WO2024130949A1 - 数据处理方法、设备及可读存储介质 - Google Patents

数据处理方法、设备及可读存储介质 Download PDF

Info

Publication number
WO2024130949A1
WO2024130949A1 PCT/CN2023/095120 CN2023095120W WO2024130949A1 WO 2024130949 A1 WO2024130949 A1 WO 2024130949A1 CN 2023095120 W CN2023095120 W CN 2023095120W WO 2024130949 A1 WO2024130949 A1 WO 2024130949A1
Authority
WO
WIPO (PCT)
Prior art keywords
secure
resource
target
access
path
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2023/095120
Other languages
English (en)
French (fr)
Inventor
王万锋
吕士表
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Wangsu Science and Technology Co Ltd
Original Assignee
Wangsu Science and Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Wangsu Science and Technology Co Ltd filed Critical Wangsu Science and Technology Co Ltd
Priority to EP23800725.6A priority Critical patent/EP4641974A4/en
Priority to US18/506,585 priority patent/US20240214356A1/en
Publication of WO2024130949A1 publication Critical patent/WO2024130949A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/029—Firewall traversal, e.g. tunnelling or, creating pinholes
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/30—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information
    • H04L63/306—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information intercepting packet switched data communications, e.g. Web, Internet or IMS communications

Definitions

  • the embodiments of the present application relate to the field of network security technology, and in particular to a data processing method, device, and readable storage medium.
  • computers are divided into a secure domain and a personal domain through virtual isolation technology. Users surf the Internet in the personal domain and work in the secure domain.
  • the network is an important data communication channel for the secure domain.
  • Network protection for the secure domain is the top priority for preventing corporate data leakage.
  • API hooks are usually used to protect the secure domain.
  • the embodiments of the present application provide a data processing method, device and readable storage medium, which direct traffic according to the target network address of the network data packet without modifying the IP header of the network data packet, thereby achieving network security and decoupling the security tunnel and sandbox network protection isolation.
  • an embodiment of the present application provides a data processing method, including:
  • the network data packet is processed according to the target path and the access permission.
  • an embodiment of the present application provides a data processing device, including:
  • An acquisition module used for acquiring a network data packet sent by the first process
  • a determination module configured to determine a target path from a first path and a second path according to a target network address of the network data packet, wherein the first path is a path passing through a physical network card, and the second path points to a preset secure tunnel;
  • a permission module used to determine the access permission of the target resource corresponding to the target network address
  • a processing module is used to process the network data packet according to the target path and the access permission.
  • an embodiment of the present application provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the electronic device implements the method described in the first aspect or various possible implementation methods of the first aspect.
  • an embodiment of the present application provides a non-volatile computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed by a processor, they are used to implement the method described in the first aspect or various possible implementation methods of the first aspect.
  • an embodiment of the present application provides a computer program product comprising a computing program, and when the computer program is executed by a processor, the method described in the first aspect or various possible implementation methods of the first aspect is implemented.
  • the electronic device obtains the network data packet sent by the first process of the application, determines the target path from the first path and the second path according to the target network address of the network data packet, and determines the access rights of the target resource corresponding to the target network address. After that, the network data packet is processed according to the target path and the access rights.
  • the electronic device diverts the traffic according to the target network address of the network data packet without modifying the IP header of the network data packet, thereby achieving network security protection and decoupling of the security tunnel and the sandbox network protection isolation.
  • FIG1 is a schematic diagram of a desktop of an electronic device in a data processing method provided in an embodiment of the present application
  • FIG2 is a schematic diagram of the structure of a sandbox in a data processing method provided in an embodiment of the present application
  • FIG3 is a flow chart of a data processing method provided in an embodiment of the present application.
  • FIG. 4 is a schematic diagram of a first path and a second path in a data processing method provided in an embodiment of the present application
  • FIG5 is another flow chart of the data processing method provided in an embodiment of the present application.
  • FIG. 6 is a schematic diagram of inter-process communication in a data processing method provided in an embodiment of the present application.
  • FIG7 is a schematic diagram of a data processing device provided in an embodiment of the present application.
  • FIG8 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application.
  • Enterprise data leakage prevention is an important part of network security.
  • Traditional enterprise data leakage prevention solutions mainly include file transparent encryption and decryption solutions, pre-interception detection solutions, in-process protection solutions, post-audit solutions and virtual cloud solutions.
  • the file transparent encryption and decryption solution will bring some unstable risks, such as file damage, complex policy configuration, poor compatibility and other problems, which will affect office efficiency.
  • Pre-interception solutions and in-process protection solutions will make users feel layers of interception during the office process, with poor experience and low work efficiency; for some core data that has been leaked, although the post-audit solution can trace back to the source of the leak, it is already difficult to remedy.
  • Virtual cloud desktops require investment in hardware and network equipment, which is costly.
  • the industry uses the zero-trust concept as a support and virtual isolation control technology to divide computers into security domains and personal domains to prevent data leakage from the source.
  • the security domain or the personal domain, especially the security domain
  • the network is the top priority for enterprise data leakage prevention.
  • API hook is used for network protection.
  • the API hook solution cannot hook some system processes, and some system processes are missed, which also poses the risk of leakage.
  • DNS Domain Name System
  • the embodiments of the present application provide a data processing method, device and readable storage medium, which direct traffic according to the target network address of the network data packet without modifying the IP header of the network data packet, thereby achieving network security and decoupling of security tunnels and sandbox network protection isolation.
  • the executor of the data processing method described in the embodiment of the present application is an electronic device, and the operating system of the electronic device is, for example, a device of the Windows system.
  • Multiple application programs are installed on the electronic device, hereinafter referred to as programs. These programs include system programs and application programs of the electronic device.
  • System programs are, for example, programs that come with the electronic device after leaving the factory, such as video players, etc.
  • Application programs are programs installed by users on electronic devices, such as word office applications, instant messaging tools, etc.
  • the electronic device can specifically be a desktop computer, a laptop computer, a tablet computer, an enterprise data leakage prevention (Endpoint Data Leakage Prevention, EDLP), a zero-trust network (Zero-Trust-Architecture, ZTNA) terminal, etc., and the embodiment of the present application is not limited.
  • EDLP Endpoint Data Leakage Prevention
  • ZTNA Zero-trust network
  • a security domain and a personal domain are divided on an electronic device through virtual isolation control technology.
  • the virtual isolation technology is also called sandbox technology.
  • the electronic device isolates the processes of the security domain and the processes of the personal domain based on the sandbox technology.
  • the personal domain is also called a non-security domain.
  • the display of the electronic device has at least two desktops, and the user can switch to different desktops, one of which is a desktop of the security domain.
  • the user opens an application on the desktop of the security domain, and the process created by the electronic device is a secure process;
  • the other desktop is the desktop of the personal domain.
  • the process created by the electronic device is a non-secure process, which is also called a personal domain process.
  • the display of the electronic device displays the desktop of the personal domain
  • the floating window on the desktop represents the desktop of the security domain.
  • Figure 1 is a schematic diagram of the desktop of the electronic device in the data processing method provided in the embodiment of the present application.
  • desktop 11 is the desktop of the personal domain
  • desktop 12 is a floating window floating on desktop 11
  • desktop 12 is the desktop of the security domain
  • the user can zoom in, zoom out or hide desktop 12 by operating the mouse.
  • the embodiment of the present application does not limit the number of desktops 12, that is, a personal domain and multiple security domains can be divided on the electronic device through virtual isolation technology, and different security domains have different permissions.
  • the personal domain has Internet access permission
  • a security domain has access to a first security resource
  • another security domain has access to a second security resource.
  • the security domain is a secure container. Using virtual isolation technology, the permissions of the security process will be limited to the minimum range. Normally, the security process is allowed to write data to the security domain, but not to the personal domain. When the security process needs to write data to the personal domain, it will be redirected to the security disk corresponding to the security domain. The security process is allowed to read data in the personal domain, and the security process is prohibited from communicating with the personal domain process. The security disk is stored in an encrypted manner, and non-security processes cannot read or write to the security disk. Through a series of isolation technologies, the security domain becomes a closed environment. In principle, data can only enter but not exit, and data can only be sent and received through authorized and secure network resources.
  • FIG2 is a schematic diagram of the structure of the sandbox in the data processing method provided in the embodiment of the present application.
  • the sandbox 200 includes an isolation application module 201, a sandbox service 202, and other application modules 203 located in the application space; and an isolation driver module 204, a process identification module 205, and other driver modules 206 located in the kernel space.
  • the isolation driver module 204 includes a Windows Filtering Platform (WFP) driver unit 2041 and a Network Driver Interface Specification (NDIS) filter driver unit 2042.
  • WFP Windows Filtering Platform
  • NDIS Network Driver Interface Specification
  • FIG2 also illustrates a tunnel gateway 207, a virtual network card 208, and a physical network card 209 related to the sandbox.
  • FIG3 is a flow chart of a data processing method provided in an embodiment of the present application. This embodiment is executed by an electronic device and includes:
  • the application is opened by double-clicking or other operations.
  • the system creates a process.
  • the process created by the system is called a non-secure process
  • the process created by the system is called a secure process.
  • some applications are started from another application. For example, an office application is started from a browser. At this time, a new process is also created.
  • the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol stack of the electronic device obtains the network data packet, which carries at least the domain name of the target resource, etc.
  • TCP/IP Transmission Control Protocol/Internet Protocol
  • the first path is a path passing through the physical network card, and the second path points to a preset secure tunnel.
  • the electronic device pre-stores the correspondence between the network address of the resource and the target path. For example, the electronic device pre-stores the target path of resource A as the first path and the target path of resource B as the second path.
  • the electronic device after the electronic device obtains the network data packet, it determines the target network address according to the domain name carried in the network data packet. For example, the electronic device sends a DNS request carrying the domain name to the Domain Name System (DNS) so that the DNS returns the target network address. After determining the target network address, the electronic device queries the above-mentioned correspondence and determines the target path from the first path and the second path.
  • DNS Domain Name System
  • FIG4 is a schematic diagram of the first path and the second path in the data processing method provided in an embodiment of the present application.
  • the TCP/IP model includes a 5-layer architecture, which is the application layer, the transport layer, the network layer, the data link layer, and the physical layer from top to bottom.
  • the electronic device creates a first process, and the first process sends a network data packet to the TCP/IP protocol stack.
  • the TCP/IP protocol stack includes a routing selection module and a WFP network protection module.
  • the electronic device pre-creates an independent secure tunnel, which is also called a network tunnel.
  • resources include: resources that are only allowed to be accessed by secure processes, resources that are only allowed to be accessed by non-secure processes, and resources that are accessible to both secure processes and non-secure processes.
  • the routing selection module determines the target path from the first path and the second path according to the target network address of the network data packet.
  • the first path is the path through the physical network card, as shown by the thick black solid line in the figure, and the second path points to the preset secure tunnel, as shown by the thick black dotted line in the figure.
  • the TCP/IP protocol stack sends the network data packet to the physical network card, and the network data packet is sent out through the physical network card.
  • the TCP/IP protocol stack sends the network data packet to the virtual network card, and then the data packet returns to the application layer, and the virtual network card is read through the application layer's secure tunnel program, and the read data packet is sent to the TCP/IP protocol stack, so that the TCP/IP protocol stack reassembles the data packet and sends the reassembled data packet through the physical network card.
  • Whether these callouts are registered can be automatically enumerated by tools, or enumerated by drivers, or static analysis methods can be used to analyze the corresponding sys driver files (reverse analysis).
  • callout1 is used for outbound connection events
  • callout2 is used for inbound connection events
  • callout3 is used for port allocation events
  • callout4 is used for port release events
  • callout5 is used to obtain the User Datagram Protocol (UDP) transport layer message data stream, and then resolve the relationship between the domain name and IP in the DNS.
  • UDP User Datagram Protocol
  • the electronic device pre-stores the correspondence between resources and access rights. For example, the electronic device pre-stores an access rights table, which indicates that resource A is only accessible to secure domain processes, resource B is only accessible to non-secure processes, and resource C is accessible to both secure and non-secure processes. Therefore, the electronic device can determine the access rights of the target resource by querying the access rights table.
  • the electronic device when the access permission indicates that the first process can access the target resource, the electronic device sends the network data packet of the first process through the first path. When the access permission indicates that the first process cannot access the target resource, the electronic device discards the network data packet of the first process.
  • not all network data packets of the secure process are sent through the second path, and not all network data packets of the non-secure process are sent through the first path, but it is related to the target path determined in step 302.
  • the target resource is a resource that only the secure process is allowed to access, a resource that only the non-secure process is allowed to access, or a resource that both the secure process and the non-secure process can access. Therefore, the decoupling of the secure tunnel and the sandbox network protection isolation can be achieved.
  • the target path is the first path
  • the first process is a secure process
  • the target resource is a resource that can be accessed by both the secure process and the non-secure process
  • the TCP/IP protocol stack sends the network data packet of the first process through the physical network card.
  • the target resource is, for example, a read-only resource.
  • the network data packet of the secure process is not sent through the secure tunnel, that is, it is not sent through the second path.
  • the TCP/IP protocol stack sends the network data packet of the first process through the virtual network card, that is, through the second path.
  • the target resource is, for example, a read-only resource.
  • the network data packet of the non-secure process is not sent through the physical network card, but is sent through the second path.
  • an electronic device obtains a network data packet sent by a first process of an application, determines a target path from a first path and a second path according to a target network address of the network data packet, and determines the access rights to the target resource corresponding to the target network address. Afterwards, the network data packet is processed according to the target path and the access rights.
  • the electronic device directs traffic according to the target network address of the network data packet without modifying the IP header of the network data packet, thereby achieving network security protection and decoupling of security tunnel and sandbox network protection isolation.
  • FIG5 is another flow chart of a method for processing a data packet provided by an embodiment of the present application. This embodiment includes:
  • step 504. Determine whether the first process is a safe process. If the first process is a safe process, execute step 505; if the first process is a non-safe process, execute step 508.
  • each time the electronic device creates a process it will assign a unique process identification number (Process Identification, PID, PID) to the process.
  • the WFP network protection module is used to determine whether a process is a safe process based on the PID of the process. For example, the WFP network protection module sends the PID to the process identification module in the sandbox, and the process identification module determines whether the first process is a safe process and returns the identification result to the WFP network protection module. For another example, the process is monitored by a process callback. When a new process is started, that is, when the first process is started, it is distinguished whether the first process is a safe process or a non-safe process according to the rules.
  • step 505. Determine whether the target resource corresponding to the target network address allows the security process to access based on the access permission. If the target resource allows the security process to access, execute step 506; if the target resource does not allow the security process to access, execute step 507.
  • the electronic device After the electronic device determines that the first process is a secure process, it continues to determine whether the target resource corresponding to the target network address allows the secure process to access. Only when the secure process is allowed to access can the secure process access the target resource and the TCP/IP protocol stack can send the network data packet.
  • the target path is the first path
  • the first process is a secure process and the target resource is a resource accessible to both the secure process and the non-secure process
  • the TCP/IP protocol stack sends the network data packet of the first process through the physical network card.
  • the target resource is, for example, a read-only resource.
  • the TCP/IP protocol stack discards the network data packet.
  • the TCP/IP protocol stack discards the network data packet.
  • the TCP/IP protocol stack sends the network data packet of the first process through the virtual network card.
  • the secure process cannot access any resources other than the secure resources, so that by default the secure process will not leak information through network channels, while the non-secure process is not controlled.
  • a trusted secure network resource is configured for the security domain, the secure process is only allowed to access this network resource and cannot access other resources, thereby complying with the "least privilege" principle. Since in some embodiments of the present application, routing control is not targeted at the process, once the secure tunnel is opened, the non-secure process can also access feasible secure network resources.
  • step 508 Determine whether the target resource corresponding to the target network address allows access by non-secure processes according to the access rights. If the target resource allows access by non-secure processes, execute step 509; if the target resource does not allow access by non-secure processes, execute step 510.
  • the TCP/IP protocol stack sends the network data packet of the first process through the physical network card.
  • the TCP/IP protocol stack sends the network data packet of the unsafe process through the first path.
  • the TCP/IP protocol stack discards the network data packet.
  • the target path is the second path
  • the first process is an unsafe process
  • the target resource is a resource that is allowed to be accessed by both unsafe processes and safe processes
  • the TCP/IP protocol stack sends the network data packet of the unsafe process through the virtual network card.
  • the target resource is, for example, a read-only resource.
  • the network data packet of the non-secure process is sent through the target path based on the access rights and determination, thereby achieving network protection while realizing the decoupling of the secure tunnel and the sandbox network protection isolation.
  • the electronic device before the electronic device obtains the network data packet sent by the first process, it also obtains a first configuration file and a second configuration file, the first configuration file is used to indicate the correspondence between the network address of the resource and the target path, and the second configuration file is used to indicate the correspondence between the network address of the resource and the target path.
  • the configuration file is used to indicate the access rights of resources.
  • the access rights include allowing only secure domain processes to access, allowing only non-secure processes to access, or allowing both secure and non-secure processes to access.
  • the electronic device obtains the first configuration file from a local or remote server in advance, and then registers it in the system routing table, so that the corresponding relationship between the network address of the resource and the target path is stored in the routing table.
  • the electronic device obtains the second configuration file from a local or remote server in advance and stores it in the TCP/IP protocol stack. In this way, after the first process sends a network data packet, the electronic device can determine the target path and access rights of the target resource by querying the first configuration file, which is fast and accurate.
  • a personal domain and a security domain can be divided on the same electronic device through virtual isolation technology, wherein the security domain can be multiple, that is, there are multiple floating windows on the desktop of the personal domain in Figure 1, and different floating windows represent different security domains.
  • communication between non-security processes in the personal domain is allowed, and communication between security processes in the same security domain is allowed, so that the security processes created in the same security domain are not restricted by the network, and the network between security processes in the security domain is guaranteed to be normal.
  • non-security processes and security processes are not allowed to communicate, and security processes in different security domains are not allowed to communicate.
  • the electronic device uses WFP technology to record the PID of the running process, the protocol to which it belongs, and the port monitored by the process, etc., to filter the inbound request of the non-security process requesting to connect to the security process, and to filter the outbound request of the security process requesting to connect to the non-security process.
  • the outbound request includes a local loopback request.
  • the electronic device also processes DNS requests, etc. through WFP technology.
  • the request initiated by the first process is called an outbound request.
  • the first process is the source process and the second process is the target process.
  • a local loopback refers to a request by the first process to establish a connection with the local second process
  • a non-local loopback refers to a request by the first process to establish a network connection with a remote process.
  • the second process when the first process is a non-secure process and the first process initiates an outbound request of a local loopback, the second process is determined from the local process.
  • the second process is a non-secure process, a connection between the first process and the second process is established, and when the second process is a secure process, the connection between the first process and the second process is prohibited.
  • the electronic device records the corresponding relationship between the port listened by each process in the local process, the protocol to which it belongs, and the PID of the process through the WFP technology. Therefore, when the first process initiates an outbound request for a local loopback, the electronic device can infer the PID of the second process based on the protocol and PID, that is, determine the second process from the local process. Afterwards, the electronic device uses the WFP network protection module in Figure 4 to determine whether the second process is a secure process. Since the first process is a non-secure process, when the second process is a non-secure process, the electronic device establishes a connection between the first process and the second process, thereby ensuring that the network between non-secure processes in the personal domain is normal. When the second process is a secure process, it is prohibited to establish a connection between the first process and the second process, thereby preventing data leakage and ensuring the security of network protection.
  • the first process when the first process is a non-secure process and the first process initiates an outbound request of a non-local loop, it is determined whether the outbound resource corresponding to the outbound request allows the non-secure process to access.
  • the outbound resource is a resource that the non-secure process is allowed to access, a connection is established between the first process and the outbound resource.
  • the outbound resource is a resource that the non-secure process is not allowed to access, establishing a connection between the first process and the outbound resource is prohibited.
  • the electronic device when the outbound request is a non-local loopback outbound request, the electronic device cannot determine the second process because the target process is on a remote device.
  • the indication information indicates the outbound resource, that is, the resource that the first process requests to access, the electronic device determines whether the outbound resource corresponding to the outbound request allows non-secure processes to access.
  • the outbound resource is a resource that allows non-secure processes to access, a connection is established between the first process and the outbound resource so that the first process can successfully access the outbound resource.
  • the outbound resource is a resource that does not allow non-secure processes to access, it is prohibited to establish a connection between the first process and the outbound resource to prevent data leakage.
  • the first process is a non-secure process and requests an outbound request
  • it is processed based on whether the outbound request is a local loopback request, thereby ensuring communication of the non-secure process in the personal domain while preventing data leakage.
  • a second process is determined from the local process, and when the second process is a secure process, a connection is established between the first process and the second process, and when the second process is an unsecure process, establishing a connection between the first process and the second process is prohibited.
  • the electronic device records the corresponding relationship between the port monitored by each process in the local process, the protocol to which it belongs, and the PID of the process through the WFP technology. Therefore, when the first process initiates an outbound request for a local loopback, the electronic device can infer the PID of the second process based on the protocol and PID. Afterwards, the electronic device uses the WFP network protection module in Figure 4 to determine whether the second process is a secure process. Since the first process is a secure process, when the second process is a secure process, the electronic device establishes a connection between the first process and the second process, thereby ensuring that the network between the secure processes in the security domain is normal. When the second process is a non-secure process, it is prohibited to establish a connection between the first process and the second process, thereby preventing data leakage and ensuring the security of network protection.
  • the first process when the first process is a secure process and the first process initiates an outbound request of a non-local loop, it is determined whether the outbound resource corresponding to the outbound request allows the secure process to access it.
  • the outbound resource allows the secure process to access it, a connection is established between the first process and the outbound resource.
  • the outbound resource does not allow the secure process to access it, establishing a connection between the first process and the outbound resource is prohibited.
  • the electronic device when the outbound request is a non-local loopback outbound request, the electronic device cannot determine the second process because the target process is on a remote device.
  • the indication information indicates the outbound resource, that is, the resource that the first process requests to access, the electronic device determines whether the outbound resource corresponding to the outbound request allows the security process to access.
  • the outbound resource allows the security process to access the resource, a connection is established between the first process and the outbound resource so that the first process can access the outbound resource.
  • the connection between the first process and the outbound resource is prohibited to prevent data leakage.
  • the outbound request is processed based on whether it is a local loopback request, thereby ensuring communication of the secure process within the security domain while preventing data leakage.
  • the request received by the first process is called an inbound request.
  • the first process is the target process and the third process is the source process.
  • a local loopback refers to a local third process requesting to establish a connection with the first process;
  • a non-local loopback refers to a remote third process requesting to establish a network connection with the first process.
  • the electronic device determines whether the third process is a secure process, and if the third process is a secure process, a network connection between the first process and the third process is established. If the third process is a non-secure process, the establishment of a network connection between the first process and the third process is prohibited.
  • the electronic device determines whether the third process is a secure process, and if the third process is a non-secure process, a network connection between the first process and the third process is established. If the third process is a secure process, the establishment of a network connection between the first process and the third process is prohibited.
  • the above-mentioned first process receives an inbound request initiated by a local third process, which is equivalent to the local third process requesting to establish a network connection with the first process, that is, the third process outbound.
  • the previous article has described the outbound scenario of the local loopback of the first process.
  • the inbound of the local loopback of the first process can be understood as the outbound of the local loopback of the third process.
  • a network connection between the first process and the third process may be established because the first process is a non-secure process.
  • the first process is a secure process and receives an inbound request of a non-local loopback, that is, when the third process is a remote process
  • the inbound request is blocked, thereby preventing data leakage through the network and preventing attacks from external malicious networks to avoid damaging the security domain.
  • an accessible network resource is configured for the security domain
  • the third process is a process of the accessible network resource
  • the third process is allowed to establish a connection with the first process.
  • all inbound requests of non-local loopbacks are blocked.
  • Fig. 6 is a schematic diagram of inter-process communication in a data processing method provided by an embodiment of the present application.
  • an electronic device 61 is divided into a personal domain 611 and a security domain 612
  • an electronic device 62 is divided into a personal domain 621 and a security domain 622 .
  • the non-secure process of the personal domain 611 is prohibited from connecting to the secure process in the security domain 612; the non-secure process in the personal domain 611 is prohibited from accessing the trusted network resources, and the non-secure process in the personal domain 611 is allowed to access the untrusted network resources.
  • the secure process in the security domain 622 is prohibited from accessing the secure process in the security domain 612.
  • the trusted network resources configured for the security domain 622 include the security domain 612
  • the secure process in the security domain 622 is allowed to access the secure process in the security domain 612.
  • non-secure processes in the personal domain 611 are prohibited from accessing trusted network resources
  • secure processes in the security domain 612 are prohibited from accessing untrusted network resources
  • non-secure processes in the personal domain 611 may be allowed to access trusted network resources
  • secure processes in the security domain 612 may be allowed to access untrusted network resources.
  • the untrusted network resources are, for example, read-only resources and cannot be written, thereby at least ensuring that no data leakage occurs.
  • the electronic device before the electronic device determines the target path from the first path and the second path according to the target network address of the network data packet, it also uses the first process to construct a DNS request. Afterwards, the electronic device sends the DNS request to the local proxy process so that the proxy process resolves the DNS request.
  • connection event does not support domain name identification.
  • the connection event refers to the event that the electronic device connects to the server corresponding to the target resource.
  • the target resource is often in the form of a domain name.
  • the electronic device needs to send a DNS request to the DNS server to obtain the IP corresponding to the domain name, that is, the target network address.
  • the DNS server is often an untrusted network resource, which will cause the DNS request to fail.
  • a proxy process is established in the electronic device to handle all DNS requests.
  • the electronic device uses a proxy process to determine whether the target resource corresponding to the domain name carried in the DNS request is a resource accessible to the security process.
  • a response message corresponding to the DNS request is sent through the UDP53 port; when the target resource corresponding to the domain name is a resource inaccessible to the security process, the response message is prohibited from being sent through the UDP53 port.
  • the first process constructs a DNS request carrying the domain name of the target resource.
  • the DNS request is parsed by the local proxy process to obtain a response message.
  • the response message carries the IP address corresponding to the domain name, that is, the target network address. Afterwards, the proxy process determines whether the target resource is a resource accessible to the security process.
  • the proxy process Only when the target resource is accessible to the security process, the proxy process will send the response message obtained by parsing the DNS request through the UDP53 port. If the target resource is a resource that the security process is not allowed to access, it is prohibited to send a response message through the UDP53 port. In this way, only Allows querying of DNS information of specific secure network resources, and intercepts all others as leaked messages to prevent data leakage and improve network protection security.
  • the first process When the first process is a non-secure process, the first process constructs a DNS request carrying the domain name of the target resource, and the DNS request is parsed by the local proxy process to obtain a response message, which carries the IP address corresponding to the domain name, that is, the target network address. After that, the proxy process sends the response message through UDP port 53.
  • the electronic device when the target resource corresponding to the domain name is a resource accessible to the security process, after the proxy process of the electronic device sends a response message corresponding to the DNS request through the UDP53 port, the electronic device also parses the mapping relationship between the domain name and the target network address from the response message and caches the mapping relationship.
  • the electronic device parses all the response messages of UDP53 port in WFP, parses the mapping relationship between the domain name and the network address and caches it. In this way, when another connection event occurs next, it can automatically identify whether the domain name corresponding to the network address needs to be restricted, and the response speed is fast.
  • the data processing device 700 includes: an acquisition module 71, a determination module 72, a permission module 73 and a processing module 74. In some embodiments, the data processing device 700 also includes a transceiver module 75.
  • An acquisition module 71 is used to acquire a network data packet sent by the first process
  • a determination module 72 configured to determine a target path from a first path and a second path according to a target network address of the network data packet, wherein the first path is a path passing through a physical network card, and the second path points to a preset secure tunnel;
  • the permission module 73 is used to determine the access rights of the target resource corresponding to the target network address
  • the processing module 74 is used to process the network data packet according to the target path and access permission.
  • the processing module 74 is used to determine whether the first process is a secure process; when the first process is a secure process, determine whether the target resource corresponding to the target network address allows the secure process to access according to the access rights;
  • the transceiver module 75 is used to send a network data packet through a target path when the target resource is a resource that allows the security process to access;
  • the processing module 74 is further configured to discard the network data packet when the target resource does not allow the security process to access it.
  • the processing module 74 is used to determine whether the target resource corresponding to the target network address allows the non-secure process to access according to the access permission when the first process is a non-secure process;
  • the transceiver module 75 is used to send a network data packet through a target path when the target resource is a resource that allows non-secure processes to access;
  • the processing module 74 is further configured to discard the network data packet when the target resource does not allow the security process to access it.
  • the acquisition module 71 before the acquisition module 71 acquires the network data packet sent by the first process, it is also used to acquire a first configuration file and a second configuration file.
  • the first configuration file is used to indicate the correspondence between the network address of the resource and the target path
  • the second configuration file is used to indicate the access rights of the resource.
  • the access rights include allowing only secure domain processes to access, allowing only non-secure processes to access, and both secure and non-secure processes to access.
  • the processing module 74 is also used to, when the first process is a non-secure process and the first process initiates an outbound request of a local loop, determine the second process from the local process, and when the second process is a non-secure process, establish a connection between the first process and the second process, and when the second process is a secure process, prohibit the establishment of a connection between the first process and the second process; when the first process is a non-secure process and the first process initiates an outbound request of a non-local loop, determine whether the outbound resource corresponding to the outbound request allows the non-secure process to access, and when the outbound resource allows the non-secure process to access the resource, establish a connection between the first process and the outbound resource, and when the outbound resource does not allow the non-secure process to access the resource, prohibit the establishment of a connection between the first process and the outbound resource.
  • the processing module 74 is also used to, when the first process is a secure process and the first process initiates an outbound request of a local loop, determine the second process from the local process, and when the second process is a secure process, establish a connection between the first process and the second process, and when the second process is a non-secure process, prohibit the establishment of a connection between the first process and the second process; when the first process is a secure process and the first process initiates an outbound request of a non-local loop, determine whether the outbound resource corresponding to the outbound request is allowed to be accessed by the secure process, and when the outbound resource is a resource that the secure process is allowed to access, establish a connection between the first process and the outbound resource, and when the outbound resource is a resource that the secure process is not allowed to access, prohibit the establishment of a connection between a process and the outbound resource.
  • the processing module 74 is further configured to block an inbound request when the first process is a secure process and the first process receives an inbound request of a non-local loopback.
  • the processing module 74 is further configured to construct a DNS request using the first process before determining the target path from the first path and the second path according to the target network address of the network data packet;
  • the transceiver module 75 is used to send the DNS request to the local proxy process so that the proxy process resolves the DNS request.
  • the processing module 74 is further used to determine whether the target resource corresponding to the domain name carried in the DNS request is a resource accessible to the security process when the first process is a security process after the transceiver module 75 sends the DNS request to the local proxy process so that the proxy process resolves the DNS request;
  • the transceiver module 75 is also used to send a response message corresponding to the DNS request through the UDP53 port when the target resource corresponding to the domain name is a resource accessible to the security process;
  • the processing module 74 is further configured to prohibit sending a response message through the UDP53 port when the target resource corresponding to the domain name is a resource that is inaccessible to the security process.
  • the processing module 74 is further used to parse out the mapping relationship between the domain name and the target network address from the response message; and cache the mapping relationship.
  • the data processing device provided in the embodiment of the present application can execute the actions of the electronic device in the above embodiment. Its implementation principle and technical effect are similar and will not be repeated here.
  • FIG8 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. As shown in FIG8 , the electronic device 800 includes:
  • Memory 82 stores computer instructions
  • the processor 81 executes the computer instructions stored in the memory 82, so that the processor 81 executes the data processing method implemented by the above electronic device.
  • the electronic device 800 further includes a communication component 83 , wherein the processor 81 , the memory 82 and the communication component 83 may be connected via a bus 88 .
  • An embodiment of the present application also provides a non-volatile computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed by a processor, they are used to implement the data processing method described in any embodiment implemented by the above electronic device.
  • An embodiment of the present application also provides a computer program product, which includes a computer program.
  • the computer program When the computer program is executed by a processor, it implements the data processing method described in any embodiment implemented by the above electronic device.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Technology Law (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例提供一种数据处理方法、设备及可读存储介质，电子设备获取应用程序的第一进程发送的网络数据包，根据网络数据包的目标网络地址从第一路径和第二路径中确定出目标路径，并确定目标网络地址对应的目标资源的访问权限。之后，根据目标路径和访问权限处理网络数据包。采用该种方案，电子设备按照网络数据包的目标网络地址对流量进行导流，无需修改网络数据包的IP头，实现网络安全防护的同时，实现安全隧道和沙箱网络保护隔离的解耦。

Description

数据处理方法、设备及可读存储介质
相关申请的交叉引用
本申请基于申请号为“202211668150.0”、申请日为2022年12月23日的中国专利申请提出，并要求上述中国专利申请的优先权，上述中国专利申请的全部内容在此以引入方式并入本申请。
技术领域
本申请实施例涉及网络安全技术领域，特别涉及一种数据处理方法、设备及可读存储介质。
背景技术
随着互联网技术的飞速发展，网络给人们带来便利的同时，也会带来企业数据泄露等安全问题。
为了防止企业数据泄露，通过虚拟隔离技术将计算机划分为安全域和个人域。用户在个人域上网，在安全域办公。网络是安全域的重要的数据通信通道，对安全域进行网络防护是企业数据防泄露的重中之重。目前通常采用应用程序接口(Application Program Interface，API)钩子(hook)来对安全域进行防护。
然而，API hook的防护方案容易出现部分进程漏防现象，导致用户在安全域访问授权网络资源时，部分进程泄露重要数据，防护效果不佳、安全性差。
发明内容
本申请实施例提供一种数据处理方法、设备及可读存储介质，按照网络数据包的目标网络地址对流量进行导流，无需修改网络数据包的IP头，实现网络安全的同时，实现安全隧道和沙箱网络保护隔离的解耦。
第一方面，本申请实施例提供一种数据处理方法，包括：
获取第一进程发送的网络数据包；
根据所述网络数据包的目标网络地址从第一路径和第二路径中确定出目标路径，所述第一路径为经过物理网卡的路径，所述第二路径指向预设的安全隧道；
确定所述目标网络地址对应的目标资源的访问权限；
根据所述目标路径和所述访问权限处理所述网络数据包。
第二方面，本申请实施例提供一种数据处理装置，包括：
获取模块，用于获取第一进程发送的网络数据包；
确定模块，用于根据所述网络数据包的目标网络地址从第一路径和第二路径中确定出目标路径，所述第一路径为经过物理网卡的路径，所述第二路径指向预设的安全隧道；
权限模块，用于确定所述目标网络地址对应的目标资源的访问权限；
处理模块，用于根据所述目标路径和所述访问权限处理所述网络数据包。
第三方面，本申请实施例提供一种电子设备，包括：处理器、存储器及存储在所述存储器上并可在处理器上运行的计算机程序，所述处理器执行所述计算机程序时使得所述电子设备实现如上第一方面或第一方面各种可能的实现方式所述的方法。
第四方面，本申请实施例提供一种非易失性计算机可读存储介质，所述计算机可读存储介质中存储有计算机指令，所述计算机指令在被处理器执行时用于实现如上第一方面或第一方面各种可能的实现方式所述的方法。
第五方面，本申请实施例提供一种包含计算程序的计算机程序产品，所述计算机程序被处理器执行时实现如上第一方面或第一方面各种可能的实现方式所述的方法。
本申请实施例提供的数据处理方法、设备及可读存储介质，电子设备获取应用程序的第一进程发送的网络数据包，根据网络数据包的目标网络地址从第一路径和第二路径中确定出目标路径，并确定目标网络地址对应的目标资源的访问权限。之后，根据目标路径和访问权限处理网络数据包。采用该种方案，电子设备按照网络数据包的目标网络地址对流量进行导流，无需修改网络数据包的IP头，实现网络安全防护的同时，实现安全隧道和沙箱网络保护隔离的解耦。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例提供的数据处理方法中电子设备的桌面示意图；
图2是本申请实施例提供的数据处理方法中沙箱的结构示意图；
图3是本申请实施例提供的数据处理方法的流程图；
图4是本申请实施例提供的数据处理方法中第一路径和第二路径的示意图；
图5是本申请实施例提供的数据处理方法的另一个流程图；
图6是本申请实施例提供的数据处理方法中进程间通信的示意图；
图7为本申请实施例提供的一种数据处理装置的示意图；
图8为本申请实施例提供的一种电子设备的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施例作进一步地详细描述。
企业数据防泄密是网络安全的一个重要组成部分。传统的企业数据防泄密方案主要包括文件透明加解密方案、事前拦截检测方案、事中防护方案、事后审计方案和虚拟云方案等。其中，文件透明加解密方案会带来一些不稳定风险，比如文件损坏、策略配置复杂、兼容性不好等问题，影响办公效率。事前拦截方案和事中防护方案会使得用户在办公过程中感觉到层层拦截，体验感差、工作效率低；对于一些已经泄密出去的核心数据，虽然事后审计方案能够回溯到泄密源，但是已经很难补救了。虚拟云桌面需要硬件、网络设备的投入，成本高。
鉴于这些问题，业界以零信任理念作为支撑，运用虚拟隔离控制技术，将计算机划分出安全域和个人域，以实现从事前源头开始防止数据泄密。无论是安全域还是个人域，尤其是安全域，网络作为重要的数据通信通道，是企业数据防泄密的重中之重。现阶段采用API hook来做网络防护。但是API hook方案无法对一些系统进程hook，漏掉部分系统进程，同样存在泄密风险。
另外，目前很多网络防护方案对域名系统(Domain Name System，DNS)流量防护不当，导致DNS被利用，即利用DNS请求泄密重要数据，网络防护效果不佳。
基于此，本申请实施例提供一种数据处理方法、设备及可读存储介质，按照网络数据包的目标网络地址对流量进行导流，无需修改网络数据包的IP头，实现网络安全的同时，实现安全隧道和沙箱网络保护隔离的解耦。
本申请实施例所述的数据处理方法的执行主体为电子设备，该电子设备的操作系统例如为windows系统的设备。电子设备上安装多个应用程序，以下简称程序。该些程序包括电子设备的系统程序和应用程序。系统程序例如为电子设备出厂后自带的程序，如视频播放器等。应用程序为用户在电子设备上自行安装的程序，如word办公应用程序、即时聊天工具等。电子设备具体可以是台式电脑、笔记本电脑、平板电脑、企业数据防泄露(Endpoint Data Leakage Prevention，EDLP)、零信任网络(Zero-Trust-Architecture，ZTNA)终端等，本申请实施例并不限制。
本申请实施例中，通过虚拟隔离控制技术在一台电子设备上划分出安全域和个人域，虚拟隔离技术又称作沙箱技术，电子设备基于沙箱技术对安全域的进程和个人域的进程进行隔离，个人域又称作非安全域。
例如，电子设备的显示器具有至少两个桌面，用户可切换到不同的桌面，其中一个桌面是安全域的桌面，用户在安全域的桌面打开应用程序，电子设备创建的进程为安全进程； 另一个桌面为个人域的桌面，用户在个人域的桌面打开应用程序，电子设备创建的进程为非安全进程，非安全进程又称作个人域进程。
再如，电子设备的显示器显示个人域的桌面，桌面上的悬浮窗代表安全域的桌面。示例性的，请参照图1，图1是本申请实施例提供的数据处理方法中电子设备的桌面示意图。请参照图1，桌面11为个人域的桌面，桌面12为悬浮在桌面11上的悬浮窗，桌面12是安全域的桌面，用户通过操作鼠标等放大、缩小或隐藏桌面12。本申请实施例不限制桌面12的数量，也就是说，可以通过虚拟隔离技术在电子设备上划分出一个人域和多个安全域，不同的安全域的权限不同。例如，个人域具有上网权限，一个安全域具有访问第一安全资源的权限，另一个安全域具有访问第二安全资源的权限。
安全域是一个安全容器，运用虚拟隔离技术，安全进程的权限会被限定在最小范围内。通常情况下，允许安全进程往安全域写入数据，不允许安全进程往个人域写数据，当安全进程需要向个人域写数据时，会被重定向到安全域对应的安全盘中。允许安全进程读取个人域中的数据，禁止安全进程和个人域进程通信。安全盘会通过加密手段存储，非安全进程无法读写安全盘。通过一系列隔离技术，安全域变成一个封闭环境，数据原则上只进不出，只允许通过授权的、安全的网络资源收发数据。
图2是本申请实施例提供的数据处理方法中沙箱的结构示意图。请参照图2，本申请实施例中，沙箱200包括位于应用空间的隔离应用模块201、沙箱服务202、其他应用模块203；以及位于内核空间的隔离驱动模块204、进程识别模块205、其他驱动模块206。其中，隔离驱动模块204包括Windows过滤平台(Windows Filtering Platform，WFP)驱动单元2041以及网络驱动程序接口规范(Network Driver Interface Specification，NDIS)过滤(fiflter)驱动单元2042。图2中还示意出了与沙箱相关的隧道网关207、虚拟网卡208和物理网卡209。
图3是本申请实施例提供的数据处理方法的流程图，本实施例由电子设备执行，本实施例包括：
301、获取第一进程发送的网络数据包。
本申请一些实施例中，用户在个人域桌面或安全域桌面选中应用程序后，通过双击等操作开启应用程序。每次打开应用程序，系统都会创建进程。用户在个人域打开应用程序，系统创建的进程称之为非安全进程，用户在安全域打开应用程序，系统创建的进程称之为安全进程。另外，有时候一些应用程序从另一个应用程序启动。例如，从浏览器启动办公应用程序。这时候也会创建新的进程。
在一些实施例中，第一进程(安全进程或个人进程)创建后，当第一进程在应用层发送网络数据包时，电子设备的传输控制协议/互联协议(Transmission Control Protocol/Internet Protocol，TCP/IP)协议栈获取该网络数据包，该网络数据包至少携带目标资源的域名等。
302、根据网络数据包的目标网络地址从第一路径和第二路径中确定出目标路径。
其中，第一路径为经过物理网卡的路径，第二路径指向预设的安全隧道。
本申请一些实施例中，电子设备上预先存储资源的网络地址和目标路径的对应关系。例如，电子设备上预先存储资源A的目标路径为第一路径，资源B的目标路径为第二路径。
在一些实施例中，电子设备获取到网络数据包后，根据网络数据包携带的域名确定出目标网络地址。例如，电子设备向域名系统(Domain Name System，DNS)发送携带域名的DNS请求，以使得DNS返回目标网络地址。确定出目标网络地址后，电子设备查询上述的对应关系，从第一路径和第二路径中确定出目标路径。
图4是本申请实施例提供的数据处理方法中第一路径和第二路径的示意图。请参照图4，TCP/IP模型包含5层架构，由上至下分别为应用层、传输层、网络层、数据链路层和物理层。应用程序打开后，电子设备创建第一进程，第一进程向TCP/IP协议栈发送网络数据包。TCP/IP协议栈包括路由选择模块和WFP网络防护模块。电子设备预先创建出一个独立的安全隧道，安全隧道又称作网络隧道。
图4中，资源包括：仅允许安全进程访问的资源、仅允许非安全进程访问的资源、安全进程和非安全进程均可访问的资源。
网络数据包到达路由选择模块后，路由选择模块根据网络数据包的目标网络地址从第一路径和第二路径中确定出目标路径。其中，第一路径为经过物理网卡的路径，如图中粗黑实线所示，第二路径指向预设的安全隧道，如图中粗黑虚线所示。
请参照图4，当目标路径为第一路径时，TCP/IP协议栈将网络数据包发送给物理网卡，通过物理网卡把网络数据包发送出去。当目标路径为第二路径时，TCP/IP协议栈把网络数据包发送给虚拟网卡，然后数据包返回至应用层，通过应用层的安全隧道程序对虚拟网卡进行读包，并将读取的数据包发送给TCP/IP协议栈，以使得TCP/IP协议栈对数据包进行重组操作，将重组后的数据包通过物理网卡发送。
图4中，为了实现利用WFP做安全域、个人域各个角度的防护，需要设置以下几个呼出接口(callout)：
callout 1、FWPM_LAYER_ALE_AUTH_CONNECT_V4/6；
callout 2、FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4/6
callout 3、FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4/6
callout 4、FWPM_LAYER_ALE_RESOURCE_RELEASE_V4/6
callout 5、FWPM_LAYER_DATAGRAM_DATA_V4/6
是否注册这几个callout可以利用工具自动枚举出来，也可以通过驱动枚举出来、也可以利用静态分析方法去分析对应的sys驱动文件(逆向分析)。
上述的呼出接口中，callout1用于出站连接事件，callout2用于入站连接事件，callout3用于端口分配事件，callout4用于端口释放事件，callout5用于获取用户数据报协议(User Datagram Protocol，UDP)传输层报文数据流，进而解析DNS中的域名和ip关系。
303、确定目标网络地址对应的目标资源的访问权限。
本申请一些实施例中，电子设备上预先存储资源与访问权限的对应关系。例如，电子设备上预先存储一个访问权限表，该访问权限表指示资源A仅允许安全域进程访问，资源B仅允许非安全进程访问，资源C允许安全进程和非安全进程可访问。因此，电子设备通过查询访问权限表，即可确定出目标资源的访问权限。
304、根据目标路径和访问权限处理网络数据包。
在一些实施例中，当访问权限指示第一进程能访问目标资源时，电子设备通过第一路径发送第一进程的网络数据包。当访问权限指示第一进程不能访问目标资源时，电子设备丢弃第一进程的网络数据包。
本申请一些实施例中，并不是所有安全进程的网络数据包都通过第二路径发送，并非所有的非安全进程的网络数据包都通过第一路径发送，而是和步骤302中确定出的目标路径有关。而且，本申请一些实施例中的目标资源是仅允许安全进程访问的资源、仅允许非安全进程访问的资源或安全进程和非安全进程均可访问的资源。因此，能够实现安全隧道和沙箱网络保护隔离的解耦。
例如，当目标路径为第一路径时，若第一进程为安全进程、目标资源为安全进程和非安全进程均能访问的资源，则TCP/IP协议栈通过物理网卡发送第一进程的网络数据包。这种情况下，目标资源例如是只读资源等。显然这种情况下，安全进程的网络数据包并未通过安全隧道发送，即并未通过第二路径发送。
再如，当目标路径为第二路径时，若第二进程为非安全进程、目标资源为安全进程和非安全进程均能访问的资源，则TCP/IP协议栈通过虚拟网卡，即通过第二路径发送第一进程的网络数据包。这种情况下，目标资源例如是只读资源等。显然这种情况下，非安全进程的网络数据包并未通过物理网卡发送，而是通过第二路径发送。
本申请一些实施例提供的数据处理方法，电子设备获取应用程序的第一进程发送的网络数据包，根据网络数据包的目标网络地址从第一路径和第二路径中确定出目标路径，并确定目标网络地址对应的目标资源的访问权限。之后，根据目标路径和访问权限处理网络数据包。采用该种方案，电子设备按照网络数据包的目标网络地址对流量进行导流，无需修改网络数据包的IP头，实现网络安全防护的同时，实现安全隧道和沙箱网络保护隔离的解耦。
图5是本申请实施例提供的数据包处理方法的另一个流程图。本实施例包括：
501、获取第一进程发送的网络数据包。
502、确定目标路径。
503、确定目标网络地址对应的目标资源的访问权限。
504、确定第一进程是否为安全进程，若第一进程为安全进程，执行步骤505；若第一进程为非安全进程，执行步骤508。
本申请实施例中，电子设备每次创建进程后，都会为该进程分配一个唯一的进程识别号(Process Identification，PID，PID)。
请参照图4，WFP网络防护模块用于根据进程的PID确定进程是否为安全进程。例如，WFP网络防护模块将PID发送给沙箱中的进程识别模块，进程识别模块确定第一进程是否为安全进程并将识别结果返回给WFP网络防护模块。再如，通过进程回调的方式对进程进行监控，当新进程启动，即第一进程启动时，根据规则区分第一进程是安全进程还是非安全进程。
505、根据访问权限确定目标网络地址对应的目标资源是否允许安全进程访问，若目标资源允许安全进程访问，则执行步骤506；若目标资源不允许安全进程访问，则执行步骤507。
电子设备确定出第一进程为安全进程后，继续确定目标网络地址对应的目标资源是否允许安全进程访问，只有在允许安全进程访问的情况下，安全进程才能访问该目标资源，TCP/IP协议栈才能将网络数据包发送出去。
506、通过目标路径发送安全进程的网络数据包。
507、丢弃安全进程的网络数据包。
例如，当目标路径为第一路径时，若第一进程为安全进程、目标资源为安全进程和非安全进程均能访问的资源，则TCP/IP协议栈通过物理网卡发送第一进程的网络数据包。这种情况下，目标资源例如是只读资源等。
再如，当目标路径为第一路径时，若第一进程为安全进程、目标资源为仅允许非安全进程访问的资源，则TCP/IP协议栈丢弃网络数据包。
又如，当目标路径为第二路径时，若第一进程为安全进程、目标资源为仅允许非安全进程访问的资源，则TCP/IP协议栈丢弃网络数据包。
又如，当目标路径为第二路径时，若第一进程为安全进程、目标资源为仅允许安全进程访问的资源，则TCP/IP协议栈通过虚拟网卡发送第一进程的网络数据包。
另外，本申请一些实施例中，还可以默认安全进程无法访问安全资源外的任何资源，从而默认情况下安全进程不会通过网络渠道泄密，而非安全进程不受管控。当给安全域配置一个可信的安全网络资源时，安全进程仅允许访问这个网络资源，不能访问其他资源，从而符合“最小权限”原则。由于本申请一些实施例中，路由控制不针对进程，因此，一旦安全隧道打开，非安全进程也可以访问可行的安全网络资源。预先配置安全网络资源通过安全隧道访问的前提下，为了防止非安全进程通过安全隧道访问安全网络资源，如果安全进程请求访问安全网络资源，则放行，即通过目标路径发送安全进程的网络数据包；如果非安全进程请求访问安全网络资源，则禁止。
采用该种方案，当第一进程为安全进程时，根据访问权限和确定是否通过目标路径发送安全进程的网络数据包，实现网络防护的同时实现安全隧道和沙箱网络保护隔离的解耦。
508、根据访问权限确定目标网络地址对应的目标资源是否允许非安全进程访问。若目标资源允许非安全进程访问，则执行步骤509；若目标资源不允许非安全进程访问，则执行步骤510。
509、通过目标路径发送非安全进程的网络数据包。
510、丢弃非安全进程的网络数据包。
例如，当目标路径为第一路径时，若第一进程为非安全进程、目标资源为安全进程和非安全进程均能访问的资源，则TCP/IP协议栈通过物理网卡发送第一进程的网络数据包。
再如，当目标路径为第一路径时，若第一进程为非安全进程、目标资源为仅允许非安全进程访问的资源，则TCP/IP协议栈通过第一路径发送非安全进程的网络数据包。
又如，当目标路径为第二路径时，若第一进程为非安全进程、目标资源为仅允许安全进程访问的资源，则TCP/IP协议栈丢弃网络数据包。
又如，当目标路径为第二路径时，若第一进程为非安全进程、目标资源为允许非安全进程和安全进程访问的资源，则TCP/IP协议栈通过虚拟网卡发送非安全进程的网络数据包。这种情况下，目标资源例如是只读资源等。
采用该种方案，当第一进程为非安全进程时，根据访问权限和确定是否通过目标路径发送非安全进程的网络数据包，实现网络防护的同时实现安全隧道和沙箱网络保护隔离的解耦。
在一些实施例中，电子设备获取第一进程发送的网络数据包之前，还获取第一配置文件和第二配置文件，第一配置文件用于指示资源的网络地址和目标路径的对应关系，第二配 置文件用于指示资源的访问权限，访问权限包括仅允许安全域进程访问、仅允许非安全进程访问、安全进程和非安全进程均可访问。
示例性的，电子设备预先从本地或远程服务器上获取第一配置文件，之后在系统路由表中进行注册，以使得路由表中存储资源的网络地址和目标路径的对应关系。同理，电子设备预先从本地或远程服务器上获取第二配置文件并存储在TCP/IP协议栈。这样一来，第一进程发送网络数据包后，电子设备通过查询第一配置文件即可确定出目标资源的目标路径和访问权限，速度快、准确率高。
本申请一些实施例中，通过虚拟隔离技术能够在同一台电子设备上划分出个人域和安全域，其中，安全域可以为多个，即图1中个人域的桌面上具有多个悬浮窗，不同悬浮窗代表不同的安全域。本申请一些实施例中，允许个人域的非安全进程之间通信，允许同一个安全域内的安全进程之间通信，使得同一安全域内创建出来的安全进程之间不受网络限制，保证了安全域内安全进程间的网络正常。本申请一些实施例不允许非安全进程和安全进程通信，不允许不同安全域的安全进程通信。为达到这样的效果，电子设备通过WFP技术，记录运行的进程的PID、所属的协议和该进程监听的端口等，过滤非安全进程请求连接安全进程的入站请求、过滤安全进程请求连接非安全进程的出站请求。其中，出站请求包括本地回环请求。一些实施例中，电子设备还通过WFP技术处理DNS请求等。
本申请一些实施例中，从第一进程的角度，当第一进程请求和第二进程建立连接时，第一进程发起的请求称之为出站请求，此时，第一进程为源进程，第二进程为目标进程。出站场景中，本地回环是指第一进程请求和本地的第二进程建立连接；非本地回环是指第一进程请求和远端的进程建立网络连接。
在一些实施例中，当第一进程为非安全进程、第一进程发起本地回环的出站请求时，从本地进程中确定出第二进程。当第二进程是非安全进程时，建立第一进程和第二进程之间的连接，当第二进程是安全进程时，禁止在第一进程和第二进程之间建立连接。
示例性的，电子设备通过WFP技术记录本地进程中每个进程监听的端口、所属的协议和进程的PID的对应关系。因此，当第一进程发起本地回环的出站请求时，电子设备根据协议和PID，能够反推出第二进程的PID，即从本地进程中确定出第二进程。之后，电子设备利用图4中的WFP网络防护模块确定出第二进程是否为安全进程。由于第一进程是非安全进程，因此，当第二进程是非安全进程时，电子设备建立第一进程和第二进程之间的连接，从而保证个人域内非安全进程之间网络正常。当第二进程是安全进程时，禁止在第一进程和第二进程之间建立连接，从而防止数据泄露，保证网络防护的安全性。
在一些实施例中，当第一进程为非安全进程、第一进程发起非本地回环的出站请求时，确定出站请求对应的出站资源是否允许非安全进程访问，当出站资源为允许非安全进程访问的资源时，建立第一进程与出站资源之间的连接，当出站资源为不允许非安全进程访问的资源时，禁止在第一进程与出站资源之间建立连接。
示例性的，当出站请求为非本地回环的出站请求时，由于目标进程在远端设备上，电子设备无法确定出第二进程。此时，由于出站请求携带指示信息，指示信息指示出站资源，即第一进程请求访问的资源，电子设备确定出站请求对应的出站资源是否允许非安全进程访问。当出站资源为允许非安全进程访问的资源时，建立第一进程与出站资源之间的连接，以便第一进程能顺利访问到出站资源。当出站资源为不允许非安全进程访问的资源时，禁止在第一进程与出站资源之间建立连接，以防止数据泄露。
采用该种方案，当第一进程为非安全进程、第一进程请求出站时，根据出站请求是否为本地回环请求进行处理，保证个人域内非安全进程的通信的同时，防止数据泄露。
在一些实施例中，当第一进程为安全进程、第一进程发起本地回环的出站请求时，从本地进程中确定出第二进程，当第二进程是安全进程时，建立第一进程和第二进程之间的连接，当第二进程是非安全进程时，禁止在第一进程和第二进程之间建立连接。
示例性的，电子设备通过WFP技术记录本地进程中每个进程监听的端口、所属的协议和进程的PID的对应关系。因此，当第一进程发起本地回环的出站请求时，电子设备根据协议和PID，能够反推出第二进程的PID。之后，电子设备利用图4中的WFP网络防护模块确定出第二进程是否为安全进程。由于第一进程是安全进程，因此，当第二进程是安全进程时，电子设备建立第一进程和第二进程之间的连接，从而保证安全域内安全进程之间网络正常。当第二进程是非安全进程时，禁止在第一进程和第二进程之间建立连接，从而防止数据泄露，保证网络防护的安全性。
在一些实施例中，当第一进程为安全进程、第一进程发起非本地回环的出站请求时，确定出站请求对应的出站资源是否允许安全进程访问，当出站资源允许安全进程访问的资源时，建立第一进程与出站资源之间的连接，当出站资源不允许安全进程访问的资源时，禁止在第一进程与出站资源之间建立连接。
示例性的，当出站请求为非本地回环的出站请求时，由于目标进程在远端设备上，电子设备无法确定出第二进程。此时，由于出站请求携带指示信息，指示信息指示出站资源，即第一进程请求访问的资源，电子设备确定出站请求对应的出站资源是否允许安全进程访问。当出站资源允许安全进程访问的资源时，建立第一进程与出站资源之间的连接，以便第一进 程能顺利访问到出站资源。当出站资源不允许安全进程访问的资源时，禁止在第一进程与出站资源之间建立连接，以防止数据泄露。
采用该种方案，当第一进程为安全进程、第一进程请求出站时，根据出站请求是否为本地回环请求进行处理，保证安全域内安全进程的通信的同时，防止数据泄露。
以上描述了第一进程请求出站的场景，下面，对第一进程入站的场景进行详细说明。
本申请一些实施例中，从第一进程的角度，当第三进程请求和第一进程建立连接时，第一进程收到的请求称之为入站请求，此时，第一进程为目标进程，第三进程为源进程。入站场景中，本地回环是指本地的第三进程请求和第一进程建立连接；非本地回环是指远端的第三进程请求和第一进程建立网络连接。
在一些实施例中，当第一进程为安全进程、第一进程接收的入站请求为本地回环的入站请求时，即第三进程为本地进程时，电子设备确定第三进程是否为安全进程，若第三进程为安全进程，则建立第一进程和第三进程的网络连接。若第三进程为非安全进程，则禁止在第一进程和第三进程之间建立网络连接。
当第一进程为非安全进程、第一进程接收的入站请求为本地回环的入站请求时，即第三进程为本地进程时，电子设备确定第三进程是否为安全进程，若第三进程为非安全进程，则建立第一进程和第三进程的网络连接。若第三进程为安全进程，则禁止在第一进程和第三进程之间建立网络连接。
可以理解的是，上述的第一进程接收到本地的第三进程发起的入站请求，相当于本地的第三进程请求与第一进程建立网络连接，即第三进程出站。前文中已描述了第一进程本地环回的出站场景，此处针对第一进程的本地回环的入站，可理解为第三进程的本地回环的出站，可参见前述第一进程的本地回环的出站处理过程。
当第一进程为非安全进程、第一进程接收到非本地回环的入站请求时，由于第一进程为非安全进程，则可以建立第一进程和第三进程之间的网络连接。
当第一进程为安全进程、第一进程接收到非本地回环的入站请求时，即第三进程为远端进程时，阻止该入站请求，从而实现防止通过网络泄露数据的目的的同时，防止来自外界恶意网络的攻击，避免破坏安全域。当给安全域配置一个可访问的网络资源时，若第三进程是可访问的网络资源的进程，则允许第三进程和第一进程建立连接。另外，若对安全域的要求较高，则阻止所有的非本地回环的入站请求。
图6是本申请实施例提供的数据处理方法中进程间通信的示意图。请参照图6，电子设备61上划分出个人域611和安全域612，电子设备62上划分出个人域621和安全域622。
请参照图6，本申请一些实施例中，禁止个人域611的非安全进程连接安全域612内的安全进程；禁止个人域611内的非安全进程访问可信网络资源，允许个人域611内的非安全进程访问不可信网络资源，默认情况下禁止安全域622内的安全进程访问安全域612内的安全进程。当为安全域622配置的可信网络资源包括安全域612时，允许安全域622内的安全进程访问安全域612内的安全进程。
需要说明的是，虽然图6中默认情况下禁止个人域611的非安全进程访问可信网络资源，禁止安全域612内的安全进程访问不可信网络资源。但是，通过在第一配置文件和第二配置文件中进行配置，也可以允许个人域611的非安全进程访问可信网络资源，允许安全域612内的安全进程访问不可信网络资源，此时，不可信的网络资源例如是只读资源，不可写，从而至少保证不会出现数据泄露。
在一些实施例中，电子设备根据网络数据包的目标网络地址从第一路径和第二路径中确定出目标路径之前，还利用第一进程构建DNS请求。之后，电子设备将DNS请求发送给本地的代理进程，以使得代理进程解析DNS请求。
示例性的，WFP技术中，连接(connect)事件不支持域名识别，连接事件指电子设备连接目标资源对应的服务器的事件，目标资源往往是域名格式，电子设备需要向DNS服务器发送DNS请求才能得到域名对应的ip，即目标网络地址。然而，DNS服务器往往是不可信的网络资源，会导致DNS请求失败。同时还可能面临DNS请求被劫持的风险。为了防止DNS请求被劫持，本申请实施例中，在电子设备建立一个代理进程，代理处理所有的DNS请求。
在一些实施例中，当第一进程为安全进程时，电子设备利用代理进程确定DNS请求携带的域名对应的目标资源是否为安全进程可访问的资源。当域名对应的目标资源为安全进程可访问的资源时，通过UDP53端口发送DNS请求对应的应答报文；当域名对应的目标资源为安全进程不可访问的资源时，禁止通过UDP53端口发送所述应答报文。
示例性的，为了要安全进程发起的DNS请求正常解析，若通过UDP53端口放行所有的出站请求，即放行所有的应答报文，则会带来安全隐患。比如，安全域内的某个安全进程将敏感数据伪造成DNS应答报文，通过UDP53端口发送出去从而造成泄密。为避免该种泄密，当第一进程为安全进程时，第一进程构建携带目标资源的域名的DNS请求，该DNS请求由本地的代理进程解析，从而得到应答报文，该应答报文携带域名对应的IP地址，即目标网络地址。之后，代理进程确定目标资源是否为安全进程可访问的资源，只有在安全进程可访问的目标资源的情况下，代理进程将解析DNS请求得到的应答报文通过UDP53端口发送出去。若目标资源为不允许安全进程访问资源，则禁止通过UDP53端口发送应答报文。这样一来，仅 允许查询特定的安全网络资源的DNS信息，其他都视为泄密报文进行拦截，防止数据泄漏，提高网络防护安全。
当第一进程为非安全进程时，第一进程构建携带目标资源的域名的DNS请求，该DNS请求由本地的代理进程解析，从而得到应答报文，该应答报文携带域名对应的IP地址，即目标网络地址。之后，代理进程通过UDP53端口发送应答报文。
在一些实施例中，当域名对应的目标资源为安全进程可访问的资源时，电子设备的代理进程通过UDP53端口发送DNS请求对应的应答报文之后，电子设备还从应答报文中解析出域名和目标网络地址的映射关系，并缓存映射关系。
示例性的，电子设备在WFP中对所有的UDP53端口的应答报文进行解析，解析出域名和网络地址的映射关系并缓存。这样一来，当接下来又有连接事件发生时，就能够自动识别出网络地址对应的域名是否需要限制，响应速度快。
下述为本申请装置实施例，可以用于执行本申请方法实施例。对于本申请装置实施例中未披露的细节，请参照本申请方法实施例。
图7为本申请实施例提供的一种数据处理装置的示意图。该数据处理装置700包括：获取模块71、确定模块72、权限模块73和处理模块74。在一些实施例中，数据处理装置700还包括收发模块75。
获取模块71，用于获取第一进程发送的网络数据包；
确定模块72，用于根据网络数据包的目标网络地址从第一路径和第二路径中确定出目标路径，第一路径为经过物理网卡的路径，第二路径指向预设的安全隧道；
权限模块73，用于确定目标网络地址对应的目标资源的访问权限；
处理模块74，用于根据目标路径和访问权限处理网络数据包。
一种实现例中，处理模块74，用于确定第一进程是否为安全进程；当第一进程为安全进程时，根据访问权限确定目标网络地址对应的目标资源是否允许安全进程访问；
收发模块75，用于当目标资源允许安全进程访问的资源时，通过目标路径发送网络数据包；
处理模块74，还用于当目标资源不允许安全进程访问时，丢弃网络数据包。
一种实现例中，处理模块74，用于当第一进程为非安全进程时，根据访问权限确定目标网络地址对应的目标资源是否允许非安全进程访问；
收发模块75，用于当目标资源允许非安全进程访问的资源时，通过目标路径发送网络数据包；
处理模块74，还用于当目标资源不允许所述安全进程访问时，丢弃网络数据包。
一种实现例中，获取模块71获取第一进程发送的网络数据包之前，还用于获取第一配置文件和第二配置文件，第一配置文件用于指示资源的网络地址和目标路径的对应关系，第二配置文件用于指示资源的访问权限，访问权限包括仅允许安全域进程访问、仅允许非安全进程访问、安全进程和非安全进程均可访问。
一种实现例中，处理模块74，还用于当第一进程为非安全进程、第一进程发起本地回环的出站请求时，从本地进程中确定出第二进程，当第二进程是非安全进程时，建立第一进程和第二进程之间的连接，当第二进程是安全进程时，禁止在第一进程和第二进程之间建立连接；当第一进程为非安全进程、第一进程发起非本地回环的出站请求时，确定出站请求对应的出站资源是否允许非安全进程访问，当出站资源允许非安全进程访问的资源时，建立第一进程与出站资源之间的连接，当出站资源不允许非安全进程访问的资源时，禁止在第一进程与出站资源之间建立连接。
一种实现例中，处理模块74，还用于当第一进程为安全进程、第一进程发起本地回环的出站请求时，从本地进程中确定出第二进程，当第二进程是安全进程时，建立第一进程和第二进程之间的连接，当第二进程是非安全进程时，禁止在第一进程和第二进程之间建立连接；当第一进程为安全进程、第一进程发起非本地回环的出站请求时，确定出站请求对应的出站资源是否允许安全进程访问，当出站资源允许安全进程访问的资源时，建立第一进程与出站资源之间的连接，当站资源不允许安全进程访问的资源时，禁止在一进程与出站资源之间建立连接。
一种实现例中，处理模块74，还用于当第一进程为安全进程、第一进程接收到非本地回环的入站请求时，阻止入站请求。
一种实现例式中，处理模块74，在根据网络数据包的目标网络地址从第一路径和第二路径中确定出目标路径之前，还用于利用所述第一进程构建DNS请求；
收发模块75，用于将DNS请求发送给本地的代理进程，以使得代理进程解析DNS请求。
一种实现例中，处理模块74在收发模块75将DNS请求发送给本地的代理进程，以使得代理进程解析DNS请求之后，还用于当第一进程为安全进程时，确定DNS请求携带的域名对应的目标资源是否为安全进程可访问的资源；
收发模块75，还用于当域名对应的目标资源为安全进程可访问的资源时，通过UDP53端口发送DNS请求对应的应答报文；
处理模块74，还用于当域名对应的目标资源为安全进程不可访问的资源时，禁止通过UDP53端口发送应答报文。
一种实现例中，处理模块74在发送模块通过UDP53端口发送应答报文之后，还用于从应答报文中解析出域名和目标网络地址的映射关系；缓存映射关系。
本申请实施例提供的数据处理装置，可以执行上述实施例中电子设备的动作，其实现原理和技术效果类似，在此不再赘述
图8为本申请实施例提供的一种电子设备的结构示意图。如图8所示，该电子设备800包括：
处理器81和存储器82；
存储器82存储计算机指令；
处理器81执行存储器82存储的计算机指令，使得处理器81执行如上电子设备实施的数据处理方法。
处理器81的具体实现过程可参见上述方法实施例，其实现原理和技术效果类似，本实施例此处不再赘述。
在一些实施例中，该电子设备800还包括通信部件83。其中，处理器81、存储器82以及通信部件83可以通过总线88连接。
本申请实施例还提供一种非易失性计算机可读存储介质，计算机可读存储介质中存储有计算机指令，计算机指令被处理器执行时用于实现如上电子设备实施的任一实施例所述的数据处理方法。
本申请实施例还提供一种计算机程序产品，该计算机程序产品包含计算机程序，计算机程序被处理器执行时实现如上电子设备实施的任一实施例所述的数据处理方法。
本领域技术人员在考虑说明书及实践这里公开的申请后，将容易想到本申请的其它实施方案。本申请旨在涵盖本申请的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本申请的一般性原理并包括本申请未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本申请的真正范围和精神由下面的权利要求书指出。
应当理解的是，本申请并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本申请的范围仅由所附的权利要求书来限制。

Claims (12)

  1. 一种数据处理方法，包括：
    获取第一进程发送的网络数据包；
    根据所述网络数据包的目标网络地址从第一路径和第二路径中确定出目标路径，所述第一路径为经过物理网卡的路径，所述第二路径指向预设的安全隧道；
    确定所述目标网络地址对应的目标资源的访问权限；
    根据所述目标路径和所述访问权限处理所述网络数据包。
  2. 根据权利要求1所述的方法，其中，所述根据所述目标路径和所述访问权限处理所述网络数据包，包括：
    确定所述第一进程是否为安全进程；
    当所述第一进程为安全进程时，根据所述访问权限确定所述目标网络地址对应的所述目标资源是否允许安全进程访问；
    当所述目标资源允许安全进程访问的资源时，通过所述目标路径发送所述网络数据包；
    当所述目标资源不允许安全进程访问时，丢弃所述网络数据包。
  3. 根据权利要求1或2所述的方法，其中，还包括：
    当所述第一进程为非安全进程时，根据所述访问权限确定所述目标网络地址对应的所述目标资源是否允许非安全进程访问；
    当所述目标资源允许非安全进程访问的资源时，通过所述目标路径发送所述网络数据包；
    当所述目标资源不允许非安全进程访问时，丢弃所述网络数据包。
  4. 根据权利要求1至3中任一项所述的方法，其中，所述获取第一进程发送的网络数据包之前，还包括：
    获取第一配置文件和第二配置文件，所述第一配置文件用于指示资源的网络地址和所述目标路径的对应关系，所述第二配置文件用于指示资源的所述访问权限，所述访问权限包括仅允许安全域进程访问、仅允许非安全进程访问、安全进程和非安全进程均可访问。
  5. 根据权利要求1至4中任一项所述的方法，其中，还包括：
    当所述第一进程为非安全进程、所述第一进程发起本地回环的出站请求时，从本地进程中确定出第二进程，当所述第二进程是非安全进程时，建立所述第一进程和所述第二进程之间的连接，当所述第二进程是安全进程时，禁止在所述第一进程和所述第二进程之间建立连接；
    当所述第一进程为非安全进程、所述第一进程发起非本地回环的出站请求时，确定出站 请求对应的出站资源是否允许非安全进程访问，当所述出站资源为允许非安全进程访问的资源时，建立所述第一进程与所述出站资源之间的连接，当所述出站资源为不允许非安全进程访问的资源时，禁止在所述第一进程与所述出站资源之间建立连接。
  6. 根据权利要求1至4中任一项所述的方法，其中，还包括：
    当所述第一进程为安全进程、所述第一进程发起本地回环的出站请求时，从本地进程中确定出第二进程，当所述第二进程是安全进程时，建立所述第一进程和所述第二进程之间的连接，当所述第二进程是非安全进程时，禁止在所述第一进程和所述第二进程之间建立连接；
    当所述第一进程为安全进程、所述第一进程发起非本地回环的出站请求时，确定出站请求对应的出站资源是否允许安全进程访问，当所述出站资源为允许安全进程访问的资源时，建立所述第一进程与所述出站资源之间的连接，当所述出站资源为不允许安全进程访问的资源时，禁止在所述第一进程与所述出站资源之间建立连接。
  7. 根据权利要求1至6中任一项所述的方法，其中，还包括：
    当所述第一进程为安全进程、所述第一进程接收到非本地回环的入站请求时，阻止所述入站请求。
  8. 根据权利要求1至7中任一项所述的方法，其中，所述根据所述网络数据包的目标网络地址从第一路径和第二路径中确定出目标路径之前，还包括：
    利用所述第一进程构建DNS请求；
    将所述DNS请求发送给本地的代理进程，以使得所述代理进程解析所述DNS请求。
  9. 根据权利要求8所述的方法，其中，所述将所述DNS请求发送给本地的代理进程，以使得所述代理进程解析所述DNS请求之后，还包括：
    当所述第一进程为安全进程时，确定所述DNS请求携带的域名对应的所述目标资源是否为安全进程可访问的资源；
    当所述域名对应的所述目标资源为安全进程可访问的资源时，通过UDP53端口发送所述DNS请求对应的应答报文；
    当所述域名对应的所述目标资源为安全进程不可访问的资源时，禁止通过UDP53端口发送所述应答报文。
  10. 根据权利要求9所述的方法，其中，所述当所述域名对应的所述目标资源为安全进程可访问的资源时，通过UDP53端口发送所述DNS请求对应的应答报文之后，还包括：
    从所述应答报文中解析出所述域名和所述目标网络地址的映射关系；
    缓存所述映射关系。
  11. 一种电子设备，包括处理器、存储器及存储在所述存储器上并可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时使得所述电子设备实现如权利要求1至 10任一所述的方法。
  12. 一种非易失性计算机可读存储介质，其上存储有计算机程序，所述计算机程序被处理器执行时实现如权利要求1至10任一所述的方法。
PCT/CN2023/095120 2022-12-23 2023-05-18 数据处理方法、设备及可读存储介质 Ceased WO2024130949A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP23800725.6A EP4641974A4 (en) 2022-12-23 2023-05-18 DATA PROCESSING METHOD, DEVICE AND READABLE STORAGE MEDIA
US18/506,585 US20240214356A1 (en) 2022-12-23 2023-11-10 Network data packet processing method, electronic device, and non-transitory computer-readable storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211668150.0 2022-12-23
CN202211668150.0A CN116232659A (zh) 2022-12-23 2022-12-23 数据处理方法、设备及可读存储介质

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/506,585 Continuation US20240214356A1 (en) 2022-12-23 2023-11-10 Network data packet processing method, electronic device, and non-transitory computer-readable storage medium

Publications (1)

Publication Number Publication Date
WO2024130949A1 true WO2024130949A1 (zh) 2024-06-27

Family

ID=86590140

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/095120 Ceased WO2024130949A1 (zh) 2022-12-23 2023-05-18 数据处理方法、设备及可读存储介质

Country Status (2)

Country Link
CN (1) CN116232659A (zh)
WO (1) WO2024130949A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117749489B (zh) * 2023-12-20 2024-09-24 北京熠智科技有限公司 一种分布式系统的网络传输隐私保护方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8887152B1 (en) * 2011-11-04 2014-11-11 Trend Micro, Inc. Android application virtual environment
CN111274583A (zh) * 2020-01-17 2020-06-12 湖南城市学院 一种大数据计算机网络安全防护装置及其控制方法
CN112003877A (zh) * 2020-09-03 2020-11-27 上海优扬新媒信息技术有限公司 一种网络隔离方法、装置、电子设备及存储介质
CN112910917A (zh) * 2021-02-25 2021-06-04 深信服科技股份有限公司 网络隔离方法、装置、设备及可读存储介质

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106411814B (zh) * 2015-07-27 2019-12-06 深圳市中兴微电子技术有限公司 一种策略管理方法及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8887152B1 (en) * 2011-11-04 2014-11-11 Trend Micro, Inc. Android application virtual environment
CN111274583A (zh) * 2020-01-17 2020-06-12 湖南城市学院 一种大数据计算机网络安全防护装置及其控制方法
CN112003877A (zh) * 2020-09-03 2020-11-27 上海优扬新媒信息技术有限公司 一种网络隔离方法、装置、电子设备及存储介质
CN112910917A (zh) * 2021-02-25 2021-06-04 深信服科技股份有限公司 网络隔离方法、装置、设备及可读存储介质

Also Published As

Publication number Publication date
CN116232659A (zh) 2023-06-06

Similar Documents

Publication Publication Date Title
RU2738021C2 (ru) Система и способы для дешифрования сетевого трафика в виртуализированной среде
US10652210B2 (en) System and method for redirected firewall discovery in a network environment
JP6188832B2 (ja) データベース・クライアント要求を処理するための方法、コンピュータ・プログラム製品、データ処理システム、およびデータベース・システム
US9306933B2 (en) Ensuring network connection security between a wrapped app and a remote server
US8893300B2 (en) Security systems and methods to reduce data leaks in enterprise networks
US10417428B2 (en) Methods and systems for providing and controlling cryptographic secure communications terminal providing a remote desktop accessible in secured and unsecured environments
TWI549452B (zh) 用於對虛擬私人網路之特定應用程式存取之系統及方法
US5826014A (en) Firewall system for protecting network elements connected to a public network
CN113904826B (zh) 数据传输方法、装置、设备和存储介质
US20040199763A1 (en) Security System with Methodology for Interprocess Communication Control
US9473298B2 (en) Simplifying IKE process in a gateway to enable datapath scaling using a two tier cache configuration
US11411933B2 (en) Trusted cyber physical system
US20240214356A1 (en) Network data packet processing method, electronic device, and non-transitory computer-readable storage medium
KR20150046176A (ko) 네트워크 환경에서 암호화된 데이터 검사
JP2016530814A (ja) 大量のｖｐｎ接続を遮断するためのゲートウェイデバイス
JP2001337864A (ja) アクセス制御システム
US7966643B2 (en) Method and system for securing a remote file system
KR101076683B1 (ko) 호스트 기반의 망분리 장치 및 방법
US8272041B2 (en) Firewall control via process interrogation
Pinkerton et al. Direct data placement protocol (DDP)/remote direct memory access protocol (RDMAP) security
WO2024130949A1 (zh) 数据处理方法、设备及可读存储介质
WO2025096362A1 (en) Systems and methods for zero trust dns based networking
US20250141886A1 (en) Data centric approach for supporting multiple inline cloud services
US11539755B1 (en) Decryption of encrypted network traffic using an inline network traffic monitor
US11902298B2 (en) Dynamic remote browsing

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23800725

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2023800725

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2023800725

Country of ref document: EP

Effective date: 20250723

ENP Entry into the national phase

Ref document number: 2023800725

Country of ref document: EP

Effective date: 20250723

ENP Entry into the national phase

Ref document number: 2023800725

Country of ref document: EP

Effective date: 20250723

WWP Wipo information: published in national office

Ref document number: 2023800725

Country of ref document: EP