Data processing method, apparatus, device, and storage medium

Abstract

To provide a data processing method, apparatus, device, and storage medium for improving the quality of network connection in a network protection process.SOLUTION: A method includes the steps of: in response to receiving a data message sent from a client, detecting by a security detection device whether a destination server corresponding to the data message is under network attack; if the data message is under network attack, guiding the data message to a security protection device and sending a test message by the security protection device; verifying a verification message returned from the client side by the security protection device, and if the verification is passed, determining that the client side is a legitimate client side and sending the data message to the destination server, and if the verification is not passed, determining that the client side is an attacking client and discarding the data message.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The embodiments of the present disclosure relate to the technical field of network security, and in particular to a data processing method, device, apparatus, and storage medium. [Background technology]

[0002] ACKFlood is one of the most common DDoS (Distributed denial of service attacks). Its main principle is to forge a large number of fake source IP addresses and send a large number of ACK (Acknowledge character) messages to a server through the forged source IP addresses, so that the server is blocked by these malicious ACK messages, and the server is further denied service.

[0003] In the prior art, the timeout retransmission mechanism of TCP (Transmission Control Protocol) can be used to verify whether the source IP of a client is legitimate. The specific steps are that after an ACKFlood attack occurs, the protection system discards the ACK message, and if the client retransmits the ACK message within a certain time, it determines that the source IP of the client is legitimate; if the client does not retransmit the ACK message within a certain time, it determines that the source IP of the client is not legitimate.

[0004] However, the inventor has found that in the conventional technology, the need for session timeout retransmission after initiating the ACK retransmission algorithm causes a short lag in the client's network connection, resulting in a poor user experience, particularly in the case of delay-sensitive services (e.g., games). Summary of the Invention

[0005] The embodiments of the present disclosure provide a data processing method, device, apparatus, and storage medium that can improve the quality of network connections in the process of network security protection, and further improve user experience.

[0006] In a first aspect, an embodiment of the present disclosure provides a data processing method applied to a network protection system including a security detection device and a security protection device, the method comprising: in response to receiving a data message sent from a client, detecting by the security detection device whether a destination server corresponding to the data message is under network attack; when the destination server detects that it is under network attack, sending a test message by the security protection device to the client, the test message having a sequence number outside the sliding window of the client, to guide the data message to the security protection device and trigger the client to return a validation message to the security protection device; verifying a verification message returned from the client by the security protection device, and if the verification passes, determining that the client is a legitimate client and sending the data message to the destination server; and if the verification does not pass, determining that the client is an attacking client and discarding the data message.

[0007] In a second aspect, an embodiment of the present disclosure provides a data processing device applied to a network protection system including a security detection device and a security protection device, comprising: a detection module for detecting, in response to receiving a data message sent from a client, whether a destination server corresponding to the data message is under network attack by the security detection device; a sending module for guiding the data message to a security protection device when the destination server detects that the destination server is under network attack, and for sending a test message by the security protection device to the client, the test message having a sequence number located outside the sliding window of the client, so as to trigger the client to return a validation message to the security protection device; and a verification module for verifying a verification message returned from the client by the security protection device, determining that the client is a legitimate client and sending the data message to the destination server if the verification is passed, and determining that the client is an attacking client and discarding the data message if the verification is not passed.

[0008] In a third aspect, embodiments of the present disclosure include An electronic device including a processor and a memory communicatively connected to the processor, The memory stores computer executable instructions, The processor executes computer executable instructions stored in the memory to provide an electronic device that realizes the data processing method according to the first aspect.

[0009] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium having stored thereon computer-executable instructions which, when executed by a processor, implements the data processing method according to the first aspect above.

[0010] In a fifth aspect, an embodiment of the present disclosure provides a computer program product including a computer program which, when executed by a processor, implements the data processing method according to the first aspect above.

[0011] In the data processing method, device, equipment, and storage medium provided by this embodiment, the method includes the steps of: in response to receiving a data message sent from a client, detecting by a security detection device whether a destination server corresponding to the data message is under a network attack; if it is detected that the destination server is under a network attack, sending a test message to the client by the security protection device, the test message having a sequence number located outside the client's sliding window, to guide the data message to the security protection device and trigger the client to return a verification message to the security protection device; verifying the verification message returned from the client by the security protection device, and if the verification is passed, determining that the client is a legitimate client and sending the data message to the destination server; if the verification is not passed, determining that the client is an attacking client and discarding the data message. In an embodiment of the present application, when a destination server is under network attack, a test message can be sent to the client by the security protection device on behalf of the server, and the sequence number of the test message is outside the sliding window of the client, which can trigger the client to return a verification message. In this way, the verification message is verified by the security protection device, and the client is determined to be authentic or not. In the process of verifying the verification message by the security protection device, there is no need to stop the network connection between the server and the client, and the quality of the network connection in the network security protection process can be improved, thereby improving the user experience. [Brief description of the drawings]

[0012] In order to more clearly describe the embodiments of the present disclosure or the technical solutions in the prior art, the following briefly introduces drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present disclosure, and those skilled in the art can further obtain other drawings based on these drawings without creative efforts. [Figure 1] FIG. 2 is a schematic diagram of an application scenario of the data processing method provided by an embodiment of the present disclosure; [Diagram 2] 4 is a flowchart of a data processing method provided by an embodiment of the present disclosure. [Diagram 3] FIG. 2 is a schematic diagram of validating a normal client provided by an embodiment of the present disclosure; [Figure 4] FIG. 1 is a schematic diagram of verification of an attacking client provided by an embodiment of the present disclosure; [Diagram 5] FIG. 1 is a structural schematic diagram of a security protection system provided by an embodiment of the present disclosure. [Figure 6] FIG. 2 is a structural block diagram of a data processing apparatus provided according to an embodiment of the present disclosure; [Figure 7] FIG. 2 is a schematic diagram of a hardware structure of an electronic device provided according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] In order to make the objectives, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be described below clearly and completely with reference to the drawings in the embodiments of the present disclosure, and it is obvious that the described embodiments are only some embodiments of the present disclosure, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present disclosure without making creative efforts are all within the scope of protection of the present disclosure.

[0014] In addition, the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) related to this application are all information and data authorized by the user or fully authorized by the parties, and the collection, use and processing of related data must comply with relevant laws, regulations and standards, and provide corresponding operation entries for the user to select permission or rejection.

[0015] ACKFlood is one of the most common DDoS (Distributed denial of service attacks). Its main principle is to forge a large number of fake source IP addresses and send a large number of ACK (Acknowledge character) messages to a server through the forged source IP addresses, so that the server is blocked by these malicious ACK messages, and the server is further denied service.

[0016] In the prior art, the timeout retransmission mechanism of TCP (Transmission Control Protocol) can be used to verify whether the source IP of a client is legitimate. The specific steps are that after an ACKFlood attack occurs, the protection system discards the ACK message, and if the client retransmits the ACK message within a certain time, it determines that the source IP of the client is legitimate; if the client does not retransmit the ACK message within a certain time, it determines that the source IP of the client is not legitimate.

[0017] However, since the ACK retransmission algorithm must be started before the session times out and then retransmission is required, a short lag occurs in the client's network connection, which can lead to poor user experience, especially for delay-sensitive services (e.g., games). In addition, the timeout retransmission interval may be very short or very long for different clients, and the ACK message may be erroneously deleted due to the long time it takes to retransmit the ACK message, which can also lead to poor user experience.

[0018] For this reason, how to improve the quality of network connections while ensuring network security is currently an issue that needs to be resolved as soon as possible.

[0019] In order to solve the above problem, the present embodiment provides the following technical idea. When a client and a server transmit data through TCP, TCP can adopt a sliding window to control transmission. That is, the receiver of a message has a sliding window of a certain size, and as messages are received in sequence, the sliding window moves. If the number of a message received by the receiver is not within the range of the sliding window, it is called out of window (i.e., OOW), where window refers to the sliding window. According to the provisions of the TCP protocol stack, when the receiver (e.g., a client) receives an OOW message, it discards the message and returns an ACK message to the other party (e.g., a server).

[0020] The present application can utilize the out of window mechanism to verify whether the source IP of a client is valid and to realize protection against ACKFlood attacks. Here, when a valid client receives one OOW message, it can trigger the out of window mechanism and return one ACK message, and when an unauthorized client (or an attacking client) receives one OOW message, it does not trigger the out of window mechanism and does not return an ACK message. Accordingly, the specific steps are as follows: First, in response to receiving a data message sent from a client, a security detection device detects whether a destination server corresponding to the data message is under network attack. Then, when it is detected that the destination server is under network attack, the data message is guided to a security protection device, and a test message is sent to the client by the security protection device (i.e., the security protection device can send a test message to the client instead of the server), where the sequence number of the test message is outside the sliding window of the client, and the out of window mechanism can be triggered so that the client returns a verification message to the security protection device. Finally, the security protection device verifies the verification message returned from the client, and if the verification passes, it determines that the client is a legitimate client and sends the data message to the destination server; if the verification does not pass, it determines that the client is an attacking client and discards the data message.

[0021] In this case, when the destination server is under network attack, the security protection device can send a test message to the client on behalf of the server, and the sequence number of the test message is outside the client's sliding window, so that the client can be triggered to return a verification message. In this way, the security protection device verifies the verification message and further determines whether the client is legitimate. In the process of the security protection device verifying the verification message, the network connection between the server and the client is not stopped, and the quality of the network connection in the network security protection process can be improved, thereby improving the user experience.

[0022] The application scenarios of the embodiments of the present disclosure will be explained below.

[0023] The data processing method provided by the embodiment of the present disclosure can be applied to a scenario in which a network protection system provides security protection to a server. FIG. 1 is a schematic diagram of an application scenario of the data processing method provided by the embodiment of the present disclosure. As shown in FIG. 1, the network protection system includes a security detection device 101 and a security protection device 102. Here, the security detection device 101 detects whether a destination server is under network attack, and if it is under network attack, guides a data message to the security protection device 102, and verifies whether a client is legitimate, and if it is determined that the client is a legitimate client, sends the data message to the destination server, and if it is determined that the client is an attacking client, discards the data message. The data processing method provided by the embodiment of the present disclosure will be described in detail in the following detailed embodiment.

[0024] 2 is a flowchart of a data processing method provided by an embodiment of the present disclosure. The information processing can be applied to a network protection system, which includes a security detection device and a security protection device. As shown in FIG. 2, the method includes the following steps S201 to S203.

[0025] In S201, in response to receiving a data message sent from a client, a security detection device detects whether a destination server corresponding to the data message is under network attack.

[0026] In the embodiment of the present disclosure, the data message sent by the client may be a message of any format. For example, the data message may be an ACK message or a PUSHACK (PUSH Acknowledge character) message. Optionally, in a network connection, the data message sent by the client is also a traffic sent by the client. Optionally, the destination server corresponding to the data message is the server to which the client intends to send the data message, i.e., the server that receives the data message.

[0027] In some embodiments, the security detection device can determine whether a server is under network attack based on information such as traffic, packet volume, number of connections, etc. Accordingly, a process of detecting whether a destination server corresponding to a data message is under network attack by the security detection device includes: detecting a number of messages, a number of data packets, and a number of connected clients of the destination server corresponding to the data message by the security detection device; determining that the destination server is under network attack if the number of messages is greater than a first predetermined threshold, and / or the number of data packets is greater than a second predetermined threshold, and / or the number of connected clients is greater than a third predetermined threshold; and determining that the destination server is not under network attack if the number of messages is equal to or less than the first predetermined threshold, the number of data packets is equal to or less than the second predetermined threshold, and the number of connected clients is equal to or less than the third predetermined threshold.

[0028] Here, the network attack may be a DDoS network attack, including an ACKFlood attack. In the embodiment of the present disclosure, the numerical values ​​of the first predetermined threshold, the second predetermined threshold and the third predetermined threshold are not specifically limited, and can be set and modified as necessary.

[0029] In addition, as shown in FIG. 5, the network protection system may further include an optical splitter, and accordingly, the step of detecting whether a destination server corresponding to the data message is under network attack by a security detection device in response to receiving a data message sent from a client includes the steps of copying the data message by the optical splitter in response to receiving the data message sent from the client, sending the copied data message to the security detection device, and detecting whether a destination server corresponding to the data message is under network attack by the security detection device.

[0030] Here, the data message is copied by the optical splitter, and the data message sent from the client is instantly detected and analyzed by the security detection device without affecting the original transmission link of the data message.

[0031] Additionally, the method may further include the step of transmitting the data message sent from the client to the destination server if the destination server detects that the network is not under attack.

[0032] Here, an optical splitter is provided to copy the data message, so that a security check can be performed on the copied data message while the data message is being transmitted normally. In other words, a security check can be performed on the destination server corresponding to the data message under conditions that do not affect the normal transmission of the data message, thereby improving the transmission efficiency of the message data.

[0033] In S202, if the destination server detects that the network is under attack, it guides a data message to the security protection device and sends a test message to the client by the security protection device, the test message having a sequence number that is outside the client's sliding window, to trigger the client to return a validation message to the security protection device.

[0034] In the embodiment of the present disclosure, the sliding window may be a sliding window in a TCP connection. If the sequence number of the test message is outside the sliding window of the client, it is determined that the test message is an out of window (oow) message. According to the definition of the TCP protocol stack, when the client receives an oow message, it discards the message and returns a verification message. Here, the test message may be a keepalive message, and the verification message may be a keepalive_ack message.

[0035] Here, in order to ensure that the client can receive the test message sent from the secure device, before the secure device sends the test message to the client, it is necessary to first limit some message information of the test message. Optionally, the step of constructing the test message by the secure device includes the steps of: determining an acknowledgment number of the data message sent from the client, and determining a sequence number of the test message as a value obtained by subtracting a predetermined value from the acknowledgment number of the data message, and / or determining first session information of the data message sent from the client, including a source port, a destination port, a source address, a destination address and a protocol type, and synchronizing the second session information of the test message as the first session information, and / or setting the set mode of the test message to only ACK set, and / or setting the test message to not carry payload data.

[0036] Here, by determining the sequence number of the test message as a value obtained by subtracting a predetermined value from the acknowledgement number of the data message, it is possible to ensure that the sequence number of the test message is located outside the sliding window of the client in order to trigger the client to return a verification message to the secure device. In the embodiment of the present disclosure, the numerical value of the predetermined value is not specifically limited and can be set and modified as necessary. Exemplarily, the predetermined value is 1, the sequence number can be represented by seq, and the acknowledgement number can be represented by ack, where seq=ack-1. For example, the range of the sliding window is 33 to 40. The acknowledgement number of the data message is 32, and at this time, the sequence number of the test message is 31, which is located outside the range of the sliding window, and can trigger the client to return a verification message to the secure device.

[0037] Here, the first session information includes a source port, a destination port, a source address, a destination address, and a protocol type, and by synchronizing the second session information of the test message with the first session information, it is possible to ensure that the test message and the received data message are in the same TCP session.

[0038] Here, by setting the test message setting method to ACK set only, it is possible to ensure that the client receives the test message.

[0039] Here, by configuring the test message so that no payload data is carried, it is possible to prevent the test message from interfering with the client's original data.

[0040] As shown in FIG. 3, after receiving the test message (e.g., a keepalive message), the normal client returns one verification message to the security protection device. As shown in FIG. 4, the attacking client is not a real client and does not have a TCP out-of-window mechanism. Therefore, after receiving the test message, the attacking client does not return a verification message and continues to send ACK messages or PUSHACK messages randomly. In some embodiments, if the verification message returned from the client is not received within a predetermined time, the security protection device determines that the client is an attacking client and discards the data message. In the embodiments of the present disclosure, the numerical value of the predetermined time is not specifically limited and can be set and modified as necessary. For example, the predetermined time may be 1 second, 2 seconds, or 3 seconds.

[0041] In some embodiments, as shown in FIG. 5, the network protection system further includes a control center device, where the control center device can send protection instructions to the security protection device and control the security protection device to activate a protection mechanism.

[0042] Optionally, the step of guiding the data message to the security protection device is as follows: sending attack warning information to the control center device by the security detection device, the control center device is used to send a protection command to the security protection device in response to receiving the attack warning information, where the protection command carries IP address information of a destination server corresponding to the data message, and in response to the security protection device receiving the protection command, determining a routing device corresponding to the IP address information of the destination server, and guiding the data message to the security protection device by the routing device. Wherein, after guiding the data message to the security protection device, the security protection device can intercept the attack message in the data message and send a normal message to the corresponding destination server.

[0043] In S203, the security protection device verifies the verification message returned from the client, and if the verification passes, it determines that the client is a legitimate client and sends a data message to the destination server; if the verification does not pass, it determines that the client is an attacking client and discards the data message.

[0044] In an embodiment of the present disclosure, the verification message can be verified based on message information of the verification message. Accordingly, the step of verifying the verification message returned from the client by the secure device includes: obtaining message information of the verification message; determining by the secure device based on the message information whether the verification message is a keep-alive message, and if so, passing the verification; otherwise, not passing the verification.

[0045] Here, the keepalive message may be a Keepalive_ack message. After receiving the test message, the normal client returns one Keepalive_ack message to the security protection device. However, since the attacking client is not a real client, it does not return a verification message, and keeps sending ACK messages or PUSHACK messages randomly. At this time, the message returned from the attacking client is not a keepalive message (Keepalive_ack message).

[0046] Optionally, the message information of the validation message includes one or more of session information, time to live information, a set method, whether payload data is carried, an acknowledgment number, and a sequence number, and accordingly, the step of determining by the security protection device based on the message information whether the validation message is a keep-alive message may include the step of determining by the security protection device based on message information of at least one of the validation messages whether the validation message is a keep-alive message.

[0047] In addition, when determining whether the verification message is a keep-alive message based on the multiple pieces of message information, if it is determined that the verification message is not a keep-alive message based on any one of the pieces of message information, it is determined that the verification message is not a keep-alive message.Only when it is determined that the verification message is a keep-alive message based on all of the multiple pieces of message information, it is determined that the verification message is a keep-alive message.

[0048] Exemplarily, it is determined whether the verification message is a keep-alive message based on the session information and the time-to-live information. Only if it is determined that the verification message is a keep-alive message based on the session information and that the verification message is a keep-alive message based on the time-to-live information, it is determined that the verification message is a keep-alive message. If it is determined that the verification message is not a keep-alive message based on the session information or that the verification message is not a keep-alive message based on the time-to-live information, it is determined that the verification message is not a keep-alive message.

[0049] The specific steps of determining whether a verification message is a keep-alive message based on each message information will be described in detail below.

[0050] Optionally, a specific step of determining whether the verification message is a keep-alive message based on the session information is to determine third session information of the verification message by the security protection device, and if the third session information is the same as the second session information of the test message, determine that the verification message is a keep-alive message; if different, determine that the verification message is not a keep-alive message.

[0051] Wherein, the second session information includes a source port, a destination port, a source address, a destination address and a protocol type. If the third session information is the same as the second session information, it can be ensured that the verification message and the test message are in the same TCP session.

[0052] Optionally, a specific step of determining whether the verification message is a keep-alive message based on the survival time information is to determine first survival time information of a data message sent from a client by a security protection device and second survival time information of the verification message, and if the first survival time information is the same as the second survival time information, determine that the verification message is a keep-alive message; if different, the verification does not pass.

[0053] Here, the first time to live information of the data message can be represented by ttl. Here, since the message sent randomly from the attacking client has randomness, and the session information may be the same as the test message, the first time to live information and the second time to live information can be set to further improve security protection. Note that, since the attacking client sends the message randomly, the ttl of each message sent from the attacking client is different.

[0054] Optionally, a specific step of determining whether the verification message is a keep-alive message through a setting manner is to determine a setting manner of the verification message by the security protection device, and if the setting manner of the verification message is only ACK set, the verification is passed; if the setting manner of the verification message is not only ACK set, the verification is not passed.

[0055] Here, by setting the setting method of the verification message to only the ACK set, it is possible to ensure that the secure device receives the verification message.

[0056] Optionally, a specific step of determining whether the verification message is a keep-alive message based on whether it carries payload data is to determine by the security protection device whether payload data is carried in the verification message, and if payload data is not carried in the verification message, the verification passes, and if payload data is carried in the verification message, the verification does not pass.

[0057] Here, by configuring the verification message so that no payload data is carried, it is possible to prevent the verification message from interfering with the original data of the client.

[0058] Optionally, a specific step of determining whether the verification message is a keep-alive message based on the acknowledgment number is to determine the acknowledgment number of the verification message by the security protection device, and if the acknowledgment number of the verification message is equal to the sequence number of the test message plus 1, the verification is passed, and if not, the verification is not passed.

[0059] Now, if the acknowledgement number in the verify message is equal to the sequence number of the test message plus one, then the client can be sure that it has successfully received the previous test message.

[0060] Optionally, a specific step of determining whether the verification message is a keep-alive message based on the sequence number is to determine the sequence number of the data message sent from the client by the security protection device, the length value of the payload data, and the sequence number of the verification message; if the sequence number of the verification message is equal to the sum of the sequence number of the data message sent from the client and the length value of the payload data, the verification is passed; if not, the verification is not passed.

[0061] Here, if the sequence number of the verification message is equal to the sum of the sequence number of the data message sent from the client and the length value of the payload data, it can be ensured that the data message sent from the client is the payload and not an attack message.

[0062] It is noted that the verification only needs to be performed once for the same client. Accordingly, the method further includes the steps of: if the verification is passed, associating the first IP address information of the client with the first time-to-live information of the data message and adding it to the whitelist; in response to receiving the new data message, determining the second IP address information of the client corresponding to the new data message and the third time-to-live information of the new data message; if the first IP address information is the same as the second IP address information in the whitelist and the first time-to-live information associated with the first IP address information is the same as the third time-to-live information, directly sending the new data message to the corresponding destination server.

[0063] An embodiment of the present disclosure provides a data processing method, including: in response to receiving a data message sent from a client, detecting by a security detection device whether a destination server corresponding to the data message is under a network attack; if detecting that the destination server is under a network attack, sending a test message to the client by the security protection device, the test message having a sequence number located outside the client's sliding window, to guide the data message to the security protection device and trigger the client to return a verification message to the security protection device; verifying the verification message returned from the client by the security protection device, and if the verification is passed, determining that the client is a legitimate client and sending the data message to the destination server; if the verification is not passed, determining that the client is an attacking client and discarding the data message. In an embodiment of the present application, when a destination server is under network attack, the security protection device can send a test message to the client on behalf of the server, and the sequence number of the test message is outside the sliding window of the client, which can trigger the client to return a verification message. In this way, the security protection device can verify the verification message and further determine whether the client is legitimate. In the process of the security protection device verifying the verification message, there is no need to stop the network connection between the server and the client, and the quality of the network connection in the network security protection process can be improved, thereby improving the user experience.

[0064] 6 is a structural block diagram of a data processing device provided by an embodiment of the present disclosure. The data processing device is applied to a network protection system, which includes a security detection device and a security protection device. Referring to FIG. 6, the device includes a detection module 601, a transmission module 602 and a verification module 603.

[0065] Wherein, the detection module 601 is used to detect whether a destination server corresponding to the data message is under network attack by the security detection device in response to receiving the data message sent from the client; The sending module 602 is used to guide the data message to a security protection device when the destination server detects that the destination server is under network attack, and to send a test message, the sequence number of which is outside the sliding window of the client, by the security protection device to the client, so as to trigger the client to return a validation message to the security protection device; The verification module 603 is used to verify the verification message returned from the client by the security protection device, and if the verification passes, determine that the client is a legitimate client and send the data message to the destination server; if the verification does not pass, determine that the client is an attacking client and discard the data message.

[0066] According to one or more embodiments of the present disclosure, the apparatus further includes a message generation module for determining an acknowledgment number of a data message sent from the client, determining a sequence number of the test message as the acknowledgment number of the data message minus a predetermined value, and / or determining first session information of the data message sent from the client, including a source port, a destination port, a source address, a destination address, and a protocol type, and synchronizing second session information of the test message with the first session information, and / or setting a set mode of the test message to only ACK set, and / or setting the test message to not carry payload data.

[0067] According to one or more embodiments of the present disclosure, the step of the verification module 603 verifying the verification message returned from the client by the security protection device specifically includes the steps of obtaining message information of the verification message, and determining by the security protection device based on the message information of the verification message whether the verification message is a keep-alive message, and if so, passing the verification; otherwise, not passing the verification.

[0068] According to one or more embodiments of the present disclosure, the message information of the verification message includes one or more of session information, time to live information, set method, whether payload data is carried, acknowledgement number, and sequence number, and accordingly, the step of the verification module 603 determining whether the verification message is a keep-alive message based on the message information of the verification message by the security protection device specifically includes a step of determining whether the verification message is a keep-alive message by the security protection device based on at least one message information of the verification message.

[0069] According to one or more embodiments of the present disclosure, the network protection system further includes a control center device, and the step of the sending module 602 guiding the data message to the security protection device specifically includes a step of sending attack warning information to the control center device by the security detection device, in which the control center device is used to send a protection command to the security protection device in response to receiving the attack warning information, where the protection command carries IP address information of a destination server corresponding to the data message; and a step of determining a routing device corresponding to the IP address information of the destination server in response to the security protection device receiving the protection command, and guiding the data message to the security protection device by the routing device.

[0070] According to one or more embodiments of the present disclosure, the process in which the detection module 601 detects whether the destination server corresponding to the data message is under a network attack by the security detection device specifically includes: detecting the number of messages, the number of data packets, and the number of connected clients of the destination server corresponding to the data message by the security detection device; determining that the destination server is under a network attack if the number of messages is greater than a first predetermined threshold, and / or the number of data packets is greater than a second predetermined threshold, and / or the number of connected clients is greater than a third predetermined threshold; and determining that the destination server is not under a network attack if the number of messages is less than or equal to the first predetermined threshold, the number of data packets is less than or equal to the second predetermined threshold, and the number of connected clients is less than or equal to the third predetermined threshold.

[0071] According to one or more embodiments of the present disclosure, the apparatus further includes an additional module, which, if the verification is passed, associates the first IP address information of the client with the first time-to-live information of the data message and adds it to a whitelist, and in response to receiving a new data message, determines the second IP address information of the client corresponding to the new data message and the third time-to-live information of the new data message, and is used to directly send the new data message to a corresponding destination server if there is a first IP address information that is the same as the second IP address information in the whitelist and the first time-to-live information associated with the first IP address information is the same as the third time-to-live information.

[0072] According to one or more embodiments of the present disclosure, the device further includes a discard module, which is used by the security protection device to determine that the client is an attacking client and discard the data message if a validation message returned from the client is not received within a predetermined time.

[0073] According to one or more embodiments of the present disclosure, the network protection system further includes an optical splitter, and the step of detecting whether a destination server corresponding to the data message is under a network attack by the security detection equipment in response to the detection module 601 receiving a data message sent from a client specifically includes the steps of copying the data message by the optical splitter in response to receiving a data message sent from a client, sending the copied data message to a security detection equipment, and detecting whether a destination server corresponding to the data message is under a network attack by the security detection equipment, and the detection module 601 is further used to send the data message to the destination server if it detects that the destination server is not under a network attack.

[0074] Wherein, the detection module 601, the transmission module 602 and the verification module 603 are connected in sequence. The data processing device provided by this embodiment can implement the technical solutions of the above method embodiments, and the realization principles and technical effects thereof are similar, so this embodiment will not be described in detail here.

[0075] FIG. 7 is a hardware structure schematic diagram of an electronic device provided by an embodiment of the present disclosure. Referring to FIG. 7, the electronic device 700 may be a terminal device or a server. Here, the terminal device may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, personal digital assistants (abbreviated as PDA), tablet computers (abbreviated as Portable Android Devices (abbreviated as PAD), portable media players (abbreviated as PMP), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop personal computers. The electronic device shown in FIG. 7 is merely an example and does not limit the functions and scope of use of the embodiment of the present disclosure.

[0076] 7, the electronic device 700 may include a processing unit (e.g., a central processing unit, an image processing unit, etc.) 701, and may perform various appropriate operations and processes based on a program stored in a read only memory (ROM) 702 or a program loaded from a storage device 708 into a random access memory (RAM) 703. The RAM 703 further stores various programs and data required for operating the electronic device 700. The processing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0077] Typically, devices such as input devices 706 including a touch screen, touch pad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc., output devices 707 including a liquid crystal display (LCD), speaker, vibrator, etc., storage devices 708 including magnetic tape, hard disk, etc., and communication devices 709 can be connected to the I / O interface 705. The communication devices 709 can enable the electronic device 700 to communicate wirelessly or via wires with other devices to exchange data. Although FIG. 7 shows the electronic device 700 having various devices, it should be understood that it is not required to implement or include all of the devices shown. More or fewer devices may alternatively be implemented or included.

[0078] In particular, according to an embodiment of the present disclosure, the processes described with reference to the above flowcharts may be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product including a computer program carried on a computer-readable medium, the computer program including program code for performing the method illustrated in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network by the communication device 709, or installed from the storage device 708, or installed from the ROM 702. When the computer program is executed by the processing device 701, the above-mentioned functions limited to the method of the embodiment of the present disclosure are performed.

[0079] It should be noted that the computer readable medium described in this disclosure may be a computer readable signal medium or a computer readable storage medium or any combination of both. The computer readable storage medium may be, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, apparatus or device, or any combination of the above. More specific examples of the computer readable storage medium may include, but are not limited to, an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or flash memory), an optical fiber, a portable compact disk read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this disclosure, the computer readable storage medium may be any tangible medium that contains or stores a program, which may be used by or in combination with an instruction execution system, apparatus or device. In this disclosure, the computer readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, in which the computer readable program code is carried. Such a propagated data signal may take various forms, including, but not limited to, an electromagnetic signal, an optical signal, or any suitable combination of the above. A computer-readable signal medium may be any computer-readable medium other than a computer-readable storage medium, which may transmit, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. A program code contained in a computer-readable medium may be transmitted by any suitable medium, including, but not limited to, electrical wire, optical cable, RF (radio frequency), or the like, or any suitable combination of the above.

[0080] The computer-readable medium may be included in the electronic device, or may exist independently of the electronic device.

[0081] The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the method shown in the above embodiments.

[0082] The computer program code for carrying out the operations of the present disclosure may be organized in one or more programming languages ​​or combinations thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and the like, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, executed as an independent package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (e.g., connected by the Internet using an Internet Service Provider).

[0083] The flowcharts and block diagrams in the drawings illustrate possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowcharts or block diagrams may represent a module, a program segment, or a portion of code, which includes one or more executable instructions for implementing a certain logical function. It should be noted that in some alternative implementations, the functions depicted in the blocks may be implemented according to a different order than that depicted in the drawings. For example, two successively shown blocks may actually be executed essentially in parallel, or may be executed in the reverse order depending on the function. It should be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented in a dedicated hardware-based system that executes a certain function or operation, or may be implemented in a combination of dedicated hardware and computer instructions.

[0084] The units described in the embodiments of the present disclosure may be implemented in the form of software or hardware, where the names of the units do not necessarily limit the units themselves, for example, the first acquisition unit may be described as "a unit for acquiring at least two Internet Protocol addresses."

[0085] The functions described herein above may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, typical types of hardware logic components that may be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0086] In the context of this disclosure, a machine-readable medium may be a tangible medium, which may include or store a program for use in or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the above. More specific examples of machine-readable storage media include an electrical connection with one or more leads, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0087] In a first aspect, according to one or more embodiments of the present disclosure, there is provided a data processing method applied to a network protection system including a security detection device and a security protection device, comprising: in response to receiving a data message sent from a client, detecting by the security detection device whether a destination server corresponding to the data message is under network attack; when the destination server detects that it is under network attack, sending a test message by the security protection device to the client, the test message having a sequence number outside the sliding window of the client, to guide the data message to the security protection device and trigger the client to return a validation message to the security protection device; verifying a verification message returned from the client by the security protection device, and if the verification passes, determining that the client is a legitimate client and sending the data message to the destination server; and if the verification does not pass, determining that the client is an attacking client and discarding the data message.

[0088] According to one or more embodiments of the present disclosure, the method further includes, before sending a test message to the client by the security protection device, determining an acknowledgment number of a data message sent from the client and determining a sequence number of the test message as a value obtained by subtracting a predetermined value from the acknowledgment number of the data message, and / or determining first session information of the data message sent from the client, including a source port, a destination port, a source address, a destination address and a protocol type, and synchronizing second session information of the test message with the first session information, and / or setting a set method of the test message to only ACK set, and / or setting the test message so that payload data is not carried in the test message.

[0089] According to one or more embodiments of the present disclosure, the step of verifying the verification message returned from the client by the security protection device includes the steps of obtaining message information of the verification message, and determining by the security protection device based on the message information of the verification message whether the verification message is a keep-alive message, and if so, passing the verification, and if not, not passing the verification.

[0090] According to one or more embodiments of the present disclosure, the message information of the validation message includes one or more of session information, time to live information, set method, whether payload data is carried, acknowledgement number, and sequence number, and accordingly, the step of determining by the security protection device whether the validation message is a keep-alive message based on the message information of the validation message includes a step of determining by the security protection device whether the validation message is a keep-alive message based on message information of at least one of the validation messages.

[0091] According to one or more embodiments of the present disclosure, the network protection system further includes a control center device, and the step of guiding the data message to the security protection device includes a step of transmitting attack warning information to the control center device by the security detection device, wherein the control center device is used to transmit a protection command to the security protection device in response to receiving the attack warning information, where the protection command carries IP address information of a destination server corresponding to the data message, and a step of determining a routing device corresponding to the IP address information of the destination server in response to the security protection device receiving the protection command, and guiding the data message to the security protection device by the routing device.

[0092] According to one or more embodiments of the present disclosure, the process of detecting whether a destination server corresponding to the data message is under a network attack by the security detection device includes: detecting a number of messages, a number of data packets, and a number of connected clients of the destination server corresponding to the data message by the security detection device; determining that the destination server is under a network attack if the number of messages is greater than a first predetermined threshold, and / or the number of data packets is greater than a second predetermined threshold, and / or the number of connected clients is greater than a third predetermined threshold; and determining that the destination server is not under a network attack if the number of messages is less than or equal to the first predetermined threshold, the number of data packets is less than or equal to the second predetermined threshold, and the number of connected clients is less than or equal to the third predetermined threshold.

[0093] According to one or more embodiments of the present disclosure, the method further includes the steps of: if the verification is passed, associating the first IP address information of the client with the first time to live information of the data message and adding it to a whitelist; in response to receiving a new data message, determining the second IP address information of the client corresponding to the new data message and the third time to live information of the new data message; and if there is first IP address information in the whitelist that is the same as the second IP address information and the first time to live information associated with the first IP address information is the same as the third time to live information, directly sending the new data message to a corresponding destination server.

[0094] According to one or more embodiments of the present disclosure, the method further includes a step of determining, by the security protection device, that the client is an attacking client if a validation message is not received from the client within a predetermined time, and discarding the data message.

[0095] According to one or more embodiments of the present disclosure, the network protection system further includes an optical splitter, and accordingly, the step of detecting, in response to receiving a data message sent from a client, whether a destination server corresponding to the data message is under a network attack by the security detection device includes the steps of: in response to receiving a data message sent from a client, copying the data message by the optical splitter, sending the copied data message to a security detection device, and detecting, in response to receiving a data message from a client, whether a destination server corresponding to the data message is under a network attack by the security detection device; The method further includes the step of transmitting a data message sent from the client to the destination server if the destination server detects that the destination server is not under a network attack.

[0096] According to one or more embodiments of the present disclosure, the method further includes sending the data message to the destination server if the destination server detects that the destination server is not under a network attack.

[0097] In a second aspect, according to one or more embodiments of the present disclosure, there is provided a data processing device applied to a network protection system including a security detection device and a security protection device, comprising: a detection module for detecting, in response to receiving a data message sent from a client, whether a destination server corresponding to the data message is under network attack by the security detection device; a sending module for guiding the data message to a security protection device when the destination server detects that the destination server is under network attack, and for sending a test message by the security protection device to the client, the test message having a sequence number located outside the sliding window of the client, so as to trigger the client to return a validation message to the security protection device; and a verification module for verifying a verification message returned from the client by the security protection device, determining that the client is a legitimate client and sending the data message to the destination server if the verification is passed, and determining that the client is an attacking client and discarding the data message if the verification is not passed.

[0098] According to one or more embodiments of the present disclosure, the apparatus further includes a message generation module for determining an acknowledgment number of a data message sent from the client, determining a sequence number of the test message as the acknowledgment number of the data message minus a predetermined value, and / or determining first session information of the data message sent from the client, including a source port, a destination port, a source address, a destination address, and a protocol type, and synchronizing second session information of the test message with the first session information, and / or setting a set mode of the test message to only ACK set, and / or setting the test message to not carry payload data.

[0099] According to one or more embodiments of the present disclosure, the step of the verification module verifying the verification message returned from the client by the security protection device specifically includes the steps of obtaining message information of the verification message, and determining by the security protection device based on the message information of the verification message whether the verification message is a keep-alive message, and if so, passing the verification; otherwise, not passing the verification.

[0100] According to one or more embodiments of the present disclosure, the message information of the verification message includes one or more of session information, time to live information, a set method, whether payload data is carried, an acknowledgment number, and a sequence number, and accordingly, the step of the verification module determining by the security protection device whether the verification message is a keep-alive message based on the message information of the verification message specifically includes a step of determining by the security protection device whether the verification message is a keep-alive message based on at least one message information of the verification message.

[0101] According to one or more embodiments of the present disclosure, the network protection system further includes a control center equipment, and the step of the sending module guiding the data message to the security protection equipment specifically includes a step of sending attack warning information to the control center equipment by the security detection equipment, in response to receiving the attack warning information, the control center equipment is used to send a protection command to the security protection equipment, where the protection command carries IP address information of a destination server corresponding to the data message; and a step of determining a routing equipment corresponding to the IP address information of the destination server and guiding the data message to the security protection equipment by the routing equipment in response to the security protection equipment receiving the protection command.

[0102] According to one or more embodiments of the present disclosure, the process in which the detection module detects whether the destination server corresponding to the data message is under a network attack by the security detection device specifically includes: detecting the number of messages, the number of data packets, and the number of connected clients of the destination server corresponding to the data message by the security detection device; determining that the destination server is under a network attack if the number of messages is greater than a first predetermined threshold, and / or the number of data packets is greater than a second predetermined threshold, and / or the number of connected clients is greater than a third predetermined threshold; and determining that the destination server is not under a network attack if the number of messages is less than or equal to the first predetermined threshold, the number of data packets is less than or equal to the second predetermined threshold, and the number of connected clients is less than or equal to the third predetermined threshold.

[0103] According to one or more embodiments of the present disclosure, the apparatus further includes an additional module, which, if the verification is passed, associates the first IP address information of the client with the first time-to-live information of the data message and adds it to a whitelist, and in response to receiving a new data message, determines the second IP address information of the client corresponding to the new data message and the third time-to-live information of the new data message, and is used to directly send the new data message to a corresponding destination server if there is a first IP address information that is the same as the second IP address information in the whitelist and the first time-to-live information associated with the first IP address information is the same as the third time-to-live information.

[0104] According to one or more embodiments of the present disclosure, the device further includes a discard module, which is used by the security protection device to determine that the client is an attacking client and discard the data message if a validation message returned from the client is not received within a predetermined time.

[0105] According to one or more embodiments of the present disclosure, the network protection system further includes an optical splitter, and the step of detecting whether a destination server corresponding to the data message is under a network attack by the security detection device in response to the detection module receiving a data message sent from a client specifically includes the steps of: copying the data message by the optical splitter in response to receiving the data message sent from a client, sending the copied data message to a security detection device, and detecting whether a destination server corresponding to the data message is under a network attack by the security detection device;

[0106] The detection module is further adapted to send the data message to the destination server if it detects that the destination server is not under a network attack.

[0107] In a third aspect, according to one or more embodiments of the present disclosure, there is provided an electronic device including a processor and a memory communicatively coupled to the processor, the electronic device comprising: The memory stores computer executable instructions; The processor executes computer executable instructions stored in the memory to provide an electronic device that realizes the data processing method described in the first aspect and various possible designs of the first aspect.

[0108] In a fourth aspect, according to one or more embodiments of the present disclosure, there is provided a computer-readable storage medium having stored thereon computer-executable instructions which, when executed by a processor, implement a data processing method as described in the first aspect above and various possible designs of the first aspect.

[0109] In a fifth aspect, an embodiment of the present disclosure provides a computer program product including a computer program which, when executed by a processor, implements the data processing method as set forth in the first aspect above and various possible designs of the first aspect.

[0110] The above description is merely a description of the preferred embodiments of the present disclosure and the technical principles used. As can be understood by those skilled in the art, the scope of disclosure covered in the present disclosure is not limited to the technical solution consisting of a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the concept of the above disclosure. For example, it should cover the technical solutions formed by mutually replacing the above features with technical features having similar functions disclosed in the present disclosure (but not limited to these).

[0111] Also, although operations have been described employing a particular order, this should not be understood as requiring that these operations be performed in the particular order shown or in a sequential order. In certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although the above discussion includes details of several specific implementations, these should not be construed as limitations on the scope of the disclosure. Some features that are described in the context of separate embodiments may also be combined and implemented in a single embodiment. Conversely, various features that are described in the context of a single embodiment may also be implemented in multiple embodiments individually or in any suitable subcombination.

[0112] Although the present subject matter has been described employing language specific to structural features and / or methodological operations, it should be understood that the subject matter defined in the appended claims is not limited to the specific features or operations described above. On the contrary, the specific features and operations described above are merely example forms of implementing the claims.

Claims

1. A data processing method applied to a network protection system including a security detection device and a security protection device, comprising: in response to receiving a data message sent from a client, detecting by the security detection device whether a destination server corresponding to the data message is under network attack; when the destination server detects that it is under network attack, sending a test message by the security protection device to the client, the test message having a sequence number outside the sliding window of the client, to guide the data message to the security protection device and trigger the client to return a validation message to the security protection device; verifying a verification message returned from the client by the security protection device, determining that the client is a legitimate client if the verification passes, and sending the data message to the destination server; and determining that the client is an attacking client if the verification does not pass, and discarding the data message; 13. A data processing method comprising:

2. prior to sending a test message to the client by the secure device; determining an acknowledgement number of a data message sent by the client and determining the sequence number of the test message as the acknowledgement number of the data message minus a predetermined value; and / or determining first session information of a data message sent from the client, the first session information including a source port, a destination port, a source address, a destination address and a protocol type, and synchronizing second session information of the test message as the first session information; and / or Setting the set method of the test message to only ACK set; and / or 2. The method of claim 1, further comprising the step of configuring the test message so that no payload data is carried in the test message.

3. The step of verifying a verification message returned from the client by the secure device comprises: obtaining message information of the verification message; The data processing method according to claim 1, further comprising the step of: determining by the security protection device whether the verification message is a keep-alive message based on message information of the verification message; if so, passing the verification; otherwise, not passing the verification.

4. The message information of the validation message includes one or more of session information, time to live information, a set method, whether payload data is carried, an acknowledgement number, and a sequence number; Accordingly, the step of determining, by the security protection device, whether the validation message is a keep-alive message based on message information of the validation message includes: The data processing method according to claim 3, further comprising the step of determining, by the security protection device, whether the validation message is a keep-alive message based on message information of at least one of the validation messages.

5. The network protection system further includes a control center device, and the step of guiding the data message to the security protection device includes: sending attack warning information to a control center device by the security detection device, the control center device being used to send a protection command to the security protection device in response to receiving the attack warning information, the protection command carrying IP address information of a destination server corresponding to the data message; The data processing method according to claim 1, further comprising a step of: in response to the security protection device receiving the protection command, determining a routing device corresponding to the IP address information of the destination server, and guiding the data message to the security protection device by the routing device.

6. The process of detecting whether a destination server corresponding to the data message is under network attack by the security detection device includes: detecting the number of messages, the number of data packets, and the number of connected clients of the destination server corresponding to the data message by the security detection device; determining that the destination server is under network attack if the number of messages is greater than a first predefined threshold, and / or the number of data packets is greater than a second predefined threshold, and / or the number of connected clients is greater than a third predefined threshold; determining that the destination server is not under a network attack if the number of messages is less than or equal to the first predetermined threshold, the number of data packets is less than or equal to the second predetermined threshold, and the number of connected clients is less than or equal to the third predetermined threshold.

7. if the verification is passed, associating the first IP address information of the client with the first time-to-live information of the data message and adding it to a whitelist; in response to receiving a new data message, determining a second IP address information of a client corresponding to the new data message and a third time to live information of the new data message; 2. The data processing method of claim 1, further comprising the step of: if there is first IP address information in the whitelist that is the same as the second IP address information, and first lifetime information associated with the first IP address information is the same as the third lifetime information, directly sending the new data message to a corresponding destination server.

8. 2. The data processing method according to claim 1, further comprising the step of: if a verification message returned from the client is not received within a predetermined time, determining by the security protection device that the client is an attacking client, and discarding the data message.

9. the network protection system further comprising an optical splitter; Accordingly, the step of detecting, in response to receiving a data message sent from a client, whether a destination server corresponding to the data message is under a network attack by the security detection device includes: In response to receiving a data message transmitted from a client, copying the data message by an optical splitter, transmitting the copied data message to a security detection device, and detecting, by the security detection device, whether a destination server corresponding to the data message is under a network attack; 2. The data processing method according to claim 1, further comprising the step of transmitting the data message sent from the client to the destination server when the destination server detects that the destination server is not under a network attack.

10. A data processing device applied to a network protection system including a security detection device and a security protection device, a detection module for detecting, in response to receiving a data message sent from a client, whether a destination server corresponding to the data message is under network attack by the security detection device; a sending module for guiding the data message to a security protection device when the destination server detects that the destination server is under network attack, and for sending a test message by the security protection device to the client, the test message having a sequence number located outside the sliding window of the client, so as to trigger the client to return a validation message to the security protection device; A data processing device comprising: a verification module for verifying a verification message returned from the client by the security protection device, determining that the client is a legitimate client if the verification passes, and sending the data message to the destination server; and determining that the client is an attacking client if the verification does not pass, and discarding the data message.

11. An electronic device comprising: a processor; and a memory communicatively coupled to the processor; The memory stores computer executable instructions, 10. An electronic device, characterized in that the processor implements the data processing method according to any one of claims 1 to 9 by executing computer executable instructions stored in the memory.

12. A computer-readable storage medium having stored thereon computer-executable instructions which, when executed by a processor, implements the data processing method according to any one of claims 1 to 9.

13. A computer program product comprising a computer program which, when executed by a processor, implements the data processing method according to any one of claims 1 to 9.

Images