External connection evidence obtaining message processing method, electronic equipment and storage medium

Abstract

The invention provides an external connection evidence obtaining message processing method, electronic equipment and a storage medium, and the external connection evidence obtaining message processing method applied to a detected terminal comprises the steps: obtaining evidence obtaining information data, and carrying out the fragmentation processing of the evidence obtaining information data, and obtaining a plurality of pieces of fragmented data; based on the fragmented data, generating a first check code corresponding to each piece of fragmented data; forming an external connection evidence obtaining message based on the first check code and the fragmented data; wherein the external connection evidence obtaining message comprises a preamble packet and a plurality of evidence obtaining data packets, and the preamble packet and the evidence obtaining data packets respectively correspond to one piece of fragmented data; and sending the external connection evidence obtaining message to an external connection evidence obtaining platform based on the UDP communication port number field. Through the technical scheme provided by the invention, more data can be transmitted to the external connection evidence obtaining platform through the limited field of the UDP communication port.

Description

Technical Field

[0001] The present invention relates to the technical field of illegal external connection, and in particular to an external connection evidence collection message processing method, electronic equipment and storage medium. Background Art

[0002] As the cybersecurity environment becomes increasingly severe, the state has issued a variety of legal provisions and policy requirements to constrain the cybersecurity construction of internal information systems of enterprises involving state secrets and commercial secrets. The "Cybersecurity Law", "Basic Requirements for Cybersecurity Level Protection", "Administrative Measures for the Level Protection of Information Systems Involving State Secrets", "Regulations on the Security Protection of Critical Information Infrastructure" and other provisions that have been issued all involve the inspection and protection of illegal external connections of networked terminals.

[0003] Illegal external connection refers to the unauthorized connection of the terminal device connected to the Internet in an internal local area network that is physically or logically isolated from the Internet. This causes the failure of isolation from the Internet, and through this illegal Internet access endpoint, further malicious network security incidents such as virus implantation, Trojan horse propagation, data theft, etc. may occur.

[0004] Therefore, illegal external connection detection systems are deployed in most information systems in internal LAN environments. Illegal external connection detection is generally divided into two technical routes: end-to-end and end-to-end. The working principle of both the end-to-end and end-to-end methods is to try to connect to the forensic platform or target machine on the Internet by sending packets. The difference is that in the end-to-end method, the Agent can actively initiate an access request and try to connect to the Internet to send data to the target machine. The forensic data contains the information of the intranet terminal itself. This method has no specific requirements on the size of the forensic data packet sent to the Internet forensic platform, the number of fragments, etc.; while the end-to-end method sends forged external forensic messages to the access terminal in the network, inducing the intranet terminal to access the Internet forensic platform or target machine. The external forensic messages sent by the existing end-to-end method cannot embed enough intranet terminal information in the forensic data packet under the premise of complying with the protocol specifications. Summary of the invention

[0005] The present invention provides an external evidence collection message processing method, an electronic device and a storage medium, which are used to solve the defects in the prior art and realize carrying more terminal information when transmitting the external evidence collection message.

[0006] The present invention provides an external evidence collection message processing method, which is applied to a detected terminal, and the method comprises: Acquire forensic information data, and perform slicing processing on the forensic information data to obtain a plurality of slicing data; Based on the shard data, generate a first check code corresponding to each shard data; An external evidence collection message is formed based on the first verification code and the fragmented data; wherein the external evidence collection message includes a leading packet and a plurality of evidence collection data packets, and the leading packet and the evidence collection data packet respectively correspond to one of the fragmented data; The external evidence collection message is sent to the external evidence collection platform based on the UDP communication port number field.

[0007] According to an external forensic message processing method provided by the present invention, generating a first check code corresponding to each of the fragmented data based on the fragmented data includes: Calculate the first check code of the leading packet based on the forensic information data; Based on the fragmented data, determine the first verification code generation data corresponding to each of the forensic data packets, and based on the first verification code generation data, calculate the first verification code corresponding to each of the forensic data packets; wherein the first verification code generation data includes the fragmented data corresponding to the forensic data packet, and the fragmented data in the forensic information data that is located before the fragmented data corresponding to the forensic data packet.

[0008] According to an external forensic message processing method provided by the present invention, the generating data based on the first verification code and calculating the first verification code corresponding to each forensic data packet include: The first check code generation data is subjected to salting processing, and an XOR operation is performed on the salted data to obtain the first check code.

[0009] According to a method for processing an external evidence collection message provided by the present invention, the external evidence collection message is formed based on the first verification code and the fragmented data, including: Determine the message type of the leading packet and the forensic data packet, and determine the data packet type of the leading packet and the forensic data packet; Based on the message type, the data packet type, the first check code and the fragmented data, the leading packet and multiple forensic data packets are formed, and the external forensic message is obtained based on the leading packet and multiple forensic data packets.

[0010] The present invention also provides an external evidence collection message processing method, which is applied to an external evidence collection platform, and the method comprises: If a leading packet in the external evidence collection message is received, a plurality of received data packets received within a preset time range are obtained based on the leading packet; Generate a second check code corresponding to the received data packet based on the fragment data carried in the leading packet and the received data packet; Determine a forensic data packet corresponding to the leading packet based on the second verification code and the first verification code carried in the leading packet and the received data packet; Forensic information data is determined based on the leading packet and the forensic data packet.

[0011] According to an external forensic message processing method provided by the present invention, the second check code corresponding to the received data packet is generated based on the fragment data carried in the leading packet and the received data packet, including: Based on the fragmented data, determining second check code generation data corresponding to each of the received data packets; The second check code corresponding to each of the received data packets is calculated based on the second check code generation data.

[0012] According to an external forensic message processing method provided by the present invention, the generating data based on the second check code and calculating the second check code corresponding to each received data packet include: The second check code generation data is subjected to salting processing, and an XOR operation is performed on the salted data to obtain the second check code.

[0013] According to an external forensic message processing method provided by the present invention, the forensic data packet corresponding to the leading packet is determined based on the second check code and the first check code carried in the leading packet and the received data packet, including: Get the preset exception handling mechanism; Based on a preset exception handling mechanism and the second check code, as well as the first check code carried in the leading packet and the received data packet, the forensic data packet corresponding to the leading packet is determined.

[0014] The present invention also provides an external evidence collection message processing device, which is applied to a detected terminal, comprising: A slicing processing module is configured to obtain forensic information data and perform slicing processing on the forensic information data to obtain a plurality of slicing data; A first generating module is configured to generate a first check code corresponding to each of the slice data based on the slice data; A forming module, configured to form an external evidence collection message based on the first verification code and the fragmented data; wherein the external evidence collection message includes a leading packet and a plurality of evidence collection data packets, and the leading packet and the evidence collection data packet respectively correspond to one of the fragmented data; The sending module is configured to send the external evidence collection message to the external evidence collection platform based on the UDP communication port number field.

[0015] The present invention also provides an external evidence collection message processing device, which is applied to an external evidence collection platform, comprising: A first acquisition module is configured to, if a leading packet in the external evidence collection message is received, acquire a plurality of received data packets received within a preset time range based on the leading packet; A second generating module is configured to generate a second check code corresponding to the received data packet based on the leading packet and the fragment data carried in the received data packet; A first determination module is configured to determine a forensic data packet corresponding to the leading packet based on the second verification code and the first verification code carried in the leading packet and the received data packet; The second determination module is configured to determine the forensic information data based on the leading packet and the forensic data packet.

[0016] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it implements any of the above-mentioned external evidence collection message processing methods.

[0017] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, it implements any of the above-mentioned external forensic message processing methods.

[0018] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned external forensic message processing methods.

[0019] The external evidence message processing method, electronic device and storage medium provided by the present invention perform fragmentation processing on evidence information data to obtain multiple fragmented data, generate a corresponding first check code based on the fragmented data, form an external evidence message based on the first check code and the fragmented data, the external evidence message includes a leading packet and multiple evidence data packets, the leading packet and the evidence data packet correspond to one fragmented data respectively, and the external evidence message is sent to the external evidence platform using the UDP communication port number field. The technical solution provided by the present invention embeds the evidence information data of the detected terminal into the UDP communication port in a fragmented manner. It is realized that more data is transmitted to the external evidence platform using the limited field of the UDP communication port. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 It is a flow chart of the external evidence collection message processing method applied to the detected terminal provided by the present invention.

[0022] Figure 2 It is a schematic diagram of a verification code and a forensic data packet in an embodiment provided by the present invention.

[0023] Figure 3 It is a flow chart of the external evidence collection message processing method provided by the present invention and applied to the external evidence collection platform.

[0024] Figure 4 It is a structural schematic diagram of an external evidence collection message processing device applied to a detected terminal provided by the present invention.

[0025] Figure 5 It is a structural schematic diagram of an external evidence collection message processing device provided by the present invention and applied to an external evidence collection platform.

[0026] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] End-to-end means installing an Agent on the terminal connected to the LAN, and periodically sending detection messages by the Agent to try to connect to the Internet to detect illegal external connections. End-to-end means not installing any plug-ins on the terminal, and detecting illegal external connections is achieved by actively sending special detection messages from the illegal external connection detection server deployed in the LAN to the terminal connected to the intranet.

[0029] The working principle of both the end-to-end and end-to-end methods is to try to connect to the forensic platform or target machine on the Internet by sending packets. The difference is that in the end-to-end method, the Agent can actively initiate an access request and try to connect to the Internet to send data to the target machine. The data contains the information of the intranet terminal itself. This method has no specific requirements on the size of the data packet sent to the Internet forensic platform, the number of fragments, etc.; while the end-to-end method mostly constructs special data packets to the access terminal in the network through the illegal external connection detection server deployed in the intranet by using forged data sources, data packet reflection, etc., to induce the intranet terminal to access the Internet forensic platform or target machine. In order to carry the information of the intranet terminal in the data packet constructed by the end-to-end method, it is necessary to fragment the intranet terminal information to be sent, embed it in a specially constructed data packet and forward it. The Internet forensic platform or target machine will reassemble it to restore and record the information of the intranet terminal.

[0030] Combine the following Figure 1-Figure 6 The invention describes an external evidence collection message processing method, an electronic device and a storage medium.

[0031] Figure 1 FIG. 1 is a flow chart showing a method for processing an external evidence collection message applied to a detected terminal according to an exemplary embodiment. Figure 1 As shown, in an exemplary embodiment, the external evidence collection message processing method includes steps 110 to 140, which are described in detail as follows.

[0032] Step 110, obtaining forensic information data, and performing segmentation processing on the forensic information data to obtain a plurality of segmented data.

[0033] In an embodiment of the present invention, a technical route of unwarranted illegal external connection detection is used, and the external connection evidence message is carried by the UDP communication port number. The detected terminal bounces the external connection evidence message to the public network evidence platform through the UDP reflection mechanism. Therefore, the calculation scheme provided by the present invention transmits the intranet terminal evidence information in fragments of the data packet to achieve carrying more intranet terminal information. For example, the total size of the evidence information data that needs to be carried to the external connection evidence platform through the UDP communication port field in the program design is 48 bits, which includes a 16-bit user ID and a 32-bit intranet IP address of the detected terminal. The evidence information data is fragmented based on the port number field. As mentioned above, the field of the UDP communication port is a maximum of 2 bytes, that is, 16 bits. Therefore, the 48-bit evidence information data can be fragmented and divided into 6 fragments, each of which has 8 bits. The fragments are shown in Table 1 below.

[0034] Table 1

[0035] Step 120: Generate a first check code corresponding to each of the slice data based on the slice data.

[0036] In the embodiment of the present invention, the external forensic message to be formed includes a leading packet and multiple forensic data packets, and the leading packet and the forensic data packet correspond to one fragment data respectively. As mentioned above, the fragment processing obtains 6 fragment data, among which the data packet carrying the fragment data No. 0 is called the "leading packet", and the data packet carrying the fragment data Nos. 1 to 5 is called the forensic data packet.

[0037] Based on the fragmented data, a first check code corresponding to each fragmented data is generated, that is, a first check code corresponding to the leading packet and each forensic data packet is generated.

[0038] Step 130, forming an external evidence collection message based on the first verification code and the fragmented data; wherein the external evidence collection message includes a leading packet and a plurality of evidence collection data packets, and the leading packet and the evidence collection data packet respectively correspond to one of the fragmented data.

[0039] In the embodiment of the present invention, an external evidence collection message is formed based on the first verification code and the fragmented data.

[0040] Step 140: Send the external evidence collection message to the external evidence collection platform based on the UDP communication port number field.

[0041] In an embodiment of the present invention, the detected terminal bounces the external evidence collection message to the public network evidence collection platform through the UDP reflection mechanism. Specifically, the data structure of the entire external evidence collection message is used as the source UDP port, and the IP address of the external evidence collection platform is written as the source IP into the external evidence collection message to obtain a UDP detection message, and the UDP detection message is sent to the detected terminal. The detected terminal replies with the source IP and source port of the UDP detection message as the destination IP and destination port according to the characteristics of the protocol stack or specific software. In this way, UDP reflection is realized, and the sending of the external evidence collection message for unwarranted and illegal external evidence collection is completed.

[0042] In an exemplary embodiment of the present invention, the step of generating, based on the fragmented data, a first check code corresponding to each of the fragmented data includes: Calculate the first check code of the leading packet based on the forensic information data; Based on the fragmented data, determine the first verification code generation data corresponding to each of the forensic data packets, and based on the first verification code generation data, calculate the first verification code corresponding to each of the forensic data packets; wherein the first verification code generation data includes the fragmented data corresponding to the forensic data packet, and the fragmented data in the forensic information data that is located before the fragmented data corresponding to the forensic data packet.

[0043] In the embodiment of the present invention, Figure 2 As shown in the figure, for the leading packet, the 48-bit forensic information data is salted and expanded to 128 bits, and then 5 XOR operations are performed to finally obtain a 6-bit first check code. The salt value uses a fixed value, and the salting formula is: overall data (48 bits) × fixed value = salted data (128 bits).

[0044] For evidence data packet A, the slice data No. 0 and the slice data No. 1 are spliced ​​to obtain the corresponding first verification code generation data. For evidence data packet B, the slice data No. 0, the slice data No. 1 and the slice data No. 2 are spliced ​​to obtain the corresponding first verification code generation data. For evidence data packet C, the slice data No. 0, the slice data No. 1, the slice data No. 2 and the slice data No. 3 are spliced ​​to obtain the corresponding first verification code generation data. For evidence data packet D, the slice data No. 0, the slice data No. 1, the slice data No. 2, the slice data No. 3 and the slice data No. 4 are spliced ​​to obtain the corresponding first verification code generation data. For evidence data packet E, the slice data No. 0, the slice data No. 1, the slice data No. 2, the slice data No. 3, the slice data No. 4 and the slice data No. 5 are spliced ​​to obtain the corresponding first verification code generation data.

[0045] Based on the first verification code generation data, the first verification code corresponding to each forensic data packet is calculated.

[0046] In an exemplary embodiment of the present invention, the step of generating data based on the first verification code and calculating the first verification code corresponding to each of the forensic data packets includes: The first check code generation data is subjected to salting processing, and an XOR operation is performed on the salted data to obtain the first check code.

[0047] In the embodiment of the present invention, each first check code generation data is subjected to salting processing to obtain 128 bits of salted data, and then 5 XOR operations are performed to finally obtain a 6-bit first check code.

[0048] Salting is to add other components to the original data to increase the complexity of the data. Specifically, each first check code generated data is multiplied by a value to obtain 128 bits of salted data.

[0049] The first checksum and fragment data carried by the leading packet and the forensic data packets A, B, C, D, and E are as follows: Figure 2 As shown, Figure 2 The checksum in 0+1+2 It means that the check code is obtained from the fragment data 0, 1, and 2.

[0050] In an exemplary embodiment of the present invention, the forming of an external evidence collection message based on the first verification code and the fragmented data includes: Determine the message type of the leading packet and the forensic data packet, and determine the data packet type of the leading packet and the forensic data packet; Based on the message type, the data packet type, the first check code and the fragmented data, the leading packet and multiple forensic data packets are formed, and the external forensic message is obtained based on the leading packet and multiple forensic data packets.

[0051] In an embodiment of the present invention, the message type and data packet type of the leading packet and the forensic data packet are determined, the message type indicates whether the external forensic message is an IPv4 forensic message or an IPv6 forensic message, and the data packet type indicates whether the data packet is a leading packet or a forensic data packet.

[0052] The leading packet and the forensic data packet each have 16 bits, as shown in Table 2 below. The first bit is the message type, which takes a value of 0 or 1; the second bit is the data packet type, which takes a value of 0 or 1; bits 3-8 are the first check code, and bits 9-16 are the fragment data.

[0053] Table 2

[0054] Figure 3 FIG. 1 is a flow chart showing a method for processing an external evidence collection message applied to an external evidence collection platform according to an exemplary embodiment. Figure 3 As shown, in an exemplary embodiment, the external evidence collection message processing method includes steps 310 to 340, which are described in detail as follows.

[0055] Step 310: If a leading packet in the external evidence collection message is received, multiple received data packets received within a preset time range are obtained based on the leading packet.

[0056] In an embodiment of the present invention, the external evidence collection platform routinely monitors all received data packets collected by the network card, and identifies whether it is a leading packet based on the format of the data message. If a leading packet is received, the received data packets within a preset time range are collected, that is, all received data packets received within 1 second before and after the leading packet are divided into the same group, and the received data packets in the same group are reassembled and calculated, that is, the evidence collection data packet corresponding to the leading packet is determined. The received data packets received beyond the preset time range are no longer reassembled and calculated with the leading packet.

[0057] Step 320: Generate a second check code corresponding to the received data packet based on the leading packet and the fragmented data carried in the received data packet.

[0058] In the embodiment of the present invention, each received data packet contains corresponding fragmented data, and based on the fragmented data, a second check code corresponding to each fragmented data is generated.

[0059] Step 330, based on the second verification code, and the first verification code carried in the leading packet and the received data packet, determine the forensic data packet corresponding to the leading packet.

[0060] In the embodiment of the present invention, the obtained second check code is compared with the first check code carried in the received data packet, thereby determining the forensic data packet corresponding to the leading packet.

[0061] Step 340: determining forensic information data based on the leading packet and the forensic data packet.

[0062] In the embodiment of the present invention, the forensic information data can be obtained by splicing the fragmented data in the leading packet and the forensic data packet.

[0063] In an exemplary embodiment of the present invention, the generating a second check code corresponding to the received data packet based on the fragment data carried in the leading packet and the received data packet includes: Based on the fragmented data, determining second check code generation data corresponding to each of the received data packets; The second check code corresponding to each of the received data packets is calculated based on the second check code generation data.

[0064] In the embodiment of the present invention, the forensic data packet following the leading packet is determined according to the order of the fragmented data fragmented by the detected terminal, that is, as mentioned above, the forensic data packet A is determined, and then the forensic data packet B is determined, and so on.

[0065] For ease of processing, the received data packets are sorted in the order of receiving time, and the fragment data in the leading packet (fragment data No. 0) is concatenated with the fragment data in all received data packets in turn, so as to obtain the corresponding second check code generation data, and then salt is added to expand it to 128 bits and then 5 XOR operations are performed to finally obtain the corresponding 6-bit second check code. The first check code and the second check code of each received data packet are compared, and the received data packet with the same two check codes is the forensic data packet A, and the fragment data carried in it is the fragment data No. 1.

[0066] Each time a forensic data packet is determined, the fragmented data of the leading packet and the fragmented data carried by the determined forensic data packet are spliced ​​in sequence, and then spliced ​​with the fragmented data in all the remaining received data packets in pairs to obtain the corresponding second check code generation data, which is then expanded to 128 bits with salt and then subjected to 5 XOR operations to finally obtain a 6-bit second check code. The first check code and the second check code of each received data packet are compared, and the received data packet with the same two check codes is the subsequent forensic data packet of the determined forensic data packet, until all forensic data packets are determined.

[0067] In an exemplary embodiment of the present invention, the step of generating data based on the second check code and calculating the second check code corresponding to each of the received data packets includes: The second check code generation data is subjected to salting processing, and an XOR operation is performed on the salted data to obtain the second check code.

[0068] In the embodiment of the present invention, each second check code generation data is subjected to salting processing to obtain 128 bits of salted data, and then 5 XOR operations are performed to finally obtain a 6-bit second check code.

[0069] In an exemplary embodiment of the present invention, determining the forensic data packet corresponding to the leading packet based on the second check code and the first check code carried in the leading packet and the received data packet includes: Get the preset exception handling mechanism; Based on a preset exception handling mechanism and the second check code, as well as the first check code carried in the leading packet and the received data packet, the forensic data packet corresponding to the leading packet is determined.

[0070] In the embodiment of the present invention, since the external evidence collection message needs to be transmitted through the public network before reaching the external authentication platform, the external evidence collection message to the external authentication platform may be abnormal due to different routing of the routers during the routing process. Abnormal situations include abnormal leading packet sequence, data packet loss, repeated data packet check code, etc. The specific explanation of the abnormal situation is as follows: Abnormal order of leading packets: The external forensic platform routinely monitors the received data packets received by the network card. After receiving the leading packet, it groups the received data packets received within the preset time range of the leading packet into a group. Therefore, if the received data packet corresponding to the leading packet arrives before the preset time range, all fragmented data cannot be completely received in the receiving window opened with the leading packet as the identifier. For example: Assume that the order of arrival of the leading packet and received data packets A, B, C, D, and E is received data packet A, leading packet, received data packet B, C, D, and E. Then, in the subsequent attempt to restore the data, received data packet A is missing, and the forensic information data cannot be completely restored.

[0071] Packet loss or duplication: During the transmission process, the received data packet is discarded by the router or intercepted by the security device, resulting in incomplete received data packets that finally reach the external evidence collection platform, or the TCP retransmission mechanism during the transmission process causes the same received data packet to arrive multiple times. For example: Assume that the complete external evidence collection message is the leading packet and the received data packets A, B, C, D, and E. If the external evidence collection message that finally reaches the external evidence collection platform is the leading packet and the received data packets B, B, C, D, and E. Then the forensic information data cannot be completely restored.

[0072] Duplicate checksums of data packets: The checksum is generated by concatenating the fragmented data. Therefore, the checksum generated by concatenating two segments of data and the checksum generated by concatenating three segments of data may be the same, resulting in errors when restoring data on the external evidence collection platform. For example: Assume that the complete external evidence collection message is a leading packet, and receives data packets A, B (checksum is 4, generated in A+B), C, D, and E. If the message received by the evidence collection platform is a leading packet, and receives data packets A, B, C (checksum is 4, generated in A+B+C), D, and E. In the restoration process, the restored data may be abnormal due to the same checksum.

[0073] Based on various abnormal situations that may occur, the present invention designs a preset exception handling mechanism for abnormalities. Assume that the complete external forensic message is the leading packet and the received data packets A, B, C, D, and E. However, an abnormality occurs during the transmission of the received data packet. The forensic platform has spliced ​​the leading packet and the received data packets A, B, C, and D, but no matching received data packet E is found in the remaining received data packets.

[0074] Remove the received data packet D that has been spliced, traverse the remaining received data packets again, and try to find a new received data packet that matches the second check code; if there is a new received data packet, use the new received data packet for subsequent splicing. If there is no new received data packet that matches the second check code or the matching received data packet E cannot be found after splicing the new received data packet. Try to find a new received data packet again until all the remaining received data packets are traversed. If a matching received data packet E can be found after traversal, end the exception handling process. If a matching data packet E still cannot be found after traversal, proceed to the following processing flow.

[0075] Remove the first spliced ​​data packet A after the leading packet, traverse the remaining data packets again, and try to find a new received data packet that matches the second check code; if there is a new received data packet, use the new received data packet for subsequent splicing. If there is no new received data packet that matches the second check code or the matching received data packet E cannot be found after splicing the new received data packet. Try to find a new received data packet again until all the remaining received data packets are traversed. If a matching received data packet E can be found after traversal, end the exception handling process. If a matching data packet E still cannot be found after traversal, proceed to the following processing flow.

[0076] If all data splicing and restoration cannot be completed after the first and second steps of the exception handling process, the leading packet is considered abnormal and the leading packet and all received data packets in the same group are discarded.

[0077] In an embodiment of the present invention, the evidence information data is processed by fragmentation to obtain a plurality of fragmented data, a corresponding first check code is generated based on the fragmented data, an external evidence message is formed based on the first check code and the fragmented data, the external evidence message includes a leading packet and a plurality of evidence data packets, the leading packet and the evidence data packet respectively correspond to a fragmented data, and the external evidence message is sent to the external evidence platform using the UDP communication port number field. The technical solution provided by the present invention embeds the evidence information data of the detected terminal into the UDP communication port in a fragmented manner. It is realized that more data is transmitted to the external evidence platform using the limited field of the UDP communication port. In addition, by defining the data format of the transmitted external evidence message, multiple functions such as efficient reorganization and integrity verification of the fragmented data on the external evidence platform are realized, and the timeliness and authenticity of the data received and reported on the external evidence platform are ensured. The UDP communication port number field is used to avoid the abnormal data packet size and data format abnormality caused by embedding the terminal information into the data packet body, as well as the phenomenon that the communication protocol of the detected terminal is incompatible and the abnormal data packet is intercepted by other security devices during the transmission process.

[0078] The following is a description of the external evidence collection message processing device provided by the present invention. The external evidence collection message processing device described below and the external evidence collection message processing method described above can be referred to each other. It should be noted that the device provided in the following embodiment and the method provided in the above embodiment belong to the same concept, and the specific manner in which each module and unit performs the operation has been described in detail in the method embodiment, which will not be repeated here.

[0079] In an exemplary embodiment of the present invention, see Figure 4 , Figure 4 An external forensic message processing device applied to a detected terminal is shown according to an exemplary embodiment, and includes the following modules.

[0080] The fragmentation processing module 410 is configured to obtain forensic information data and perform fragmentation processing on the forensic information data to obtain a plurality of fragmentation data; A first generating module 420 is configured to generate a first check code corresponding to each of the slice data based on the slice data; A forming module 430 is configured to form an external evidence collection message based on the first verification code and the fragmented data; wherein the external evidence collection message includes a leading packet and a plurality of evidence collection data packets, and the leading packet and the evidence collection data packet respectively correspond to one of the fragmented data; The sending module 440 is configured to send the external evidence collection message to the external evidence collection platform based on the UDP communication port number field.

[0081] In an exemplary embodiment of the present invention, the first generating module 420 includes: A first calculation submodule, configured to calculate the first check code of the leading packet based on the forensic information data; The first determination submodule is configured to determine the first verification code generation data corresponding to each of the forensic data packets based on the fragmentation data, and calculate the first verification code corresponding to each of the forensic data packets based on the first verification code generation data; wherein the first verification code generation data includes the fragmentation data corresponding to the forensic data packet, and the fragmentation data in the forensic information data that is located before the fragmentation data corresponding to the forensic data packet.

[0082] In an exemplary embodiment of the present invention, the computing submodule includes: The first salt processing unit is configured to perform salt processing on the first check code generation data, and perform an XOR operation on the salted data to obtain the first check code.

[0083] In an exemplary embodiment of the present invention, the module 430 is formed, including: A second determination submodule is configured to determine the message type of the leading packet and the forensic data packet, and determine the data packet type of the leading packet and the forensic data packet; A submodule is formed, configured to form the leading packet and multiple forensic data packets based on the message type, the data packet type, the first check code and the fragmented data, and obtain the external forensic message based on the leading packet and the multiple forensic data packets.

[0084] In an exemplary embodiment of the present invention, see Figure 5 , Figure 5 An external evidence collection message processing device applied to an external evidence collection platform is shown according to an exemplary embodiment, and includes the following modules.

[0085] The first acquisition module 510 is configured to, if a leading packet in the external evidence collection message is received, acquire a plurality of received data packets received within a preset time range based on the leading packet; A second generating module 520 is configured to generate a second check code corresponding to the received data packet based on the fragmentation data carried in the leading packet and the received data packet; A first determination module 530 is configured to determine a forensic data packet corresponding to the leading packet based on the second verification code and the first verification code carried in the leading packet and the received data packet; The second determination module 540 is configured to determine the forensic information data based on the leading packet and the forensic data packet.

[0086] In an exemplary embodiment of the present invention, the second generating module 520 includes: A generating submodule, configured to determine, based on the fragmented data, second check code generation data corresponding to each of the received data packets; The second calculation submodule is configured to generate data based on the second check code and calculate the second check code corresponding to each of the received data packets.

[0087] In an exemplary embodiment of the present invention, a submodule is generated, comprising: The second salt processing unit is configured to perform salt processing on the second check code generation data, and perform an XOR operation on the salted data to obtain the second check code.

[0088] In an exemplary embodiment of the present invention, the first determining module 530 includes: An acquisition submodule configured to acquire a preset exception handling mechanism; The third determination submodule is configured to determine the forensic data packet corresponding to the leading packet based on a preset exception handling mechanism and the second check code, and the first check code carried in the leading packet and the received data packet.

[0089] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute the external evidence collection message processing method.

[0090] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0091] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the external forensic message processing method provided by the above-mentioned methods.

[0092] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the external forensic message processing method provided by the above-mentioned methods.

[0093] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0094] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0095] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for processing external evidence collection messages, characterized in that: Applied to the detected terminal, the method comprises: Acquire forensic information data, and perform slicing processing on the forensic information data to obtain a plurality of slicing data; Based on the shard data, generate a first check code corresponding to each shard data; An external evidence collection message is formed based on the first verification code and the fragmented data; wherein the external evidence collection message includes a leading packet and a plurality of evidence collection data packets, and the leading packet and the evidence collection data packet respectively correspond to one of the fragmented data; The external evidence collection message is sent to the external evidence collection platform based on the UDP communication port number field.

2. The method for processing external evidence collection messages according to claim 1, characterized in that: The step of generating, based on the shard data, a first check code corresponding to each shard data, comprises: Calculate the first check code of the leading packet based on the forensic information data; Based on the fragmented data, determine the first verification code generation data corresponding to each of the forensic data packets, and based on the first verification code generation data, calculate the first verification code corresponding to each of the forensic data packets; wherein the first verification code generation data includes the fragmented data corresponding to the forensic data packet, and the fragmented data in the forensic information data that is located before the fragmented data corresponding to the forensic data packet.

3. The method for processing external evidence collection messages according to claim 2, characterized in that: The step of generating data based on the first verification code and calculating the first verification code corresponding to each of the forensic data packets includes: The first check code generation data is subjected to salting processing, and an XOR operation is performed on the salted data to obtain the first check code.

4. The method for processing external evidence collection messages according to any one of claims 1 to 3, characterized in that: The forming of an external evidence collection message based on the first verification code and the fragmented data includes: Determine the message type of the leading packet and the forensic data packet, and determine the data packet type of the leading packet and the forensic data packet; Based on the message type, the data packet type, the first check code and the fragmented data, the leading packet and multiple forensic data packets are formed, and the external forensic message is obtained based on the leading packet and multiple forensic data packets.

5. A method for processing external evidence collection messages, characterized in that: Applied to an external evidence collection platform, the method includes: If a leading packet in the external evidence collection message is received, a plurality of received data packets received within a preset time range are obtained based on the leading packet; Generate a second check code corresponding to the received data packet based on the fragment data carried in the leading packet and the received data packet; Determine a forensic data packet corresponding to the leading packet based on the second verification code and the first verification code carried in the leading packet and the received data packet; Forensic information data is determined based on the leading packet and the forensic data packet.

6. The method for processing external evidence collection messages according to claim 5, characterized in that: The generating a second check code corresponding to the received data packet based on the fragment data carried in the leading packet and the received data packet includes: Based on the fragmented data, determining second check code generation data corresponding to each of the received data packets; The second check code corresponding to each of the received data packets is calculated based on the second check code generation data.

7. The method for processing external evidence collection messages according to claim 6, characterized in that: The generating data based on the second check code and calculating the second check code corresponding to each of the received data packets includes: The second check code generation data is subjected to salting processing, and an XOR operation is performed on the salted data to obtain the second check code.

8. The method for processing external evidence collection messages according to any one of claims 5 to 7, characterized in that: The determining, based on the second check code and the first check code carried in the leading packet and the received data packet, a forensic data packet corresponding to the leading packet comprises: Get the preset exception handling mechanism; Based on a preset exception handling mechanism and the second check code, as well as the first check code carried in the leading packet and the received data packet, the forensic data packet corresponding to the leading packet is determined.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the program, it implements the external evidence collection message processing method as described in any one of claims 1 to 8.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the external forensic message processing method as described in any one of claims 1 to 8.

Images