A data processing method, device, apparatus, and storage medium

Abstract

The embodiment of the application provides a data processing method, device and equipment and a storage medium, message data is transmitted by encryption, thereby preventing traffic from being eavesdropped and tampered with, so that secure access to a network server is realized; the application further performs security check after processing the message information, and only when the check is passed, the message information is sent to the network server, so that an additional security check is added to the data, abnormality or tampering that may be introduced in the processing process can be found in time, and it is ensured that the data finally sent to the network server is complete and reliable, so that the data security of the entire communication link is further improved; the application receives encrypted messages, decrypts, executes operations and performs subsequent security check through a business fast forwarding area, so that unnecessary process jumps and resource allocation time can be reduced, the data processing speed is accelerated, and the overall communication efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a data processing method and device, equipment and storage medium. BACKGROUND

[0002] With the development of Web applications and changes in user needs, the importance of user terminals in accessing network servers is increasing. In the prior art, data is tampered with and eavesdropped during user access to network servers, greatly reducing the security of data transmission. SUMMARY

[0003] In view of the above problems, the present application is proposed to provide a data processing method, device, equipment and storage medium to overcome the above problems or at least partially solve the above problems.

[0004] To solve the above problems, the present application discloses a data processing method applied to a network function virtualization platform, the network function virtualization platform comprising a service fast forwarding area, the network function virtualization platform being connected with a user terminal and a network server respectively, the method comprising:

[0005] After the user terminal and the network server establish a communication connection, the encrypted message information sent by the user terminal is received through the service fast forwarding area;

[0006] Determine the key information corresponding to the message information;

[0007] Decrypt the encrypted message information according to the key information to obtain message information;

[0008] Determine the operation information to be performed on the message information;

[0009] Perform the operation corresponding to the operation information on the message information through the service fast forwarding area to obtain processed message information;

[0010] Security check is performed on the processed message information;

[0011] When the security check is passed, the processed message information is sent to the network server.

[0012] Optionally, the network function virtualization platform further comprises a service logic area, further comprising:

[0013] The encrypted communication connection request sent by the user terminal is received through the service fast forwarding area;

[0014] Obtain the decryption key corresponding to the user terminal;

[0015] decrypt the encrypted communication connection request by the decryption key to obtain the communication connection request;

[0016] determine whether the operation information corresponding to the communication connection request is contained in the service fast forwarding area;

[0017] if the operation information corresponding to the communication connection request is not contained in the service fast forwarding area, send the communication connection request to the service logic area;

[0018] query the operation information corresponding to the communication connection request by the service logic area, and send the operation information to the service fast forwarding area;

[0019] after performing the operation corresponding to the operation information on the communication connection request by the service fast forwarding area, send the processed communication connection request to the network server, so that the network server establishes a communication connection with the user terminal according to the processed communication connection request.

[0020] Optionally, the message information includes an identifier of the user terminal, and the security check on the processed message information includes:

[0021] obtain an access control list, the access control list including identifiers of user terminals with access rights;

[0022] determine whether the identifier of the user terminal is contained in the access control list;

[0023] if the identifier of the user terminal is contained in the access control list, it is determined that the permission check on the user terminal is passed.

[0024] Optionally, the network function virtualization platform further includes a key management center and an SDN controller, the key management center including key information corresponding to a plurality of user terminals pre-negotiated;

[0025] the determination of the key information corresponding to the message information includes:

[0026] send a key acquisition request to the SDN controller by the service fast forwarding area, the key acquisition request including the identifier of the user terminal;

[0027] query the key information corresponding to the identifier of the user terminal in the key management center by the SDN controller, and send the key information to the service fast forwarding area.

[0028] Optionally, the method further includes:

[0029] receive data sent by the network server by the service fast forwarding area;

[0030] encrypt the data according to the key information, to obtain encrypted data;

[0031] send the encrypted data to the user terminal.

[0032] Optionally, the service fast forwarding area includes a plurality of virtual servers, and the performing, by the service fast forwarding area, the operation corresponding to the operation information on the message information to obtain processed message information includes:

[0033] performing, by a target virtual server in the service fast forwarding area, the operation corresponding to the operation information on the message information to obtain processed message information;

[0034] Further comprising:

[0035] when the target virtual server fails, determining that the state of the service fast forwarding area is a healthy virtual server;

[0036] the performing, by the target virtual server in the service fast forwarding area, the operation corresponding to the operation information on the message information to obtain processed message information includes:

[0037] performing, by the healthy virtual server, the operation corresponding to the operation information on the message information to obtain processed message information.

[0038] Optionally, when the message information includes a plurality of message information, the receiving, by the service fast forwarding area, the encrypted message information sent by the user terminal includes:

[0039] receiving, by a plurality of virtual servers corresponding to a plurality of message information, the encrypted message information sent by the user terminal.

[0040] The application further discloses a data processing device applied to a network function virtualization platform, wherein the network function virtualization platform includes a service fast forwarding area, the network function virtualization platform is connected with a user terminal and a network server respectively, and the device includes:

[0041] a first receiving module, configured to receive, by the service fast forwarding area, encrypted message information sent by the user terminal after the user terminal and the network server establish a communication connection;

[0042] a first determining module, configured to determine key information corresponding to the message information;

[0043] a first decryption module, configured to decrypt the encrypted message information according to the key information to obtain message information;

[0044] a second determining module, configured to determine operation information required to be performed on the message information;

[0045] an execution module, configured to perform an operation corresponding to the operation information on the message information through the service fast forwarding area to obtain processed message information;

[0046] a verification module, configured to perform security verification on the processed message information;

[0047] a first sending module, configured to send the processed message information to the network server when the security verification is passed.

[0048] Optionally, the network function virtualization platform further includes a service logic area, and further includes:

[0049] a second receiving module, configured to receive an encrypted communication connection request sent by the user terminal through the service fast forwarding area;

[0050] an acquisition module, configured to acquire a decryption key corresponding to the user terminal;

[0051] a second decryption module, configured to decrypt the encrypted communication connection request through the decryption key to obtain the communication connection request;

[0052] a judgment module, configured to judge whether the service fast forwarding area contains operation information corresponding to the communication connection request;

[0053] a request sending module, configured to send the communication connection request to the service logic area if the service fast forwarding area does not contain the operation information corresponding to the communication connection request;

[0054] an operation information sending module, configured to query the operation information corresponding to the communication connection request through the service logic area and send the operation information to the service fast forwarding area;

[0055] a communication module, configured to send the processed communication connection request to a network server after performing an operation corresponding to the operation information on the communication connection request through the service fast forwarding area, so that the network server establishes a communication connection with the user terminal according to the processed communication connection request.

[0056] Optionally, the message information includes an identifier of a user terminal, and the verification module includes:

[0057] an acquisition sub-module, configured to acquire an access control list, the access control list including identifiers of user terminals with access rights;

[0058] a judgment sub-module, configured to judge whether the access control list contains the identifier of the user terminal;

[0059] The first determining sub-module is configured to determine that the permission check for the user terminal is passed if the identification of the user terminal is included in the access control list.

[0060] Optionally, the network function virtualization platform further comprises a key management center and an SDN controller, the key management center comprising pre-negotiated key information corresponding to a plurality of user terminals.

[0061] The first determining module comprises:

[0062] The first sending sub-module is configured to send a key acquisition request to the SDN controller through the service fast forwarding area, the key acquisition request comprising the identification of the user terminal.

[0063] The second sending sub-module is configured to query the key information corresponding to the identification of the user terminal from the key management center through the SDN controller and send the key information to the service fast forwarding area.

[0064] Optionally, the apparatus further comprises:

[0065] The third receiving module is configured to receive data sent by the network server through the service fast forwarding area.

[0066] The encryption module is configured to encrypt the data according to the key information to obtain encrypted data.

[0067] The second sending module is configured to send the encrypted data to the user terminal.

[0068] Optionally, the service fast forwarding area comprises a plurality of virtual servers, and the execution module comprises:

[0069] The execution sub-module is configured to execute the operation corresponding to the operation information on the message information through a target virtual server in the service fast forwarding area to obtain processed message information.

[0070] Further comprising:

[0071] The second determining sub-module is configured to determine that the state of the service fast forwarding area is a healthy virtual server when the target virtual server fails.

[0072] The execution sub-module comprises:

[0073] The execution unit is configured to execute the operation corresponding to the operation information on the message information through the healthy virtual server to obtain processed message information.

[0074] Optionally, when the message information comprises a plurality of pieces, the first receiving module comprises:

[0075] The receiving sub-module is configured to receive the encrypted message information sent by the user terminal through a plurality of virtual servers corresponding to a plurality of message information.

[0076] The application further discloses an electronic device, including a processor, a memory, and a computer program stored on the memory and capable of running on the processor, and when the computer program is executed by the processor, the steps of the data processing method are implemented.

[0077] The application further discloses a computer readable storage medium, and the computer readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data processing method are implemented.

[0078] The application embodiment has the following advantages:

[0079] The application discloses a data processing method, which realizes secure access to a network server by encrypting message data for transmission to prevent eavesdropping and tampering of the traffic. BRIEF DESCRIPTION OF DRAWINGS

[0080] Figure 1 is a step flow chart of a data processing method provided by the application embodiment;

[0081] Figure 2 is a flow chart of a data processing method provided by the application embodiment;

[0082] Figure 3 is a structural block diagram of a data processing device provided by the application embodiment. DETAILED DESCRIPTION

[0083] In order to make the above-mentioned purposes, features and advantages of the application more obvious and easy to understand, the application will be further described in detail below with reference to the drawings and specific embodiments.

[0084] One of the core ideas of the embodiment of the present application is that by encrypting the message data for transmission, the traffic is prevented from being eavesdropped and tampered with, thereby realizing secure access to the network server; the present application further performs security verification after processing the message information, and only sends it to the network server after verification, thereby adding an additional security checkpoint for data, which can timely detect abnormalities or tampering that may be introduced during processing, and ensure that the data ultimately sent to the network server is complete and reliable, thereby further improving the data security of the entire communication link. The present application receives encrypted messages, decryption, execution of operations, and subsequent security verification, etc. are all completed through the business fast forwarding area, which can reduce unnecessary process jumps and resource allocation time, speed up data processing speed, and improve overall communication efficiency.

[0085] Referring to Figure 1 , a step flowchart of a data processing method provided by an embodiment of the present application is shown, which is applied to a network function virtualization platform, the network function virtualization platform is connected with a user terminal and a network server respectively, and the method can include the following steps:

[0086] Step 101, after the user terminal and the network server establish a communication connection, the encrypted message information sent by the user terminal is received through the business fast forwarding area.

[0087] In the embodiment of the present application, the business fast forwarding area has a network interface and corresponding network protocol stack support, can identify and receive the required message according to the standard network communication protocol (such as TCP / IP protocol family), and at the same time, the function of receiving encrypted messages is based on the security communication framework set by the network function virtualization platform, which plans the channel of data inflow and the processing pre-process of encrypted data, and ensures that the encrypted message from the user terminal can be accurately captured by the business fast forwarding area, and prepares for further analysis and processing.

[0088] When the user terminal (such as personal computer, smart phone, tablet computer and other devices that can access the network and initiate communication) and the network server (which can be a server device providing web service, data storage service, application service, etc.) successfully establish a communication connection, the business fast forwarding area in the network function virtualization platform begins to play a role, which always listens to the network data flow from the user terminal, and once detects the message information encrypted and sent to the target network server, it will be received.

[0089] The message information can be encrypted by using various encryption methods such as symmetric encryption algorithm (such as AES encryption algorithm) or asymmetric encryption algorithm (such as RSA encryption algorithm), which carries various data contents that the user wants to convey to the network server, such as user login information, business operation request, file transmission data, etc.

[0090] Step 102, determine the key information corresponding to the message information;

[0091] In the embodiment of the application, after receiving the encrypted message information, the corresponding key information needs to be determined from the corresponding key management system or storage location. It should be noted that the key information is obtained in advance according to the certificate file.

[0092] If a symmetric encryption method is used, the user terminal and the receiving party usually share the same key in advance. At this time, the key needs to be accurately extracted from the pre-agreed secure storage location (such as a key database).

[0093] If an asymmetric encryption algorithm is used, the private key that can decrypt the message needs to be obtained from the corresponding private key storage area, because in asymmetric encryption, the public key is used for encryption and the private key is used for decryption. For example, in a certificate-based encrypted communication scenario, the platform obtains the related identifier of the corresponding public key information from the digital certificate attached to the message through verification, and then finds the matching private key from the local key repository according to the identifier.

[0094] Step 103, decrypt the encrypted message information according to the key information to obtain the message information;

[0095] In the embodiment of the application, after obtaining the correct key information, the corresponding decryption algorithm is used to decrypt the encrypted message information received previously. In one example, if the AES symmetric encryption algorithm is used, the key is input into the decryption algorithm function as a parameter according to the specified decryption process, and the ciphertext is processed block by block or bit by bit to restore the original message information.

[0096] If the RSA asymmetric encryption algorithm is used, the obtained private key is used to perform inverse operation on the part of the ciphertext encrypted by the public key according to the mathematical operation rules, to restore the original message content. For example, the encrypted message originally presents a string of seemingly irregular binary ciphertext, which will become the original message containing clear and readable text, numerical information, etc. after decryption. It may be a specific user login related message content such as "username: Zhang San, password: 123456, request login operation".

[0097] Step 104, determine the operation information to be performed on the message information;

[0098] In the embodiment of the present application, after the original message information is successfully acquired, the operation information that needs to be performed on the message information can be determined based on various factors, such as the format and content of the message itself, the processing rules preset by the network function virtualization platform, and the like. For example, if the format of the message does not conform to the standard format received by the target network server, the operation information can include the requirement of performing format conversion on the message to make it conform to the parsing specification of the server side.

[0099] In an example, the protocol format of the message information is A protocol, and the network server supports B protocol, so the message data needs to be rewritten, and the operation information performed on the message information is the conversion of the protocol format of the message information.

[0100] In step 105, the operation corresponding to the operation information is performed on the message information by the service fast forwarding area, and the processed message information is obtained.

[0101] In the embodiment of the present application, the service fast forwarding area in the network function virtualization platform can be used to process the message information. If the operation information is a message forwarding operation, the service fast forwarding area can accurately send the message information to the next network node or directly to the corresponding port of the target network server through the network interface according to the network topology and the address information of the target server. If it is a format conversion operation, the fields and encoding methods in the message can be adjusted according to the predetermined format specification, such as converting the text field originally encoded in ASCII to UTF-8 encoding, or converting the structure of the message from a specific custom format to a request message format conforming to the HTTP protocol standard, and the like. After processing, the processed message information that meets the requirements is obtained.

[0102] In step 106, the processed message information is subjected to security verification.

[0103] In the embodiment of the present application, the processed message information obtained in step 105 can be subjected to security verification. This verification process can cover multiple dimensions.

[0104] In an example, the integrity of the message is first checked. The checksum of the message (such as the common CRC checksum, MD5 checksum, etc.) or the digest information of the message generated by using a hash algorithm (such as SHA-256, etc.) is calculated, and is compared with the reference value stored in advance or attached to the message to determine whether they are consistent, so as to determine whether the message has been lost or tampered with during transmission and processing.

[0105] Secondly, the legality of the message will be verified, according to the security policy and business rules preset by the network function virtualization platform, check whether the source of the message is legal, the content of the message is in line with the business requirements (such as whether it contains illegal characters, whether it conforms to the format specification of a specific business, etc.). In addition, if it involves security mechanisms such as digital signature, the validity of the signature will also be verified to ensure that the message is indeed generated by the legitimate sender and has not been tampered with.

[0106] Step 107, when the security check is passed, the processed message information is sent to the network server.

[0107] In the embodiment of the application, when the processed message information passes the security check and the result is passed, it means that the message information at this time has gone through a series of rigorous processing procedures, is safe and reliable, and meets the requirements. At this time, the network function virtualization platform will send the processed message information to the network server. The sending process also follows the network communication protocol (such as the TCP / IP protocol family), and through the network interface and the corresponding network link, the message is accurately and correctly transmitted to the specified port of the network server, so that the network server can carry out corresponding business processing based on the content of the message after receiving the message, such as analyzing the user's web access request and returning the corresponding web page content, or storing, calculating and further operating the business data submitted by the user.

[0108] The application discloses a data processing method, which transmits message data by encryption to prevent traffic from being eavesdropped and tampered with, thereby realizing secure access to a network server; the application further performs security check after processing the message information, and only sends it to the network server after passing the check, thereby adding an "inspection checkpoint" for data, discovering abnormalities or tampering in the processing process in time, ensuring that the data finally sent to the network server is complete and reliable, and further improving the data security of the entire communication link; the application receives encrypted messages, decrypts, executes operations, and performs subsequent security checks through a business fast forwarding area, thereby reducing unnecessary process jumps and resource allocation time, accelerating data processing speed, and improving overall communication efficiency.

[0109] In an embodiment of the present application, the network function virtualization platform further comprises a service logic area, and further comprises: receiving the encrypted communication connection request sent by the user terminal through the service fast forwarding area; obtaining the decryption key corresponding to the user terminal; decrypting the encrypted communication connection request through the decryption key to obtain the communication connection request; judging whether the service fast forwarding area contains the operation information corresponding to the communication connection request; if the service fast forwarding area does not contain the operation information corresponding to the communication connection request, sending the communication connection request to the service logic area; querying the operation information corresponding to the communication connection request through the service logic area, and sending the operation information to the service fast forwarding area; after executing the operation corresponding to the operation information on the communication connection request through the service fast forwarding area, sending the processed communication connection request to the network server, so that the network server establishes a communication connection with the user terminal according to the processed communication connection request.

[0110] In the embodiment of the present application, when the user terminal wants to establish a communication connection with the network server, it will first generate a communication connection request, which contains the identification information of the user terminal itself (such as IP address, device number, etc.), the target server information of the request connection (such as server domain name, IP address, etc.), and some other necessary data contents for verification or indicating the connection intention.

[0111] In order to ensure the security in the transmission process, the user terminal will use a specific encryption algorithm to encrypt the communication connection request, and then send the encrypted request to the network. At this time, the service fast forwarding area in the network function virtualization platform is like an "information collection station", which is always listening to the network port, and according to the network communication protocol (such as TCP / IP protocol family) to identify and receive the encrypted communication connection request from the user terminal, to ensure that no request information meeting the requirements is missed, and to prepare for further processing.

[0112] After receiving the encrypted communication connection request, the next step is to obtain the key that can decrypt it. If the symmetric encryption method is used, the decryption key is the same key that the user terminal and the network function virtualization platform previously shared. At this time, the platform needs to accurately find and extract this key from a secure key storage location (such as a special key database, which has strict access control and encryption protection measures).

[0113] If an asymmetric encryption algorithm is used, for example, based on public key encryption and private key decryption, the platform needs to obtain the corresponding private key from the corresponding private key storage area according to the public key information (which can be identified and associated through a digital certificate or the like) associated with the user terminal, because only the matching private key can decrypt the content encrypted by the corresponding public key. For example, in a PKI (Public Key Infrastructure) based network environment, the platform will first verify the digital certificate attached to the communication connection request, confirm the legitimacy of the certificate, obtain the public key related identification information from the certificate, and then find the corresponding private key in the local key repository according to the identification.

[0114] When the business fast forwarding area obtains the correct decryption key, it will use the corresponding decryption algorithm to decrypt the previously received encrypted communication connection request. Taking the symmetric encryption algorithm AES as an example, the obtained key will be input into the AES decryption algorithm function as an important parameter, and the data in the encrypted request will be processed block by block or bit by bit according to the specified decryption process, and the ciphertext will be gradually converted into the original, clear and readable communication connection request content.

[0115] After successfully decrypting the communication connection request, the network function virtualization platform business fast forwarding area will perform internal lookup and judgment to see if it has pre-stored operation information corresponding to the communication connection request. The business fast forwarding area can maintain an operation information table or operation rule set inside, which records the operation details of similar requests processed previously or some specific type of requests according to the preset rules.

[0116] For example, for some common and standardized web access requests, the business fast forwarding area may have pre-configured corresponding forwarding operation information, knowing that such requests should be directly forwarded to which specific network server module or network node. At this time, the relevant features of the communication connection request (such as request type, target server identification, etc.) obtained by decryption will be compared with the existing operation information to see if the corresponding operation information can be matched. If the business fast forwarding area contains the operation information corresponding to the communication connection request, the operation corresponding to the operation information can be performed on the communication connection request at this time.

[0117] If the service fast forwarding area does not contain the operation information corresponding to the communication connection request, that is, it is determined that the operation information corresponding to the communication connection request does not exist in the service fast forwarding area, in order to continue to process the request and find the appropriate operation mode to establish the communication connection, the network function virtualization platform will send the decrypted communication connection request to the service logic area, and the sending process also follows the network communication protocol, will pack the communication connection request into appropriate network data packets, and then accurately transmit it to the receiving port of the service logic area through the internal network link, to ensure that the request information reaches the service logic area completely and without error, so that the service logic area can carry out further query operation based on the received request.

[0118] After the service logic area receives the communication connection request from the service fast forwarding area, it will start the query mechanism to find the operation information corresponding to the request. The service logic area often has a more abundant service rule knowledge base and more complex logic analysis ability. It can analyze the characteristics of the communication connection request (such as the type of the request, the server resources involved, the user's permission level, etc.), combine a large amount of information such as pre-set business process rules, security policies and system configurations, and use various ways such as querying the database, matching the rule template and calling the related algorithm to carry out comprehensive analysis, in order to determine the operation information suitable for the communication connection request. For example, if the communication connection request is an access request for a specific permission controlled enterprise intranet page resource, the service logic area will find out the specific operation information according to the user terminal identity authentication information, the permission requirement of the requested resource and other factors, such as whether to perform additional identity verification operation before forwarding operation, or directly allow forwarding operation. Once the corresponding operation information is queried, the service logic area will pack the operation information into network data packets according to the communication mechanism inside the network function virtualization platform, and then accurately send it back to the service fast forwarding area through the internal network link, so that the service fast forwarding area can subsequently execute the corresponding operation according to the operation information.

[0119] The business fast forwarding area receives the operation information sent back from the business logic area, and processes the communication connection request according to the specific operation corresponding to the operation information, if the operation information indicates a forwarding operation, the business fast forwarding area will accurately send the communication connection request to the next network node or directly to the corresponding port of the target network server according to the network topology and the address information (such as IP address, port number, etc.) of the network server through the network interface and the underlying network driver of the business fast forwarding area; if the operation information requires a format conversion operation, for example, converting the request format from a specific custom format to a request format conforming to the HTTP protocol standard, the format conversion module inside the business fast forwarding area will adjust the fields, encoding methods, etc. in the communication connection request, reassemble according to the predetermined format specification, obtain the processed communication connection request, and then, also in accordance with the network communication protocol (such as the TCP / IP protocol family), the business fast forwarding area will send the processed communication connection request to the network server through the network link. The network server receives the request and processes it based on the content of the request, such as verifying the legality of the request, parsing the parameter information in the request, and then establishing a communication connection with the user terminal to realize subsequent communication activities such as data interaction between the two parties.

[0120] In an embodiment of the present application, the message information includes the identification of the user terminal, and the security check on the processed message information includes: obtaining an access control list, the access control list including the identification of the user terminal with access rights; determining whether the identification of the user terminal is included in the access control list; and if the identification of the user terminal is included in the access control list, determining that the permission check on the user terminal is passed.

[0121] In the embodiment of the present application, the network function virtualization platform can further include a user security function area, and the access control list can be obtained from the user security function area. The access control list (ACL, Access Control List) is a commonly used tool in network security mechanisms, which is set and maintained in advance by a network administrator or a security policy configuration module of the system. The list records the identification information of the user terminals granted access rights in detail. The identification of the user terminal can have various forms, such as common IP address, MAC address, device serial number, or unique identity number allocated to the user terminal in a specific network system. The network function virtualization platform extracts the access control list from a specific storage location or configuration database. The storage location usually has strict access right management, and only system modules or administrator accounts with corresponding rights can read, modify, and other operations, so as to ensure the security and accuracy of the access control list.

[0122] For example, in an enterprise intranet, the network administrator will add the IP addresses of various client terminals to the corresponding access control list according to the work responsibilities and business needs of employees in different departments, and clearly specify the range of network resources they can access, such as market department employees' computers can access marketing-related data servers, and R&D department employees' computers can access code repository server resources, etc. These information will be reflected in the access control list.

[0123] After obtaining the access control list, the network function virtualization platform extracts the user terminal identifier contained in the just-received message information, and then compares it with each user terminal identifier in the access control list. This comparison process can be implemented in various ways. For example, if the user terminal identifier is in the form of an IP address, the platform can use a string matching algorithm or an IP address comparison function to accurately match the IP address in the message with the IP address entries recorded in the access control list. If other forms of identifiers such as device serial numbers are used, there will be corresponding lookup and matching mechanisms to determine whether there is an identical identifier record in the access control list. For example, if the IP address of the user terminal in the message information is "192.168.1.100", the platform will search the numerous IP address records in the access control list to determine whether this IP address exists, in order to determine whether the user terminal is within the authorized access range.

[0124] When the preceding comparison and judgment steps find that the access control list indeed contains the user terminal identifier carried in the message information, the network function virtualization platform will determine that the permission check for the user terminal is passed, which means that from the perspective of access permission, the user terminal is allowed to perform corresponding operations and send corresponding message information in the network system. Based on the result of this permission check, the platform can continue to perform other security checks on the message information (such as data integrity check, message legality check, etc.), or further process and forward the message according to the normal business process, and promote the smooth development of the entire network communication activity. For example, in an online shopping platform network system, if the user terminal identifier passes the permission check of the access control list, the platform can continue to process the message containing information such as product selection, ordering, etc. sent by the user terminal, and forward it to the corresponding order processing server and other related modules for subsequent business operations.

[0125] The application can clearly determine whether the user terminal currently sending the message information is authorized by comparing with the access control list, avoid the illegal user terminal from trying to break through the network security line by means of the forged or tampered message, illegally obtaining the network resource or performing malicious operation, thereby ensuring that the data and resource in the network system are only open to the authorized object, and maintaining the network security order.

[0126] In an embodiment of the application, the network function virtualization platform further comprises a key management center and an SDN controller, the key management center comprises pre-negotiated key information corresponding to a plurality of user terminals; and the key information corresponding to the message information is determined by sending a key acquisition request to the SDN controller through the service fast forwarding area, the key acquisition request comprising an identifier of the user terminal; querying the key information corresponding to the user terminal identifier from the key management center through the SDN controller, and sending the key information to the service fast forwarding area.

[0127] In the embodiment of the application, when the service fast forwarding area of the network function virtualization platform receives the encrypted message information from the user terminal, in order to be able to perform the decryption operation on the message, the corresponding key information needs to be acquired first, at this time, the service fast forwarding area will generate a key acquisition request, the request comprising an identifier of the user terminal sending the message information, as described above, the identifier of the user terminal can be an IP address, a MAC address or a unique identity number allocated by a specific network system, etc., the service fast forwarding area will encapsulate the key acquisition request according to the communication protocol and message format set inside the network function virtualization platform, and then send the key acquisition request to the SDN controller through the network link inside the platform, for example, in a network function virtualization environment, the service fast forwarding area detects an encrypted message from a user terminal with an IP address of "192.168.1.100", it will construct a key acquisition request, and mark the "192.168.1.100" user terminal identifier in the request, and then send the request to the SDN controller through the internal virtual network channel.

[0128] After the SDN controller receives the key acquisition request from the service fast forwarding area, a query mechanism is started to find the key information corresponding to the user terminal identifier contained in the request. The key management center negotiates the session symmetric key for the user and the server to communicate before establishing the session according to the certificate information. After the negotiation is completed, the key is stored in the key database. The key information corresponding to multiple user terminals is pre-negotiated and stored in the library. According to the user terminal identifier in the key acquisition request, the key information library is accurately positioned to the corresponding key record through searching and matching operations. For example, if the user terminal identifier indicated in the key acquisition request, the SDN controller will find the key information associated with the user terminal identifier as an index in the key database of the key management center. Once the corresponding key information is found, the SDN controller will also encapsulate the key information according to the communication protocol and message format inside the network function virtualization platform, and then send it back to the service fast forwarding area through the internal network link, to ensure that the service fast forwarding area can accurately receive the key information, so as to perform subsequent decryption operation on the message information.

[0129] In an embodiment of the present application, the method further comprises: receiving data sent by the network server through the service fast forwarding area; encrypting the data according to the key information to obtain encrypted data; and sending the encrypted data to the user terminal.

[0130] In the embodiment of the present application, during the running of the network function virtualization platform, the network server will send various types of data to the user terminal based on the interaction demand between the network server and the user terminal. These data can be web content information (such as HTML documents, pictures, script files, etc.), or response data to the previous request of the user terminal (such as query results returned after the user queries the database, feedback information after business operation, etc.). The network server will encapsulate and send these data to the network according to the network communication protocol (such as TCP / IP protocol family). The service fast forwarding area in the network function virtualization platform acts as a "transit station" role to receive these data. It always listens to the network data flow from the network server, identifies the required data according to the established protocol rules and its own configuration, and receives it down for further processing. For example, when the user requests to view the product detail page through the browser, the network server will send the web data containing product pictures, prices, descriptions, etc. The service fast forwarding area will receive these data.

[0131] After the data sent by the network server is successfully received in the business fast forwarding area, the data can be encrypted according to the key information determined before, and the key information is the key corresponding to the key involved when the user terminal sends the message information to the network server before. If a symmetric encryption algorithm (such as the AES algorithm) is used, the business fast forwarding area will divide the received data according to certain grouping rules (such as 128 bits for a group, etc.), then use the key as an important parameter, and use the encryption algorithm function of the AES to encrypt each group of data. Through multiple rounds of encryption operations such as permutation and substitution, the original clear and readable data is converted into a string of seemingly irregular ciphertext data, that is, the encrypted data is obtained, and the security of the data in the transmission process back to the user terminal is ensured.

[0132] After the data is encrypted in the business fast forwarding area, the encrypted data is obtained, and then the encrypted data needs to be sent to the user terminal, so that the user terminal can receive the information from the network server. The business fast forwarding area will encapsulate the encrypted data into network data packets according to the network communication protocol (such as the TCP / IP protocol family), add necessary protocol header information (such as the source address of the network address where the business fast forwarding area is located, the destination address of the IP address of the user terminal, and the port number and other information), and then send the data packet to the corresponding port of the user terminal through the internal and external network links of the network function virtualization platform. For example, in a network function virtualization application scenario in a campus network environment, the business fast forwarding area encapsulates the network server data containing the course material download link after encryption, and accurately sends the data to the student user terminal requesting the material through the virtual network inside the campus network and the router connected to the external network and other devices, completing the data transmission process. The application effectively protects the privacy of the user and the security of the data interaction between the network server and the user terminal, ensures the safety and reliability of the information in the network transmission, and maintains the security environment of the entire network communication.

[0133] In an embodiment of the application, the business fast forwarding area includes a plurality of virtual servers, and the operation information corresponding to the operation information is executed on the message information through the target virtual server in the business fast forwarding area to obtain the processed message information. When the target virtual server fails, the state of the business fast forwarding area is determined to be a healthy virtual server. The operation information corresponding to the operation information is executed on the message information through the target virtual server in the business fast forwarding area to obtain the processed message information, including executing the operation information corresponding to the operation information on the message information through the virtual server in a healthy state to obtain the processed message information.

[0134] In the embodiment of the present application, after determining the operation information required for the message information, the service fast forwarding area selects a suitable target virtual server from the multiple virtual servers contained in the service fast forwarding area to perform the corresponding operation. Each virtual server is configured with specific functions or has corresponding resources to process specific types of operation tasks in the service fast forwarding area. For example, some virtual servers can be used for data format conversion operation and have corresponding encoding conversion tools and parsing modules; some virtual servers can be used for message forwarding operation and are configured with perfect network routing function and network interface. When the message information needs to be operated, the target virtual server with matching function is selected according to the specific requirements of the operation information. After selection, the target virtual server processes the message information according to the specific operation mode specified by the operation information. For example, if the operation information requires converting the format of the message from a self-defined format to a format conforming to the HTTP protocol standard, the data parsing module in the target virtual server will first disassemble the message according to the existing format, and then the encoding conversion module will re-encode and assemble it according to the HTTP protocol standard, and finally obtain the processed message information, so that it can meet the requirements of subsequent network server receiving and processing.

[0135] During network operation, the target virtual server may fail to work normally due to various reasons (such as hardware failure, crash caused by software vulnerability, network connection exception, etc.). At this time, the service fast forwarding area can timely discover and confirm the fault state of the target virtual server, which can be realized in various ways, such as periodically sending heartbeat detection signals to each virtual server, and if the response of the target virtual server is not received within the specified time, it can be judged that the target virtual server has failed; or monitoring the key performance indicators (such as CPU usage rate being 0 for a long time, network interface having no data transmission and reception, etc.) of the virtual server to determine the occurrence of failure. Once it is determined that the target virtual server has failed, the service fast forwarding area will start the virtual server health state searching mechanism to check the state of all virtual servers in the area, mainly to check whether they are currently executing tasks, that is, whether they are in a healthy state. By traversing the task queues, resource occupation conditions and other information of each virtual server, the virtual servers with idle resources and in a healthy state are selected to prepare for subsequent transfer of the message processing task originally to be performed by the target virtual server.

[0136] For example, the service fast forwarding area originally arranges virtual server A to process the forwarding operation of a certain message information as the target virtual server, but after virtual server A fails, it is found through checking that virtual servers B and C currently have no tasks being processed, so they are determined as virtual servers in a healthy state and can be selected for subsequent processing of the message information.

[0137] The application continues to perform the message processing task by replacing the target virtual server with a healthy virtual server, realizes seamless connection of service processing, effectively avoids the message processing interruption problem caused by server failure, guarantees the continuity and stability of network communication, which makes the entire network function virtualization platform still be able to process message information according to the established business process when facing the sudden failure of the virtual server, maintains the normal interaction between the user terminal and the network server, ensures that the network service is not interrupted, realizes business non-perception when the single load balancing server failure triggers traffic switching, and improves the ability of the network system to cope with failure and the overall reliability.

[0138] In an embodiment of the application, when the message information includes multiple message information, receiving the encrypted message information sent by the user terminal through the service fast transfer area includes: receiving the encrypted message information sent by the user terminal through multiple virtual servers corresponding to the multiple message information.

[0139] In the actual network communication scenario, multiple message information is often simultaneously sent from the user terminal to the network server, for example, in a large enterprise office network, numerous employees simultaneously use office terminals to perform web page browsing, file uploading and downloading, business data submission and other operations, thereby generating a large amount of different message information, at this time, multiple virtual servers in the service fast transfer area of the network function virtualization platform cooperatively participate in the process of receiving the encrypted message information, thereby realizing load balancing.

[0140] Each virtual server is configured or dynamically allocated to receive specific message information, which can be determined based on multiple factors, a common way is to divide according to the type of message information, for example, message information related to web access request is allocated to virtual server A for receiving, message information containing file transmission related content is arranged for virtual server B for receiving, etc.; another way is to allocate according to certain attributes (such as IP address range, department affiliation, etc.) of the user terminal, for example, message information sent by user terminals belonging to a certain department is uniformly received by virtual server C, these virtual servers always listen to the network port, according to the network communication protocol and receiving rules set by the network function virtualization platform, identify the encrypted message information from the user terminal direction and meet the receiving requirements of the virtual server, and receive it, for example, virtual server A will specially focus on the message in the network traffic whose purpose is to access a specific web service and uses the corresponding encryption method, once the encrypted message that meets the conditions is detected, it will be received and prepared for subsequent processing.

[0141] For example, Figure 2A flow chart of a data processing method provided by an embodiment of the application is shown. User 1 can send a communication connection request to a target virtual server in the service fast forwarding area. The target virtual server can determine whether there is operation information of the communication connection request. If not, the communication connection request is sent to a backend server in the service logic area. The operation information corresponding to the communication connection request is queried in the backend server. The operation information is sent to the target virtual server by the backend server. The corresponding operation of the communication connection request is performed according to the operation information. The processed communication connection request is obtained. The processed communication connection request is subjected to security check. The processed communication connection request is sent to the web server after the security check is passed. Thus, the communication connection between user 1 and the web server is established.

[0142] After the communication connection between user 1 (user terminal) and the web server is established, user 1 starts to send files to the web server. User 1 can encrypt the files to be sent by using the key agreed in advance by the key management center. The encrypted files are sent to the service fast forwarding area. When the files are large, they are encapsulated into many data packets. The service fast forwarding area sends a key acquisition request to the SDN controller to acquire the symmetric key agreed in advance, and then decrypts the encrypted files according to the key to obtain the original files. Since a connection is established, the service fast forwarding area can directly query the corresponding rules from the table. The rules include how to operate the packets (rewrite, encapsulate, etc.). Since the packets sent by the user terminal have passed the security check, the processed packets can be directly sent to the web server.

[0143] The packets received by the service fast forwarding area are encrypted packets. The encryption key is obtained by user 1 and the key management center according to the certificate. The key management center can distribute the key to the SDN controller. The service fast forwarding area can acquire the key information from the SDN controller when the encrypted packets need to be decrypted.

[0144] The application discloses a data processing method, which realizes safe access to a network server by encrypting transmission of message data to prevent eavesdropping and tampering of traffic.

[0145] It should be noted that, for the method embodiments, in order to simply describe, they are all expressed as a series of action combinations, but those skilled in the art should know that the embodiments of the application are not limited by the action sequence described, because according to the embodiments of the application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification all belong to preferred embodiments, and the actions involved are not necessarily necessary for the embodiments of the application.

[0146] Referring to Figure 3 , a structural block diagram of a data processing device provided by an embodiment of the application is shown, which is applied to a network function virtualization platform, the network function virtualization platform includes a business fast transfer area, the network function virtualization platform is connected with a user terminal and a network server respectively, and the device includes:

[0147] A first receiving module 201 is configured to receive encrypted message information sent by the user terminal through the business fast transfer area after the user terminal and the network server establish a communication connection.

[0148] A first determining module 202 is configured to determine key information corresponding to the message information.

[0149] A first decryption module 203 is configured to decrypt the encrypted message information according to the key information to obtain the message information.

[0150] A second determining module 204 is configured to determine operation information to be performed on the message information.

[0151] An execution module 205 is configured to perform an operation corresponding to the operation information on the message information through the business fast transfer area to obtain processed message information.

[0152] A verification module 206 is configured to perform security verification on the processed message information.

[0153] The first sending module 207 is used for sending the processed message information to the network server after the security check is passed.

[0154] The application discloses a data processing device, which prevents flow from being eavesdropped and tampered by encrypting transmission of message data, thereby realizing safe access to a network server; the application further performs security check after processing message information, and only sends the message information to the network server after the security check is passed, so that a data is additionally provided with an "security checkpoint", abnormality or tampering in a processing process can be found in time, and it is ensured that data finally sent to the network server is complete and reliable, and data security of the whole communication link is further improved; the application receives encrypted message, decryption, operation execution and subsequent security check through a business fast switching area, unnecessary process switching and resource allocation time can be reduced, data processing speed is accelerated, and overall communication efficiency is improved.

[0155] In an embodiment of the application, the network function virtualization platform further comprises a business logic area, and further comprises:

[0156] The second receiving module is configured to receive the encrypted communication connection request sent by the user terminal through the business fast switching area;

[0157] The obtaining module is configured to obtain a decryption key corresponding to the user terminal;

[0158] The second decryption module is configured to decrypt the encrypted communication connection request through the decryption key to obtain the communication connection request;

[0159] The judging module is configured to judge whether the operation information corresponding to the communication connection request is contained in the business fast switching area;

[0160] The request sending module is configured to send the communication connection request to the business logic area if the operation information corresponding to the communication connection request is not contained in the business fast switching area;

[0161] The operation information sending module is configured to query the operation information corresponding to the communication connection request through the business logic area, and send the operation information to the business fast switching area;

[0162] The communication module is configured to send the processed communication connection request to the network server after the operation information corresponding to the operation is performed on the communication connection request through the business fast switching area, so that the network server establishes a communication connection with the user terminal according to the processed communication connection request.

[0163] In an embodiment of the application, the message information comprises an identifier of the user terminal, and the check module comprises:

[0164] The acquisition sub-module is configured to acquire an access control list, wherein the access control list comprises a user terminal identifier with access permission.

[0165] The judgment sub-module is configured to judge whether the user terminal identifier is contained in the access control list.

[0166] The first determination sub-module is configured to determine that the permission check for the user terminal is passed if the user terminal identifier is contained in the access control list.

[0167] In an embodiment of the present application, the network function virtualization platform further comprises a key management center and an SDN controller, wherein the key management center comprises pre-negotiated key information corresponding to a plurality of user terminals.

[0168] The first determination module comprises:

[0169] The first sending sub-module is configured to send a key acquisition request to the SDN controller through the service fast forwarding area, wherein the key acquisition request comprises the user terminal identifier.

[0170] The second sending sub-module is configured to query the key information corresponding to the user terminal identifier from the key management center through the SDN controller and send the key information to the service fast forwarding area.

[0171] In an embodiment of the present application, the device further comprises:

[0172] The third receiving module is configured to receive data sent by the network server through the service fast forwarding area.

[0173] The encryption module is configured to encrypt the data according to the key information to obtain encrypted data.

[0174] The second sending module is configured to send the encrypted data to the user terminal.

[0175] In an embodiment of the present application, the service fast forwarding area comprises a plurality of virtual servers, and the execution module comprises:

[0176] The execution sub-module is configured to execute the operation corresponding to the operation information on the message information through a target virtual server in the service fast forwarding area to obtain processed message information.

[0177] Further comprising:

[0178] The second determination sub-module is configured to determine that the state of the service fast forwarding area is a healthy virtual server when the target virtual server fails.

[0179] The execution sub-module comprises:

[0180] The execution unit is used for performing an operation corresponding to the operation information on the message information by the virtual server in a healthy state, to obtain processed message information.

[0181] In an embodiment of the present application, when the message information includes multiple, the first receiving module comprises:

[0182] The receiving sub-module is used for receiving the encrypted message information sent by the user terminal through the multiple virtual servers corresponding to the multiple message information.

[0183] The present application discloses a kind of data processing device, by message data is encrypted transmission, prevent traffic from eavesdropping and tampering, to realize the security access of network server;The present application will also be carried out after processing message information Security Check, only pass the check will be sent to network server, for data, it has added a "security checkpoint", can find the abnormality possibly introduced in processing process or tampered with etc., ensure that the data that finally reaches network server is complete and reliable, further improve the data security of entire communication link, the present application receives encrypted message, decryption, execution operation and subsequent security check etc.are all completed by business fast transfer area, unnecessary process jump and resource deployment time can be reduced, speed up data processing speed, improve overall communication efficiency.

[0184] For device embodiment, since it is basically similar to method embodiment, so it is described more simply, and relevant part refers to the part of method embodiment.

[0185] The present application also provides an electronic device, comprising:

[0186] Including processor, memory and computer program stored on memory and capable of running on processor, the computer program is implemented when processor executes each process of the above-mentioned data processing method embodiment, and can achieve the same technical effect, to avoid repetition, here no longer repeat.

[0187] The present application also provides a kind of computer readable storage medium, computer readable storage medium stores computer program, computer program is implemented when processor executes each process of the above-mentioned data processing method embodiment, and can achieve the same technical effect, to avoid repetition, here no longer repeat.

[0188] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments.

[0189] Those skilled in the art will appreciate that embodiments of the present application can be readily used as a method, apparatus, or computer program product. Accordingly, embodiments of the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, and the like) embodying computer program instructions.

[0190] Embodiments of the present application are described herein with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing device or other programmable data processing terminal devices to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal devices, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0191] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing terminal devices to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0192] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal devices to cause a series of operational steps to be performed on the computer or other programmable terminal devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable terminal devices provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0193] While preferred embodiments of the present application have been described, modifications and alterations thereto will occur to those skilled in the art upon reading the preceding description. In particular, it will be apparent to those skilled in the art that parts can be added to, or substituted for, parts of the described embodiments of the present application. Accordingly, the application is intended to be

[0194] Finally, it needs to be pointed out that in this article, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the term "includes" "contains" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or terminal device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or terminal device. Without more limitation, the element defined by the statement "includes a" does not exclude the presence of other identical elements in the process, method, article or terminal device including the element.

[0195] The above describes in detail the data processing method, device, equipment and storage medium provided by the present application. The principles and implementation manners of the present application are described by applying specific examples. The above example is only used to help understand the method of the present application and its core idea. Meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manner and application range will be changed. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A data processing method, characterized by, The application is applied to a network function virtualization platform, the network function virtualization platform comprises a service fast forwarding area, the network function virtualization platform is connected with a user terminal and a network server respectively, the service fast forwarding area comprises an operation information table or an operation rule set corresponding to a communication connection request, and the operation information table and the operation rule set record operation details of a similar request processed previously or corresponding to a certain specific type of request according to a preset rule; The receiving of the encrypted message, the decryption, the operation execution and the subsequent security check are all completed through the service fast forwarding area; the method comprises: After the user terminal and the network server establish a communication connection, the encrypted message information sent by the user terminal is received through the service fast forwarding area; The key information corresponding to the message information is determined; The encrypted message information is decrypted according to the key information to obtain message information; The operation information to be executed on the message information is determined; The operation corresponding to the operation information is executed on the message information through the service fast forwarding area to obtain processed message information; The security check is performed on the processed message information; When the security check is passed, the processed message information is sent to the network server; The network function virtualization platform further comprises a service logic area, and further comprises: The encrypted communication connection request sent by the user terminal is received through the service fast forwarding area; The decryption key corresponding to the user terminal is obtained; The encrypted communication connection request is decrypted through the decryption key to obtain the communication connection request; It is judged whether the operation information corresponding to the communication connection request is contained in the service fast forwarding area; If the operation information corresponding to the communication connection request is not contained in the service fast forwarding area, the communication connection request is sent to the service logic area; The operation information corresponding to the communication connection request is inquired through the service logic area, and the operation information is sent to the service fast forwarding area; After the operation corresponding to the operation information is executed on the communication connection request through the service fast forwarding area, the processed communication connection request is sent to the network server, so that the network server establishes a communication connection with the user terminal according to the processed communication connection request.

2. The method according to claim 1, wherein the message information comprises an identifier of the user terminal, and the security check on the processed message information comprises: An access control list comprising identifiers of user terminals with access rights is obtained; It is judged whether the identifier of the user terminal is contained in the access control list; If the identifier of the user terminal is contained in the access control list, it is determined that the permission check on the user terminal is passed.

3. The method of claim 1, wherein, The network function virtualization platform further comprises a key management center and an SDN controller; the key management center comprises key information corresponding to a plurality of user terminals negotiated in advance; The determination of the key information corresponding to the message information comprises: A key acquisition request is sent to the SDN controller through the service fast forwarding area, and the key acquisition request comprises the identifier of the user terminal. The SDN controller queries the key information corresponding to the user terminal identifier from the key management center, and sends the key information to the service fast forwarding area.

4. The method of claim 1, wherein, The method further comprises: The service fast forwarding area receives data sent by the network server; The data is encrypted according to the key information to obtain encrypted data; The encrypted data is sent to the user terminal.

5. The method of claim 1, wherein, The service fast forwarding area comprises a plurality of virtual servers, and the service fast forwarding area performs the operation corresponding to the operation information on the message information to obtain processed message information, comprising: The target virtual server in the service fast forwarding area performs the operation corresponding to the operation information on the message information to obtain processed message information; Further comprising: When the target virtual server fails, the state of the service fast forwarding area is determined to be a healthy virtual server; The target virtual server in the service fast forwarding area performs the operation corresponding to the operation information on the message information to obtain processed message information, comprising: The healthy virtual server performs the operation corresponding to the operation information on the message information to obtain processed message information.

6. The method of claim 5, wherein, When the message information comprises a plurality of message information, the service fast forwarding area receives the encrypted message information sent by the user terminal, comprising: A plurality of virtual servers corresponding to a plurality of message information receive the encrypted message information sent by the user terminal.

7. A data processing apparatus, characterized by The network function virtualization platform comprises a service fast forwarding area, and the network function virtualization platform is connected with a user terminal and a network server, respectively. The service fast forwarding area contains an operation information table or an operation rule set corresponding to a communication connection request, and the operation information table and the operation rule set record the operation details of a similar request processed previously or a certain specific type of request according to a preset rule; The encrypted message, decryption, operation execution, and subsequent security verification are all completed by the service fast forwarding area; the device comprises: A first receiving module is configured to receive encrypted message information sent by the user terminal through the service fast forwarding area after the user terminal and the network server establish a communication connection; A first determining module is configured to determine key information corresponding to the message information; A first decryption module is configured to decrypt the encrypted message information according to the key information to obtain message information; A second determining module is configured to determine operation information to be executed on the message information; An execution module is configured to perform the operation corresponding to the operation information on the message information through the service fast forwarding area to obtain processed message information; A verification module is configured to perform security verification on the processed message information; A first sending module is configured to send the processed message information to the network server when the security verification is passed. The network function virtualization platform further comprises a service logic area, and further comprises: A second receiving module is configured to receive encrypted communication connection requests sent by the user terminal through the service fast forwarding area; An obtaining module is configured to obtain a decryption key corresponding to the user terminal; A second decryption module is configured to decrypt the encrypted communication connection request by using the decryption key to obtain the communication connection request; A judging module is configured to judge whether the operation information corresponding to the communication connection request is contained in the service fast forwarding area; A request sending module is configured to send the communication connection request to the service logic area if the operation information corresponding to the communication connection request is not contained in the service fast forwarding area; An operation information sending module is configured to query the operation information corresponding to the communication connection request by using the service logic area, and send the operation information to the service fast forwarding area; A communication module is configured to send the processed communication connection request to a network server after performing the operation corresponding to the operation information on the communication connection request by using the service fast forwarding area, so that the network server establishes a communication connection with the user terminal according to the processed communication connection request.

8. An electronic device, comprising: The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the data processing method in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the data processing method in any one of claims 1-6.

Images