node during the process of the marked network access data packet flowing through the target data sending node and being sent to the network interface, and send the marked network access data packet to the data to-be-sent node, wherein the data to-be-sent node is a kernel hook point of Output set in the Linux kernel, and the hijacking processing function is used to hijack the marked network access data packet and send it to the data to-be-sent node by loading the target kernel module and registering it on the target data sending node, so that the marked network access data packet can be hijacked by the external access traffic hijacking system deployed on the data to-be-sent node; The sending module is configured to utilize the external access traffic hijacking system deployed in the node to be sent to send the marked network access data packet to the target device corresponding to the target public network, wherein the external access traffic hijacking system is used for public network access.

11. A data processing device, comprising: A receiving module, configured to receive a response encapsulated data packet sent by a target device corresponding to a target public network, and send the response encapsulated data packet to a target entry node, wherein the response encapsulated data packet is generated by the target device processing a marked network access data packet, and the marked network access data packet is sent to the target device corresponding to the target public network through the data processing method of claim 1; A parsing module is configured to parse the response encapsulated data packet using the external access traffic hijacking system deployed by the target entry node to obtain a response data packet; The sending module is configured to send the response data packet to the data sender according to the attribute information of the response data packet when it is determined that the response data packet meets the characteristics of the target data packet.

12. A computing device comprising: Memory and processor; The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions. When the computer program / instructions are executed by the processor, the steps of the data processing method according to any one of claims 1 to 9 are implemented.

13. A computer-readable storage medium storing a computer program / instruction, wherein the computer program / instruction, when executed by a processor, implements the steps of the data processing method according to any one of claims 1 to 9.

14. A computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the data processing method according to any one of claims 1 to 9.

Images