Network message processing method and device, electronic equipment and storage medium

Abstract

The invention provides a network message processing method and device, electronic equipment and a storage medium, and the network message processing method is applied to a bypass blocking device, and comprises the steps: obtaining a mirror image message of a target network message; judging whether the mirror image message is a blocking message sent by the bypass blocking device; and if yes, skipping security detection on the mirror image message, and discarding the mirror image message. After the mirror image message is obtained, safety detection is not directly carried out on the mirror image message, and whether the mirror image message is the blocking message sent by the bypass blocking device is judged firstly. Therefore, security detection can be prevented from being carried out on the sent blocking message again, and infinite loop detection of the blocking message is further avoided, so that only the message transmitted between two communication parties is detected, and stable operation of a network is ensured.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, electronic device and storage medium for processing network messages. Background Art

[0002] In critical information infrastructure, there are high requirements for the security, stability, processing speed, and throughput of network equipment. In order to ensure the information security of network equipment, protection devices are connected in series or reverse proxy access in network equipment. However, the series operation of protection devices in network equipment will cause certain network delays to network equipment. Therefore, bypass blocking technology came into being.

[0003] At present, the bypass blocking technology is used to ensure the information security of network devices, mainly by connecting the blocking device in the network device in a bypass manner. Specifically, when the client sends a message to the server, the bypass blocking device mirrors the message between the client and the server. After the bypass blocking device obtains the mirrored message, it matches the content in the mirrored message with the pre-set security protection rules. If the match is successful, the bypass blocking device believes that there is a security problem with the message sent by the client to the server, and then sends a blocking message to the client and the server to block the communication between the client and the server. If the match fails, the bypass blocking device believes that there is no security problem with the message sent by the client to the server, and then allows the client to send messages to the server.

[0004] However, under Internet Protocol (IP) type blocking, that is, the security protection rules include abnormal IPs, the blocking messages sent by the bypass blocking device to the client and server are the same as the messages sent between the client and the server in terms of IP addresses. The blocking messages sent to the client and the server will be mirrored by the bypass blocking device and processed using the preset security protection rules. The bypass blocking device will generate a blocking message for the blocking message, and then send the newly generated blocking message to the client and the server. In the process of sending the new blocking message to the client and the server, it will be mirrored and processed by the bypass blocking device. In this way, for a message with security issues sent between the client and the server, blocking messages will be continuously generated, forming a cyclic storm, thereby affecting the stable operation of the network where the client and the server are located. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a method, device, electronic device and storage medium for processing network messages to ensure stable operation of the network.

[0006] In order to solve the above technical problems, the embodiments of the present application provide the following technical solutions:

[0007] The first aspect of the present application provides a method for processing a network message, which is applied to a bypass blocking device, and the method includes: obtaining a mirror message of a target network message; determining whether the mirror message is a blocking message issued by the bypass blocking device itself; if so, skipping the security check of the mirror message and discarding the mirror message.

[0008] Compared with the prior art, the network message processing method provided in the first aspect of the present application does not directly perform security detection on the mirror message after obtaining the mirror message of the target network message, but first determines whether the mirror message is a blocking message issued by the bypass blocking device itself. If so, it means that the mirror message obtained at this time is a blocking message previously issued by the bypass blocking device itself. If a security detection is performed again, a security problem will definitely be detected, thereby regenerating a blocking message and sending it out, which will cause a message storm. Therefore, no security detection is performed on the mirror message, and the mirror message is discarded. In this way, it is possible to avoid performing security detection on the blocked message that has been issued again, thereby avoiding infinite loop detection of the blocked message, so that only the messages transmitted between the communicating parties are detected, ensuring the stable operation of the network.

[0009] In some changed implementation modes of the first aspect of the present application, the determination of whether the mirror message is a blocking message issued by the bypass blocking device itself includes: obtaining an identifier of a preset position in the mirror message; determining whether the identifier exists in a preset list, wherein the preset list records identifiers of preset positions in issued blocking messages; if so, determining that the mirror message is a blocking message issued by the bypass blocking device itself; if not, determining that the blocking message is not a blocking message issued by the bypass blocking device itself.

[0010] By recording the relevant content of the blocking message that has been sent in a preset list, when judging whether the mirror message is a blocking message that has been sent before, the corresponding content in the mirror message is matched with the preset list, so as to quickly determine whether the mirror message is a blocking message that has been sent by the bypass blocking device before, thereby improving the efficiency of network message security detection.

[0011] In some changed implementation modes of the first aspect of the present application, the preset position includes a first position and a second position, and the preset list includes an identifier of the first position and an identifier of the second position in the blocking message; the determining whether the identifier exists in the preset list includes: determining whether the identifier of the first position and the identifier of the second position in the mirror message both exist in the preset list; if so, determining that the identifier exists in the preset list; if not, determining that the identifier does not exist in the preset list.

[0012] Matching the contents of two different positions in the mirrored message with the preset list respectively can avoid the error caused by comparing one message alone and improve the accuracy of judging whether the mirrored message is a blocking message previously sent.

[0013] In some changed implementation modes of the first aspect of the present application, the identifier of the preset position in the mirror message is a first value obtained by processing the message content of the preset position in the mirror message using a preset algorithm, and the preset list includes a value obtained by processing the message content of the preset position in the blocking message using a preset algorithm; determining whether the identifier exists in the preset list includes: determining whether the first value is the same as the value in the preset list; if so, determining that the identifier exists in the preset list; if not, determining that the identifier does not exist in the preset list. The first value is obtained.

[0014] After the content in the mirror message is processed according to the preset algorithm, it is matched with the preset list. If there is a lot of corresponding content in the mirror message, the preset algorithm can be used to reduce the amount of data, thereby reducing the workload of matching with the preset list, thereby improving the efficiency of judging whether the mirror message was previously sent by itself.

[0015] In some changed implementation modes of the first aspect of the present application, the preset position includes a first position and a second position, the identifier of the preset position in the mirror message is a second value obtained by processing the total content consisting of the message content of the first position and the message content of the second position in the mirror message using a preset algorithm, and the preset list includes the total content consisting of the message content of the first position and the message content of the second position in the blocking message using a preset algorithm; determining whether the identifier exists in the preset list includes: determining whether the second value is the same as the value in the preset list; if so, determining that the identifier exists in the preset list; if not, determining that the identifier does not exist in the preset list.

[0016] The content of two different positions in the mirror message is obtained, and then the combined content is calculated using a preset algorithm, and then the calculated value is matched with the value in the preset list. On the one hand, it can avoid the error caused by matching a single content in the message, and on the other hand, it can reduce the data volume of the two contents, thereby improving the efficiency and accuracy of the mirror message in judging whether it is a blocking message sent by itself.

[0017] In some changed implementation modes of the first aspect of the present application, after determining whether the mirror message is a blocking message issued by the bypass blocking device itself, the method further includes: if not, performing a security check on the mirror message; when there is a security problem with the mirror message, generating a blocking message corresponding to the mirror message; sending the blocking message corresponding to the mirror message to the communicating parties of the target network message; and recording the blocking message corresponding to the mirror message in a preset list.

[0018] After determining that the mirrored message is not a blocking message, a security check is performed on the mirrored message, and after detecting that the mirrored message has a security problem, while sending a blocking message corresponding to the mirrored message to both communicating parties, the blocking message is recorded in a preset list, ensuring that the blocking messages recorded in the preset list are all the blocking messages sent previously, ensuring the integrity of the blocking message records in the preset list, and thereby improving the accuracy of judging whether the mirrored message is a blocking message sent by itself.

[0019] In some changed implementation modes of the first aspect of the present application, recording the blocking message corresponding to the mirror message in a preset list includes: obtaining the first message content from the first position of the blocking message corresponding to the mirror message, the content corresponding to the first position being able to uniquely represent the corresponding message; obtaining the second message content from the second position of the blocking message corresponding to the mirror message, the content corresponding to the second position being able to uniquely represent the corresponding message, and the second position being different from the first position; processing the total content consisting of the first message content and the second message content using a preset algorithm to obtain a blocking value; and recording the blocking value in the preset list.

[0020] When recording the blocking message corresponding to the mirror message in the preset list, the content of the blocking message itself is not recorded. Instead, the message contents of two representative positions in the blocking message are merged and the value calculated by the preset algorithm is adopted. Since the message contents at these two positions can uniquely identify the blocking message, each blocking message in the preset list can be accurately distinguished, and the preset algorithm is used to calculate the message, which can reduce the amount of information stored in the preset list.

[0021] The second aspect of the present application provides a network message processing device, the identification device is applied to a bypass blocking device, and the device includes: an acquisition module, used to obtain a mirror message of a target network message; a judgment module, used to judge whether the mirror message is a blocking message issued by the bypass blocking device itself; if so, enter the processing module; the processing module is used to skip the security check of the mirror message and discard the mirror message.

[0022] The third aspect of the present application provides an electronic device, comprising: a processor, a memory, and a bus; wherein the processor and the memory communicate with each other via the bus; and the processor is used to call program instructions in the memory to execute the method in the first aspect.

[0023] A fourth aspect of the present application provides a computer-readable storage medium, the storage medium comprising: a stored program; wherein, when the program is executed, the device where the storage medium is located is controlled to execute the method in the first aspect.

[0024] The network message processing device provided in the second aspect, the electronic device provided in the third aspect, and the computer-readable storage medium provided in the fourth aspect of the present application have the same or similar technical effects as the network message processing method provided in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] By reading the detailed description below with reference to the accompanying drawings, the above and other purposes, features and advantages of the exemplary embodiments of the present application will become easy to understand. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0026] Figure 1 A schematic diagram of an application scenario of the method for processing network messages in an embodiment of the present application;

[0027] Figure 2 The flowchart of the method for processing network messages in the embodiment of the present application is shown as follows: Figure 1 ;

[0028] Figure 3 The flowchart of the method for processing network messages in the embodiment of the present application is shown as follows: Figure 2 ;

[0029] Figure 4 This is a schematic diagram of a portion of the structure of the blocking message in the embodiment of the present application. Figure 1 ;

[0030] Figure 5 This is a schematic diagram of a portion of the structure of the blocking message in the embodiment of the present application. Figure 2 ;

[0031] Figure 6 The structure of the network message processing device in the embodiment of the present application is shown as follows Figure 1 ;

[0032] Figure 7 The structure of the network message processing device in the embodiment of the present application is shown as follows Figure 2 ;

[0033] Figure 8Schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0034] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0035] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.

[0036] At present, while the bypass blocking device acquires, judges and blocks the messages transmitted in the network, it also acquires the blocking message sent by itself, judges that the blocking message has security problems, and sends another blocking message based on the blocking message. This repetition will form a message storm in the network, affecting the normal operation of the network.

[0037] In view of this, the embodiment of the present application provides a network message processing method, device, electronic device and storage medium. After obtaining the mirror message of the target network message (or: target message), the mirror message is no longer directly security checked, but first determines whether the mirror message is a blocking message previously issued by the bypass blocking device itself. If so, the mirror message is no longer processed. In this way, normal messages can be distinguished from blocking messages in the obtained mirror message, avoiding security checks on the blocking message again, and issuing blocking messages, avoiding message storms, and ensuring the normal operation of the network.

[0038] First, the application scenario of the network message processing method provided in the embodiment of the present application is described.

[0039] Figure 1 This is a schematic diagram of an application scenario of the method for processing network messages in an embodiment of the present application, see Figure 1 As shown, the scenario may include: a client 11 , a server 12 , and a bypass blocking device 13 .

[0040] When the client 11 sends a message a to the server 12, the bypass blocking device 13 performs mirroring processing on the message a in the path sent by the client 11 to the server 12 to obtain a mirrored message. The bypass blocking device 13 matches the mirrored message with the preset security protection rules. If the match is successful, it is determined that there is a security problem with the message a, and a blocking message is generated based on the message a, and the blocking message is sent to the client 11 and the server 12 through the above path. In the process of sending the blocking message to the client 11 and the server 12, the client 11 also sends a message b to the server 12. At this time, the bypass blocking device 13 continues to obtain messages, and may obtain a blocking message or a message b. When the message b is obtained, the judgment blocking device 11 first determines whether the mirrored message of the message b is previously sent by the bypass blocking device itself. If not, it means that the mirrored message is a normal message, and the mirrored message is no longer subjected to security detection. When the blocking message is obtained, the judgment blocking device 11 first determines whether the mirrored message of the blocking message is previously sent by the bypass blocking device itself. If so, it means that the mirrored message is a blocking message, and the mirrored message is no longer subjected to security detection. In this way, the message transmitted between the client 11 and the server 12 can be clearly distinguished by the bypass blocking device 13 to determine whether it is a blocking message or a normal message, and then no blocking message is generated again based on the blocking message, thereby ensuring the normal operation of the network.

[0041] Next, the method for processing network messages provided in the embodiment of the present application is described in detail.

[0042] Figure 2 The flowchart of the method for processing network messages in the embodiment of the present application is shown as follows: Figure 1 , see Figure 2 As shown, the method may include:

[0043] S21: Obtain a mirror image message of the target network message.

[0044] The target network message here can refer to the message transmitted within the preset network range. The preset network can refer to a private network, that is, an internal network, or a public network, that is, an external network or a specified area in an external network, or a combination of a private network and a public network. The specific range of the preset network needs to be determined according to the object of security detection. For example: when it is necessary to perform security detection on the message transmitted between a client and a server, the network here is the network formed between the client and the server.

[0045] In the preset network, when a message is detected to be transmitted, the message is the target network message. While not affecting the normal transmission of the target network message, the target network message is mirrored to obtain a mirrored message.

[0046] In the process of mirroring, a splitter device can be set at the port where the external network core switch connects to the operator (i.e., the server operator), and the target network message can be split by the splitter device to obtain the mirror message. Other existing data replication technologies can also be used to obtain the mirror message of the target network message.

[0047] S22: Determine whether the mirrored message is a blocking message sent by the bypass blocking device itself. If yes, execute S23; if no, execute S24.

[0048] After receiving the mirrored message, the mirrored message is not immediately subjected to a security check, but a check is made to determine whether the mirrored message is a blocking message previously sent by the mirrored message itself. This is because after the bypass blocking device determines that there is a security problem with the message normally transmitted between the client and the server, it will generate a blocking message and send it to both the client and the server. While transmitting normal messages between the client and the server, blocking messages are also transmitted. While obtaining the normally transmitted message, the bypass blocking device also obtains the blocking message. If the obtained blocking message is treated as a normally transmitted message for security check, it will also be determined that there is a security problem, and then a blocking message of the blocking message will be generated again and transmitted between the client and the server. In this way, there will be more and more blocking messages between the client and the server, forming a message storm. The normally transmitted message here does not refer to a message without a security problem, but a message sent by the client to the server, or by the server to the client, rather than a message sent by the bypass blocking device.

[0049] In the specific judgment process, the judgment can be made according to the content in the mirror message. For example: when the mirror message is a Transmission Control Protocol (TCP) message, it is judged whether the reset (Reset, RST) flag bit is 1, and whether the modification mark of the bypass blocking device is modified. If it is 1, and it carries the modification mark of the bypass blocking device, it is determined that the mirror message is a blocking message previously issued by the bypass blocking device itself. If it is not 1, or it does not carry the modification mark of the bypass blocking device, it is determined that the mirror message is not a blocking message previously issued by the bypass blocking device itself. For another example: it is determined whether there is a preset mark at the preset position of the mirror message. If it exists, it is determined that the mirror message is a blocking message previously issued by the bypass blocking device itself. If it does not exist, it is determined that the mirror message is not a blocking message previously issued by the bypass blocking device itself. It can also be queried in the record list of blocking messages that the bypass blocking device has issued. If the same message is found, it is determined that the mirror message is a blocking message previously issued by the bypass blocking device itself. If the same message is not found, it is determined that the mirror message is not a blocking message previously issued by the bypass blocking device itself.

[0050] S23: Skip the security check on the mirrored message and discard the mirrored message.

[0051] When it is determined that the mirrored message is a blocking message previously sent by the bypass blocking device itself, no security check is performed on the mirrored message and the mirrored message can be directly discarded.

[0052] S24: Perform security check on the mirror message.

[0053] When it is determined that the mirror message is not a blocking message previously sent by the bypass blocking device itself, it means that the mirror message is a message sent between the communicating parties. At this time, it is necessary to match the mirror message with the preset security protection rules. If the match is successful, it means that there is a security problem with the target network message corresponding to the mirror message, and it is necessary to block the connection between the communicating parties of the target network message. That is, a blocking message is generated based on the target network message, and then the blocking message is sent to the communicating parties of the target network message. If the match fails, it means that there is no security problem with the target network message corresponding to the mirror message, and no processing is performed on the target network message, so that the target network message continues to flow.

[0054] The preset security protection rules here are the rules used to detect whether there are security issues in messages, which may include various features of messages that have been determined to have security issues, such as: black Internet Protocol (IP) addresses, black port numbers, malicious behavior features, sensitive information features, etc.

[0055] The blocking message is based on the specific content of the target network message, such as source IP address, source port, destination IP address, destination port, body content, etc. The message is obtained after adjusting the body content, converting the source and destination IP addresses, and converting the source and destination ports.

[0056] As can be seen from the above content, the network message processing method provided by the embodiment of the present application does not directly perform security detection on the mirror message after obtaining the mirror message of the target network message, but first determines whether the mirror message is a blocking message issued by the bypass blocking device itself. If so, it means that the mirror message obtained at this time is a blocking message previously issued by the bypass blocking device itself. If a security detection is performed again, it will definitely detect that there is a security problem, thereby regenerating a blocking message and sending it out, which will cause a message storm. Therefore, no security detection is performed on the mirror message, and the mirror message is discarded. In this way, it is possible to avoid performing security detection on the blocked message that has been issued again, thereby avoiding infinite loop detection of the blocked message, so that only the messages transmitted between the two communicating parties are detected, ensuring the stable operation of the network.

[0057] Furthermore, as a Figure 2As a refinement and extension of the method shown, an embodiment of the present application also provides a method for processing a network message.

[0058] Figure 3 The flowchart of the method for processing network messages in the embodiment of the present application is shown as follows: Figure 2 , see Figure 3 As shown, the method may include:

[0059] S31: Obtain a mirror image message of the target network message.

[0060] The specific implementation method of step S31 is the same as that of the aforementioned step S21. Please refer to the relevant instructions in the aforementioned step S21, which will not be repeated here.

[0061] S32: Obtain an identifier of a preset position in the mirroring message.

[0062] The preset position here can be the RST flag in the mirror message, or it can be a position preset in the mirror message for configuring the corresponding identifier when it is a blocking message. When the preset position is the RST flag, if it indicates blocking, the identifier on it is 1. When the preset position is a preset position, if it indicates blocking, the identifier on it is a pre-agreed identifier. Of course, the identifier of the preset position in the mirror message can also be the message content of the specified position in the mirror message.

[0063] S33: Determine whether the identifier exists in the preset list. If yes, execute S34; if no, execute S35.

[0064] The preset list records the identifiers of preset positions in the sent blocking messages.

[0065] In the preset list, the blocking message itself can be directly recorded. In order to reduce the occupation of the preset list resources, the identifier of the preset position in the sent blocking message can be recorded.

[0066] It should be noted here that if the identifier indicating the blocking is fixed, for example, the RST flag is 1 and the identifier is preset, then the preset list can record it before the blocking message is sent. If the identifier indicating the blocking changes based on the message, then after the blocking message is sent, the preset list can record the identifier at the preset position according to the sent blocking message.

[0067] In order to improve the accuracy of the judgment, two preset positions may be used, that is, the preset positions include a first position and a second position, and the preset list includes an identifier of the first position and an identifier of the second position in the blocking message.

[0068] The above step S33 may include:

[0069] Step A1: Determine whether the identifier at the first position and the identifier at the second position in the mirroring message are both in the preset list. If yes, execute A2; if no, execute A3.

[0070] Step A2: Determine whether the identifier exists in the preset list.

[0071] Step A3: Determine whether the identifier does not exist in the preset list.

[0072] In the first position of the mirrored message, there is an identifier. In the second position of the mirrored message, there is also an identifier. If the target network message corresponding to the mirrored message is sent by a bypass blocking device, then the target network message is a blocking message. After the blocking message is sent, the identifiers at the first position and the second position in the blocking message will be recorded in the preset list. The two identifiers obtained from the mirrored message are matched with the identifiers in the preset list. If both identifiers successfully match the preset list, it is determined that the identifier of the mirrored message at the preset position exists in the preset list. If one of the two identifiers fails to match the preset list, it is determined that the identifier of the mirrored message at the preset position does not exist in the preset list.

[0073] For example, assuming that there is an identifier a at the first position of the mirrored message, an identifier b at the second position, and the preset list records identifier a, identifier b, and identifier c. If the identifiers at the two positions of the mirrored message can match the identifiers in the preset list, it is determined that the identifier of the mirrored message at the preset position exists in the preset list.

[0074] For another example, assume that there is an identifier a at the first position of the mirrored message, an identifier d at the second position, and the preset list records identifiers a, b, and c. If one identifier in the mirrored message does not match an identifier in the preset list, it is determined that the identifier of the mirrored message at the preset position does not exist in the preset list.

[0075] The first position and the second position here can be any two positions in the message. Preferably, positions in different types of structures can be selected. In this way, the identification difference between the two positions can be maximized, and it can be prevented from being easily tampered with, thereby improving the accuracy of the judgment.

[0076] In order to improve the efficiency of judgment, the value obtained by calculating the message content can be used. That is, the identifier of the preset position in the mirror message is the first value obtained by processing the message content of the preset position in the mirror message using a preset algorithm, and the preset list includes the value obtained by processing the message content of the preset position in the blocked message using a preset algorithm.

[0077] For the message content at the preset position in the mirrored message, if the data volume is large, a preset algorithm can be used for calculation to obtain a value with a smaller data volume, i.e., the first value. For example, if the message content at the preset position in the mirrored message is "abcdef", the preset algorithm is used for calculation to obtain the value "2". In this way, the amount of data to be compared with the preset list can be reduced, the comparison efficiency can be improved, and the judgment efficiency can be further improved.

[0078] The preset algorithm here may be any algorithm for reducing the amount of data, for example, a Hash algorithm or a Message Digest 5 (MD5) algorithm.

[0079] In the preset list, after the bypass blocking device sends a blocking message in the history process, the message content at the preset position in the blocking message will be calculated using a preset algorithm to obtain a value. After that, the mirror message of the target network message is obtained from the network, and the message content is obtained from the preset position of the mirror message. The preset algorithm is also used to calculate the obtained identifier, and then the calculated first value is matched with the value in the preset list. If the match is successful, it is determined that the mirror message is the blocking message previously sent by the bypass blocking device itself. If the match fails, it is determined that the mirror message is a mirror image of the message of normal communication between the two parties of the message, and a security check is required.

[0080] The above step S33 may include:

[0081] The first value obtained Step B1: Determine whether the first value is the same as the value in the preset list. If yes, execute step B2, if no, execute step B3.

[0082] Step B2: Determine whether the identifier exists in the preset list.

[0083] Step B3: Determine whether the identifier does not exist in the preset list.

[0084] In order to improve the accuracy and efficiency of the judgment at the same time, two preset positions can be used, and the value obtained by calculating the message content is used for comparison. That is, the preset position includes the first position and the second position, the identifier of the preset position in the mirror message is the second value obtained by processing the total content of the message content of the first position and the message content of the second position in the mirror message using the preset algorithm, and the preset list includes the total content of the message content of the first position and the message content of the second position in the blocked message, which is the value obtained by processing the preset algorithm.

[0085] For the message content composed of the first position and the second position in the mirror message, if the data volume is large, a preset algorithm can be used for calculation to obtain a value with a smaller data volume, namely the second value. For example, if the message content at the first position in the mirror message is "abcdef", and the message content at the second position in the mirror message is "qwertyu", "abcdefqwertyu" is calculated using a preset algorithm to obtain a value of "5". In this way, the amount of data to be compared with the preset list can be reduced, the comparison efficiency can be improved, and the judgment efficiency can be improved.

[0086] In the preset list, after the bypass blocking device sends a blocking message in the history process, the message content composed of the first position and the second position in the blocking message is calculated using a preset algorithm to obtain a value. After that, a mirror message of the target network message is obtained from the network, and the message content is obtained from the first position and the second position of the mirror message. The preset algorithm is also used to calculate the message content, and then the calculated second value is matched with the preset list. If the match is successful, it is determined that the mirror message is the blocking message previously sent by the bypass blocking device itself. If the match fails, it is determined that the mirror message is a mirror image of the message of normal communication between the two parties of the message, and a security check is required.

[0087] The above step S33 may include:

[0088] Step C1: Determine whether the second value is the same as the value in the preset list. If yes, execute step C3; if no, execute step C4.

[0089] Step C2: Determine whether the identifier exists in the preset list.

[0090] Step C3: Determine whether the identifier does not exist in the preset list.

[0091] When it is determined in S33 that the identifier exists in the preset list, S34 is executed, and when it is determined in S33 that the identifier does not exist in the preset list, S35 is executed.

[0092] S34: Determine that the mirrored message is a blocking message sent by the bypass blocking device itself.

[0093] When the identifier of the preset position in the mirror message exists in the preset list, it means that the corresponding target network message is sent by the bypass blocking device. At this time, it can be determined that the mirror message, that is, the target network message, is a blocking message sent by the bypass blocking device itself.

[0094] S35: Determine that the blocking message is not a blocking message sent by the bypass blocking device itself.

[0095] When the identifier of the preset position in the mirror message does not exist in the preset list, it means that the corresponding target network message is not sent by the bypass blocking device. At this time, it can be determined that the mirror message, that is, the target network message, is not a blocking message sent by the bypass blocking device itself, but a message sent between the communicating parties.

[0096] After determining that the mirrored message is a blocking message sent by the bypass blocking device itself, the mirrored message at this time does not need to be subjected to security detection, and S36 is executed.

[0097] S36: Skip the security check on the mirrored message and discard the mirrored message.

[0098] The specific implementation method of step S36 is the same as that of the aforementioned step S23. Please refer to the relevant instructions in the aforementioned step S23, which will not be repeated here.

[0099] After determining that the mirrored message is not a blocking message sent by the bypass blocking device itself, it means that the target network message corresponding to the mirrored message is a message sent between the communicating parties. The function of the bypass blocking device is to perform security detection of messages transmitted between the communicating parties. Therefore, the mirrored message at this time needs to be security detected, and S37 is executed.

[0100] S37: Perform security check on the mirror message.

[0101] The specific implementation method of step S37 is the same as that of the aforementioned step S24. Please refer to the relevant instructions in the aforementioned step S24, which will not be repeated here.

[0102] After using the preset security protection rules to perform security checks on mirrored messages, two results will be obtained. One result is that the mirrored message fails to match the preset security protection rules. The other result is that the mirrored message successfully matches the preset security protection rules. For the former, it means that there are no security issues with the mirrored message, and its corresponding target network message can flow normally. For the latter, it means that there are security issues with the mirrored message and further processing is required.

[0103] S38: When there is a security problem with the mirrored message, a blocking message corresponding to the mirrored message is generated.

[0104] The presence of security issues in the mirrored message indicates that there are security issues in the target network message of the mirror, which in turn indicates that there are security issues between the communicating parties of the target network message. It is necessary to generate a corresponding blocking message based on the mirrored message to block the communication between the communicating parties.

[0105] When generating a blocking message corresponding to a mirrored message, the source IP address in the mirrored message can be used as the destination IP address, the source port as the destination port, the destination IP address as the source IP address, the destination port as the source port, the sequence number+1, the value corresponding to the Identification field in the IP header structure plus 1, and the 16-bit window size field in the TCP header generate a random value to obtain a blocking message, and then send the blocking message to the sender of the target network message; the source IP address, source port, destination IP address, and destination port in the mirrored message remain unchanged, the sequence number+1, the value corresponding to the Identification field in the IP header structure plus 1, and the 16-bit window size field in the TCP header generate a blocking message using the above random value, and then send the blocking message to the receiver of the target network message.

[0106] S39: Send the blocking message corresponding to the mirror message to both communicating parties of the target network message.

[0107] S310: Record the blocking message corresponding to the mirroring message in a preset list.

[0108] After the bypass blocking device successfully sends a blocking message corresponding to the mirror message to both communicating parties, the blocking message corresponding to the mirror message also needs to be recorded in the preset list, so that after the sent blocking message is mirrored again by the bypass blocking device, the mirror message can be identified through the preset list as the blocking message previously sent by itself.

[0109] Recording the blocking message in the preset list does not record the blocking message itself, but records the message contents at two different positions in the blocking message and obtains the value after calculation.

[0110] Specifically, the above step S310 may include:

[0111] Step E1: Obtain the first message content from the first position of the blocking message corresponding to the mirrored message.

[0112] The content corresponding to the first position can uniquely represent the corresponding message. In practical applications, the first position can be an Identification field in an IP header structure.

[0113] Step E2: Obtain the second message content from the second position of the blocking message corresponding to the mirrored message.

[0114] The content corresponding to the second position can uniquely represent the corresponding message, and the second position is different from the first position. In practical applications, the second position may be a 16-bit window size field in a TCP header.

[0115] Step E3: The total content consisting of the first message content and the second message content is processed using a preset algorithm to obtain a blocking value.

[0116] Step E4: Record the blocking value in a preset list.

[0117] After determining that the blocking message has been successfully sent, the message content is extracted from two positions of the blocking message that can uniquely represent the message, and the extracted message content is combined together to be calculated using a preset algorithm, and then the calculated blocking value is stored in a preset list. In this way, if the bypass blocking device mirrors the blocking message from the network, and the value obtained by combining the message content at the first position and the second position of the mirrored message and calculating using a preset algorithm is the same as a value stored in the preset list, it is determined that the mirrored message is the blocking message it has previously sent, and no security detection is performed again, avoiding the discovery of security issues through another security detection, and then generating a duplicate blocking message, thereby avoiding message storms.

[0118] Finally, taking TCP transmission as an example, the processing of network messages provided in the embodiments of the present application is explained again.

[0119] The bypass blocking device mirrors the TCP message transmitted in the network to obtain a mirror message, and then matches the mirror message with the preset security protection rules. If the match is successful, a blocking message is generated based on the mirror message and sent to the communicating parties of the TCP message through the network.

[0120] Figure 4 This is a schematic diagram of a portion of the structure of the blocking message in the embodiment of the present application. Figure 1 , see Figure 4 As shown, when generating the blocking message, the Identification field in the mirrored message IP header structure is incremented by 1 to obtain a new value A, which is assigned to the Identification field in the RST packet IP header.

[0121] Figure 5 This is a schematic diagram of a portion of the structure of the blocking message in the embodiment of the present application. Figure 2 , see Figure 5 As shown, when generating a blocking message, a random value B is generated and assigned to the 16-bit window size field in the TCP header of the RST packet.

[0122] For the values ​​A and B, a hash algorithm (eg, CRC32, SHA256, etc.) is used for processing, C = hash (A, B), and then C is stored in the blocked object flow table.

[0123] The bypass blocking device continues to mirror the TCP message transmitted in the network to obtain a mirror message, and then extracts the identifier E from the Identification field in the IP header of the mirror message, and extracts the identifier F from the 16-bit window size field in the TCP header, and uses the same hash algorithm to calculate C1=hash(E,F). If the C1 value is the same as the C value recorded in the blocked object flow table, it is the RST packet previously sent by the bypass blocking device itself, and no security check is performed on this mirror message, that is, no new RST packet is sent. If the C1 value is different from the C value recorded in the blocked object flow table, it is not the RST packet previously sent by the bypass blocking device itself, and a security check is required for this mirror message.

[0124] At this point, the method for processing network messages provided in the embodiments of the present application has been fully described.

[0125] Based on the same inventive concept, as an implementation of the above method, an embodiment of the present application also provides a network message processing device.

[0126] Figure 6 The structure of the network message processing device in the embodiment of the present application is shown as follows Figure 1 , see Figure 6 As shown, the device may include: an acquisition module 61, a judgment module 62, and a processing module 63. The acquisition module 61, the judgment module 62, and the processing module 63 are connected in sequence.

[0127] The acquisition module 61 is used to acquire the mirror message of the target network message.

[0128] The judging module 62 is used to judge whether the mirrored message is a blocking message sent by the bypass blocking device itself; if so, enter the processing module.

[0129] The processing module 63 is used to skip the security check on the mirroring message and discard the mirroring message.

[0130] Furthermore, as a Figure 6 As a refinement and extension of the device shown, an embodiment of the present application further provides a device for processing network messages.

[0131] Figure 7 The structure of the network message processing device in the embodiment of the present application is shown as follows Figure 2 , see Figure 7 As shown, the device may include: an acquisition module 71, a judgment module 72, a processing module 73, a detection module 74, a generation module 75, a blocking module 76, and a storage module 77. The acquisition module 71, the judgment module 72, the processing module 73, the generation module 75, the blocking module 76, and the storage module 77 are connected in sequence. The detection module 74 is connected to the judgment module 72.

[0132] The acquisition module 71 is used to acquire the mirror message of the target network message.

[0133] The judging module 72 includes: an acquiring unit 721, a judging unit 722, a first determining unit 723 and a second determining unit 724. The acquiring unit 721, the judging unit 722 and the first determining unit 723 are connected in sequence. The second determining unit 724 is connected to the judging unit 722.

[0134] The acquiring unit 721 is configured to acquire an identifier of a preset position in the mirroring message.

[0135] The judging unit 722 is used to judge whether the identifier exists in a preset list, and the preset list records the identifiers of preset positions in the sent blocking messages. If yes, the process proceeds to the first determining unit 723, and if not, the process proceeds to the second determining unit 724.

[0136] The first determining unit 723 is configured to determine that the mirrored message is a blocking message sent by the bypass blocking device itself.

[0137] The second determining unit 724 is configured to determine that the blocking message is not a blocking message sent by the bypass blocking device itself.

[0138] When the preset position includes a first position and a second position, and the preset list includes an identifier of the first position and an identifier of the second position in the blocking message, the judgment unit 722 is specifically used to judge whether the identifier of the first position and the identifier of the second position in the mirror message both exist in the preset list; if so, it is determined that the identifier exists in the preset list; if not, it is determined that the identifier does not exist in the preset list.

[0139] When the identifier of the preset position in the mirror message is a first value obtained by processing the message content of the preset position in the mirror message using a preset algorithm, and the preset list includes a value obtained by processing the message content of the preset position in the blocking message using a preset algorithm, the judgment unit 722 is specifically used to determine whether the first value is the same as the value in the preset list by the obtained first value; if so, determine that the identifier exists in the preset list; if not, determine that the identifier does not exist in the preset list.

[0140] When the preset position includes a first position and a second position, the identifier of the preset position in the mirrored message is a second value obtained by processing the total content consisting of the message content of the first position and the message content of the second position in the mirrored message using a preset algorithm, and the preset list includes a value obtained by processing the total content consisting of the message content of the first position and the message content of the second position in the blocked message using a preset algorithm, the judging unit 722 is specifically used to judge whether the second value is the same as the value in the preset list; if so, determine that the identifier exists in the preset list; if not, determine that the identifier does not exist in the preset list.

[0141] The processing module 73 is used to skip the security check on the mirroring message and discard the mirroring message.

[0142] The detection module 74 is used to perform security detection on the mirroring message.

[0143] The generating module 75 is used to generate a blocking message corresponding to the mirroring message when there is a security problem in the mirroring message.

[0144] The blocking module 76 is used to send a blocking message corresponding to the mirror message to both communicating parties of the target network message.

[0145] The storage module 77 is used to record the blocking message corresponding to the mirroring message in a preset list.

[0146] The storage module 77 includes: a first acquisition unit 771, a second acquisition unit 772, a processing unit 773 and a storage unit 774. The first acquisition unit 771, the second acquisition unit 772, the processing unit 773 and the storage unit 774 are connected in sequence.

[0147] The first acquisition unit 771 acquires the first message content from the first position of the blocking message corresponding to the mirrored message, where the content corresponding to the first position can uniquely represent the corresponding message.

[0148] The second acquisition unit 772 is used to acquire the second message content from the second position of the blocking message corresponding to the mirrored message, where the content corresponding to the second position can uniquely represent the corresponding message, and the second position is different from the first position.

[0149] The processing unit 773 is used to process the total content consisting of the first message content and the second message content using a preset algorithm to obtain a blocking value.

[0150] The storage unit 774 is used to record the blocking value in the preset list.

[0151] It should be noted here that the description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0152] Based on the same inventive concept, an embodiment of the present application also provides an electronic device. Figure 8 This is a schematic diagram of the structure of the electronic device in the embodiment of the present application, see Figure 8 As shown, the electronic device may include: a processor 81, a memory 82, and a bus 83; wherein the processor 81 and the memory 82 communicate with each other via the bus 83; the processor 81 is used to call program instructions in the memory 82 to execute the methods in one or more of the above embodiments.

[0153] It should be noted that the description of the above electronic device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the electronic device embodiment of this application, please refer to the description of the method embodiment of this application for understanding.

[0154] Based on the same inventive concept, an embodiment of the present application further provides a computer-readable storage medium, which may include: a stored program; wherein, when the program is running, the device where the storage medium is located is controlled to execute the method in one or more of the above embodiments.

[0155] It should be noted here that the description of the above storage medium embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the storage medium embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0156] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for processing network messages, characterized in that: The method is applied to a bypass blocking device, and the method comprises: Get the mirror message of the target network message; Determining whether the mirrored message is a blocking message sent by the bypass blocking device itself; If so, skip the security check on the mirrored message and discard the mirrored message.

2. The method according to claim 1, characterized in that The determining whether the mirrored message is a blocking message sent by the bypass blocking device itself includes: Obtaining an identifier of a preset position in the mirroring message; Determine whether the identifier exists in a preset list, wherein the preset list records identifiers of preset positions in sent blocking messages; If so, determining that the mirrored message is a blocking message sent by the bypass blocking device itself; If not, it is determined that the blocking message is not a blocking message sent by the bypass blocking device itself.

3. The method according to claim 2, characterized in that The preset position includes a first position and a second position, and the preset list includes an identifier of the first position and an identifier of the second position in the blocking message; The determining whether the identifier exists in a preset list includes: Determine whether the identifier of the first position and the identifier of the second position in the mirroring message both exist in the preset list; If so, determining that the identifier exists in the preset list; If not, it is determined that the identifier does not exist in the preset list.

4. The method according to claim 2, characterized in that: The identifier of the preset position in the mirrored message is a first value obtained by processing the message content at the preset position in the mirrored message using a preset algorithm, and the preset list includes a value obtained by processing the message content at the preset position in the blocked message using a preset algorithm; The determining whether the identifier exists in a preset list includes: Determine whether the first value is the same as the value in the preset list; If so, determining that the identifier exists in the preset list; If not, it is determined that the identifier does not exist in the preset list.

5. The method according to claim 2, characterized in that: The preset position includes a first position and a second position, the identifier of the preset position in the mirrored message is a second value obtained by processing the total content of the message content of the first position and the message content of the second position in the mirrored message using a preset algorithm, and the preset list includes the total content of the message content of the first position and the message content of the second position in the blocked message, which is a value obtained by processing the preset algorithm; The determining whether the identifier exists in a preset list includes: Determine whether the second value is the same as the value in the preset list; If so, determining that the identifier exists in the preset list; If not, it is determined that the identifier does not exist in the preset list.

6. The method according to any one of claims 1 to 5, characterized in that After determining whether the mirrored message is a blocking message sent by the bypass blocking device itself, the method further includes: If not, performing a security check on the mirrored message; When there is a security problem with the mirrored message, generating a blocking message corresponding to the mirrored message; Sending a blocking message corresponding to the mirror message to both communicating parties of the target network message; The blocking message corresponding to the mirroring message is recorded in a preset list.

7. The method according to claim 6, characterized in that The recording of the blocking message corresponding to the mirroring message in a preset list includes: Acquire the first message content from the first position of the blocking message corresponding to the mirrored message, where the content corresponding to the first position can uniquely represent the corresponding message; Acquire a second message content from a second position of the blocking message corresponding to the mirrored message, where the content corresponding to the second position can uniquely represent the corresponding message, and the second position is different from the first position; Processing the total content composed of the first message content and the second message content by using a preset algorithm to obtain a blocking value; The blocking value is recorded in the preset list.

8. A network message processing device, characterized in that: The identification device is applied to a bypass blocking device, and the device comprises: An acquisition module, used for acquiring a mirror message of a target network message; A judging module, used for judging whether the mirrored message is a blocking message sent by the bypass blocking device itself; if so, entering a processing module; The processing module is used to skip the security check on the mirroring message and discard the mirroring message.

9. An electronic device, characterized in that: The electronic device comprises: a processor, a memory, and a bus; wherein the processor and the memory communicate with each other via the bus; and the processor is used to call program instructions in the memory to execute the method as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The storage medium comprises: a stored program; wherein, when the program is running, the device where the storage medium is located is controlled to execute the method as claimed in any one of claims 1 to 7.

Images