PLD-based network flow legality verification and encryption communication system and method

Abstract

The invention relates to the technical field of network flow verification, and discloses a PLD-based network flow legality verification and encryption communication system and method, and the system comprises a definition programming module which carries out the self-definition of a rule stored in a local library, so as to form a target rule; the storage module is formed by adopting a memory of a central processing unit (CPU) of a NumA framework and is used for buffering data packets transmitted by a network, and the data packets comprise logs; the matching module is used for checking the transmitted data packet based on the target rule so as to form a detection result and output the detection result; and the verification module is used for carrying out verification according to the target rule based on the output detection result, and if the result is unique. According to the method, through flexible rule definition, a dynamic encryption strategy, efficient legality verification and optimized data interaction efficiency, the security and reliability of data interaction are remarkably improved, and a more comprehensive and effective security guarantee is provided for computer data interaction.

Description

Technical Field

[0001] The present invention relates to the technical field of network flow validation, and in particular to a PLD-based network flow legality validation and encryption communication system and method. Background Art

[0002] When data is exchanged through computers, it is necessary to encrypt the data. The encryption form is relatively simple and cannot be changed dynamically. Therefore, when access is cracked, it is easy for viruses and other software to actively obtain information, resulting in data loss and leakage. Summary of the invention

[0003] The purpose of the present invention is to provide a PLD-based network traffic legitimacy verification and encryption communication system and method for solving the above problems.

[0004] In order to achieve the above object, the present invention provides the following technical solutions:

[0005] A PLD-based network traffic legitimacy verification and encryption communication system, comprising:

[0006] Define programming modules to customize the rules stored in the local library to form target rules;

[0007] A storage module, formed by the memory of a CPU of a NumA architecture, for buffering data packets transmitted over a network, wherein the data packets include logs;

[0008] A matching module performs inspection processing on the data packet in transmission based on the target rule to form a detection result output;

[0009] The validation module performs a validation based on the output detection result according to the target rule. If the result is unique, the result is established and feedback is given;

[0010] The encryption module encrypts and stores the returned data according to the feedback and in combination with the target rules.

[0011] Preferably, the matching module includes:

[0012] The running machine loading unit loads and obtains the command of the target rule, generates a matching library and an instruction respectively, and matches the unique matching library with the unique instruction;

[0013] A keyword search unit matches the log in the data packet based on the acquired unique matching library, and groups the matching results into sets to form a plurality of sets;

[0014] The missing validation unit performs validation based on the fact that the multiple sets are located in the expert library, and based on the validation results, performs a validity check on the non-set fields in the two adjacent sets, and forms a matching rule in the passed state, and updates the matching rule to the local library memory rule corresponding to the target rule line number for replacement.

[0015] Preferably, the verification module includes:

[0016] A judgment unit, located on a virtual machine, runs a new rule generated by replacing the target rule, re-executes the data packet according to the new rule to form a key data feature matching the target data flow, and performs a marking process on the target data flow to form a marked data flow;

[0017] The detection unit determines that the data packet matches the marked data flow and flows into the local library through the new rule, and determines that the data packet inspection is passed.

[0018] A PLD-based network traffic legitimacy verification and encryption communication method, used to implement the PLD-based network traffic legitimacy verification and encryption communication system described in the above scheme, includes the following steps:

[0019] S01, loading and running the new rules in the local library based on the acquisition;

[0020] S02, parsing the data packets of the buffered network transmission cached in the local library to obtain the logs in the data packets;

[0021] S03, based on obtaining the log and the new rule, running and giving the execution result;

[0022] S04. Based on the execution result, determine whether the feedback data needs to be encrypted.

[0023] Preferably, the generation of new rules in the local library in step S01 includes:

[0024] S11. Customize the rules stored in the local library according to the requirements to form target rules;

[0025] S12, loading the command of the target rule, generating a matching library and an instruction respectively, and making a unique matching library correspond to a unique instruction, thereby forming multiple combinations;

[0026] S13. Verify that the multiple sets are located in the expert database, and based on the verification results, perform a validity check on the non-set fields in the two adjacent sets, and form a matching rule in the passed state, and update the matching rule to the local database memory rule corresponding to the target rule line number for replacement.

[0027] Preferably, the step S02 of parsing the data packets of the buffered network transmission cached in the local library comprises:

[0028] S21, analyzing the data packet to obtain the number of lines and characters of the log;

[0029] S22: Match the characters of the log based on the obtained matching library, and generate a set of log line numbers corresponding to the characters of the matching library.

[0030] Preferably, the feedback data is encrypted in step S04 by generating an authentication key for the public key through a digital string within the target rule.

[0031] In the above technical scheme, a PLD-based network traffic legitimacy verification and encryption communication system and method provided by the present invention has the following beneficial effects: it can dynamically adjust the encryption method based on the target rules, thereby improving the flexibility and adaptability of encryption. When the access rules or security requirements change, the system can easily update the target rules and adjust the encryption strategy accordingly, and re-execute the new rules to mark the data packets, thereby ensuring the legitimacy and correctness of the data packets and avoiding system crashes or data loss caused by data errors or illegal access. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0033] Figure 1 A schematic diagram of a module provided by an embodiment of the present invention;

[0034] Figure 2 A schematic diagram of a matching module provided in an embodiment of the present invention;

[0035] Figure 3 A schematic diagram of a verification module provided by an embodiment of the present invention;

[0036] Figure 4 A flowchart provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] Embodiment 1

[0039] like Figure 1-3 As shown, a PLD-based network traffic legitimacy verification and encryption communication system includes:

[0040] Define programming modules to customize the rules stored in the local library to form target rules;

[0041] The storage module is formed by the memory of the CPU of the NumA architecture and is used to buffer data packets transmitted over the network, including logs;

[0042] The matching module performs inspection and processing on the transmitted data packets based on the target rules to form the detection result output;

[0043] The validation module performs a test based on the output test results and the target rules. If the result is unique, the result is established and feedback is given.

[0044] The encryption module encrypts and stores the returned data based on the feedback and target rules.

[0045] The matching module includes:

[0046] The running machine loading unit loads and obtains the command of the target rule, generates a matching library and an instruction respectively, and matches the unique matching library with the unique instruction;

[0047] A keyword search unit matches the logs in the data packet based on the acquired unique matching library, and groups the matching results into sets to form a plurality of sets;

[0048] The missing validation unit performs validation based on the multiple sets located in the expert library, and based on the validation results, performs a validity check on the non-set fields in the two adjacent sets, and forms a matching rule in the passed state, and updates the matching rule to the corresponding target rule row number in the local library memory rule for replacement.

[0049] The validation module includes:

[0050] A judgment unit, located on a virtual machine, runs a new rule generated by replacing a target rule, re-executes the data packet according to the new rule, forms a key data feature that matches a target data flow, and performs a marking process on the target data flow to form a marked data flow;

[0051] The detection unit, the data packet matching mark data flow flows into the local library through the new rules, and determines that the data packet inspection has passed.

[0052] Embodiment 2

[0053] like Figure 4 As shown, based on the above embodiment, this example includes the following steps:

[0054] S01, loading and running the new rules in the local library based on the acquisition;

[0055] S02, parsing the data packets of the buffered network transmission cached in the local library to obtain the logs in the data packets;

[0056] S03, run based on the acquired log and new rules, and give the execution result;

[0057] S04. Based on the execution result, determine whether the feedback data needs to be encrypted.

[0058] Furthermore, the generation of new rules in the local library in step S01 includes:

[0059] S11. Customize the rules stored in the local library according to the requirements to form target rules;

[0060] S12, loading the command of the target rule, generating a matching library and an instruction respectively, and matching the unique matching library with the unique instruction, thereby forming multiple combinations;

[0061] S13. Verify that multiple sets are located in the expert database, and based on the verification results, perform a validity check on the non-set fields in two adjacent sets, and form a matching rule in the passed state, and update the matching rule to the corresponding target rule row number in the local database memory rule for replacement.

[0062] Wherein, step S02 of parsing the data packets of the buffered network transmission cached in the local library includes:

[0063] S21, analyzing the data packet to obtain the number of lines and characters of the log;

[0064] S22: Match the characters of the log based on the obtained matching library, and generate a set of log line numbers corresponding to the characters of the matching library.

[0065] Furthermore, in step S04, the feedback data is encrypted by generating a certification key for the public key through a digital string within the target rule.

[0066] The above technology can dynamically adjust the encryption method based on the target rules, improving the flexibility and adaptability of encryption. When the access rules or security requirements change, the system can easily update the target rules and adjust the encryption policy accordingly, and re-execute the new rules to mark the data packets, ensuring the legitimacy and correctness of the data packets, and avoiding system crashes or data loss due to data errors or illegal access.

[0067] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0068] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0069] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0070] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0071] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0072] The embodiments of the present application also provide a specific implementation of an electronic device capable of implementing all steps of the method in the above embodiments, and the electronic device specifically includes the following contents:

[0073] Processor, memory, communications interface and bus;

[0074] Wherein, the processor, memory, and communication interface communicate with each other via the bus;

[0075] The processor is used to call the computer program in the memory, and when the processor executes the computer program, all the steps in the method in the above embodiment are implemented.

[0076] The embodiments of the present application also provide a computer-readable storage medium capable of implementing all the steps of the method in the above embodiments, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, all the steps of the method in the above embodiments are implemented.

[0077] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the hardware + program embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. Although the embodiment of this specification provides the method operation steps described in the embodiment or flow chart, more or less operation steps can be included based on conventional or non-creative means. The order of steps listed in the embodiment is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiment or the accompanying drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or device including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or device. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or device including the elements. For the convenience of description, the above device is described by dividing it into various modules according to its functions. Of course, when implementing the embodiments of this specification, the functions of each module can be implemented in the same one or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The present invention is described with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the process and / or box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0078] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, the embodiments of this specification may be in the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the embodiments of this specification may be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts refer to the partial description of the method embodiment. In the description of this specification, the description of the reference term "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiment of this specification.

[0079] In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradicting each other. The above is only an embodiment of the embodiment of this specification and is not intended to limit the embodiment of this specification. For those skilled in the art, the embodiment of this specification may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiment of this specification shall be included in the scope of the claims of the embodiment of this specification.

Claims

1. A PLD-based network traffic legitimacy verification and encryption communication system, characterized in that: include: Define programming modules to customize the rules stored in the local library to form target rules; A storage module, formed by the memory of a CPU of a NumA architecture, for buffering data packets transmitted over a network, wherein the data packets include logs; A matching module performs inspection processing on the data packet in transmission based on the target rule to form a detection result output; The validation module performs a validation based on the output detection result according to the target rule. If the result is unique, the result is established and feedback is given; The encryption module encrypts and stores the returned data according to the feedback and in combination with the target rules.

2. According to the PLD-based network traffic legitimacy verification and encryption communication system according to claim 1, it is characterized in that: The matching module comprises: The running machine loading unit loads and obtains the command of the target rule, generates a matching library and an instruction respectively, and matches the unique matching library with the unique instruction; A keyword search unit matches the log in the data packet based on the acquired unique matching library, and groups the matching results into sets to form a plurality of sets; The missing validation unit performs validation based on the fact that the multiple sets are located in the expert library, and based on the validation results, performs a validity check on the non-set fields in the two adjacent sets, and forms a matching rule in the passed state, and updates the matching rule to the local library memory rule corresponding to the target rule line number for replacement.

3. According to the PLD-based network traffic legitimacy verification and encryption communication system of claim 1, it is characterized in that: The verification module comprises: A judgment unit, located on a virtual machine, runs a new rule generated by replacing the target rule, re-executes the data packet according to the new rule to form a key data feature matching the target data flow, and performs a marking process on the target data flow to form a marked data flow; The detection unit determines that the data packet matches the marked data flow and flows into the local library through the new rule, and determines that the data packet inspection is passed.

4. A PLD-based network traffic legitimacy verification and encryption communication method, used to implement the PLD-based network traffic legitimacy verification and encryption communication system described in any of claims 1-3, characterized in that: The following steps are involved: S01, loading and running the new rules in the local library based on the acquisition; S02, parsing the data packets of the buffered network transmission cached in the local library to obtain the logs in the data packets; S03, based on obtaining the log and the new rule, running and giving the execution result; S04. Based on the execution result, determine whether the feedback data needs to be encrypted.

5. A PLD-based network traffic legitimacy verification and encryption communication method according to claim 4, characterized in that: The generation of new rules in the local library in step S01 includes: S11. Customize the rules stored in the local library according to the requirements to form target rules; S12, loading the command of the target rule, generating a matching library and an instruction respectively, and making a unique matching library correspond to a unique instruction, thereby forming multiple combinations; S13. Verify that the multiple sets are located in the expert database, and based on the verification results, perform a validity check on the non-set fields in the two adjacent sets, and form a matching rule in the passed state, and update the matching rule to the local database memory rule corresponding to the target rule line number for replacement.

6. A PLD-based network traffic legitimacy verification and encryption communication method according to claim 4, characterized in that: The step S02 of parsing the data packets of the buffered network transmission cached in the local library includes: S21, analyzing the data packet to obtain the number of lines and characters of the log; S22: Match the characters of the log based on the obtained matching library, and generate a set of log line numbers corresponding to the characters of the matching library.

7. A PLD-based network traffic legitimacy verification and encryption communication method according to claim 4, characterized in that: The feedback data is encrypted in step S04 by generating a certification key for a public key through a digital string in the target rule.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the PLD-based network traffic legitimacy verification and encryption communication method described in any one of claims 4 to 7 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the PLD-based network traffic legitimacy verification and encryption communication method described in any one of claims 4 to 7 are implemented.

Images