WO2017020607A1

WO2017020607A1 - Rdp data playback method, server and system

Info

Publication number: WO2017020607A1
Application number: PCT/CN2016/079192
Authority: WO
Inventors: 魏国强
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-08-06
Filing date: 2016-04-13
Publication date: 2017-02-09
Also published as: CN106453202A

Abstract

The present invention discloses a remote desktop protocol (RDP) data playback method, server and system. The method comprises: obtaining, by a playback server, image data to be played back, wherein the image data is converted from RDP data; and transmitting, according to a predefined data outputting rule, the image data to a playback client side to enable the playback client side to display received image data. The present invention can convert acquired RDP data into image streaming, which can be played back in a normal speed or a fast speed, or suspended at an assigned position, preventing from a specific protocol analysis for realizing reconstruction of the image streaming, and satisfying a need in an image audit.

Description

RDP protocol data playback method, server and system

Technical field

The present invention relates to the field of computer technologies, and in particular, to an RDP protocol data playback method, server, and system capable of displaying stored data in an image manner for auditing user operations.

Background technique

RDP (Remote Desktop Protocol) allows users to operate remote computer hosts over the network. Accessing remote hosts through this protocol is the default function of the Windows family. Widespread deployment of Windows has made RDP widely used, such as various virtual host services on the public network, virtual host environments used in private networks, and remote transport of telecommunication networks. Dimension. If the host is running a Windows environment, there is usually a need for remote control through RDP.

The user remotely operates the host through the RDP protocol. If a critical application is running on the remote host, the user's operation usually needs to be audited afterwards. Auditing can be performed at multiple levels, for example, log auditing can be performed on specific applications operated by users, and auditing can be performed in the background of remote hosts. Among them, it is convenient and common to audit through RDP, because it is convenient to intercept the RDP data stream between the user and the remote host, and the data stream is not specific to any specific application, can be universal, and RDP data stream The data itself is compressed, and the data stream is much less than the final image data.

After acquiring the data stream on the network, how to convert the data stream into an image stream is the key to auditing. The RDP protocol stipulates that the image stream can be reconstructed theoretically by parsing the RDP data stream. However, since the RDP protocol itself is very large and the RDP protocol is constantly evolving, it is very complicated to reconstruct the image stream by parsing the RDP protocol. The problem of parsing the latest protocol data.

Summary of the invention

The main purpose of the present invention is to provide a RDP protocol data playback method, server and system, which aims to avoid the reconstruction of the image stream by avoiding the specific RDP protocol parsing and meet the requirements of image auditing.

To achieve the above objective, the present invention provides an RDP protocol data playback method, including:

The playing server acquires graphic data to be played back, and the graphic data is converted by RDP protocol data;

The graphic data is sent to the playing client by a preset data output rule, and the received graphic data is displayed by the playing client.

Preferably, the step of the playing server acquiring the graphic data to be played back comprises:

The playback server reads the PDU of the RDP and the timestamp of the transmission of the PDU;

Determining, according to the type of the PDU, whether the data transmitted by the PDU is graphic data; if not, discarding;

If so, the graphics data is parsed from the PDU and the graphics data is encapsulated in a rule negotiated with the playback client.

Preferably, the step of sending the graphic data to the playing client by using a preset data output rule comprises:

If the normal speed playback is preset, after waiting for the first preset time, the playback server outputs data to the playback client;

If the n-speed is required to be quickly browsed, the playback server outputs data to the playback client after waiting for the second preset time, where the second preset time is less than the first preset time, and n is greater than or equal to 1 ;

If the preset needs to be stepped to see the details of the user operation, the playback server outputs a data to the playback client and stops outputting until the next single step instruction is received.

Preferably, before the step of the playing server acquiring the graphic data to be played back, the method further includes:

The play server establishes a connection with the play client and negotiates the data output rule with the play server.

Preferably, the step of the playing server establishing a connection with the playing client comprises:

After the playback server is started, establishing a control channel for communication with the playback controller;

Receiving a data playback instruction sent by the play controller;

Returning, according to the data playback instruction, an access address to the play controller, and forwarding, by the play controller, the access address to the play client;

Establishing a connection with the playback client based on the access address.

The embodiment of the invention further provides a playback server for playing back RDP protocol data, including:

Obtaining a module, configured to acquire graphic data to be played back, wherein the graphic data is converted by RDP protocol data;

The sending module is configured to send the graphic data to the playing client according to a preset data output rule, and the received graphic data is displayed by the playing client.

Preferably, the obtaining module is further configured to: read a PDU of the RDP and a timestamp of the PDU transmission; determine, according to the type of the PDU, whether the data transmitted by the PDU is graphic data; if not, discard; if yes, The graphics data is parsed from the PDU, and the graphics data is encapsulated in a rule negotiated with the playback client.

Preferably, the sending module is further configured to: if the normal speed playing is preset, wait for the first preset time, and output data to the playing client; if the preset needs n times speed to quickly browse, wait for the second After the preset time, the data is output to the playing client, where the second preset time is less than the first preset time, and n is greater than or equal to 1; if a preset step is required to see the details of the user operation, Then output a data to the playback client and stop outputting until receiving The next single step instruction.

Preferably, the play server further includes:

The negotiation module is configured to establish a connection with the play client and negotiate the data output rule with the play server.

Preferably, the negotiating module is further configured to: after the play server is started, establish a control channel for communication with the play controller; receive a data playback instruction sent by the play controller; according to the data playback instruction, The playback controller returns an access address, and the play controller forwards the access address to the play client; and establishes a connection with the play client based on the access address.

The embodiment of the invention further provides a system for playing back RDP protocol data, comprising: a playing client, a playing server, and a playing controller for controlling the playing client and the playing server, wherein:

The playing server is the playing server according to any one of claims 6-10;

The playing client is configured to access the playing server under the control of the playing controller, and perform RDP negotiation with the playing server, and receive graphic data output by the playing server and display the graphic data;

The play controller is further configured to send a play command to the play server to control the start and stop and speed of the play.

Another embodiment of the present invention provides a computer storage medium storing execution instructions for performing the method in the above embodiments.

The RDP protocol data playback method, server and system provided by the present invention, the playing server acquires graphic data to be played back; and the graphic data is sent to the playing client according to a preset data output rule, and the playing client is The terminal displays the received graphic data, and the solution can convert the acquired RDP protocol data into an image stream and the image can be played at normal speed, fast play, pause at a specified position, etc., avoiding specific protocol parsing to realize image stream reconstruction. , to meet the needs of image auditing.

DRAWINGS

1 is a schematic structural diagram of a system for playing back RDP protocol data according to a preferred embodiment of the present invention;

2 is a schematic flowchart of a first embodiment of a data playback method of an RDP protocol according to the present invention;

3 is a schematic flowchart of a second embodiment of a RDP protocol data playback method according to the present invention;

4 is a schematic diagram of functional modules of a first embodiment of a playback server for playing back RDP protocol data according to the present invention;

FIG. 5 is a schematic diagram of functional modules of a second embodiment of a playback server for playing back RDP protocol data according to the present invention.

The implementation, functional features, and advantages of the present invention will be further described in conjunction with the embodiments.

In order to make the technical solutions of the present invention clearer and clearer, the following will be further described in detail with reference to the accompanying drawings.

detailed description

It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

The main solution of the embodiment of the present invention is: the playing server acquires the graphic data to be played back; the graphic data is sent to the playing client according to a preset data output rule, and the received graphic data is displayed by the playing client. The solution can convert the acquired RDP protocol data into an image stream and the image can be played at normal speed, fast play, pause at a specified position, play with a minimum image change granularity, etc., avoiding specific protocol analysis to achieve The reconstruction of the image stream satisfies the needs of image auditing.

Since the reconstruction of the image stream by parsing the RDP protocol in the related art is very complicated, there is also a problem that the latest protocol data cannot be parsed.

The invention provides a solution that can avoid the reconstruction of the image stream by avoiding the specific RDP protocol parsing and meet the requirements of image auditing.

Optionally, as shown in FIG. 1 , the system of the present invention relates to a system for playing back RDP protocol data, including: a playing client, a playing server, and a playing controller for controlling the playing client and the playing server, wherein:

The playing server acquires graphic data to be played back, and the graphic data is converted by RDP protocol data; the playing server sends the graphic data to the playing client according to a preset data output rule; the data output The rules may include normal speed playback of the playback data, fast play, pause at a specified location, playback at a minimum image change granularity, and the like.

Optionally, in the solution of the embodiment, the obtained RDP protocol data is required, and the intercepted RDP protocol data has a certain format requirement. Since the image is time-conceptual, a simple data stream cannot reconstruct the image. Therefore, the intercepted RDP protocol data needs to have two elements: the protocol data unit (PDU) of the RDP and the time when the PDU is transmitted.

The PDU is a plaintext that satisfies the requirements of the RDP protocol and is not encrypted by the SSL protocol or the RDP encryption protocol.

In this embodiment, the interception scheme of the RDP protocol data is not specifically limited. For example, the interception may be performed by inserting a gateway in the process of the user accessing the server, or may be converted by the network packet capture tool.

In addition, the data storage method is not limited, and may exist as a file or in a binary manner in a database.

As described above, referring to FIG. 1, the system architecture involved in the solution of the present invention includes: a playback client, a playback server, a playback controller, and stored data. among them:

The playback client is a compatible RDP client that can receive RDP protocol data, implement the protocol primitives, and display the graphics. As time changes, the graphics can become video.

The playback server is a virtual RDP server that can read and store the stored data into standard RDP protocol data output to the RDP client, and also receive instructions from the playback controller.

The playback controller controls the playback server and the playback client. The playback controller can control the start and stop and speed of the playback by assigning it to the playback server. The playback controller is responsible for launching the playback client and specifying that it is connected to the playback server to obtain the played data.

The actual existence form is not limited, the playback controller, the playback client and the player server may exist in one process, or may be divided into two or more processes on the same host, or distributed through the network. Connected on both hosts.

The playback server can serve as a pre-launch service for many playback clients, or it can be started by the playback controller specifically for a playback client service.

The embodiment of the present invention describes a implementation method by taking a dedicated playback server as an example.

First, the playback controller starts the playback server:

Start the playback controller, then start the playback server by the playback controller and establish a control channel to communicate with it. The user specifies the data to be played back, and the playback controller passes the information to the playback server. The playback server returns an access address to the playback controller, and the playback client will use the access address to access the playback server.

Then, the playback controller starts the playback client:

The playback controller starts the playback client and passes the obtained access address to the playback client. The playback client connects to the playback server according to the access address.

After that, the playback client negotiates with the playback server protocol:

After the client accesses the playback server, the standard RDP protocol is started to negotiate. The negotiation process is similar to the negotiation process in the process of recording the original data. Only during the negotiation process, the playback client only needs to receive the image channel in the RDP protocol. The data of other channels is no longer received. During the protocol negotiation phase, the playback server needs to read the stored graphics data to restore the original display parameters.

Then, the playback client interacts with the playback server to graph data:

After completing the protocol negotiation phase, the playback server begins to read the stored graphics data. The detailed process is as follows:

1. The play server reads the timestamp of a PDU and response.

2. Determine whether it is graphic data according to the type of PDU. The criterion for judging is whether the channel ID of the PDU is 1003. If it is 1003, it is graphic data, if not, it will be discarded.

3. The PDU needs to be processed in response. Image data needs to be resolved from the original PDU and then encapsulated according to the negotiated rules with the playback client.

4. Determine the waiting time according to the playback speed determined by the playback controller and the previous timestamp. For example, if the playback controller determines to play at normal speed, it waits for the time difference between the two timestamps to output data to the playback client. If you need 2x speed for quick browsing, you only need to wait half a time difference to output data to the playback client. If the playback controller needs to step through to see the details of the user's operation, the playback server stops outputting after outputting a data to the playback client until the next single step instruction of the playback controller is received.

5. After the playback client receives the data, it processes according to the normal process and displays the graphic when the data is recorded. The specific logic is completely determined by the RDP client.

In this embodiment, the playing server acquires the graphic data to be played back by using the foregoing solution, and sends the graphic data to the playing client according to the preset data output rule, and the received graphic data is displayed by the playing client. The acquired RDP protocol data can be converted into an image stream and the image can be played at normal speed, fast played, paused at a specified position, etc., avoiding specific protocol parsing to realize image stream reconstruction, and meeting the requirements of image auditing.

Based on the above system architecture, an embodiment of the RDP protocol data playback method of the present invention is proposed.

As shown in FIG. 2, the first embodiment of the present invention provides an RDP protocol data playback method, including:

Step S101, the play server acquires graphic data to be played back, and the graphic data is converted by RDP protocol data;

Step S102: Send the graphic data to the playing client according to a preset data output rule, and display the received graphic data by the playing client.

Optionally, the playback server obtains the intercepted RDP protocol data, and converts the RDP protocol data into graphics data and stores it locally.

The interception scheme of the RDP protocol data is not specifically limited in this embodiment. For example, the gateway may be intercepted during the process of the user accessing the server, or may be converted by the network packet capture tool.

The playback server of this embodiment is a virtual RDP server capable of reading stored graphics data and also receiving instructions of the playback controller.

The playback server may adopt the following scheme when acquiring graphic data to be played back:

The playback server reads the PDU of the RDP and the timestamp of the transmission of the PDU; determines whether the data transmitted by the PDU is graphic data according to the type of the PDU; if not, discards; if yes, parses from the PDU Graphical data is presented and encapsulated in a rule negotiated with the playback client.

The data output rule set in this embodiment may be:

First, the playback controller starts the playback server:

Then, the playback controller starts the playback client:

After that, the playback client negotiates with the playback server protocol:

After the client accesses the playback server, the standard RDP protocol is started for negotiation, and the negotiation process and recording original The negotiation process in the data process is similar, except that during playback, the client only needs to receive data from the image channel in the RDP protocol, and the data of other channels is no longer received. During the protocol negotiation phase, the playback server needs to read the stored graphics data to restore the original display parameters.

Then, the playback client interacts with the playback server to graph data:

1. The play server reads the timestamp of a PDU and response.

As shown in FIG. 3, the second embodiment of the present invention provides an RDP protocol data playback method. The method further includes: before the step of acquiring the graphic data to be played back by the playback server, according to the embodiment shown in FIG.

Step S100, the playing server establishes a connection with the playing client, and negotiates the data output rule with the playing server.

The data output rule set in this embodiment may be:

Thereby, the image can be played at normal speed, fast play, paused at a specified position, played with a minimum image change granularity, etc., avoiding specific protocol parsing to achieve image stream reconstruction, meeting the needs of image auditing .

The process of establishing a connection between the playback server and the playing client is as follows:

Receiving a data playback instruction sent by the play controller;

Establishing a connection with the playback client based on the access address.

In this embodiment, the playback server establishes a connection with the playback client and negotiates a data output rule with the playback server. After that, the playback server acquires graphics data to be played back; and outputs the graphics data with preset data. a rule for transmitting a playback client, wherein the playback client displays the received graphics data, the scheme can convert the acquired RDP protocol data into an image stream and the image can be played at a normal speed, quickly played, paused at a specified location, The minimum image change granularity is used for playing, etc., and the specific protocol analysis is avoided to realize the reconstruction of the image stream, which satisfies the requirements of image auditing.

Correspondingly, an embodiment of a playback server for playing back RDP protocol data of the present invention is proposed.

As shown in FIG. 4, the first embodiment of the present invention provides a playback server for playing back RDP protocol data, including: an obtaining module 201 and a sending module 202, where:

The obtaining module 201 is configured to acquire graphic data to be played back, where the graphic data is converted by RDP protocol data;

The sending module 202 is configured to send the graphic data to the playing client by using a preset data output rule, and the receiving client displays the received graphic data.

Optionally, the obtaining module 201 is further configured to: read a PDU of the RDP and a timestamp of the PDU transmission; determine, according to the type of the PDU, whether the data transmitted by the PDU is graphic data; if not, discard; If so, the graphics data is parsed from the PDU and the graphics data is encapsulated in a rule negotiated with the playback client.

Optionally, the sending module 202 is further configured to: if the normal speed playing is preset, wait for the first preset time, and output data to the playing client; if the preset needs n times speed to quickly browse, wait After the second preset time, the data is output to the playing client, where the second preset time is less than the first preset time, n is greater than or equal to 1; If you need to step through to see the details of the user's operation, then output a data to the playback client and stop output until the next single step instruction is received.

Wherein, when the playback server obtains the graphic data to be played back, the following scheme may be specifically adopted:

The data output rule set in this embodiment may be:

First, the playback controller starts the playback server:

Then, the playback controller starts the playback client:

After that, the playback client negotiates with the playback server protocol:

Then, the playback client interacts with the playback server to graph data:

1. The play server reads the timestamp of a PDU and response.

In this embodiment, the playing server acquires the graphic data to be played back by using the foregoing solution, and sends the graphic data to the playing client according to the preset data output rule, and the received graphic data is displayed by the playing client. Ability to convert acquired RDP protocol data into image stream and image can be played at normal speed, fast play, paused in the finger Positioning, etc., avoiding the specific protocol analysis to achieve image stream reconstruction, meeting the needs of image auditing.

As shown in FIG. 5, a second embodiment of the present invention provides a playback server that plays back RDP protocol data, and the playback server further includes:

The negotiation module 200 is configured to establish a connection with the play client and negotiate the data output rule with the play server.

The data output rule set in this embodiment may be:

Receiving a data playback instruction sent by the play controller;

Establishing a connection with the playback client based on the access address.

In this embodiment, the playback server establishes a connection with the playback client and negotiates a data output rule with the playback server. After that, the playback server acquires graphics data to be played back; and outputs the graphics data with preset data. a rule for transmitting a playback client, wherein the playback client displays the received graphics data, the scheme can convert the acquired RDP protocol data into an image stream and the image can be played at a normal speed, quickly played, paused at a specified location, Minimal image change granularity for playback, etc., avoiding specific protocol parsing to achieve image stream reconstruction, meeting the needs of image auditing; by constructing a virtual server, borrowing from existing RDP client, it is very simple An efficient way to implement playback of RDP protocol data.

Embodiments of the present invention also provide a storage medium. Optionally, in this embodiment, an execution instruction is stored in the storage medium, and the execution instruction is used to execute the foregoing method.

Optionally, in the embodiment, the foregoing storage medium may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), and a Random Access Memory (RAM). Mobile hard A variety of media that can store program code, such as disks, disks, or optical disks.

The above description is only a preferred embodiment of the present invention, and is not intended to limit the scope of the invention, and the equivalent structure or process changes made by the specification and the drawings of the present invention may be directly or indirectly applied to other related technical fields. The same is included in the scope of patent protection of the present invention.

Industrial applicability

As described above, an RDP protocol data playback method, server, and system provided by an embodiment of the present invention have the following beneficial effects: the acquired RDP protocol data can be converted into an image stream and the image can be played at a normal speed, quickly played, and paused. Specifying the location, etc., avoiding the specific protocol parsing to achieve image stream reconstruction, meeting the needs of image auditing.

Claims

A RDP protocol data playback method includes:

The playing server acquires graphic data to be played back, and the graphic data is converted by RDP protocol data;

The graphic data is sent to the playing client by a preset data output rule, and the received graphic data is displayed by the playing client.
The method of claim 1, wherein the step of the playback server acquiring graphics data to be played back comprises:

The playback server reads the PDU of the RDP and the timestamp of the transmission of the PDU;

Determining, according to the type of the PDU, whether the data transmitted by the PDU is graphic data; if not, discarding;

If so, the graphics data is parsed from the PDU and the graphics data is encapsulated in a rule negotiated with the playback client.
The method of claim 1, wherein the step of transmitting the graphic data to the playback client with a preset data output rule comprises:

If the normal speed playback is preset, after waiting for the first preset time, the playback server outputs data to the playback client;

If the n-speed is required to be quickly browsed, the playback server outputs data to the playback client after waiting for the second preset time, where the second preset time is less than the first preset time, and n is greater than or equal to 1 ;

If the preset needs to be stepped to see the details of the user operation, the playback server outputs a data to the playback client and stops outputting until the next single step instruction is received.
The method according to claim 1, 2 or 3, wherein the step of the playback server acquiring the graphic data to be played back further comprises:

The play server establishes a connection with the play client and negotiates the data output rule with the play server.
The method of claim 4, wherein the step of the play server establishing a connection with the play client comprises:

After the playback server is started, establishing a control channel for communication with the playback controller;

Receiving a data playback instruction sent by the play controller;

Returning, according to the data playback instruction, an access address to the play controller, and forwarding, by the play controller, the access address to the play client;

Establishing a connection with the playback client based on the access address.
A playback server that plays back RDP protocol data, including:

Obtaining a module, configured to acquire graphic data to be played back, wherein the graphic data is converted by RDP protocol data;

The sending module is configured to send the graphic data to the playing client according to a preset data output rule, and the received graphic data is displayed by the playing client.
The playback server according to claim 6, wherein

The acquiring module is further configured to: read a PDU of the RDP and a timestamp of the PDU transmission; determine, according to the type of the PDU, whether the data transmitted by the PDU is graphic data; if not, discard; if yes, the slave The graphics data is parsed in the PDU, and the graphics data is encapsulated in a rule negotiated with the playback client.
The playback server according to claim 6, wherein

The sending module is further configured to: if the normal speed playing is preset, wait for the first preset time, and output data to the playing client; if the preset needs to be n times speed fast browsing, wait for the second preset time After the data is output to the playback client, the second preset time is less than the first preset time, n is greater than or equal to 1; if the preset needs to be stepped to see the details of the user operation, then the playback is performed. The client stops output after outputting a data until the next single step instruction is received.
The play server according to claim 6, 7 or 8, wherein the play server further comprises:

The negotiation module is configured to establish a connection with the play client and negotiate the data output rule with the play server.
The playback server according to claim 9, wherein

The negotiation module is further configured to: after the play server is started, establish a control channel for communication with the play controller; receive a data playback instruction sent by the play controller; and control the play according to the data playback instruction Returning an access address, and the play controller forwards the access address to the play client; and establishes a connection with the play client based on the access address.
A system for playing back RDP protocol data, comprising: a playing client, a playing server, and a playing controller for controlling the playing client and the playing server, wherein:

The playing server is the playing server according to any one of claims 6-10;

The playing client is configured to access the playing server under the control of the playing controller, and perform RDP negotiation with the playing server, and receive graphic data output by the playing server and display the graphic data;

The play controller is further configured to send a play command to the play server to control the start and stop and speed of the play.