Data processing method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a data processing method and device, equipment and a storage medium, and aims to prevent flow from being eavesdropped and tampered by encrypting and transmitting message data, thereby realizing secure access to a network server. According to the invention, after the message information is processed, security verification is carried out, and the message information is sent to the network server only if the verification is passed, so that a security check level is added for data, and situations such as abnormity or tampering which may be introduced in the processing process can be found in time; according to the method provided by the invention, encryption message receiving, decryption, operation execution, subsequent security verification and the like are completed through the service fast forwarding area, so that unnecessary process jump and resource allocation time can be reduced, and the security of the whole communication link is improved. The data processing speed is accelerated, and the overall communication efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a data processing method, device, equipment and storage medium. Background Art

[0002] With the development of Web applications and the changes in user needs, user terminals are becoming more and more important in accessing network servers. In the prior art, data of users may be tampered with and eavesdropped during access to network servers, which greatly reduces the security of data transmission. Summary of the invention

[0003] In view of the above problems, embodiments of the present invention are proposed to provide a data processing method, apparatus, device and storage medium that overcome the above problems or at least partially solve the above problems.

[0004] In order to solve the above problems, an embodiment of the present invention discloses a data processing method, which is applied to a network function virtualization platform, wherein the network function virtualization platform includes a service fast forwarding area, and the network function virtualization platform is connected to a user terminal and a network server respectively, and the method includes:

[0005] After the user terminal establishes a communication connection with the network server, receiving encrypted message information sent by the user terminal through the service fast forwarding area;

[0006] Determine the key information corresponding to the message information;

[0007] Decrypting the encrypted message information according to the key information to obtain the message information;

[0008] Determine the operation information to be performed on the message information;

[0009] Performing the operation corresponding to the operation information on the message information through the service fast forwarding area to obtain processed message information;

[0010] Performing security verification on the processed message information;

[0011] When the security check passes, the processed message information is sent to the network server.

[0012] Optionally, the network function virtualization platform further includes a service logic area, and further includes:

[0013] Receiving, through the service fast forwarding area, an encrypted communication connection request sent by the user terminal;

[0014] Obtaining a decryption key corresponding to the user terminal;

[0015] Decrypting the encrypted communication connection request using the decryption key to obtain the communication connection request;

[0016] Determining whether the service fast-forwarding area contains operation information corresponding to the communication connection request;

[0017] If the service fast-forwarding area does not contain the operation information corresponding to the communication connection request, sending the communication connection request to the service logic area;

[0018] Querying the operation information corresponding to the communication connection request through the business logic area, and sending the operation information to the business fast transfer area;

[0019] After performing the operation corresponding to the operation information on the communication connection request through the service fast forwarding area, the processed communication connection request is sent to the network server, so that the network server establishes a communication connection with the user terminal according to the processed communication connection request.

[0020] Optionally, the message information includes an identifier of a user terminal, and the performing security verification on the processed message information includes:

[0021] Acquire an access control list, wherein the access control list includes user terminal identifiers having access rights;

[0022] Determining whether the access control list contains the identifier of the user terminal;

[0023] If the access control list contains the identifier of the user terminal, it is determined that the authority check on the user terminal is passed.

[0024] Optionally, the network function virtualization platform further includes a key management center and an SDN controller, and the key management center includes key information corresponding to a plurality of pre-negotiated user terminals;

[0025] The determining the key information corresponding to the message information includes:

[0026] Sending a key acquisition request to the SDN controller through the service fast forwarding area, wherein the key acquisition request includes an identifier of the user terminal;

[0027] The key information corresponding to the user terminal identifier is queried in the key management center through the SDN controller, and the key information is sent to the service fast-forwarding area.

[0028] Optionally, the method further comprises:

[0029] Receiving data sent by the network server through the service fast forwarding area;

[0030] Encrypting the data according to the key information to obtain encrypted data;

[0031] The encrypted data is sent to the user terminal.

[0032] Optionally, the service fast forwarding area includes a plurality of virtual servers, and performing the operation corresponding to the operation information on the message information through the service fast forwarding area to obtain the processed message information includes:

[0033] Performing the operation corresponding to the operation information on the message information through the target virtual server in the service fast forwarding area to obtain processed message information;

[0034] Also includes:

[0035] When the target virtual server fails, determining that the status of the service fast-forwarding zone is a healthy virtual server;

[0036] The performing the operation corresponding to the operation information on the message information through the target virtual server in the service fast forwarding area to obtain the processed message information includes:

[0037] The virtual server in a healthy state performs the operation corresponding to the operation information on the message information to obtain processed message information.

[0038] Optionally, when the message information includes multiple messages, the receiving, through the service fast forwarding area, the encrypted message information sent by the user terminal includes:

[0039] The encrypted message information sent by the user terminal is received by multiple virtual servers corresponding to the multiple message information.

[0040] The present invention also discloses a data processing device, which is applied to a network function virtualization platform, wherein the network function virtualization platform includes a service fast-forwarding area, and the network function virtualization platform is connected to a user terminal and a network server respectively, and the device includes:

[0041] A first receiving module, configured to receive encrypted message information sent by the user terminal through the service fast forwarding area after the user terminal establishes a communication connection with the network server;

[0042] A first determining module, used to determine the key information corresponding to the message information;

[0043] A first decryption module, used to decrypt the encrypted message information according to the key information to obtain the message information;

[0044] A second determination module is used to determine operation information that needs to be performed on the message information;

[0045] An execution module, used for executing the operation corresponding to the operation information on the message information through the service fast forwarding area to obtain the processed message information;

[0046] A verification module, used to perform security verification on the processed message information;

[0047] The first sending module is used to send the processed message information to the network server after the security check passes.

[0048] Optionally, the network function virtualization platform further includes a service logic area, and further includes:

[0049] A second receiving module, configured to receive an encrypted communication connection request sent by the user terminal through the service fast forwarding area;

[0050] An acquisition module, used to acquire a decryption key corresponding to the user terminal;

[0051] A second decryption module, configured to decrypt the encrypted communication connection request using the decryption key to obtain the communication connection request;

[0052] A judgment module, used to judge whether the service fast-forwarding area contains operation information corresponding to the communication connection request;

[0053] A request sending module, configured to send the communication connection request to the service logic area if the service fast-forwarding area does not contain the operation information corresponding to the communication connection request;

[0054] An operation information sending module, used to query the operation information corresponding to the communication connection request through the business logic area, and send the operation information to the business fast transfer area;

[0055] The communication module is used to perform the operation corresponding to the operation information on the communication connection request through the service fast-forwarding area, and then send the processed communication connection request to the network server, so that the network server establishes a communication connection with the user terminal according to the processed communication connection request.

[0056] Optionally, the message information includes an identifier of a user terminal, and the verification module includes:

[0057] An acquisition submodule, used to acquire an access control list, wherein the access control list includes user terminal identifiers having access rights;

[0058] A determination submodule, used to determine whether the access control list contains the identifier of the user terminal;

[0059] The first determination submodule is used to determine whether the permission check on the user terminal is passed if the access control list contains the identifier of the user terminal.

[0060] Optionally, the network function virtualization platform further includes a key management center and an SDN controller, and the key management center includes key information corresponding to a plurality of pre-negotiated user terminals;

[0061] The first determining module includes:

[0062] A first sending submodule, configured to send a key acquisition request to the SDN controller through the service fast forwarding area, wherein the key acquisition request includes an identifier of the user terminal;

[0063] The second sending submodule is used to query the key information corresponding to the user terminal identifier from the key management center through the SDN controller, and send the key information to the service fast forwarding area.

[0064] Optionally, the device further comprises:

[0065] A third receiving module, used for receiving data sent by the network server through the service fast forwarding area;

[0066] An encryption module, used for encrypting the data according to the key information to obtain encrypted data;

[0067] The second sending module is used to send the encrypted data to the user terminal.

[0068] Optionally, the service fast-forwarding area includes a plurality of virtual servers, and the execution module includes:

[0069] An execution submodule, used for executing the operation corresponding to the operation information on the message information through the target virtual server in the service fast forwarding area to obtain the processed message information;

[0070] Also includes:

[0071] A second determination submodule is used to determine that the state of the service fast-forwarding area is a healthy virtual server when the target virtual server fails;

[0072] The execution submodule includes:

[0073] The execution unit is used to execute the operation corresponding to the operation information on the message information through the virtual server in a healthy state to obtain the processed message information.

[0074] Optionally, when the message information includes multiple messages, the first receiving module includes:

[0075] The receiving submodule is used to receive the encrypted message information sent by the user terminal through multiple virtual servers corresponding to the multiple message information.

[0076] The present invention also discloses an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the steps of the above-mentioned data processing method when executed by the processor.

[0077] The present invention also discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned data processing method are implemented.

[0078] The embodiments of the present invention include the following advantages:

[0079] The present invention discloses a data processing method, which implements secure access to a network server by encrypting and transmitting message data to prevent traffic from being eavesdropped and tampered with; the present invention performs security verification after processing the message information, and only sends it to the network server if the verification is passed, thereby adding another security checkpoint for the data, and can timely discover abnormalities or tampering that may be introduced during the processing process, thereby ensuring that the data ultimately delivered to the network server is complete and reliable, and further improving the data security of the entire communication link; the present invention receives encrypted messages, decrypts, executes operations, and performs subsequent security verifications, etc., all of which are completed through a business fast-forwarding area, thereby reducing unnecessary process jumps and resource allocation time, accelerating data processing speed, and improving overall communication efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] Figure 1 is a flow chart of steps of a data processing method provided by an embodiment of the present invention;

[0081] Figure 2 It is a flowchart of a data processing method provided by an embodiment of the present invention;

[0082] Figure 3 It is a structural block diagram of a data processing device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0083] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and understandable, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0084] One of the core concepts of the embodiments of the present invention is to prevent traffic from being eavesdropped and tampered with by encrypting the transmission of message data, thereby achieving secure access to the network server; the present invention performs a security check after processing the message information, and only sends it to the network server after the check is passed, thereby adding another security checkpoint for the data, and can promptly discover anomalies or tampering that may be introduced during the processing process, thereby ensuring that the data ultimately delivered to the network server is complete and reliable, further improving the data security of the entire communication link. The present invention receives encrypted messages, decrypts, executes operations, and performs subsequent security checks, all of which are completed through the business fast-forwarding area, which can reduce unnecessary process jumps and resource allocation time, speed up data processing, and improve overall communication efficiency.

[0085] Reference Figure 1 , shows a flow chart of steps of a data processing method provided by an embodiment of the present invention, which is applied to a network function virtualization platform, wherein the network function virtualization platform is connected to a user terminal and a network server respectively, and the method may include the following steps:

[0086] Step 101, after the user terminal establishes a communication connection with the network server, the encrypted message information sent by the user terminal is received through the service fast forwarding area.

[0087] In an embodiment of the present invention, the service fast-forwarding zone has a network interface and corresponding network protocol stack support, and can identify and receive messages that meet the requirements in accordance with standard network communication protocols (such as the TCP / IP protocol family). At the same time, its function of receiving encrypted messages is based on a secure communication framework set by a network function virtualization platform. The framework plans the data inflow channel and the pre-processing process of encrypted data to ensure that the encrypted messages sent from the user terminal can be accurately captured by the service fast-forwarding zone, preparing for further analysis and processing.

[0088] When a communication connection is successfully established between a user terminal (such as personal computers, smart phones, tablets, and other devices that can access the network and initiate communication) and a network server (which can be a server-side device that provides web services, data storage services, application services, etc.), the business fast-forwarding area in the network function virtualization platform begins to play a role. It will always monitor the network data traffic from the user terminal. Once it detects encrypted message information sent to the target network server, it will receive it.

[0089] The message information may be encrypted using a variety of encryption methods such as symmetric encryption algorithms (such as AES encryption algorithm) or asymmetric encryption algorithms (such as RSA encryption algorithm). It carries various data contents that users want to convey to the network server, such as user login information, business operation requests, file transfer data, etc.

[0090] Step 102, determining the key information corresponding to the message information;

[0091] In the embodiment of the present invention, after receiving the encrypted message information, it is necessary to determine the corresponding key information from the corresponding key management system or storage location. It should be noted that the key information is obtained by negotiation in advance based on the certificate file.

[0092] If symmetric encryption is used, the user terminal and the recipient usually share the same key in advance. At this time, it is necessary to accurately extract the key from a pre-agreed secure storage location (such as a key database, etc.).

[0093] If an asymmetric encryption algorithm is used, it is necessary to obtain the private key that can decrypt the message from the corresponding private key storage area, because in asymmetric encryption, the public key is used for encryption and the private key is used for decryption. For example, in a certificate-based encrypted communication scenario, the platform will verify the digital certificate attached to the message, obtain the relevant identifier of the corresponding public key information, and then find the matching private key from the local key warehouse based on the identifier.

[0094] Step 103, decrypting the encrypted message information according to the key information to obtain the message information;

[0095] In an embodiment of the present invention, after obtaining the correct key information, the corresponding decryption algorithm will be used to perform a decryption operation on the previously received encrypted message information. In one example, if the AES symmetric encryption algorithm is used, the key will be input as a parameter into the decryption algorithm function according to its specified decryption process, and the ciphertext will be restored block by block or bit by bit to finally obtain the original message information.

[0096] If it is based on the RSA asymmetric encryption algorithm, the private key is used to perform reverse operations on the public key encrypted part of the ciphertext according to its mathematical operation rules to restore the original message content. For example, the encrypted message originally presented as a string of seemingly irregular binary ciphertext, after decryption, it will become the original message containing clearly readable text, numerical values ​​and other information, which may be a specific user login-related message content such as "Username: Zhang San, Password: 123456, requesting login operation".

[0097] Step 104, determining the operation information to be performed on the message information;

[0098] In an embodiment of the present invention, after successfully acquiring the original message information, the operation information that needs to be performed on the message information can be determined based on various factors, such as the format of the message itself, content attributes, and some processing rules preset by the network function virtualization platform. For example, if the format of the message does not conform to the standard format received by the target network server, the operation information may include a requirement for format conversion of the message so that it conforms to the parsing specifications of the server.

[0099] In one example, the protocol format of the message information is protocol A, and the protocol supported by the network server is protocol B, then the message data needs to be rewritten, and the operation information performed on the message information at this time is to convert the protocol format of the message information.

[0100] Step 105: Perform an operation corresponding to the operation information on the message information through the service fast forwarding area to obtain processed message information.

[0101] In an embodiment of the present invention, the message information can be processed accordingly with the help of the business fast-forwarding area in the network function virtualization platform. If the operation information is a message forwarding operation, the business fast-forwarding area will accurately send the message information to the next network node or directly to the corresponding port of the target network server through the network interface based on the network topology structure and the address information of the target server; if it is a format conversion operation, the fields, encoding methods, etc. in the message will be adjusted according to the predetermined format specifications, such as converting the text field originally encoded in ASCII to UTF-8 encoding, or converting the structure of the message from a specific custom format to a request message format that complies with the HTTP protocol standard, etc., and after processing, the processed message information that meets the requirements is obtained.

[0102] Step 106: Perform security verification on the processed message information.

[0103] In the embodiment of the present invention, the message information processed in step 105 may be subjected to security verification, and this verification process may cover multiple dimensions.

[0104] In one example, the integrity of the message is checked first by calculating the checksum of the message (such as the common CRC checksum, MD5 checksum, etc.) or using a hash algorithm (such as SHA-256, etc.) to generate the summary information of the message, and comparing it with the pre-stored reference value or the reference value attached to the message to see whether they are consistent, so as to determine whether there is any data loss or tampering during the transmission and processing of the message.

[0105] Secondly, the legitimacy of the message will be verified. According to the security policies and business rules preset by the network function virtualization platform, the source of the message will be checked to see if it is legal and whether the content of the message meets the business requirements (for example, whether it contains illegal characters, whether it meets the format specifications of specific businesses, etc.). In addition, if security mechanisms such as digital signatures are involved, the validity of the signature will also be verified to ensure that the message is indeed generated by a legitimate sender and has not been tampered with.

[0106] Step 107: When the security check passes, the processed message information is sent to the network server.

[0107] In an embodiment of the present invention, when the processed message information undergoes security verification and the result is passed, it means that the message information at this time has undergone a series of rigorous processing procedures and is safe, reliable and meets the requirements. At this time, the network function virtualization platform will send the processed message information to the network server. The sending process also follows the network communication protocol (such as the TCP / IP protocol family), and transmits the message accurately to the designated port of the network server through the network interface and the corresponding network link, so that the network server can carry out corresponding business processing based on its content after receiving the message, such as parsing the user's web page access request and returning the corresponding web page content, or storing and calculating the business data submitted by the user. Further operations.

[0108] The present invention discloses a data processing method, which implements secure access to a network server by encrypting and transmitting message data to prevent traffic from being eavesdropped and tampered with; the present invention performs a security check after processing the message information, and only sends it to the network server if the check is passed, thereby adding another "security checkpoint" to the data, and can timely discover abnormalities or tampering that may be introduced during the processing process, thereby ensuring that the data ultimately delivered to the network server is complete and reliable, and further improving the data security of the entire communication link; the present invention receives encrypted messages, decrypts, executes operations, and performs subsequent security checks, etc., all of which are completed through a business fast-forwarding area, which can reduce unnecessary process jumps and resource allocation time, speed up data processing, and improve overall communication efficiency.

[0109] In one embodiment of the present invention, the network function virtualization platform also includes a business logic area, and also includes: receiving an encrypted communication connection request sent by a user terminal through a business fast-forwarding area; obtaining a decryption key corresponding to the user terminal; decrypting the encrypted communication connection request through the decryption key to obtain a communication connection request; determining whether the business fast-forwarding area contains operation information corresponding to the communication connection request; if the business fast-forwarding area does not contain the operation information corresponding to the communication connection request, sending the communication connection request to the business logic area; querying the operation information corresponding to the communication connection request through the business logic area, and sending the operation information to the business fast-forwarding area; after performing the operation corresponding to the operation information on the communication connection request through the business fast-forwarding area, sending the processed communication connection request to the network server, so that the network server establishes a communication connection with the user terminal according to the processed communication connection request.

[0110] In an embodiment of the present invention, when a user terminal wants to establish a communication connection with a network server, it will first generate a communication connection request. This request includes information such as the user terminal's own identification information (such as IP address, device number, etc.), information related to the target server requested for connection (such as server domain name, IP address, etc.), and some other necessary data content for verifying or indicating the intention to connect.

[0111] To ensure security during transmission, the user terminal uses a specific encryption algorithm to encrypt the communication connection request, and then sends the encrypted request to the network. The business fast-forwarding area in the network function virtualization platform is like an "information collection station" at this time. It always listens to the network port and identifies and receives the encrypted communication connection request from the user terminal according to the network communication protocol (such as the TCP / IP protocol family), ensuring that no request information that meets the requirements is missed, and preparing for further processing.

[0112] After receiving the encrypted communication connection request, the next step is to obtain the key that can decrypt it. If symmetric encryption is used, then the decryption key is the same key that was previously shared by the user terminal and the network function virtualization platform. At this time, the platform needs to accurately find and extract the key from a secure key storage location (such as a dedicated key database, which has strict access control and encryption protection measures).

[0113] If an asymmetric encryption algorithm is used, such as public key encryption and private key decryption, the platform needs to obtain the corresponding private key from the corresponding private key storage area based on the public key information associated with the user terminal (which may be identified and associated by means of digital certificates, etc.), because only the matching private key can decrypt the content encrypted by the corresponding public key. For example, in a network environment based on PKI (public key infrastructure), the platform will first verify the digital certificate attached to the communication connection request, confirm the legitimacy of the certificate, obtain the identification information related to the public key, and then use this identification to accurately find the corresponding private key in the local key warehouse.

[0114] When the business fast-forwarding area obtains the correct decryption key, it will use the corresponding decryption algorithm to decrypt the previously received encrypted communication connection request. Taking the symmetric encryption algorithm AES as an example, the obtained key will be input into the AES decryption algorithm function as an important parameter. According to the decryption process specified, the data in the encrypted request will be restored block by block or bit by bit, and the ciphertext will be gradually converted into the original, clear and readable communication connection request content.

[0115] After successfully decrypting the communication connection request, the business quick-transfer area of ​​the network function virtualization platform will conduct an internal search and judgment to see whether it has pre-stored the operation information corresponding to the communication connection request. An operation information table or a set of operation rules can be maintained inside the business quick-transfer area. These contents record similar requests that have been processed before or the operation details corresponding to certain specific types of requests according to preset rules.

[0116] For example, for some common and standardized web page access requests, the business fast forwarding area may have configured the corresponding forwarding operation information in advance, and knows which specific network server module or network node such requests should be directly forwarded to. At this time, the relevant features of the communication connection request just decrypted (such as request type, target server identifier, etc.) will be compared with the existing operation information to see if the corresponding operation information can be matched. If the business fast forwarding area contains the operation information corresponding to the communication connection request, the operation corresponding to the operation information can be performed on the communication connection request.

[0117] If the business fast-forwarding area does not contain the operation information corresponding to the communication connection request, that is, when it is determined that the operation information corresponding to the communication connection request does not exist in the business fast-forwarding area, in order to continue processing the request and find a suitable operation method to establish a communication connection, the network function virtualization platform will send the decrypted communication connection request to the business logic area. The sending process also follows the network communication protocol, and will encapsulate the communication connection request into appropriate network data packets. Then, it will be accurately transmitted to the corresponding receiving port of the business logic area through the internal network link, ensuring that the request information arrives at the business logic area intact and without error, so that the business logic area can perform further query operations based on the received request.

[0118] After receiving the communication connection request from the business fast forwarding area, the business logic area will start the query mechanism to find the operation information corresponding to the request. The business logic area often has a richer business rule knowledge base and more complex logic analysis capabilities. It can perform comprehensive analysis based on the various characteristics of the communication connection request (such as the requested business type, the server resources involved, the user's authority level, etc.), combined with a large amount of pre-set business process rules, security policies, and system configuration information, through querying the database, matching rule templates, calling related algorithms, and other methods to determine the operation information suitable for the communication connection request. For example, if the communication connection request is an access request for an internal corporate web page resource under a specific authority control, the business logic area will find out whether additional identity authentication operations are required before forwarding operations, or whether forwarding is allowed directly, based on factors such as the identity authentication information of the user terminal and the authority requirements of the requested resource. Once the corresponding operation information is queried, the business logic area will encapsulate the operation information into network data packets according to the communication mechanism within the network function virtualization platform, and then accurately send it back to the business fast forwarding area through the internal network link, so that the business fast forwarding area can subsequently perform corresponding operations based on the operation information.

[0119] After receiving the operation information sent back from the business logic area, the business fast forwarding area will process the communication connection request according to the specific operation corresponding to the operation information. If the operation information indicates a forwarding operation, the business fast forwarding area will accurately send the communication connection request to the next network node or directly to the corresponding port of the target network server through its own network interface and the underlying network driver according to the network topology and the address information of the network server (such as IP address, port number, etc.); if the operation information requires a format conversion operation, such as converting the format of the request from a specific custom format to a request format that complies with the HTTP protocol standard, the format conversion module inside the business fast forwarding area will adjust the fields, encoding methods, etc. in the communication connection request, reassemble it according to the predetermined format specification, and obtain the processed communication connection request. Then, also following the network communication protocol (such as TCP / IP protocol family), the business fast forwarding area will send the processed communication connection request to the network server through the network link. After receiving the request, the network server will perform corresponding processing based on the content of the request, such as verifying the legitimacy of the request, parsing the parameter information in the request, etc., and then establish a communication connection with the user terminal to realize subsequent communication activities such as data interaction between the two parties.

[0120] In one embodiment of the present invention, the message information includes an identifier of a user terminal, and a security check is performed on the processed message information, including: obtaining an access control list, the access control list including an identifier of a user terminal with access rights; determining whether the access control list contains the identifier of the user terminal; if the access control list contains the identifier of the user terminal, determining that the permission check for the user terminal has passed.

[0121] In an embodiment of the present invention, the network function virtualization platform may further include a user security function area, and an access control list may be obtained from the user security function area. The access control list (ACL) is a commonly used tool in a network security mechanism, which is pre-set and maintained by a network administrator or a security policy configuration module of the system. This list records in detail the identification information of user terminals that are granted access rights. The identification of the user terminal may be in various forms, such as a common IP address, MAC address, device serial number, or a unique identity number assigned to the user terminal in a specific network system. The network function virtualization platform will extract the access control list from a specific storage location or configuration database. The storage location usually has strict access permission management, and only system modules or administrator accounts with corresponding permissions can perform operations such as reading and modification, thereby ensuring the security and accuracy of the access control list.

[0122] For example, in an enterprise's internal network, the network administrator will add the IP address of each client terminal to the corresponding access control list based on the job responsibilities and business needs of employees in different departments, and clearly define the range of network resources they can access. For example, the computers of marketing department employees can access marketing-related data servers, while the computers of R&D department employees can access server resources such as code repositories. This information will be reflected in the access control list.

[0123] After obtaining the access control list, the network function virtualization platform will extract the user terminal identifier contained in the message information just received, and then compare it with each user terminal identifier in the access control list one by one. This comparison process can be implemented in a variety of ways. For example, if the user terminal identifier is in the form of an IP address, the platform can use a string matching algorithm or an IP address comparison function to accurately match the IP address in the message with the IP address entry recorded in the access control list; if other identification forms such as device serial numbers are used, there will also be a corresponding search and matching mechanism to determine whether there is an identical identification record in the access control list. For example, if the IP address of the user terminal shown in the message information is "192.168.1.100", the platform will search for this IP address in the many IP address records in the access control list to determine whether the user terminal is within the scope of authorized access.

[0124] When, after the previous comparison and judgment steps, it is found that the access control list does contain the user terminal identifier carried in the message information, the network function virtualization platform will determine that the permission check for the user terminal has passed, which means that from the perspective of access rights, the user terminal is allowed to perform corresponding operations and send corresponding message information in the network system. The subsequent platform can continue to perform other security checks on the message information (such as data integrity check, message legitimacy check, etc.) based on the result of this permission check, or further process and forward the message according to the normal business process to promote the smooth development of the entire network communication activities. For example, in the network system of an online shopping platform, if the user terminal identifier passes the permission check of the access control list, the platform can continue to process the message sent by the user terminal containing information such as product selection and order placement, and forward it to the corresponding order processing server and other related modules for subsequent business operations.

[0125] By comparing with the access control list, the present invention can clearly determine whether the user terminal currently sending the message information is authorized, thereby preventing illegal user terminals from trying to break through the network security defense line with the help of forged or tampered messages, illegally obtaining network resources or performing malicious operations, thereby ensuring that the data and resources in the network system are only open to legally authorized objects, and maintaining network security order.

[0126] In one embodiment of the present invention, the network function virtualization platform also includes a key management center and an SDN controller, the key management center includes key information corresponding to multiple pre-negotiated user terminals; determining the key information corresponding to the message information includes: sending a key acquisition request to the SDN controller through the service fast forwarding area, the key acquisition request includes the identifier of the user terminal; querying the key information corresponding to the user terminal identifier from the key management center through the SDN controller, and sending the key information to the service fast forwarding area.

[0127] In an embodiment of the present invention, when the service fast-forwarding area of ​​the network function virtualization platform receives encrypted message information from a user terminal, in order to be able to decrypt the message, it is first necessary to obtain the corresponding key information. At this time, the service fast-forwarding area will generate a key acquisition request, which includes the identifier of the user terminal that sends the message information. As mentioned above, the identifier of the user terminal can be in the form of an IP address, a MAC address, or a unique identity number assigned to it by a specific network system. The service fast-forwarding area will encapsulate the key acquisition request according to the communication protocol and message format set within the network function virtualization platform, and then send it to the SDN controller through the network link within the platform. For example, in a network function virtualization environment, the service fast-forwarding area detects an encrypted message from a user terminal with an IP address of "192.168.1.100", it will construct a key acquisition request, indicate the user terminal identifier "192.168.1.100" in the request, and then send the request to the SDN controller through the internal virtual network channel.

[0128] After receiving the key acquisition request from the service fast-forwarding zone, the SDN controller will start the query mechanism to find the key information corresponding to the user terminal identifier contained in the request. Before establishing the session, the key management center negotiates the session symmetric key for the user to communicate with the server based on the certificate information. After the negotiation is completed, the key will be stored in the key database. This library pre-negotiates and stores the key information corresponding to multiple user terminals. It will accurately locate the corresponding key record in the key information library through retrieval, matching and other operations based on the user terminal identifier in the key acquisition request. For example, if the user terminal identifier is specified in the key acquisition request, the SDN controller will search for the key information associated with the user terminal identifier as the index in the key database of the key management center. Once the corresponding key information is found, the SDN controller will also encapsulate the key information according to the communication protocol and message format within the network function virtualization platform, and then send it back to the service fast-forwarding zone through the internal network link to ensure that the service fast-forwarding zone can receive accurate key information for subsequent decryption operations of the message information.

[0129] In one embodiment of the present invention, the method further includes: receiving data sent by the network server through the service fast forwarding area; encrypting the data according to the key information to obtain encrypted data; and sending the encrypted data to the user terminal.

[0130] In the embodiment of the present invention, during the operation of the network function virtualization platform, the network server will send various types of data to the user terminal based on the interaction needs between the user terminal and the network server. These data can be web page content information (such as HTML documents, pictures, script files, etc.), or response data to the user terminal's previous request (such as query results returned after the user queries the database, feedback information after the business operation, etc.). The network server will encapsulate these data according to the network communication protocol (such as the TCP / IP protocol family) and send them to the network, and the business fast forwarding area in the network function virtualization platform acts as a "transfer station" for receiving these data. It always monitors the network data traffic from the network server, and identifies and receives the data that meets the requirements according to the established protocol rules and its own configuration, so as to prepare for further processing. For example, when a user requests to view the product details page from an e-commerce website server through a browser, the network server will send out the web page data containing product pictures, prices, descriptions and other information, and the business fast forwarding area will receive these data.

[0131] After the business fast-forwarding area successfully receives the data sent by the network server, it can encrypt the data according to the previously determined key information. The key information here is the key corresponding to the message information sent by the user terminal to the network server. If a symmetric encryption algorithm (such as the AES algorithm) is used, the business fast-forwarding area will divide the received data according to certain grouping rules (such as 128 bits per group, etc.), and then use the key as an important parameter to encrypt each group of data using the AES encryption algorithm function. Through multiple rounds of permutation, substitution and other encryption operations, the originally clear and readable original data is converted into a string of seemingly irregular ciphertext data, that is, the encrypted data is obtained, which ensures the confidentiality of the data during transmission back to the user terminal.

[0132] After the encryption of data is completed in the business fast forwarding area and the encrypted data is obtained, it is necessary to send the encrypted data to the user terminal so that the user terminal can receive the information from the network server. The business fast forwarding area will encapsulate the encrypted data into network data packets according to the network communication protocol (such as the TCP / IP protocol family), add necessary protocol header information (such as the source address is the network address where the business fast forwarding area is located, the destination address is the IP address of the user terminal, and there is also information such as the port number), and then send the data packet to the corresponding port of the user terminal through the network link inside and outside the network function virtualization platform. For example, in a network function virtualization application scenario under a campus network environment, after the business fast forwarding area encapsulates the encrypted network server data containing the course material download link, it accurately sends the data to the student user terminal requesting the material through the virtual network inside the campus network and the router and other devices connected to the external network to complete the data transmission process; the present invention effectively protects the privacy of the user and the confidentiality of the interactive data between the network server and the user terminal by encrypting and transmitting the data returned by the network server, ensuring the security and reliability of information in network transmission, and maintaining the security environment of the entire network communication.

[0133] In one embodiment of the present invention, the service fast-forwarding zone includes multiple virtual servers, and the service fast-forwarding zone executes operations corresponding to operation information on message information to obtain processed message information, including: executing operations corresponding to operation information on message information through a target virtual server in the service fast-forwarding zone to obtain processed message information; and also including: when a target virtual server fails, determining that the status of the service fast-forwarding zone is a healthy virtual server; executing operations corresponding to operation information on message information through a target virtual server in the service fast-forwarding zone to obtain processed message information, including: executing operations corresponding to operation information on message information through a virtual server whose status is healthy to obtain processed message information.

[0134] In an embodiment of the present invention, after determining the operation information to be performed on the message information, the business fast-forwarding area will select a suitable target virtual server from the multiple virtual servers it contains to perform the corresponding operation. Each virtual server in the business fast-forwarding area is configured with specific functions or has corresponding resources to process specific types of operation tasks. For example, some virtual servers can be specifically used for data format conversion operations and have corresponding encoding conversion tools and parsing modules; some virtual servers can be used for message forwarding operations and are configured with complete network routing functions and network interfaces. When it is necessary to operate on the message information, a target virtual server with matching functions will be selected based on the specific requirements of the operation information. After selection, the target virtual server will process the message information in accordance with the specific operation method specified in the operation information. For example, if the operation information requires the format of the message to be converted from a custom format to a format that complies with the HTTP protocol standard, the data parsing module in the target virtual server will first disassemble the message according to the existing format, and then the encoding conversion module will re-encode and assemble it according to the HTTP protocol specification, and finally obtain the processed message information so that it can meet the requirements of subsequent network server reception and processing.

[0135] During network operation, the target virtual server may fail to work properly due to various reasons (such as hardware failure, crash caused by software vulnerabilities, network connection abnormalities, etc.). At this time, the business fast-forwarding zone can promptly discover and confirm the fault status of the target virtual server. This can be achieved in a variety of ways, such as regularly sending heartbeat detection signals to each virtual server. If no response is received from the target virtual server within the specified time, it can be determined that it has failed; or monitoring the key performance indicators of the virtual server (such as CPU usage being 0 for a long time, network interface having no data transmission and reception, and other abnormal conditions) to determine the occurrence of the fault. Once it is determined that the target virtual server has failed, the business fast-forwarding zone will start a healthy virtual server search mechanism to check the status of all virtual servers in the zone, mainly to check whether they are currently not executing any tasks, that is, whether they are in a healthy state. By traversing the task queues, resource occupancy and other information of each virtual server, those virtual servers with idle resources and healthy status that can undertake new tasks are screened out, in preparation for the subsequent transfer of the message processing tasks that should have been executed by the target virtual server.

[0136] For example, the business fast-forwarding zone originally arranged virtual server A as the target virtual server to handle the forwarding operation of a certain message information. However, after virtual server A fails, it is found through inspection that virtual servers B and C are not currently processing tasks. They will then be determined as virtual servers in a healthy state and can be selected later to continue processing the message information.

[0137] The present invention uses a healthy virtual server to replace the failed target virtual server to continue to execute the message processing task, thereby achieving seamless connection of business processing, effectively avoiding the message processing interruption problem caused by server failure, and ensuring the continuity and stability of network communication. This enables the entire network function virtualization platform to process message information according to the established business process in the face of sudden failure of the virtual server, maintain normal interaction between the user terminal and the network server, ensure that the network service is not interrupted, and achieve business unawareness when a single load balancing server failure triggers traffic switching, thereby improving the network system's ability to cope with failures and overall reliability.

[0138] In one embodiment of the present invention, when the message information includes multiple messages, receiving the encrypted message information sent by the user terminal through the service fast forwarding area includes: receiving the encrypted message information sent by the user terminal through multiple virtual servers corresponding to the multiple message information.

[0139] In an embodiment of the present invention, in an actual network communication scenario, there are often multiple message information sent from a user terminal to a network server at the same time. For example, in a large enterprise office network, many employees use office terminals to browse web pages, upload and download files, submit business data, and other operations at the same time, which will generate a large amount of different message information. At this time, multiple virtual servers in the business fast-forwarding area of ​​the network function virtualization platform will collaboratively participate in the process of receiving these encrypted message information, thereby achieving load balancing.

[0140] Each virtual server will be configured or dynamically assigned to receive specific message information, which may be determined based on a variety of factors. A common way is to divide it according to the type of message information, such as assigning message information involving web page access requests to virtual server A, and arranging message information containing file transfer related content to virtual server B, etc.; another way is to allocate according to certain attributes of the user terminal (such as IP address range, department affiliation, etc.). For example, message information sent by user terminals belonging to a certain department is uniformly received by virtual server C. These virtual servers will always monitor the network port, identify the encrypted message information from the user terminal and meet their own receiving requirements according to the network communication protocol and receiving rules set by the network function virtualization platform, and receive it. For example, virtual server A will pay special attention to those messages in the network traffic that are intended to access specific web services and use the corresponding encryption method. Once an encrypted message that meets the conditions is detected, it will be received and prepared for subsequent processing.

[0141] like Figure 2A flow chart of a data processing method provided by an embodiment of the present invention is shown, user 1 can send a communication connection request to a target virtual server in a business fast-forwarding area, and then the target virtual server can determine whether there is operation information of the communication connection request, and if not, the communication connection request is sent to a back-end server in a business logic area, and the operation information corresponding to the communication connection request is queried in the back-end server, and then the back-end server sends the operation information to the target virtual server, and then performs a corresponding operation on the communication connection request according to the operation information to obtain a processed communication connection request, and then performs a security check on the processed communication connection request, and after the security check passes, the processed communication connection request is sent to the web server, thereby establishing a communication connection between user 1 and the web server;

[0142] After establishing a communication connection between user 1 (user terminal) and the web server, user 1 starts to send files to the web server. User 1 can encrypt the files to be sent through the key pre-negotiated by the key management center, and then send the encrypted files to the business fast forwarding area. When the file is large, it will be encapsulated into many data messages. After each message arrives at the business fast forwarding area, the business fast forwarding area can send a key acquisition request to the SDN controller to obtain the pre-negotiated symmetric key, and then decrypt the encrypted file according to the key to obtain the original file. Since an established connection is used, the business fast forwarding area can directly query the corresponding rules by looking up the table. The rules include how to operate the message (rewrite, encapsulate, etc.). At the same time, since the message sent by the user has been security checked and passed, the processed message can be directly sent to the web server.

[0143] The message received by the service fast forwarding area is an encrypted message. The encryption key is obtained by user 1 and the key management center through negotiation based on the certificate. The key management center can then distribute the key to the SDN controller. When the service fast forwarding area needs to decrypt the encrypted message, it can obtain the key information from the SDN controller.

[0144] The present invention discloses a data processing method, which implements secure access to a network server by encrypting and transmitting message data to prevent traffic from being eavesdropped and tampered with; the present invention performs security verification after processing the message information, and only sends it to the network server if the verification is passed, thereby adding another security checkpoint for the data, and can timely discover abnormalities or tampering that may be introduced during the processing process, thereby ensuring that the data ultimately delivered to the network server is complete and reliable, and further improving the data security of the entire communication link; the present invention receives encrypted messages, decrypts, executes operations, and performs subsequent security verifications, etc., all of which are completed through a business fast-forwarding area, thereby reducing unnecessary process jumps and resource allocation time, accelerating data processing speed, and improving overall communication efficiency.

[0145] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0146] Reference Figure 3 , shows a structural block diagram of a data processing device provided by an embodiment of the present invention, which is applied to a network function virtualization platform, the network function virtualization platform includes a service fast forwarding area, the network function virtualization platform is connected to a user terminal and a network server respectively, and the device includes:

[0147] The first receiving module 201 is used to receive the encrypted message information sent by the user terminal through the service fast forwarding area after the user terminal establishes a communication connection with the network server;

[0148] A first determination module 202, used to determine key information corresponding to the message information;

[0149] The first decryption module 203 is used to decrypt the encrypted message information according to the key information to obtain the message information;

[0150] A second determination module 204 is used to determine operation information that needs to be performed on the message information;

[0151] An execution module 205 is used to execute an operation corresponding to the operation information on the message information through the service fast forwarding area to obtain the processed message information;

[0152] Verification module 206, used to perform security verification on the processed message information;

[0153] The first sending module 207 is used to send the processed message information to the network server after the security check passes.

[0154] The present invention discloses a data processing device, which encrypts and transmits message data to prevent traffic from being eavesdropped and tampered with, thereby achieving secure access to a network server; the present invention performs a security check after processing the message information, and only sends it to the network server after the check is passed, thereby adding another "security checkpoint" for the data, and can promptly discover abnormalities or tampering that may be introduced during the processing process, thereby ensuring that the data ultimately delivered to the network server is complete and reliable, and further improving the data security of the entire communication link; the present invention receives encrypted messages, decrypts, executes operations, and performs subsequent security checks, etc., all of which are completed through a business fast-forwarding area, which can reduce unnecessary process jumps and resource allocation time, speed up data processing, and improve overall communication efficiency.

[0155] In one embodiment of the present invention, the network function virtualization platform further includes a service logic area, and further includes:

[0156] A second receiving module, used for receiving an encrypted communication connection request sent by a user terminal through a service fast forwarding area;

[0157] An acquisition module, used to acquire a decryption key corresponding to a user terminal;

[0158] A second decryption module, used to decrypt the encrypted communication connection request using a decryption key to obtain a communication connection request;

[0159] A judgment module, used to judge whether the service fast-forwarding area contains operation information corresponding to the communication connection request;

[0160] A request sending module, used for sending the communication connection request to the business logic area if the business fast forwarding area does not contain the operation information corresponding to the communication connection request;

[0161] An operation information sending module is used to query the operation information corresponding to the communication connection request through the business logic area and send the operation information to the business fast transfer area;

[0162] The communication module is used to perform the operation corresponding to the operation information on the communication connection request through the service fast forwarding area, and then send the processed communication connection request to the network server, so that the network server establishes a communication connection with the user terminal according to the processed communication connection request.

[0163] In an embodiment of the present invention, the message information includes an identifier of a user terminal, and the verification module includes:

[0164] An acquisition submodule, used to acquire an access control list, the access control list including user terminal identifiers having access rights;

[0165] A judgment submodule, used to judge whether the access control list contains the identification of the user terminal;

[0166] The first determination submodule is used to determine whether the permission check on the user terminal is passed if the access control list contains the identifier of the user terminal.

[0167] In an embodiment of the present invention, the network function virtualization platform further includes a key management center and an SDN controller, and the key management center includes key information corresponding to a plurality of pre-negotiated user terminals;

[0168] The first determination module includes:

[0169] A first sending submodule, configured to send a key acquisition request to the SDN controller through the service fast forwarding area, where the key acquisition request includes an identifier of a user terminal;

[0170] The second sending submodule is used to query the key information corresponding to the user terminal identifier from the key management center through the SDN controller, and send the key information to the service fast forwarding area.

[0171] In one embodiment of the present invention, the device further includes:

[0172] A third receiving module, used for receiving data sent by the network server through the service fast forwarding area;

[0173] An encryption module, used to encrypt data according to key information to obtain encrypted data;

[0174] The second sending module is used to send the encrypted data to the user terminal.

[0175] In one embodiment of the present invention, the service fast-forwarding area includes multiple virtual servers and an execution module, including:

[0176] An execution submodule, used for executing the operation corresponding to the operation information on the message information through the target virtual server in the service fast forwarding area to obtain the processed message information;

[0177] Also includes:

[0178] The second determination submodule is used to determine that the status of the service fast-forwarding zone is a healthy virtual server when a target virtual server fails;

[0179] Execution submodules, including:

[0180] The execution unit is used to execute the operation corresponding to the operation information on the message information through the virtual server in a healthy state to obtain the processed message information.

[0181] In an embodiment of the present invention, when the message information includes multiple, the first receiving module includes:

[0182] The receiving submodule is used to receive encrypted message information sent by the user terminal through multiple virtual servers corresponding to the multiple message information.

[0183] The present invention discloses a data processing device, which encrypts and transmits message data to prevent traffic from being eavesdropped and tampered with, thereby achieving secure access to a network server; the present invention performs a security check after processing the message information, and only sends it to the network server after the check is passed, thereby adding another "security checkpoint" for the data, and can promptly discover abnormalities or tampering that may be introduced during the processing process, thereby ensuring that the data ultimately delivered to the network server is complete and reliable, and further improving the data security of the entire communication link; the present invention receives encrypted messages, decrypts, executes operations, and performs subsequent security checks, etc., all of which are completed through a business fast-forwarding area, which can reduce unnecessary process jumps and resource allocation time, speed up data processing, and improve overall communication efficiency.

[0184] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0185] An embodiment of the present invention further provides an electronic device, including:

[0186] It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned data processing method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0187] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned data processing method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0188] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0189] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0190] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0191] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0192] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0193] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0194] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0195] The data processing method, device, equipment and storage medium provided by the present invention are introduced in detail above. The principles and implementation methods of the present invention are explained in this article using specific examples. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A data processing method, characterized in that: Applied to a network function virtualization platform, the network function virtualization platform includes a service fast-forwarding area, the network function virtualization platform is connected to a user terminal and a network server respectively, and the method includes: After the user terminal establishes a communication connection with the network server, receiving encrypted message information sent by the user terminal through the service fast forwarding area; Determine the key information corresponding to the message information; Decrypting the encrypted message information according to the key information to obtain the message information; Determine the operation information to be performed on the message information; Performing the operation corresponding to the operation information on the message information through the service fast forwarding area to obtain processed message information; Performing security verification on the processed message information; When the security check passes, the processed message information is sent to the network server.

2. The method according to claim 1, characterized in that The network function virtualization platform also includes a service logic area, and further includes: Receiving, through the service fast forwarding area, an encrypted communication connection request sent by the user terminal; Obtaining a decryption key corresponding to the user terminal; Decrypting the encrypted communication connection request using the decryption key to obtain the communication connection request; Determining whether the service fast-forwarding area contains operation information corresponding to the communication connection request; If the service fast-forwarding area does not contain the operation information corresponding to the communication connection request, sending the communication connection request to the service logic area; Querying the operation information corresponding to the communication connection request through the business logic area, and sending the operation information to the business fast transfer area; After performing the operation corresponding to the operation information on the communication connection request through the service fast forwarding area, the processed communication connection request is sent to the network server, so that the network server establishes a communication connection with the user terminal according to the processed communication connection request.

3. The method according to claim 1, wherein the message information includes an identifier of a user terminal, and the step of performing security verification on the processed message information comprises: Acquire an access control list, wherein the access control list includes user terminal identifiers having access rights; Determining whether the access control list contains the identifier of the user terminal; If the access control list contains the identifier of the user terminal, it is determined that the authority check on the user terminal is passed.

4. The method according to claim 1, characterized in that: The network function virtualization platform also includes a key management center and an SDN controller; the key management center includes key information corresponding to a plurality of pre-negotiated user terminals; The determining the key information corresponding to the message information includes: Sending a key acquisition request to the SDN controller through the service fast forwarding area, wherein the key acquisition request includes an identifier of the user terminal; The key information corresponding to the user terminal identifier is queried from the key management center through the SDN controller, and the key information is sent to the service fast-forwarding area.

5. The method according to claim 1, characterized in that The method further comprises: Receiving data sent by the network server through the service fast forwarding area; Encrypting the data according to the key information to obtain encrypted data; The encrypted data is sent to the user terminal.

6. The method according to claim 1, characterized in that The service fast forwarding area includes a plurality of virtual servers, and performing the operation corresponding to the operation information on the message information through the service fast forwarding area to obtain the processed message information includes: Performing the operation corresponding to the operation information on the message information through the target virtual server in the service fast forwarding area to obtain processed message information; Also includes: When the target virtual server fails, determining that the status of the service fast-forwarding zone is a healthy virtual server; The performing the operation corresponding to the operation information on the message information through the target virtual server in the service fast forwarding area to obtain the processed message information includes: The virtual server in a healthy state performs the operation corresponding to the operation information on the message information to obtain processed message information.

7. The method according to claim 6, characterized in that When the message information includes multiple messages, the receiving, through the service fast forwarding area, the encrypted message information sent by the user terminal includes: The encrypted message information sent by the user terminal is received by multiple virtual servers corresponding to the multiple message information.

8. A data processing device, characterized in that: Applied to a network function virtualization platform, the network function virtualization platform includes a service fast-forwarding area, the network function virtualization platform is connected to a user terminal and a network server respectively, and the device includes: A receiving gate, used for receiving the encrypted message information sent by the user terminal through the service fast forwarding area after the user terminal establishes a communication connection with the network server; A first determining module, used to determine the key information corresponding to the message information; A decryption gate, used to decrypt the encrypted message information according to the key information to obtain the message information; A second determination module is used to determine operation information that needs to be performed on the message information; An execution module, used for executing the operation corresponding to the operation information on the message information through the service fast forwarding area to obtain the processed message information; A check gate, used for performing security check on the processed message information; The sending module is used to send the processed message information to the network server after the security check passes.

9. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor is used to execute the steps of the data processing method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data processing method according to any one of claims 1 to 7 are implemented.

Images