Data packet security detection method and device, computer equipment and storage medium

Abstract

The invention relates to a data packet security detection method and device, computer equipment and a storage medium. The method comprises the following steps: in response to a data packet sent by a network card, acquiring packet header data of the data packet, and a network card code and a queue code of the network card; the network card comprises at least one waiting queue; the queue codes are codes of waiting queues where the data packets are located in the network card; performing security detection on the data packet according to the packet header data of the data packet; under the condition that the security detection of the data packet is passed, determining a key value of the data packet according to the network card code and the queue code; and controlling the network card to perform service processing on the data packet according to the key value. By adopting the method, the states of jamming, crash and the like can be avoided within a relatively long time, the attack information is effectively intercepted, and the accuracy of defense and security detection is further improved.

Description

Technical Field

[0001] This application relates to the field of data security technology, and particularly to a method, device, computer device, and storage medium for detecting packet security. Background Art

[0002] With the rapid development of the Internet, network security issues have gradually emerged. Distributed Denial of Service Attack (DDOS) uses a large number of computers or network zombies to send a large number of requests to the target server, exhausting its bandwidth or computing resources and causing normal users to be unable to access the service. This kind of attack not only causes the server to crash, but may also lead to enterprise losses and reputation crises.

[0003] In traditional technologies, the defense methods against distributed denial of service attacks usually include firewalls, limiting the reception rate, etc. Although this method can complete the defense against distributed denial of service attacks, it still misses some abnormal requests. Therefore, there is a problem of inaccurate defense against distributed denial of service attacks. Summary of the Invention

[0004] Based on this, it is necessary to provide a method, device, computer device, and storage medium for detecting packet security that can improve the accuracy of defense for the above technical problems.

[0005] In a first aspect, this application provides a method for detecting packet security, which is applied to a packet processor. The method includes:

[0006] In response to a packet sent by the network card, obtain the header data of the packet, as well as the network card code and queue code of the network card; the network card includes at least one waiting queue; the queue code is the code of the waiting queue where the packet is located in the network card;

[0007] Perform security detection on the packet according to the header data of the packet;

[0008] In the case where the security detection of the packet passes, determine the key value of the packet according to the network card code and queue code;

[0009] Control the network card to perform service processing on the packet according to the key value.

[0010] In one embodiment, the header data includes address data and protocol data; the address data includes the source Internet protocol address. Performing security detection on the packet according to the header data of the packet includes:

[0011] Perform validity detection on the packet according to the address data and protocol data of the packet;

[0012] When the validity check of the data packet passes, security check is performed on the data packet according to the source Internet Protocol address of the data packet;

[0013] When the validity check of the data packet fails, the data packet is deleted.

[0014] In one embodiment, validity check is performed on the data packet according to the header data of the data packet, including:

[0015] Address validity check is performed on the data packet according to the address data of the data packet; and,

[0016] Protocol validity check is performed on the data packet according to the protocol data of the data packet.

[0017] In one embodiment, security check is performed on the data packet according to the source Internet Protocol address, including:

[0018] When the source Internet Protocol address belongs to the whitelist and does not belong to the blacklist, it is determined that the security check of the data packet passes; the whitelist includes the domain name protocol addresses of at least one trusted network card; the blacklist includes the preset domain name protocol addresses with security risks;

[0019] When the source Internet Protocol address does not belong to the whitelist, it is determined that the security check of the data packet fails.

[0020] In one embodiment, according to the key value, the network card is controlled to perform service processing on the data packet, including:

[0021] According to the key value, the socket descriptor of the data packet is determined;

[0022] The socket descriptor is sent to the network card for the network card to perform service processing on the data packet according to the socket descriptor.

[0023] In one embodiment, according to the network card code and the queue code, the key value of the data packet is determined, including:

[0024] Based on the displacement splicing algorithm, the network card code and the queue code are spliced to obtain a splicing result;

[0025] The splicing result is used as the key value of the data packet.

[0026] In a second aspect, the present application further provides a data packet security detection device, including:

[0027] An acquisition module, configured to acquire the header data of the data packet and the network card code and queue code of the network card in response to the data packet sent by the network card; at least one waiting queue is included in the network card; the queue code is the code of the waiting queue where the data packet is located in the network card;

[0028] A detection module, configured to perform security detection on a data packet according to the header data of the data packet;

[0029] A matching module, configured to determine the key value of the data packet according to the network card encoding and the queue encoding when the security detection of the data packet passes;

[0030] A processing module, configured to control the network card to perform service processing on the data packet according to the key value.

[0031] In a third aspect, the present application further provides a computer device, including a memory and a processor, where the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0032] In response to a data packet sent by the network card, obtain the header data of the data packet, as well as the network card encoding and the queue encoding of the network card; the network card includes at least one waiting queue; the queue encoding is the encoding of the waiting queue where the data packet is located in the network card;

[0033] Perform security detection on the data packet according to the header data of the data packet;

[0034] When the security detection of the data packet passes, determine the key value of the data packet according to the network card encoding and the queue encoding;

[0035] Control the network card to perform service processing on the data packet according to the key value.

[0036] In a fourth aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0037] In response to a data packet sent by the network card, obtain the header data of the data packet, as well as the network card encoding and the queue encoding of the network card; the network card includes at least one waiting queue; the queue encoding is the encoding of the waiting queue where the data packet is located in the network card;

[0038] Perform security detection on the data packet according to the header data of the data packet;

[0039] When the security detection of the data packet passes, determine the key value of the data packet according to the network card encoding and the queue encoding;

[0040] Control the network card to perform service processing on the data packet according to the key value.

[0041] In a fifth aspect, the present application further provides a computer program product, including a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0042] In response to a data packet sent by a network card, obtain the header data of the data packet, as well as the network card code and queue code of the network card; the network card includes at least one waiting queue; the queue code is the code of the waiting queue in which the data packet is located in the network card.

[0043] Perform security detection on the data packet according to the header data of the data packet.

[0044] When the security detection of the data packet passes, determine the key value of the data packet according to the network card code and queue code.

[0045] Control the network card to perform service processing on the data packet according to the key value.

[0046] The above-mentioned data packet security detection method, device, computer device and storage medium, in response to a data packet sent by a network card, obtain the header data of the data packet, as well as the network card code and queue code of the network card; the network card includes at least one waiting queue; the queue code is the code of the waiting queue in which the data packet is located in the network card; perform security detection on the data packet according to the header data of the data packet; when the security detection of the data packet passes, determine the key value of the data packet according to the network card code and queue code; control the network card to perform service processing on the data packet according to the key value. In this application, a data packet processor is introduced. The data packet processor can support multi-network card security detection. At the same time, multiple network card queues can be set in one network card. That is to say, through the communication between the data packet processor and the network card, the state of freezing or crashing will not occur for a long time, effectively intercepting attack information and further improving the accuracy of defense and security detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following will briefly introduce the drawings required for the description of the embodiments or related technologies. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0048] Figure 1 It is an application environment diagram of a data packet security detection method provided in this embodiment.

[0049] Figure 2 It is a flowchart of the first data packet security detection method provided in this embodiment.

[0050] Figure 3 It is a flowchart of a security detection step provided in this embodiment.

[0051] Figure 4 It is a flowchart of the second data packet security detection method provided in this embodiment.

[0052] Figure 5 The structural block diagram of a data packet security detection device provided in this embodiment;

[0053] Figure 6 The internal structure diagram of a computer device provided in this embodiment. Specific implementation manners

[0054] In order to make the objectives, technical solutions and advantages of this application clearer, the following further elaborates on this application in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not used to limit this application.

[0055] The data packet security detection method provided in the embodiments of this application can be applied to, for example, Figure 1 the application environment shown in the figure. Among them, a data packet processing (eXpress Data Path, XDP) program is mounted in the data packet processor 101. It is a kernel technology that realizes high-performance data packet processing and forwarding in the kernel space by using the extended Berkeley packet filter (eBPF) mechanism. It can significantly improve network performance and provides a flexible programming interface, enabling users to implement various custom network functions. Compared with traditional user-space data packet processing, XDP can significantly reduce the data packet processing latency and the occupancy of the Central Processing Unit (CPU). The network card 102 stores the mapping relationship between the network card and the network card queue and descriptors. The data packet processor 101 responds to the data packet sent by the network card 102, obtains the header data of the data packet, as well as the network card code and queue code of the network card; the network card includes at least one waiting queue; the queue code is the code of the waiting queue where the data packet is located in the network card; the data packet is subjected to security detection according to the header data of the data packet; in the case where the security detection of the data packet passes, the key value of the data packet is determined according to the network card code and queue code; and the network card is controlled to perform service processing on the data packet according to the key value.

[0056] In an exemplary embodiment, as Figure 2 shown in the figure, a data packet security detection method is provided. Taking the application of this method to the Figure 1 data packet processor 101 in the figure as an example, the following steps S201 to S204 are included. Among them:

[0057] S201, in response to the data packet sent by the network card, obtain the header data of the data packet, as well as the network card code and queue code of the network card.

[0058] Among them, the network card includes at least one waiting queue; the queue code is the code of the waiting queue where the data packet is located in the network card; the packet header data includes address data and protocol data; the address data includes the source Internet Protocol (IP) address, the destination IP address, the port number, etc. The protocol data includes the Ethernet (ETH) protocol number, the Internet Protocol (IP) number, etc.

[0059] Specifically, in response to the data packet sent by the network card, the data packet processor obtains the packet header data of the data packet, as well as the network card code and the queue code of the network card.

[0060] It should be noted that this embodiment can also preferentially obtain the number of network cards and the number of queues in each network card; construct a descriptor mapping table according to the number of network cards and the number of queues; and mount the XDP program on the specified network card.

[0061] Exemplarily, constructing a descriptor mapping table according to the number of network cards and the number of queues includes: assuming the number of network cards is N and the number of queues per network card is M, through the displacement splicing algorithm (N i <<8|M i ) calculate the key value corresponding to the network card Ni and the queue M of this network card i For each key value, create a socket descriptor (AF_XDP socket) corresponding to the XDP protocol, and then save the key value and the socket descriptor in the descriptor mapping table.

[0062] S202, perform security detection on the data packet according to the packet header data of the data packet.

[0063] Specifically, input the packet header data of the data packet into a pre-trained security detection model to obtain a security detection result; if the security detection of the data packet fails, delete the data packet; if the security detection of the data packet passes, determine the key value of the data packet according to the network card code and the queue code.

[0064] S203, in the case where the security detection of the data packet passes, determine the key value of the data packet according to the network card code and the queue code.

[0065] One optional implementation method is: according to the network card code and the queue code. Perform splicing processing on the network card code and the queue code, and use the splicing result as the key value of the data packet.

[0066] Another optional implementation method is: based on the displacement splicing algorithm, perform splicing processing on the network card code and the queue code to obtain a splicing result; use the splicing result as the key value of the data packet.

[0067] Specifically, the displacement splicing algorithm (network card encoding << 8 | network card queue encoding) splices the network card encoding and the queue encoding to obtain a splicing result; the splicing result is used as the key value of the data packet.

[0068] S204. According to the key value, control the network card to perform service processing on the data packet.

[0069] One optional implementation is: obtain the socket descriptor corresponding to the key value; the data packet processor sends the socket descriptor to the network card; the network card, in response to the socket descriptor, directly redirects the data packet to the network card application layer through the redirection function (bpf_redirect_map); the application layer listens to the socket descriptor and performs normal data packet service processing.

[0070] Another optional implementation is: determine the socket descriptor of the data packet according to the key value; send the socket descriptor to the network card for the network card to perform service processing on the data packet according to the socket descriptor.

[0071] Specifically, according to the key value, determine the socket descriptor corresponding to the key value from the pre-set descriptor mapping table; send the socket descriptor to the network card for the network card to perform service processing on the data packet according to the socket descriptor.

[0072] For the above data packet security detection method, in response to the data packet sent by the network card, obtain the header data of the data packet, as well as the network card encoding and queue encoding of the network card; there is at least one waiting queue in the network card; the queue encoding is the encoding of the waiting queue where the data packet is located in the network card; perform security detection on the data packet according to the header data of the data packet; in the case where the security detection of the data packet passes, determine the key value of the data packet according to the network card encoding and queue encoding; according to the key value, control the network card to perform service processing on the data packet. This application introduces a data packet processor, which can support multi-network card security detection. At the same time, multiple network card queues can be set in one network card. That is to say, through the communication between the data packet processor and the network card, the state of freezing or crashing will not occur for a long time, effectively intercepting attack information and further improving the accuracy of defense and security detection.

[0073] Figure 3 It is a schematic flowchart of the security detection steps in an embodiment. This embodiment refines the step of performing security detection on the data packet according to the header data of the data packet in the above embodiment, and gives an optional way of the security detection steps, including the following steps:

[0074] S301. Perform validity detection on the data packet according to the address data and protocol data of the data packet.

[0075] Specifically, perform address validity detection on the data packet according to the address data of the data packet; and perform protocol validity detection on the data packet according to the protocol data of the data packet. If both the address validity detection and the protocol validity detection of the data packet pass, it is determined that the validity detection of the data packet passes; otherwise, it is determined that the validity detection of the data packet fails, and the data packet needs to be deleted.

[0076] Exemplarily, respectively determine whether the source IP address, the destination IP address, and the port number match the preset source IP address, the preset destination IP address, and the preset port number. If all match, it is determined that the address validity detection of the data packet passes; if there is at least one mismatch, it is determined that the address validity detection of the data packet fails, and the data packet is deleted.

[0077] Exemplarily, respectively determine whether the Ethernet protocol and the Internet protocol number match the preset Ethernet protocol and the preset Internet protocol number. If all match, it is determined that the protocol validity detection of the data packet passes; if there is at least one mismatch, it is determined that the protocol validity detection of the data packet fails, and the data packet is deleted.

[0078] S302, in the case where the validity detection of the data packet passes, perform security detection on the data packet according to the source Internet protocol address of the data packet.

[0079] Specifically, in the case where the source Internet protocol address belongs to the whitelist and does not belong to the blacklist, it is determined that the security detection of the data packet passes; in the case where the source Internet protocol address does not belong to the whitelist, it is determined that the security detection of the data packet fails.

[0080] Among them, the whitelist includes the domain name protocol addresses of at least one trusted network card; the blacklist includes the preset domain name protocol addresses with security risks.

[0081] Exemplarily, according to the source Internet protocol address of the data packet, determine whether the source Internet protocol address belongs to the whitelist; in the case where the source Internet protocol address does not belong to the whitelist, the security detection of the data packet fails, and the data packet is deleted; in the case where the source Internet protocol address belongs to the whitelist, determine whether the source Internet protocol address belongs to the blacklist; in the case where the source Internet protocol address belongs to the blacklist, the security detection of the data packet fails, and the data packet is deleted; in the case where the source Internet protocol address belongs to the whitelist and does not belong to the blacklist, it is determined that the security detection of the data packet passes.

[0082] S303, in the case where the validity detection of the data packet fails, delete the data packet.

[0083] In this embodiment, the address data and protocol data of the data packet are used to perform validity detection on the data packet; in the case where the validity detection of the data packet passes, security detection is performed on the data packet according to the source Internet protocol address of the data packet; in the case where the validity detection of the data packet fails, the data packet is deleted, which can enable the data packet to perform black and white list identification, interception, or forwarding before the kernel network protocol stack, and intercept and detect the data packet more accurately, further improving the defense accuracy and effectiveness against distributed denial-of-service attacks.

[0084] In one embodiment, this embodiment gives an optional method for data packet security detection, which is described by taking the application of this method to a server as an example. As Figure 4 shown, the method includes the following steps:

[0085] S401, in response to a data packet sent by the network card, obtain the header data of the data packet, as well as the network card code and queue code of the network card.

[0086] Among them, the network card includes at least one waiting queue; the queue code is the code of the waiting queue where the data packet is located in the network card.

[0087] S402, perform address validity detection on the data packet according to the address data of the data packet; and perform protocol validity detection on the data packet according to the protocol data of the data packet.

[0088] S403, in the case where the validity detection of the data packet passes, perform security detection on the data packet according to the source Internet protocol address of the data packet.

[0089] S404, in the case where the security detection of the data packet passes, perform splicing processing on the network card code and queue code based on the displacement splicing algorithm to obtain a splicing result.

[0090] S405, use the splicing result as the key value of the data packet.

[0091] S406, determine the socket descriptor of the data packet according to the key value.

[0092] S407, send the socket descriptor to the network card for the network card to perform service processing on the data packet according to the socket descriptor.

[0093] It should be understood that although the steps in the flowcharts involved in the above-described embodiments are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless there is a clear indication in this article, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-described embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be executed alternately or in turn with at least a part of other steps or steps or stages in other steps.

[0094] Based on the same inventive concept, an embodiment of the present application also provides a data packet security detection device for implementing the data packet security detection method described above. The implementation solution provided by this device to solve problems is similar to the implementation solution described in the above method. Therefore, the specific limitations in one or more embodiments of the data packet security detection device provided below can refer to the limitations on the data packet security detection method in the above text, and will not be repeated here.

[0095] In an exemplary embodiment, as Figure 5 shown, a data packet security detection device is provided, including: an acquisition module 10, a detection module 11, a matching module 12, and a processing module 13, where:

[0096] The acquisition module 10 is configured to obtain the header data of the data packet, as well as the network card code and queue code of the network card in response to the data packet sent by the network card; there are at least one waiting queue in the network card; the queue code is the code of the waiting queue where the data packet is located in the network card;

[0097] The detection module 11 is configured to perform security detection on the data packet according to the header data of the data packet;

[0098] The matching module 12 is configured to determine the key value of the data packet according to the network card code and queue code when the security detection of the data packet passes;

[0099] The processing module 13 is configured to control the network card to perform service processing on the data packet according to the key value.

[0100] In some embodiments, the detection module 11 is further configured to perform validity detection on the data packet according to the address data and protocol data of the data packet; when the validity detection of the data packet passes, perform security detection on the data packet according to the source Internet protocol address of the data packet; when the validity detection of the data packet fails, delete the data packet.

[0101] In some embodiments, the detection module 11 is further configured to perform an address validity detection on the data packet according to the address data of the data packet; and perform a protocol validity detection on the data packet according to the protocol data of the data packet.

[0102] In some embodiments, the detection module 11 is further configured to determine that the security detection of the data packet passes when the source Internet protocol address belongs to the whitelist and does not belong to the blacklist; the whitelist includes the domain name protocol addresses of at least one trusted network card; the blacklist includes the preset domain name protocol addresses with security risks; when the source Internet protocol address does not belong to the whitelist, it is determined that the security detection of the data packet fails.

[0103] In some embodiments, the matching module 12 is further configured to determine the socket descriptor of the data packet according to the key value; send the socket descriptor to the network card for the network card to perform service processing on the data packet according to the socket descriptor.

[0104] In some embodiments, the processing module 13 is further configured to perform splicing processing on the network card encoding and the queue encoding based on the displacement splicing algorithm to obtain a splicing result; use the splicing result as the key value of the data packet.

[0105] Each module in the above data packet security detection device can be implemented in whole or in part by software, hardware, and their combination. Each of the above modules can be embedded in the processor in the computer device in hardware form or independent of it, or stored in the memory in the computer device in software form, so that the processor can call and execute the operations corresponding to each of the above modules.

[0106] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as Figure 6 shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O), and a communication interface. Among them, the processor, the memory, and the input / output interface are connected through the system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals through a network connection. The computer program, when executed by the processor, implements a data packet security detection method.

[0107] Those skilled in the art can understand,Figure 6 The structure shown is only a block diagram of some structures related to the solution of this application, and does not constitute a limitation on the computer device to which the solution of this application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine some components, or have different component arrangements.

[0108] In an exemplary embodiment, a computer device is provided, including a memory and a processor. A computer program is stored in the memory. When the processor executes the computer program, the following steps are implemented:

[0109] In response to a data packet sent by the network card, obtain the header data of the data packet, as well as the network card code and queue code of the network card; the network card includes at least one waiting queue; the queue code is the code of the waiting queue in which the data packet is located in the network card;

[0110] Perform a security check on the data packet according to the header data of the data packet;

[0111] When the security check of the data packet passes, determine the key value of the data packet according to the network card code and queue code;

[0112] Control the network card to perform service processing on the data packet according to the key value.

[0113] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0114] Perform a validity check on the data packet according to the address data and protocol data of the data packet;

[0115] When the validity check of the data packet passes, perform a security check on the data packet according to the source Internet protocol address of the data packet;

[0116] When the validity check of the data packet fails, delete the data packet.

[0117] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0118] Perform an address validity check on the data packet according to the address data of the data packet; and,

[0119] Perform a protocol validity check on the data packet according to the protocol data of the data packet.

[0120] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0121] When the source Internet protocol address belongs to the whitelist and does not belong to the blacklist, it is determined that the security detection of the data packet passes; the whitelist includes the domain name protocol addresses of at least one trusted network card; the blacklist includes the preset domain name protocol addresses with security risks.

[0122] When the source Internet protocol address does not belong to the whitelist, it is determined that the security detection of the data packet fails.

[0123] In one embodiment, when the processor executes the computer program, the following steps are further implemented:

[0124] Determine the socket descriptor of the data packet according to the key value;

[0125] Send the socket descriptor to the network card for the network card to perform service processing on the data packet according to the socket descriptor.

[0126] In one embodiment, when the processor executes the computer program, the following steps are further implemented:

[0127] Based on the displacement splicing algorithm, splice the network card encoding and the queue encoding to obtain a splicing result;

[0128] Use the splicing result as the key value of the data packet.

[0129] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0130] In response to the data packet sent by the network card, obtain the header data of the data packet, as well as the network card encoding and the queue encoding of the network card; at least one waiting queue is included in the network card; the queue encoding is the encoding of the waiting queue where the data packet is located in the network card;

[0131] Perform security detection on the data packet according to the header data of the data packet;

[0132] When the security detection of the data packet passes, determine the key value of the data packet according to the network card encoding and the queue encoding;

[0133] Control the network card to perform service processing on the data packet according to the key value.

[0134] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented:

[0135] Perform validity detection on the data packet according to the address data and protocol data of the data packet;

[0136] When the validity detection of the data packet passes, perform security detection on the data packet according to the source Internet protocol address of the data packet;

[0137] Delete the data packet if the validity check of the data packet fails.

[0138] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0139] Perform an address validity check on the data packet according to the address data of the data packet; and,

[0140] Perform a protocol validity check on the data packet according to the protocol data of the data packet.

[0141] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0142] Determine that the security check of the data packet passes if the source Internet protocol address belongs to the white list and does not belong to the black list; the white list includes the domain name protocol addresses of at least one trusted network card; the black list includes the preset domain name protocol addresses with security risks;

[0143] Determine that the security check of the data packet fails if the source Internet protocol address does not belong to the white list.

[0144] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0145] Determine the socket descriptor of the data packet according to the key value;

[0146] Send the socket descriptor to the network card for the network card to perform service processing on the data packet according to the socket descriptor.

[0147] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0148] Perform splicing processing on the network card encoding and the queue encoding based on the displacement splicing algorithm to obtain a splicing result;

[0149] Use the splicing result as the key value of the data packet.

[0150] In one embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0151] In response to the data packet sent by the network card, obtain the header data of the data packet, as well as the network card encoding and the queue encoding of the network card; at least one waiting queue is included in the network card; the queue encoding is the encoding of the waiting queue where the data packet is located in the network card;

[0152] Perform a security check on the data packet according to the header data of the data packet;

[0153] When the security detection of the data packet passes, determine the key value of the data packet according to the network card code and the queue code;

[0154] According to the key value, control the network card to perform service processing on the data packet.

[0155] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented:

[0156] Perform validity detection on the data packet according to the address data and protocol data of the data packet;

[0157] When the validity detection of the data packet passes, perform security detection on the data packet according to the source Internet protocol address of the data packet;

[0158] When the validity detection of the data packet fails, delete the data packet.

[0159] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented:

[0160] Perform address validity detection on the data packet according to the address data of the data packet; and,

[0161] Perform protocol validity detection on the data packet according to the protocol data of the data packet.

[0162] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented:

[0163] When the source Internet protocol address belongs to the white list and does not belong to the black list, determine that the security detection of the data packet passes; the white list includes the domain name protocol addresses of at least one trusted network card; the black list includes the preset domain name protocol addresses with security risks;

[0164] When the source Internet protocol address does not belong to the white list, determine that the security detection of the data packet fails.

[0165] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented:

[0166] Determine the socket descriptor of the data packet according to the key value;

[0167] Send the socket descriptor to the network card for the network card to perform service processing on the data packet according to the socket descriptor.

[0168] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented:

[0169] Based on the displacement splicing algorithm, splice the network card code and the queue code to obtain a splicing result;

[0170] Use the splicing result as the key value of the data packet.

[0171] It should be noted that the data involved in this application (including but not limited to the data for analysis, stored data, displayed data, etc.) are all information and data authorized by users or fully authorized by all parties, and the collection, use, and processing of relevant data need to comply with relevant regulations.

[0172] Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to a memory, database, or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memories. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The databases involved in the embodiments provided in this application can include at least one of relational databases and non-relational databases. Non-relational databases can include distributed databases based on blockchain, etc., and are not limited thereto. The processors involved in the embodiments provided in this application can be general-purpose processors, central processors, graphics processors, digital signal processors, programmable logic devices, data processing logics based on quantum computing, etc., and are not limited thereto.

[0173] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as the scope recorded in this specification.

[0174] The above-described embodiments merely represent several implementation manners of the present application. The description thereof is relatively specific and detailed, but it should not be construed as a limitation to the patent scope of the present application. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can still be made, and these all fall within the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the appended claims.

Claims

1. A method for detecting the security of data packets, characterized in that, Applied to a data packet processor, the method includes: In response to a data packet sent by a network card, obtaining the header data of the data packet, as well as the network card code and queue code of the network card; at least one waiting queue is included in the network card; the queue code is the code of the waiting queue in which the data packet is located in the network card; Performing a security check on the data packet according to the header data of the data packet; When the security check of the data packet passes, determining the key value of the data packet according to the network card code and the queue code; Controlling the network card to perform service processing on the data packet according to the key value.

2. The method according to claim 1, characterized in that, The header data includes address data and protocol data; the address data includes the source Internet protocol address; the performing a security check on the data packet according to the header data of the data packet includes: Performing a validity check on the data packet according to the address data and protocol data of the data packet; When the validity check of the data packet passes, performing a security check on the data packet according to the source Internet protocol address of the data packet; When the validity check of the data packet fails, deleting the data packet.

3. The method according to claim 2, wherein The performing a validity check on the data packet according to the header data of the data packet includes: Performing an address validity check on the data packet according to the address data of the data packet; and, Performing a protocol validity check on the data packet according to the protocol data of the data packet.

4. The method according to claim 2, wherein The performing a security check on the data packet according to the source Internet protocol address includes: When the source Internet protocol address belongs to the white list and does not belong to the black list, determining that the security check of the data packet passes; the white list includes at least one domain name protocol address of a trusted network card; the black list includes preset domain name protocol addresses with security risks; When the source Internet protocol address does not belong to the white list, determining that the security check of the data packet fails.

5. The method according to claim 1, characterized in that The controlling the network card to perform service processing on the data packet according to the key value includes: Determining the socket descriptor of the data packet according to the key value; Sending the socket descriptor to the network card for the network card to perform service processing on the data packet according to the socket descriptor.

6. The method according to claim 1, wherein The determining the key value of the data packet according to the network card code and the queue code includes: Performing a splicing process on the network card code and the queue code based on a displacement splicing algorithm to obtain a splicing result; Using the splicing result as the key value of the data packet.

7. A data packet security detection device, characterized in that, The device includes: An obtaining module, configured to obtain the header data of the data packet, as well as the network card code and queue code of the network card in response to a data packet sent by the network card; at least one waiting queue is included in the network card; the queue code is the code of the waiting queue in which the data packet is located in the network card; A detecting module, configured to perform a security check on the data packet according to the header data of the data packet; A matching module, configured to determine the key value of the data packet according to the network card code and the queue code when the security check of the data packet passes; A processing module, configured to control the network card to perform service processing on the data packet according to the key value.

8. A computer device, comprising a memory and a processor, the memory storing a computer program, characterized in that, When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images