WO2020233412A1 - 数据泄露防护 - Google Patents

数据泄露防护 Download PDF

Info

Publication number
WO2020233412A1
WO2020233412A1 PCT/CN2020/089040 CN2020089040W WO2020233412A1 WO 2020233412 A1 WO2020233412 A1 WO 2020233412A1 CN 2020089040 W CN2020089040 W CN 2020089040W WO 2020233412 A1 WO2020233412 A1 WO 2020233412A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
module
packet
tcp connection
data
Prior art date
Application number
PCT/CN2020/089040
Other languages
English (en)
French (fr)
Inventor
朱学朋
Original Assignee
新华三信息安全技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 新华三信息安全技术有限公司 filed Critical 新华三信息安全技术有限公司
Priority to EP20808962.3A priority Critical patent/EP3890278B1/en
Priority to JP2021565789A priority patent/JP7395615B2/ja
Priority to US17/423,817 priority patent/US11973741B2/en
Publication of WO2020233412A1 publication Critical patent/WO2020233412A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H04L67/568—Storing data temporarily at an intermediate stage, e.g. caching
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/166—Implementing security features at a particular protocol layer at the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/30—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/141—Setup of application sessions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H04L67/564—Enhancement of application control based on intercepted application data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/163—In-band adaptation of TCP data exchange; In-band control procedures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2212/00—Encapsulation of packets

Definitions

  • DLP Data Leakage Prevention
  • the DLP device acts as a proxy device and is connected between the user device and the server through a network bridge.
  • the DLP device monitors one or more specified transmission control protocol (English: Transmission Control Protocol, abbreviated: TCP) ports.
  • TCP Transmission Control Protocol
  • the DLP device After the DLP device receives the handshake message sent by the user equipment, it maps the handshake message to the specified TCP port through the preset firewall rules. After that, the DLP device establishes a TCP connection with the user device through the designated TCP port. In addition, the DLP device establishes a TCP connection with the server through the specified TCP port.
  • the DLP device establishes TCP connections with the user equipment and the server respectively through the designated TCP port, so that the user equipment and the server transmit packets to the opposite end through the DLP device.
  • the DLP device can perform monitoring operations on the specified TCP port; again, the implementation of data leakage prevention depends on the bridge and firewall rules provided by the operating system. If the bridge is paralyzed or even the kernel crashes, DLP will be caused. The TCP connection established between the device and the user device and the server is disconnected, and the user device cannot access the network.
  • FIG. 1 is a schematic diagram of a DLP software architecture provided by an embodiment of the application
  • FIG. 2 is a schematic structural diagram of a DLP device provided by an embodiment of the application.
  • FIG. 3 is a schematic diagram of a processing flow of an HTTP message provided by an embodiment of the application.
  • FIG. 4 is a schematic structural diagram of another DLP device provided by an embodiment of the application.
  • FIG. 5 is a schematic diagram of a processing flow of an IP packet provided by an embodiment of the application.
  • FIG. 6 is a schematic diagram of the message processing process of the proxy module provided by an embodiment of the application.
  • FIG. 7 is a schematic diagram of the message processing process of the DLP service scanning submodule and the proxy module provided by an embodiment of the application;
  • FIG. 8 is a schematic flowchart of a message processing method provided by an embodiment of the application.
  • an embodiment of the present application provides a DLP device.
  • the DLP software architecture includes DLP management platform and DLP equipment.
  • the DLP management platform is used to provide users with a platform to manage and operate DLP equipment.
  • the DLP management platform includes a DLP event display module and a DLP strategy formulation module.
  • the DLP event display module is used to display the DLP events sent by the DLP device.
  • the DLP event is the processing result after the DLP device scans the DLP service.
  • the processing results include release messages and block messages.
  • the DLP policy formulation module is used to receive the security policy input by the user and send the security policy to the DLP device.
  • DLP equipment includes driver module, network protocol (English: Internet Protocol, abbreviation: IP) message forwarding module, DLP preprocessing module, application (English: Application, abbreviation: APP) proxy entry, APP proxy exit, TCP proxy and condom Socket layer (English: Secure Sockets Layer, abbreviation: SSL) offloading module, deep packet inspection (English: Deep Packet Inspection, abbreviation: DPI) engine, DLP service scanning module and DLP communication module, etc.
  • network protocol English: Internet Protocol, abbreviation: IP
  • APP Application, abbreviation: APP proxy entry
  • APP proxy exit APP proxy exit
  • TCP proxy and condom Socket layer English: Secure Sockets Layer, abbreviation: SSL
  • the driving module is used to map the IP message received by the network card to the user mode buffer.
  • the IP message forwarding module is used to forward IP messages.
  • the IP message forwarding module can realize the complete forwarding function of the IP message of the DLP device.
  • the DLP preprocessing module is used to reorganize IP packet fragments and TCP packet fragments for packet preprocessing operations.
  • the TCP proxy and SSL offloading modules are used to manage the TCP user mode protocol stack and the Open Secure Sockets Layer (English: Open Secure Sockets Layer, referred to as: OpenSSL) cryptographic library.
  • OpenSSL Open Secure Sockets Layer
  • the intermediate buffer is used to buffer the data generated by the DLP device in the process of processing IP packets.
  • the TCP entry is used to provide the APP proxy entry with a structure corresponding to the IP packet when the DLP device receives the IP packet, where the IP packet includes the TCP port information of the TCP entry.
  • the TCP exit is used to provide the TCP port information of the TCP entry for the APP proxy exit when the DLP device sends an IP packet.
  • the APP proxy entry is used to call the TCP user mode protocol stack to establish the TCP entry and the TCP exit; receive the IP message forwarding module corresponding to the structure of the IP message sent to the APP proxy entry through the TCP entry; call the OpenSSL cryptographic library to transfer the IP packet.
  • the user data of the document is decrypted, and the user data obtained after the decryption is cached in the intermediate buffer; the structure is sent to the DPI engine.
  • the DPI engine is used to receive the structure sent by the APP proxy entry, perform protocol analysis on the IP message, determine the application layer protocol used to transmit the IP message, and restore the user data included in the IP message.
  • the DLP service scanning module is used to receive the scanning message sent by the DPI engine, and perform scanning processing on the DLP service. Specifically, from the security policy, search for target matching items that match the user data; according to the action items corresponding to the target matching items, send corresponding messages to the APP agent exit.
  • the APP proxy exit is used to receive the message sent by the DLP service scanning module, call the TCP exit, and instruct the IP packet forwarding module to forward the packet, or release the buffered IP packet.
  • the DLP communication module is used to obtain the processing result of the DLP service scanned by the DLP service scanning module, send the processing result to the DLP management platform, and receive the security policy sent by the DLP management platform.
  • the DLP device when the DLP device determines that the application layer protocol used to transmit the IP packet is monitored, it establishes the first TCP connection between the DLP device and the user equipment based on the TCP port information included in the IP packet, and The second TCP connection between the DLP device and the server further implements data leakage protection for the user device based on the first TCP connection and the second TCP connection.
  • the DLP device has realized monitoring on any TCP port.
  • DLP equipment does not need to set up additional network bridge and firewall rules, which solves the problem that users cannot access the network caused by network bridge failure or even kernel crash.
  • FIG. 2 is a schematic diagram of a DLP device provided by an embodiment of the application.
  • the DLP device includes: a network card 104, a driving module 100, a forwarding module 101, an agent module 102, and a DPI module 103.
  • the driving module 100, the forwarding module 101, the proxy module 102, and the DPI module 103 may be software modules, that is, modules implemented by a central processing unit (English: Central Processing Unit, referred to as CPU) running a software program.
  • the foregoing forwarding module 101 is the IP packet forwarding module in FIG. 1.
  • the above-mentioned proxy module 102 includes the APP proxy exit and the APP proxy entry in FIG. 1.
  • the above-mentioned DPI module 103 includes the DPI engine and the DLP service scanning module in FIG. 1.
  • the network card 104 is used to receive the IP packet sent by the user equipment, and send the IP packet to the driving module 100.
  • the IP message includes information such as IP header and TCP header.
  • the TCP header includes TCP port information.
  • the IP message can be a protocol message or a data message.
  • the driving module 100 is configured to receive an IP message and buffer the IP message in a user mode buffer.
  • the buffer includes a kernel mode buffer and a user mode buffer.
  • the rate at which the DLP device caches data to the kernel mode buffer is higher than the rate at which data is cached to the user mode buffer.
  • the upper application can directly access the data stored in the user mode buffer, but cannot directly access the data stored in the kernel mode buffer.
  • the driving module 100 receives an IP message, and may store the IP message in the kernel mode buffer first. After that, the driving module 100 copies the IP message from the kernel mode buffer to the user mode buffer.
  • the driving module 100 receives an IP message, and can store the IP message in a user mode buffer. In this way, the driving module 100 does not need to copy the IP message from the kernel mode buffer to the user mode buffer, which effectively improves the message processing efficiency.
  • the drive module 100 can use a zero-copy technology drive module provided by the CPU, such as a data plane development kit (English: Data Plane Development Kit, abbreviated as: DPDK) drive module, which can realize that the received IP message is skipped
  • a data plane development kit English: Data Plane Development Kit, abbreviated as: DPDK
  • the kernel mode register is directly cached to the user mode register.
  • the forwarding module 101 is configured to read an IP message from the user mode buffer, form a structure corresponding to the IP message, and send the structure to the proxy module 102.
  • the forwarding module 101 is used to implement the forwarding of IP packets, and call upper-layer service ports to process the IP packets in each stage of forwarding.
  • the forwarding module 101 may read the IP message from the user mode buffer, analyze the IP message, and form a structure corresponding to the IP message.
  • the structure of the IP message may include IP header information of the IP message, TCP header information, storage location of the IP message, and so on.
  • the forwarding module 101 sends the structure corresponding to the IP message to the proxy module 102.
  • the proxy module 102 is used to receive the structure corresponding to the IP message sent by the forwarding module 101; obtain the TCP port information according to the structure corresponding to the IP message; according to the TCP port information, detect whether the DLP device and the user equipment are established A TCP connection; if the first TCP connection is not established, when the IP message is a data message, the structure corresponding to the IP message is sent to the DPI module 103.
  • the proxy module 102 After the proxy module 102 receives the structure sent by the forwarding module 101, it can obtain the TCP port information from the structure; it can also determine the storage location of the IP packet based on the structure, and find the IP packet according to the storage location, from The TCP port information is extracted from the IP packet. The proxy module 102 detects whether the first TCP connection is established between the DLP device and the user equipment according to the TCP port information.
  • the DLP device can set a TCP connection list.
  • the TCP connection list includes: TCP port information of the TCP connection established between the DLP device and the user device. Based on this, the above-mentioned proxy module 102 detects whether the first TCP connection is established between the DLP device and the user equipment according to the TCP port information, which can be implemented in the following manner.
  • the proxy module 102 detects whether the TCP port information is included in the TCP connection list according to the acquired TCP port information. If it is included, the proxy module 102 determines that the first TCP connection is established between the DLP device and the user equipment. If it is not included, the proxy module 102 determines that the first TCP connection is not established between the DLP device and the user equipment.
  • the proxy module 102 sends the structure corresponding to the IP packet to the DPI module 103.
  • the DPI module 103 performs protocol identification on the IP message according to the structure corresponding to the IP message.
  • the proxy module 102 detects the message type of the IP message, that is, whether the IP message is a protocol message or a data message.
  • the protocol message may specifically be a handshake message, and the handshake message is a message used to establish a TCP connection between devices.
  • the protocol message is an example of a handshake message.
  • the proxy module 102 If the proxy module 102 detects that the IP message is a data message, the proxy module 102 sends the DPI module 103 a structure corresponding to the IP message.
  • the DPI module 103 is used to receive the structure corresponding to the IP message sent by the proxy module 102; obtain the message characteristics of the IP message according to the structure corresponding to the IP message; and compare the message characteristics of the IP message with each application The message characteristics corresponding to the layer protocol match, and the application layer protocol used to transmit the IP message is determined; when the application layer protocol used to transmit the IP message is monitored, the first message is sent to the proxy module 102.
  • the first message indicates that the application layer protocol used to transmit the IP message is monitored.
  • the message characteristics of the IP message may include: the quintuple information of the IP message, the length of the message, and characteristic keywords.
  • the DPI module 103 After receiving the structure corresponding to the IP message, the DPI module 103 performs protocol identification on the IP message. Specifically, the DPI module 103 determines the storage location of the IP message according to the structure corresponding to the IP message, finds the IP message according to the storage location, and obtains the message characteristics of the IP message; by combining the message of the IP message The feature matches the message feature corresponding to each application layer protocol, and the application layer protocol used to transmit the IP message is determined.
  • the message characteristics corresponding to each application layer protocol have been configured in the DLP device in advance.
  • the application layer protocol has protocol 1 and protocol 2.
  • the message characteristics corresponding to each application layer protocol have been pre-configured in the DLP device, including: the message characteristics corresponding to protocol 1 are x and xx, and the message characteristics corresponding to protocol 2 are y and yy. If the DPI module 103 obtains that the message characteristics of an IP message are x and xx, it is determined that the message characteristics of the IP message match the message characteristics corresponding to protocol 1, and protocol 1 is used to transmit the IP message Application layer protocol.
  • the DPI module 103 After determining the application layer protocol used to transmit the IP message, the DPI module 103 detects whether the application layer protocol used to transmit the IP message is a preset monitored application layer protocol. If so, the DPI module 103 sends the first message to the agent module 102.
  • the first message may be a function return value.
  • the return value of the function is specifically the result of the previous negotiation between the DPI module 103 and the proxy module 102. For example, 0 means being monitored, 1 means not being monitored. If the DPI module 103 determines that the application layer protocol used to transmit the IP packet is monitored, it sends the function value 0 to the proxy module 102.
  • the above function may be Fun() function, get() function, etc.
  • the embodiments of the present application do not specifically limit this. In the embodiments of the present application, only 0 means being monitored and 1 means not being monitored as an example for description, which is not limiting. For example, you can also use 3 to indicate being monitored and 4 to indicate not being monitored.
  • the proxy module 102 is further configured to, after receiving the first message, establish a TCP connection pair according to the TCP port information of the IP message.
  • the TCP connection pair includes a first TCP connection and a second TCP connection between the DLP device and the server.
  • the proxy module 102 After receiving the first message, the proxy module 102 determines that the application layer protocol used to transmit the IP message is monitored, uses the TCP user mode protocol stack, and establishes the first TCP connection with the user equipment according to the TCP port information of the IP message, and Establish a second TCP connection with the server.
  • the TCP port information used to establish the first TCP connection is the same as the TCP port information included in the IP message; similarly, the TCP port information used to establish the second TCP connection and the TCP port information included in the IP message Same too. Even if the DLP device divides the TCP connection between the user equipment and the server into the first TCP connection and the second TCP connection, that is, the DLP device interrupts the TCP connection between the user equipment and the server, it will not change the IP packet sent by the user equipment. Information such as TCP port reduces the risk of the server discovering that IP packets are being proxied.
  • the DLP device can monitor the TCP ports used to establish these TCP connections. Based on this, the DLP device no longer monitors the specified TCP port in the process of implementing data leakage prevention, and realizes the monitoring of any TCP port.
  • the proxy module 102 in the process of detecting the message type of the IP message, sends to the forwarding module 101 if it determines that the IP message is a protocol message (for example, a handshake message) The second message.
  • a protocol message for example, a handshake message
  • the second message indicates that the IP message is a protocol message.
  • the forwarding module 101 determines that the IP message is a protocol message according to the second message.
  • the forwarding module 101 reads the IP message from the user mode buffer, and sends the IP message to the server.
  • the server establishes a TCP connection with the user equipment according to the IP message. In this way, the number of packets processed by the DLP device is reduced, the burden of the DLP device is reduced, and the user device directly establishes a TCP connection with the server, which reduces the risk of the server discovering that the IP packet is proxied.
  • the second message may be a function return value.
  • the return value of this function is specifically the result of the previous negotiation between the proxy module 102 and the forwarding module 101. For example, 0 indicates that the IP message is a protocol message, and 1 indicates that the IP message is a data message. If the DPI module 103 detects that the IP message is a protocol message, it sends the function value 0 to the proxy module 102. If the DPI module 103 detects that the IP message is a data message, it sends the function value 1 to the proxy module 102.
  • the above function may be Fun() function, get() function, etc.
  • the embodiments of the present application do not specifically limit this. In the embodiments of the present application, only 0 indicates that the IP message is a protocol message, and 1 indicates that the IP message is a data message as an example for description, which is not limiting. For example, 3 may also indicate that the IP message is a protocol message, and 4 that the IP message is a data message.
  • the DPI module 103 is also used to perform a deep packet inspection step, thereby implementing data leakage prevention.
  • the IP packet also includes first user data.
  • the DPI module 103 determines that the application layer protocol used to transmit the IP packet is monitored, the DPI module 103 marks the location of the first user data. That is, the DPI module 103 marks the specific byte of the first user data in the IP packet.
  • the DPI module 103 performs decapsulation processing on the IP packet to obtain the inner layer packet with the encapsulation header removed.
  • the DPI module 103 obtains and caches the first user data corresponding to the marked location.
  • the first user data corresponding to the location of the first user data is: user data at the location of the first user data in the IP packet.
  • the DPI module 103 obtains a preset security policy, and the security policy includes matching items and action items.
  • the DPI module 103 searches for a target matching item that matches the first user data from the security policy, and executes the action item corresponding to the target matching item.
  • the DPI module 103 is further configured to perform the step of determining whether user data belonging to the same original data is received, so as to implement accurate deep packet inspection on the original data.
  • the DPI module 103 determines whether all user data belonging to the same original data has been received. If all user data belonging to the same original data has been received, that is, the original data is restored, the DPI module 103 obtains a preset security policy, and searches the security policy for a target matching item that matches the user data. If all user data belonging to the same original data is not received, the DPI module 103 repeats the process of determining whether all user data belonging to the same original data has been received.
  • the sender puts the original data to be transmitted in an application layer message for transmission.
  • the sender needs to perform fragmentation processing on the application layer message. That is, the sender divides an application layer message into multiple IP packets for transmission.
  • the above-mentioned IP packet is an IP packet. After receiving all the IP message fragments of the application layer message, the receiving end restores the original data to be transmitted.
  • the application layer messages include Hypertext Transfer Protocol (English: HyperText Transport Protocol, abbreviation: HTTP) messages, Simple Mail Transfer Protocol (English: Simple Mail Transfer Protocol, abbreviation: SMTP) messages and file transfer protocol (English: : File Transfer Protocol, FTP for short) messages, etc.
  • Hypertext Transfer Protocol English: HyperText Transport Protocol, abbreviation: HTTP
  • Simple Mail Transfer Protocol English: Simple Mail Transfer Protocol, abbreviation: SMTP
  • file transfer protocol English: : File Transfer Protocol, FTP for short
  • the DPI module 103 can determine whether all user data belonging to the same original data has been received in the following manner.
  • the DPI module 103 can determine that a complete application layer message has been received, and then determine that all user data belonging to the same original data has been received.
  • the processing flow of the HTTP message is divided into multiple IP messages.
  • the DLP device receives the first IP message
  • the DPI module 103 extracts the start tag from the first IP message. It is understandable that during HTTP packet transmission, the device will only send an IP packet of the HTTP packet and receive the response packet corresponding to the IP packet before sending the next IP packet of the HTTP packet. Text.
  • the DPI module 103 caches the user data in the first IP message and releases the first IP message. In the same way, before the DLP device receives the last IP packet of the HTTP packet, it caches the user data in each IP packet in the HTTP packet and releases each IP packet in the HTTP packet. After the DLP device receives the last IP message of the HTTP message, the DPI module 103 extracts the end tag from the last IP message of the HTTP message. At this time, the DPI module 103 determines that a complete HTTP message is received, that is, all user data belonging to the same original data is received. The DPI module 103 obtains a preset security policy, searches for a target matching item that matches the original data from the security policy, and executes an action item corresponding to the target matching item.
  • the action items included in the security policy have two action types, namely, packet release and packet blocking.
  • the DPI module 103 when the action item corresponding to the target matching item is packet release, the DPI module 103 sends a third message to the proxy module 102.
  • the third message indicates that the IP message is released, and the third message includes the first storage location of the first user data.
  • the proxy module 102 After receiving the third message, the proxy module 102 determines to release the IP packet, and searches for the first user data according to the first storage location. The proxy module 102 encapsulates the first user data according to the TCP port information of the second TCP connection to obtain the second user data. The second user data includes the TCP header and the first user data. The proxy module 102 sends the fourth message to the forwarding module 101. The fourth message indicates that the IP packet is released, and the fourth message includes the second storage location of the second user data.
  • the forwarding module 101 After receiving the fourth message, the forwarding module 101 determines to release the IP packet, and searches for the second user data according to the second storage location. The forwarding module 101 encapsulates the second user data to obtain an IP message, and sends the IP message to the server. It can be understood that the IP packet obtained by the forwarding module 101 encapsulating the second user data is the same as the IP packet received by the aforementioned network card 104.
  • the DPI module 103 when the action item corresponding to the target matching item is packet blocking, the DPI module 103 sends a fifth message to the proxy module 102.
  • the fifth message indicates that the IP packet is blocked, and the fifth message
  • the message includes the first storage location of the first user data and the first blocking data.
  • the first blocking data may be a character string preset by the DLP device.
  • the proxy module 102 After receiving the fifth message, the proxy module 102 searches for and releases the first user data according to the first storage location. In addition, the proxy module 102 encapsulates the first blocking data according to the TCP port information of the first TCP connection to obtain the second blocking data. The second blocking data includes the TCP header and the first blocking data. The proxy module 102 sends the second blocking data to the forwarding module 101.
  • the forwarding module 101 After receiving the second blocking data, the forwarding module 101 encapsulates the second blocking data to obtain a blocking message.
  • the forwarding module 101 replaces the server and sends a blocking message to the user equipment.
  • the blocking message may be a "403 Forbidden” blocking message.
  • “403 Forbidden (Forbidden)” can be understood as the first blocking data.
  • the user equipment After the user equipment receives the blocking message, it can be determined that the access failed this time and an error occurred in the access data.
  • the third message and the fifth message may be a function return value.
  • the return value of this function is the result of the previous negotiation between the DPI module 103 and the agent module 102. For example, 3 means to pass the message, 4 means to block the message. If the DPI module 103 determines that the action item corresponding to the target matching item is a message release, it sends the function value 3 to the agent module 102. If the DPI module 103 determines that the action item corresponding to the target matching item is message blocking, it sends a function value of 4 to the proxy module 102.
  • the above function may be Fun() function, get() function, etc.
  • the embodiments of this application do not make specific limitations on this.
  • only 3 represents the release of the message
  • 4 represents the blocking of the message as an example for description, which is not limiting. For example, you can also use 1 to express the message, and 0 to block the message.
  • the fourth message can be a function return value.
  • the return value of this function is the result of the previous negotiation between the forwarding module 101 and the proxy module 102. For example, 3 means to pass the message, 4 means to block the message. If the proxy module 102 receives the third message, it sends the function value 3 to the forwarding module 101. If the proxy module 102 receives the fifth message, it sends the function value 4 to the forwarding module 101.
  • the above function may be Fun() function, get() function, etc.
  • the embodiments of the present application do not specifically limit this.
  • only 3 represents the release of the message
  • 4 represents the blocking of the message as an example for description, which is not limiting. For example, you can also use 1 to express the message, and 0 to block the message.
  • the DPI module 103 is further configured to perform a process of sending a sixth message to the proxy module 102 when the application layer protocol used to transmit the IP message is not monitored, thereby realizing fast IP packets are forwarded locally.
  • the DPI module 103 sends the sixth message to the proxy module 102.
  • the sixth message indicates that the application layer protocol used to transmit the IP message is not monitored.
  • the proxy module 102 receives and sends the sixth message to the forwarding module 101. After the forwarding module 101 receives the sixth message, it determines according to the sixth message that the application layer protocol used to transmit the IP message is not monitored, reads the IP message from the user mode buffer, and sends the IP message to the server . At this time, the DPI module 103 does not perform deep packet inspection on the IP message, which improves the forwarding efficiency of the IP message.
  • the sixth message may be a function return value.
  • the return value of the function is specifically the result of the previous negotiation between the DPI module 103 and the proxy module 102. For example, 0 means being monitored, 1 means not being monitored. If the DPI module 103 determines that the application layer protocol used to transmit the IP message is not monitored, it sends the function value 1 to the proxy module 102.
  • the DPI module 103 may include a DPI protocol analysis sub-module 1031, a data reduction module 1032, and a DLP service scanning sub-module 1033. Based on the DLP device shown in Figure 4, the processing flow of the IP packet is shown in Figure 5.
  • the driving module 100 receives the IP message, and buffers the IP message in the user mode buffer.
  • the forwarding module 101 reads the IP message from the user mode buffer, forms a structure corresponding to the IP message, and sends the structure to the proxy module 102.
  • the proxy module 102 receives the structure and obtains TCP port information according to the structure; according to the TCP port information, it detects whether the first TCP connection is established between the DLP device and the user equipment; if the first TCP connection is not established, the IP message is In the case of a data message, the structure is sent to the DPI protocol analysis sub-module 1031.
  • the DPI protocol analysis sub-module 1031 receives the structure sent by the proxy module 102. Determine the storage location of the IP packet according to the structure, and find the IP packet according to the storage location. On the basis of the traditional application layer protocol identification, the DPI protocol parsing submodule 1031 performs protocol identification on the IP message, and determines the application layer protocol used to transmit the IP message. The DPI protocol analysis sub-module 1031 determines whether the application layer protocol used to transmit the IP packet is monitored. If the application layer protocol used to transmit the IP message is monitored, the DPI protocol parsing submodule 1031 analyzes and marks the location of the first user data included in the IP message, and sends the marked first user data to the data reduction module 1032 s position.
  • the data return atom module 1032 decapsulates the IP packet, obtains and caches the first user data corresponding to the marked location.
  • the data restoring module 1032 determines whether all user data belonging to the same original data has been received. If all user data belonging to the same original data is not received, the data reduction module 1032 caches the first user data. If all user data belonging to the same original data has been received, the data restoring module 1032 calls the port registered by the DLP service scanning submodule 1033 to send a scanning message to the DLP service scanning submodule 1033.
  • the scan message includes the first storage location of the first user data.
  • the DLP service scanning submodule 1033 After receiving the scan message, the DLP service scanning submodule 1033 obtains the first user data according to the first storage location.
  • the DLP service scanning submodule 1033 obtains a preset security policy, searches for a target matching item matching the first user data from the security policy, and sends a corresponding message to the agent module 102 according to the action item corresponding to the target matching item.
  • the DLP service scanning submodule 1033 sends a third message to the proxy module 102.
  • the DLP service scanning submodule 1033 sends a fifth message to the agent module 102.
  • the DLP service scanning submodule 1033 After the DLP service scanning submodule 1033 finds the target matching item that matches the first user data, it sends the action item corresponding to the target matching item to the DPI protocol analysis submodule 1031.
  • the DPI protocol parsing sub-module 1031 sends a corresponding message to the agent module 102.
  • the DPI protocol parsing submodule 1031 sends a third message to the proxy module 102.
  • the DPI protocol parsing submodule 1031 sends a fifth message to the proxy module 102.
  • the proxy module 102 If the proxy module 102 receives the third message, it searches for the first user data according to the first storage location of the first user data; and encapsulates the first user data according to the TCP port information of the second TCP connection to obtain the second User data, the second user data includes the TCP header and the first user data, and sends a fourth message to the forwarding module 101.
  • the forwarding module 101 receives the fourth message, searches for the second user data according to the second storage location of the second user data; encapsulates the second user data to obtain an IP packet, and sends the IP packet to the server.
  • the proxy module 102 If the proxy module 102 receives the fifth message, it releases the first user data according to the first storage location of the first user data; according to the TCP port information of the first TCP connection, the first blocking data is encapsulated to obtain the The second blocking data, the second blocking data includes the TCP header and the first blocking data; the second blocking data is sent to the forwarding module 101.
  • the forwarding module 101 receives the second blocking data; encapsulating the second blocking data to obtain a blocking message; and sending the blocking message to the user equipment.
  • the proxy module 102 If the proxy module 102 detects that the first TCP connection is not established between the DLP device and the user equipment, it sends a second message to the forwarding module 101 when the IP message is a handshake message.
  • the forwarding module 101 receives the second message, and sends an IP packet to the server according to the second message.
  • the DPI protocol parsing submodule 1031 determines that the application layer protocol used to transmit the IP message is not monitored, it sends a sixth message to the proxy module 102.
  • the proxy module 102 receives and sends the sixth message to the forwarding module 101.
  • the forwarding module 101 receives the sixth message, and sends an IP packet to the server according to the sixth message.
  • Step 601 The proxy module 102 receives the structure sent by the forwarding module 101, and obtains TCP port information according to the structure.
  • Step 602 The proxy module 102 detects whether a first TCP connection is established between the DLP device and the user equipment according to the TCP port information. If the first TCP connection is not established, step 603 is executed. If the first TCP connection is established, step 605 is executed.
  • Step 603 The proxy module 102 detects whether the IP message is a handshake message. If it is a handshake message, step 604 is executed. If it is not a handshake message, that is, the IP message is a data message, step 605 is executed.
  • Step 604 the proxy module 102 sends a second message to the forwarding module 101.
  • the forwarding module 101 After receiving the second message, the forwarding module 101 sends an IP packet to the server according to the second message.
  • Step 605 The proxy module 102 sends the structure to the DPI module 103.
  • the DPI module 103 obtains the message characteristics of the IP message according to the structure.
  • the DPI module 103 determines the application layer protocol used to transmit the IP message by matching the message feature of the IP message with the message feature corresponding to each application layer protocol.
  • the DPI module 103 sends the first message to the proxy module 102.
  • the DPI module 103 sends a sixth message to the proxy module 102.
  • Step 606 If the proxy module 102 receives the sixth message, it determines that the application layer protocol used to transmit the IP packet is not monitored, and step 607 is executed. If the first message is received, it is determined that the application layer protocol used to transmit the IP packet is monitored, and step 608 is executed.
  • Step 607 The proxy module 102 sends a sixth message to the forwarding module 101.
  • the forwarding module 101 After receiving the sixth message, the forwarding module 101 sends an IP packet to the server according to the sixth message.
  • the proxy module 102 establishes a TCP connection pair according to the TCP port information.
  • the TCP connection pair includes a first TCP connection and a second TCP connection.
  • step 701 the DLP service scanning sub-module 1033 receives the scanning message sent by the data reduction module 1032.
  • step 702 the DLP service scanning submodule 1033 obtains a preset security policy according to the scan message, and searches the security policy for a target matching item that matches the first user data.
  • Step 703 if the DLP service scanning sub-module 1033 does not find a target matching item, step 704 is executed. If the target matching item is found, step 706 is executed.
  • step 704 the DLP service scanning sub-module 1033 calls the proxy module 102 to send a third message to the proxy module 102.
  • Step 705 The proxy module 102 searches for the first user data; according to the TCP port information of the second TCP connection, encapsulates the first user data to obtain the second user data, and sends a fourth message to the forwarding module 101.
  • step 706 if the DLP service scanning submodule 1033 determines that the action item corresponding to the target matching item is the message release, step 704 is executed. If the DLP service scanning submodule 1033 determines that the action item corresponding to the target matching item is packet blocking, step 707 is executed.
  • step 707 the DLP service scanning sub-module 1033 calls the proxy module 102 to send a fifth message to the proxy module 102.
  • Step 708 The proxy module 102 releases the first user data; encapsulates the first blocking data according to the TCP port information of the first TCP connection to obtain the second blocking data; and sends the second blocking data to the forwarding module 101.
  • the proxy module 102 may also be used to execute the process of establishing an SSL protocol connection when the IP message is an encrypted message of the SSL protocol.
  • the IP message is an encrypted message of the SSL protocol.
  • the user data included in the encrypted message of the SSL protocol is decrypted, and the user data in the plain text is obtained, thereby realizing the process of data leakage prevention.
  • the proxy module 102 calls the first interface and the second interface of the OpenSSL cryptographic library respectively.
  • the proxy module 102 binds the called first interface with the first TCP connection, and binds the called second interface with the second TCP connection, thereby completing the establishment of the SSL protocol connection.
  • the proxy module 102 After receiving the structure corresponding to the IP message, the proxy module 102 determines the storage location of the IP message according to the structure, and finds the IP message according to the storage location. The proxy module 102 calls the OpenSSL cryptographic library based on the first interface bound by the first TCP connection, decrypts the user data included in the IP message, and obtains the user data in the plain text. The proxy module 102 sends the storage location of the plaintext user data to the DPI module 103.
  • the proxy module 102 After receiving the third message sent by the DPI module 103, the proxy module 102 invokes the OpenSSL cryptographic library based on the second interface bound by the second TCP connection to encrypt the user data included in the IP message to obtain the user data in the cipher text , And encapsulate the ciphertext user data.
  • the proxy module 102 may not process the IP message.
  • FIG. 8 is a schematic flowchart of a message processing method according to an embodiment of the application. The method is applied to DLP equipment, and the message processing method includes the following steps.
  • Step 801 Receive an IP packet sent by the user equipment.
  • the IP message includes information such as an IP header and a TCP header.
  • the TCP header includes TCP port information.
  • the IP message can be a protocol message or a data message.
  • the DLP device is set between the user device and the server.
  • the user equipment sends an IP packet to the server through the DLP device.
  • Step 802 According to the TCP port information, it is detected whether a first TCP connection is established between the DLP device and the user equipment. If the first TCP connection is not established, the DLP device executes step 803.
  • the DLP device After receiving the IP packet, the DLP device obtains the TCP port information of the IP packet. The DLP device detects whether the first TCP connection is established between the DLP device and the user equipment according to the acquired TCP port information. If the first TCP connection is not established, the DLP device executes step 803.
  • Step 803 When the IP message is a data message, the application layer protocol used to transmit the IP message is determined by matching the message feature of the IP message with the message feature corresponding to each application layer protocol.
  • the DLP device detects that the first TCP connection is not established, it detects the message type of the IP message, that is, whether the IP message is a data message or a protocol message.
  • the protocol message may be a handshake message. The following embodiment uses a handshake message as an example for description. If it is detected that the IP message is a data message, the DLP device determines the application layer protocol used to transmit the IP message by matching the message feature of the IP message with the message feature corresponding to each application layer protocol.
  • Step 804 When the application layer protocol used to transmit the IP message is monitored, establish a TCP connection pair according to the TCP port information.
  • the TCP connection pair includes a first TCP connection and a second TCP connection between the DLP device and the server.
  • the DLP device When the application layer protocol used to transmit the IP message is monitored, the DLP device establishes a first TCP connection with the user equipment according to the TCP port information. The DLP device establishes a second TCP connection with the server according to the TCP port information. The DLP device subsequently transmits the IP message through the first TCP connection and the second TCP connection without changing the TCP port information of the IP message, which reduces the risk of the server finding that the IP message is proxied.
  • the DLP device when the IP message is a protocol message, such as a handshake message, the DLP device passes the IP message, that is, sends the IP message to the server.
  • the server establishes a TCP connection with the user equipment according to the IP message.
  • the number of packets processed by the DLP device is reduced, the burden of the DLP device is reduced, and the user device directly establishes a TCP connection with the server, which reduces the risk of the server discovering that the IP packet is proxied.
  • the DLP device detects that the first TCP connection is established, it determines that it is used to transmit IP by matching the packet characteristics of the IP packet with the packet characteristics corresponding to each application layer protocol.
  • the application layer protocol of the message The DLP device does not need to detect the message type of the IP message, which reduces the burden of the DLP device.
  • the DLP device when the application layer protocol used to transmit the IP packet is not monitored, the DLP device allows the IP packet, that is, sends the IP packet to the server.
  • the DLP device does not process IP packets, which reduces the burden of the DLP device.
  • the DLP device may also mark the location of the first user data included in the IP packet, decapsulate the IP packet, and obtain And cache the first user data corresponding to the marked location.
  • the DLP device obtains the preset security policy.
  • the security policy includes matching items and action items.
  • the DLP device searches for the target matching item that matches the first user data from the security policy, and executes the action item corresponding to the target matching item.
  • the action items include message release and message blocking.
  • the DLP device encapsulates the first user data according to the TCP port information of the second TCP connection, obtains an IP packet, and sends the IP packet to the server .
  • the DLP device encapsulates the first user data according to the TCP port information of the second TCP connection to obtain the second user data, and the second user data includes TCP Header and first user data. After that, the DLP device encapsulates the second user data to obtain an IP message, and sends the IP message to the server.
  • the DLP device when the action item corresponding to the target matching item is packet blocking, the DLP device generates a blocking packet according to the TCP port information of the first TCP connection.
  • the DLP device replaces the server and sends blocking messages to the user equipment, which improves the security of the network.
  • the DLP device calls the first interface and the second interface of the OpenSSL cryptographic library respectively. Interface, bind the called first interface with the first TCP connection, and bind the called second interface with the second TCP connection. In this way, the DLP device can complete the SSL encryption and decryption process of user data, obtain user data in plain text, and correctly perform data leakage protection processing on user data.
  • the DLP device when the DLP device determines that the application layer protocol used to transmit the IP message is monitored, it establishes the first TCP between the DLP device and the user equipment based on the TCP port information included in the IP message Connection, and the second TCP connection between the DLP device and the server, and then according to the first TCP connection and the second TCP connection, data leakage protection for the user device is implemented. It can be seen that in the embodiment of the present application, the DLP device realizes monitoring on any TCP port in the process of implementing data leakage prevention. In addition, DLP equipment does not need to set up additional network bridge and firewall rules, which solves the problem that users cannot access the network caused by network bridge failure or even kernel crash.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Technology Law (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

一种数据泄露防护(DLP)设备及报文处理方法，DLP设备接收用户设备发送的IP报文，IP报文包括TCP端口信息；根据TCP端口信息，检测DLP设备与用户设备之间是否建立第一TCP连接；若未建立第一TCP连接，则在IP报文是数据报文时，将IP报文的报文特征与各个应用层协议对应的报文特征匹配，确定用于传输IP报文的应用层协议；当用于传输IP报文的应用层协议被监听时，根据TCP端口信息，建立TCP连接对，TCP连接对包括第一TCP连接，以及DLP设备与服务器之间的第二TCP连接。

Description

数据泄露防护
本申请要求于2019年5月21日提交中国专利局、申请号为201910426343.7发明名称为“数据泄露防护设备及报文处理方法”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
背景技术
随着信息技术的飞速发展，互联网已成为日常办公、通信交流和协作互动的必备工具。但是，互联网在提高人们工作效率的同时，也对信息的存储以及计算机的访问控制提出了安全需求。然而，公司的内部人员利用互联网有意或者无意地执行某些操作，经常会导致发生网络泄密等重大损失事件。为了解决该问题，数据泄露防护(英文：Data Leakage Prevention，简称：DLP)技术被提出。
目前，采用DLP技术进行安全防护时，DLP设备作为代理设备，通过网桥被连接在用户设备与服务器之间。DLP设备监听指定的一个或多个传输控制协议(英文：Transmission Control Protocol，简称：TCP)端口。DLP设备接收到用户设备发送的握手报文后，通过预设的防火墙规则，向指定的TCP端口映射握手报文。之后，DLP设备通过指定的TCP端口与用户设备建立TCP连接。另外，DLP设备通过指定的TCP端口与服务器建立TCP连接。
因此，DLP设备通过指定的TCP端口，分别与用户设备、服务器建立TCP连接，进而使得用户设备、服务器通过DLP设备向对端传输报文。
在上述数据泄露防护过程中，DLP设备可对指定的TCP端口执行监听操作；再次，数据泄露防护的实现依赖于操作系统提供的网桥和防火墙规则，若网桥瘫痪甚至内核崩溃，将导致DLP设备分别与用户设备、服务器建立的TCP连接断开，出现用户设备无法访问网络的问题。
附图简要说明
图1为本申请实施例提供的一种DLP软件架构示意图；
图2为本申请实施例提供的一种DLP设备的结构示意图；
图3为本申请实施例提供的一种HTTP报文的处理流程示意图；
图4为本申请实施例提供的另一种DLP设备的结构示意图；
图5为本申请实施例提供的一种IP报文的处理流程示意图；
图6为本申请实施例提供的代理模块的报文处理过程示意图；
图7为本申请实施例提供的DLP业务扫描子模块、代理模块的报文处理过程示意图；
图8为本申请实施例提供的一种报文处理方法的流程示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
为了实现DLP设备对任一TCP端口的监听，并解决由网桥瘫痪甚至内核崩溃引起的用户无法访问网络的问题，本申请实施例提供了一种DLP设备。如图1所示的DLP软件架构。该DLP软件架构包括DLP管理平台和DLP设备。DLP管理平台用于为用户提供了一个管理和操作DLP设备的平台。
具体的，DLP管理平台包括DLP事件展示模块和DLP策略制定模块。
其中，DLP事件展示模块用于，展示DLP设备发送的DLP事件。DLP事件为：DLP设备对DLP业务进行扫描处理后的处理结果。处理结果包括放行报文和阻断报文等。
DLP策略制定模块用于，接收用户输入的安全策略，并向DLP设备发送安全策略。
DLP设备包括驱动模块、网络协议(英文：Internet Protocol，简称：IP)报文转发模块、DLP预处理模块、应用(英文：Application，简称：APP)代理入口、APP代理出口、TCP代理与安全套接字层(英文：Secure Sockets Layer，简称：SSL)卸载模块、深度包检测(英文：Deep Packet Inspection，简称：DPI)引擎、DLP业务扫描模块和DLP通信模块等。
其中，驱动模块用于，将网卡接收到IP报文映射至用户态缓存器中。
IP报文转发模块用于，转发IP报文。IP报文转发模块可以实现完整的DLP设备的IP报文的转发功能。
DLP预处理模块用于，对IP报文分片进行重组、TCP报文分片进行重组 等报文预处理操作。
TCP代理与SSL卸载模块用于，管理TCP用户态协议栈和开放式安全套接字层(英文：Open Secure Sockets Layer，简称：OpenSSL)密码库。
中间缓存用于，缓存DLP设备在处理IP报文的过程中产生的数据。
TCP入口用于，在DLP设备接收到IP报文时，为APP代理入口提供IP报文对应的结构体，其中，IP报文包括该TCP入口的TCP端口信息。
TCP出口用于，在DLP设备发送IP报文时，为APP代理出口提供TCP入口的TCP端口信息。
APP代理入口用于，调用TCP用户态协议栈建立TCP入口和TCP出口；接收IP报文转发模块通过TCP入口向APP代理入口发送的IP报文对应的结构体；调用OpenSSL密码库，对IP报文的用户数据解密，将解密后得到的用户数据缓存至中间缓存；向DPI引擎发送结构体。
DPI引擎用于，接收APP代理入口发送的结构体，对IP报文进行协议分析，确定用于传输IP报文的应用层协议，并还原IP报文包括的用户数据。
DLP业务扫描模块用于，接收DPI引擎发送的扫描消息，对DLP业务进行扫描处理。具体的，从安全策略中，查找与用户数据匹配的目标匹配项；根据目标匹配项对应的动作项，向APP代理出口发送对应的消息。
APP代理出口用于，接收DLP业务扫描模块发送的消息，调用TCP出口，指示IP报文转发模块转发报文，或释放缓存的IP报文。
DLP通信模块用于，获取DLP业务扫描模块对DLP业务进行扫描处理后的处理结果，向DLP管理平台发送处理结果；接收DLP管理平台发送的安全策略。
在本申请实施例中，DLP设备在确定用于传输IP报文的应用层协议被监听时，基于IP报文包括的TCP端口信息，建立DLP设备与用户设备之间的第一TCP连接，以及DLP设备与服务器之间的第二TCP连接，进而依据第一TCP连接和第二TCP连接，实现对用户设备的数据泄露防护。
可见，DLP设备在实现数据泄露防护的过程中，实现了对任一TCP端口的监听。另外，DLP设备也无需设置额外的网桥和防火墙规则，解决了由网桥瘫痪甚至内核崩溃引起的用户无法访问网络的问题。
下面通过具体实施例，对本申请实施例提供的DLP设备进行说明。
参考图2，图2为本申请实施例提供的一种DLP设备的示意图。该DLP设备包括：网卡104、驱动模块100、转发模块101、代理模块102和DPI模块103。其中，驱动模块100、转发模块101、代理模块102和DPI模块103可以为软件模块，即由中央处理器(英文：Central Processing Unit，简称：CPU)运行软件程序实现的模块。上述转发模块101即为图1中的IP报文转发模块。上述代理模块102包括图1中的APP代理出口和APP代理入口。上述DPI模块103包括图1中的DPI引擎和DLP业务扫描模块。
其中，网卡104用于，接收用户设备发送的IP报文，并向驱动模块100发送IP报文。IP报文包括IP头部、TCP头部等信息。其中，TCP头部包括TCP端口信息。IP报文可以为协议报文，也可以为数据报文。
驱动模块100用于，接收IP报文，并将IP报文缓存至用户态缓存器。
本申请实施例中，缓存器包括内核态缓存器和用户态缓存器。DLP设备向内核态缓存器缓存数据的速率高于向用户态缓存器缓存数据的速率。上层应用可直接访问用户态缓存器中存储的数据，但无法直接访问内核态缓存器中存储的数据。
一个示例中，驱动模块100接收IP报文，可以将IP报文先存储至内核态缓存器。之后，驱动模块100再将IP报文从内核态缓存器拷贝至用户态缓存器中。
另一个示例中，驱动模块100接收IP报文，可以将IP报文存储至用户态缓存器。这样，驱动模块100不必将IP报文从内核态缓存器拷贝至用户态缓存器，有效提高了报文处理效率。
一个示例中，驱动模块100可以采用CPU提供的零拷贝技术驱动模块，如数据平面开发套件(英文：Data Plane Development Kit，简称：DPDK)驱动模块，这可以实现将接收的IP报文，跳过内核态缓存器，直接缓存至用户态缓存器。
转发模块101用于，从用户态缓存器读取IP报文，形成与IP报文对应的结构体，并向代理模块102发送结构体。
本申请实施例中，转发模块101用于实现IP报文的转发，并在转发的各 个阶段调用上层业务端口对IP报文进行处理。
具体的，转发模块101可以从用户态缓存器读取IP报文，对IP报文进行分析，形成与IP报文对应的结构体。其中，IP报文的结构体可以包括IP报文的IP头部信息、TCP头部信息、IP报文的存储位置等。转发模块101将IP报文对应的结构体发送给代理模块102。
代理模块102用于，接收转发模块101发送的IP报文对应的结构体；根据IP报文对应的结构体，获取TCP端口信息；根据TCP端口信息，检测DLP设备与用户设备之间是否建立第一TCP连接；若未建立第一TCP连接，则在IP报文是数据报文时，向DPI模块103发送IP报文对应的结构体。
代理模块102接收到转发模块101上送的结构体后，可以从结构体中获取到TCP端口信息；也可以基于结构体确定IP报文的存储位置，并根据存储位置，找到IP报文，从IP报文中提取到TCP端口信息。代理模块102根据TCP端口信息，检测DLP设备与用户设备之间是否建立第一TCP连接。
在一个可选的实施例中，DLP设备可以设置TCP连接列表。TCP连接列表包括：DLP设备与用户设备之间建立的TCP连接的TCP端口信息。基于此，上述代理模块102根据TCP端口信息，检测DLP设备与用户设备之间是否建立第一TCP连接的过程，可通过下述方式实现。
具体地，代理模块102根据获取的TCP端口信息，检测TCP连接列表中是否包括该TCP端口信息。若包括，则代理模块102确定DLP设备与用户设备之间建立了第一TCP连接。若未包括，则代理模块102确定DLP设备与用户设备之间未建立第一TCP连接。
若已建立第一TCP连接，则代理模块102向DPI模块103发送IP报文对应的结构体。DPI模块103根据IP报文对应的结构体，对IP报文进行协议识别。
若未建立第一TCP连接，则代理模块102检测IP报文的报文类型，即检测IP报文为协议报文，还是数据报文。在本申请实施例中，协议报文可具体为握手报文，握手报文为用于建立设备之间TCP连接的报文。下述实施例以协议报文是握手报文为例进行说明。
如果代理模块102检测到IP报文是数据报文，则代理模块102向DPI模 块103发送IP报文对应的结构体。
DPI模块103用于，接收代理模块102发送的IP报文对应的结构体；根据IP报文对应的结构体，获取IP报文的报文特征；通过将IP报文的报文特征与各个应用层协议对应的报文特征匹配，确定用于传输IP报文的应用层协议；当用于传输IP报文的应用层协议被监听时，向代理模块102发送第一消息。
其中，第一消息指示：用于传输IP报文的应用层协议被监听。IP报文的报文特征可以包括：IP报文的五元组信息、报文的长度、特征关键字等。
DPI模块103接收到IP报文对应的结构体后，对IP报文进行协议识别。具体的，DPI模块103根据IP报文对应的结构体，确定IP报文的存储位置，并根据存储位置，找到IP报文，获取IP报文的报文特征；通过将IP报文的报文特征与各个应用层协议对应的报文特征匹配，确定用于传输IP报文的应用层协议。
本申请实施例中，DLP设备中预先已配置了各个应用层协议对应的报文特征。例如，应用层协议有协议1和协议2。DLP设备中预先已配置了各个应用层协议对应的报文特征包括：协议1对应的报文特征为x和xx，协议2对应的报文特征为y和yy。若DPI模块103获取到一个IP报文的报文特征为x和xx，则确定该IP报文的报文特征与协议1对应的报文特征匹配，协议1为用于传输该IP报文的应用层协议。
DPI模块103在确定用于传输IP报文的应用层协议后，检测用于传输IP报文的应用层协议是否为预设的被监听的应用层协议。若是，则DPI模块103向代理模块102发送第一消息。
其中，作为示例而非限定，第一消息可以为一个函数返回值。该函数返回值具体为DPI模块103和代理模块102在先协商的结果。例如，0表示被监听，1表示未被监听。若DPI模块103确定用于传输IP报文的应用层协议被监听，则向代理模块102发送函数值0。
上述函数可以为Fun()函数、get()函数等。本申请实施例对此不做具体限定。本申请实施例中，仅以0表示被监听，1表示未被监听为例进行说明，并不起限定作用。例如，还可以以3表示被监听，4表示未被监听。
代理模块102还用于，在接收到第一消息后，根据IP报文的TCP端口信息，建立TCP连接对。其中，TCP连接对包括第一TCP连接，以及DLP设备与所述服务器之间的第二TCP连接。
代理模块102接收到第一消息后，确定用于传输IP报文的应用层协议被监听，利用TCP用户态协议栈，根据IP报文的TCP端口信息，与用户设备建立第一TCP连接，并且与服务器建立第二TCP连接。
可以理解的是，建立第一TCP连接所使用的TCP端口信息与IP报文包括的TCP端口信息相同；同理，建立第二TCP连接所使用的TCP端口信息与IP报文包括的TCP端口信息也相同。即使DLP设备将用户设备与服务器间的TCP连接划分为了第一TCP连接和第二TCP连接，即DLP设备打断用户设备与服务器间的TCP连接，也不会改变用户设备发送的IP报文的TCP端口等信息，降低了服务器发现IP报文被代理的风险。
在本申请实施例中，对于DLP设备建立的TCP连接，如上述第一TCP连接和第二TCP连接，DLP设备均可监听用于建立这些TCP连接的TCP端口。基于此，DLP设备在实现数据泄露防护的过程中，不再对指定的TCP端口进行监听，实现了对任一TCP端口的监听。
可选地，在本申请实施例中，代理模块102在检测IP报文的报文类型的过程中，如果确定IP报文是协议报文(例如，握手报文)，则向转发模块101发送第二消息。
其中，第二消息指示：IP报文为协议报文。
转发模块101在接收到第二消息后，根据第二消息，确定IP报文是协议报文。转发模块101从用户态缓存器中读取IP报文，并向服务器发送该IP报文。服务器根据该IP报文与用户设备建立TCP连接。这样，减少了DLP设备处理的报文数量，降低了DLP设备的负担，且用户设备直接与服务器建立TCP连接，降低了服务器发现IP报文被代理的风险。
其中，作为示例而非限定，第二消息可以为一个函数返回值。该函数返回值具体为代理模块102和转发模块101在先协商的结果。例如，0表示IP报文是协议报文，1表示IP报文是数据报文。若DPI模块103检测到IP报文为协议报文，则向代理模块102发送函数值0。若DPI模块103检测到IP报 文为数据报文，则向代理模块102发送函数值1。
上述函数可以为Fun()函数、get()函数等。本申请实施例对此不做具体限定。本申请实施例中，仅以0表示IP报文是协议报文，1表示IP报文是数据报文为例进行说明，并不起限定作用。例如，还可以以3表示IP报文是协议报文，4表示IP报文是数据报文。
可选地，在本申请实施例中，DPI模块103还用于执行深度包检测步骤，进而实现数据泄露防护。
具体地，IP报文还包括第一用户数据。首先，在DPI模块103确定用于传输IP报文的应用层协议被监听时，DPI模块103对第一用户数据的位置进行标记。也即是，DPI模块103对第一用户数据在IP报文中所处的具体字节标记。
然后，DPI模块103对IP报文进行解封装处理，得到去掉封装头部的内层报文。DPI模块103获取并缓存与所标记的位置对应的第一用户数据。其中，与第一用户数据的位置对应的第一用户数据为：IP报文中，在第一用户数据的位置处的用户数据。
最后，DPI模块103获取预设的安全策略，安全策略包括匹配项和动作项。DPI模块103从安全策略中，查找与第一用户数据匹配的目标匹配项，并执行目标匹配项对应的动作项。
可选地，在本申请实施例中，DPI模块103还用于执行判断是否接收到属于同一原始数据的用户数据的步骤，进而实现准确的对原始数据进行深度包检测。
具体地，DPI模块103判断是否已接收到属于同一原始数据的全部用户数据。若已接收到属于同一原始数据的全部用户数据，即还原出原始数据，则DPI模块103获取预设的安全策略，从安全策略中，查找与用户数据匹配的目标匹配项。若未接收到属于同一原始数据的全部用户数据，则DPI模块103重复执行判断是否已接收到属于同一原始数据的全部用户数据的过程。
可以理解的是，发送端将待传输的原始数据放在一个应用层报文中进行传输。当待传输的原始数据的长度(或字节数)较大时，发送端需对应用层报文进行分片处理。也就是，发送端将一个应用层报文划分为多个IP包进行 传输。上述一个IP包即为一个IP报文。接收端在接收到应用层报文的全部IP报文分片后，还原出待传输的原始数据。其中，应用层报文包括超文本传输协议(英文：Hyper Text Transport Protocol，简称：HTTP)报文、简单邮件传输协议(英文：Simple Mail Transfer Protocol，简称：SMTP)报文和文件传输协议(英文：File Transfer Protocol，简称：FTP)报文等。
一个示例中，DPI模块103可采用如下方式判断是否已接收到属于同一原始数据的全部用户数据。
具体的，一个应用层报文划分为多个IP报文时，第一个IP报文中携带有应用层报文的起始标记，最后一个IP报文中携带有应用层报文的结束标记。DPI模块103获取到属于同一应用层报文的起始标记和结束标记时，DPI模块103可确定接收到一个完整的应用层报文，进而确定接收到属于同一原始数据的全部用户数据。
例如，如图3所示的HTTP报文的处理流程。一个HTTP报文被划分为多个IP报文，DLP设备接收到第一个IP报文时，DPI模块103从第一个IP报文中提取到起始标记。可以理解的是，在HTTP报文传输时，设备只有将HTTP报文的一个IP报文放行，并接收到该IP报文对应的响应报文后，才会发送HTTP报文的下一个IP报文。
因此，DPI模块103缓存第一个IP报文中的用户数据，并放行第一个IP报文。同理，DLP设备接收到HTTP报文的最后一个IP报文前，缓存HTTP报文中每一个IP报文中的用户数据，并放行HTTP报文中每一个IP报文。DLP设备接收到HTTP报文的最后一个IP报文后，DPI模块103从HTTP报文的最后一个IP报文中提取到结束标记。此时，DPI模块103确定接收到完整的HTTP报文，即接收到属于同一原始数据的全部用户数据。DPI模块103获取预设的安全策略，从安全策略中，查找与原始数据匹配的目标匹配项，并执行目标匹配项对应的动作项。
可选地，在本申请实施例中，安全策略包括的动作项有两种动作类型，即报文放行和报文阻断。
在一种实现方式中，当目标匹配项对应的动作项为报文放行时，则DPI模块103向代理模块102发送第三消息。第三消息指示：放行IP报文，且第 三消息包括第一用户数据的第一存储位置。
代理模块102接收到第三消息后，确定放行IP报文，根据第一存储位置查找第一用户数据。代理模块102根据第二TCP连接的TCP端口信息，对第一用户数据进行封装处理，得到第二用户数据。第二用户数据包括TCP头部以及第一用户数据。代理模块102向转发模块101发送第四消息。第四消息指示：放行IP报文，且第四消息包括第二用户数据的第二存储位置。
转发模块101接收到第四消息后，确定放行IP报文，根据第二存储位置，查找第二用户数据。转发模块101对第二用户数据进行封装处理，得到IP报文，并向服务器发送IP报文。可以理解的是，转发模块101对第二用户数据进行封装处理得到的IP报文与上述网卡104接收到的IP报文相同。
在另一种实现方式中，当目标匹配项对应的动作项为报文阻断时，则DPI模块103向代理模块102发送第五消息，第五消息指示：阻断IP报文，且第五消息包括第一用户数据的第一存储位置和第一阻断数据。其中，第一阻断数据可以为DLP设备预先设置的一个字符串。
代理模块102接收到第五消息后，根据第一存储位置，查找并释放第一用户数据。另外，代理模块102根据第一TCP连接的TCP端口信息，对第一阻断数据进行封装处理，得到第二阻断数据，第二阻断数据包括TCP头部以及第一阻断数据。代理模块102向转发模块101发送第二阻断数据。
转发模块101接收到第二阻断数据后，对第二阻断数据进行封装处理，得到阻断报文。转发模块101代替服务器，向用户设备发送阻断报文。一个示例中，阻断报文可以为“403禁用(Forbidden)”阻断报文。其中，“403禁用(Forbidden)”可以理解为第一阻断数据。
用户设备接收到阻断报文后，可确定本次访问失败，访问数据出现错误。
其中，作为示例而非限定，第三消息和第五消息可以为一函数返回值。该函数返回值为DPI模块103和代理模块102在先协商的结果。例如，3表示放行报文，4表示阻断报文。若DPI模块103确定目标匹配项对应的动作项为报文放行，则向代理模块102发送函数值3。若DPI模块103确定目标匹配项对应的动作项为报文阻断，则向代理模块102发送函数值4。
上述函数可以为Fun()函数、get()函数等。本申请实施例对此不做具体限 定。本申请实施例中，仅以3表示放行报文，4表示阻断报文为例进行说明，并不起限定作用。例如，还可以以1表示放行报文，0表示阻断报文。
同理，第四消息可以为一函数返回值。该函数返回值为转发模块101和代理模块102在先协商的结果。例如，3表示放行报文，4表示阻断报文。若代理模块102接收到第三消息后，向转发模块101发送函数值3。若代理模块102接收到第五消息，向转发模块101发送函数值4。
上述函数可以为Fun()函数、get()函数等。本申请实施例对此不做具体限定。本申请实施例中，仅以3表示放行报文，4表示阻断报文为例进行说明，并不起限定作用。例如，还可以以1表示放行报文，0表示阻断报文。
可选地，在本申请实施例中，DPI模块103还用于执行当用于传输所述IP报文的应用层协议未被监听时，向代理模块102发送第六消息的过程，进而实现快速地转发IP报文。
具体的，当用于传输IP报文的应用层协议未被监听时，DPI模块103向代理模块102发送第六消息。第六消息指示：用于传输IP报文的应用层协议未被监听。
代理模块102接收并向转发模块101发送第六消息。转发模块101接收到第六消息后，根据第六消息，确定用于传输IP报文的应用层协议未被监听，从用户态缓存器中读取出IP报文，并向服务器发送IP报文。此时，DPI模块103未对IP报文进行深度包检测，提高了IP报文的转发效率。
其中，作为示例而非限定，第六消息可以为一个函数返回值。该函数返回值具体为DPI模块103和代理模块102在先协商的结果。例如，0表示被监听，1表示未被监听。若DPI模块103确定用于传输IP报文的应用层协议未被监听，则向代理模块102发送函数值1。
可选地，在本申请实施例中，如图4所示，DPI模块103可以包括DPI协议解析子模块1031、数据还原子模块1032和DLP业务扫描子模块1033。基于图4所示的DLP设备，IP报文的处理流程如图5所示。
具体的，驱动模块100接收IP报文，并将IP报文缓存至用户态缓存器。
转发模块101从用户态缓存器读取IP报文，形成与IP报文对应的结构体，并向代理模块102发送结构体。
代理模块102接收结构体，根据结构体，获取TCP端口信息；根据TCP端口信息，检测DLP设备与用户设备之间是否建立第一TCP连接；若未建立第一TCP连接，则在IP报文是数据报文时，向DPI协议解析子模块1031发送结构体。
DPI协议解析子模块1031接收代理模块102发送的结构体。根据结构体确定IP报文的存储位置，并根据存储位置，找到IP报文。在传统的应用层协议识别的基础上，DPI协议解析子模块1031对IP报文进行协议识别，并确定用于传输IP报文的应用层协议。DPI协议解析子模块1031判断用于传输IP报文的应用层协议是否被监听。若用于传输IP报文的应用层协议被监听，则DPI协议解析子模块1031分析并标记IP报文包括的第一用户数据的位置，并向数据还原子模块1032发送标记的第一用户数据的位置。
数据还原子模块1032对IP报文进行解封装处理，获取并缓存与所标记的位置对应的第一用户数据。数据还原子模块1032判断是否已接收到属于同一原始数据的全部用户数据。若未接收到属于同一原始数据的全部用户数据，数据还原子模块1032缓存第一用户数据。若已接收到属于同一原始数据的全部用户数据，数据还原子模块1032调用DLP业务扫描子模块1033注册的端口，向DLP业务扫描子模块1033发送扫描消息。扫描消息包括第一用户数据的第一存储位置。
DLP业务扫描子模块1033接收到扫描消息后，根据第一存储位置获取第一用户数据。DLP业务扫描子模块1033获取预设的安全策略，从安全策略中，查找与第一用户数据匹配的目标匹配项，根据目标匹配项对应的动作项，向代理模块102发送相应的消息。
例如，当目标匹配项对应的动作项为报文放行时，DLP业务扫描子模块1033向代理模块102发送第三消息。当目标匹配项对应的动作项为报文阻断时，DLP业务扫描子模块1033向代理模块102发送第五消息。
可选的，本申请实施例中，DLP业务扫描子模块1033查找到与第一用户数据匹配的目标匹配项后，向DPI协议解析子模块1031发送目标匹配项对应的动作项。DPI协议解析子模块1031向代理模块102发送相应的消息。
例如，当目标匹配项对应的动作项为报文放行时，DPI协议解析子模块 1031向代理模块102发送第三消息。当目标匹配项对应的动作项为报文阻断时，DPI协议解析子模块1031向代理模块102发送第五消息。
若代理模块102接收到第三消息，则根据第一用户数据的第一存储位置，查找第一用户数据；根据第二TCP连接的TCP端口信息，对第一用户数据进行封装处理，得到第二用户数据，第二用户数据包括TCP头部以及第一用户数据，并向转发模块101发送第四消息。转发模块101接收第四消息，根据第二用户数据的第二存储位置，查找第二用户数据；对第二用户数据进行封装处理，得到IP报文，并向服务器发送IP报文。
若代理模块102接收到第五消息，则根据第一用户数据的第一存储位置，释放第一用户数据；根据第一TCP连接的TCP端口信息，对第一阻断数据进行封装处理，得到第二阻断数据，第二阻断数据包括TCP头部以及第一阻断数据；向转发模块101发送第二阻断数据。转发模块101接收第二阻断数据；对第二阻断数据进行封装处理，得到阻断报文；向用户设备发送阻断报文。
若代理模块102检测到DLP设备与用户设备之间未建立第一TCP连接，则在IP报文是握手报文时，向转发模块101发送第二消息。
转发模块101接收第二消息，根据第二消息，向服务器发送IP报文。
DPI协议解析子模块1031若确定用于传输IP报文的应用层协议未被监听，则向代理模块102发送第六消息。
代理模块102接收并向转发模块101发送第六消息。
转发模块101接收第六消息，根据第六消息向服务器发送IP报文。
为便于理解，结合图6所示的代理模块102的报文处理过程示意图，对代理模块102处理流程进行解释说明。
步骤601，代理模块102接收转发模块101发送的结构体，根据结构体，获取TCP端口信息。
步骤602，代理模块102根据TCP端口信息，检测DLP设备与用户设备之间是否建立第一TCP连接。若未建立第一TCP连接，则执行步骤603。若建立第一TCP连接，则执行步骤605。
步骤603，代理模块102检测IP报文是否是握手报文。若是握手报文，则执行步骤604。若不是握手报文，也就是IP报文是数据报文，则执行步骤 605。
步骤604，代理模块102向转发模块101发送第二消息。
转发模块101接收到第二消息后，根据第二消息，向服务器发送IP报文。
步骤605，代理模块102向DPI模块103发送结构体。
DPI模块103根据结构体，获取IP报文的报文特征。DPI模块103通过将IP报文的报文特征与各个应用层协议对应的报文特征匹配，确定用于传输IP报文的应用层协议。当用于传输IP报文的应用层协议被监听时，DPI模块103向代理模块102发送第一消息。当用于传输IP报文的应用层协议未被监听时，DPI模块103向代理模块102发送第六消息。
步骤606，代理模块102若接收到第六消息，确定用于传输IP报文的应用层协议未被监听，执行步骤607。若接收到第一消息，确定用于传输IP报文的应用层协议被监听，执行步骤608。
步骤607，代理模块102向转发模块101发送第六消息。
转发模块101接收到第六消息后，根据第六消息，向服务器发送IP报文。
步骤608，代理模块102根据TCP端口信息，建立TCP连接对，TCP连接对包括第一TCP连接以及第二TCP连接。
上述步骤601-608部分的描述比较简单，具体的可参考图1-5部分的相关描述。
为便于理解，结合图7所示的DLP业务扫描子模块1033、代理模块102的报文处理过程意图，对报文处理流程进行解释说明。
步骤701，DLP业务扫描子模块1033接收数据还原子模块1032发送的扫描消息。
步骤702，DLP业务扫描子模块1033根据扫描消息，获取预设的安全策略，从安全策略中，查找与第一用户数据匹配的目标匹配项。
步骤703，DLP业务扫描子模块1033若未查找目标匹配项，则执行步骤704。若查找目标匹配项，则执行步骤706。
步骤704，DLP业务扫描子模块1033调用代理模块102，向代理模块102发送第三消息。
步骤705，代理模块102查找第一用户数据；根据第二TCP连接的TCP 端口信息，对第一用户数据进行封装处理，得到第二用户数据，并向转发模块101发送第四消息。
步骤706，DLP业务扫描子模块1033若确定目标匹配项对应的动作项为报文放行，则执行步骤704。DLP业务扫描子模块1033若确定目标匹配项对应的动作项为报文阻断，则执行步骤707。
步骤707，DLP业务扫描子模块1033调用代理模块102，向代理模块102发送第五消息。
步骤708，代理模块102释放第一用户数据；根据第一TCP连接的TCP端口信息，对第一阻断数据进行封装处理，得到第二阻断数据；向转发模块101发送第二阻断数据。
上述步骤701-708部分的描述比较简单，具体的可参考图1-5部分的相关描述。
可选地，在本申请实施例中，代理模块102还可以用于在IP报文为SSL协议的加密报文时，执行建立SSL协议连接的过程。通过建立SSL协议连接，实现对SSL协议的加密报文包括的用户数据进行解密处理，得到明文的用户数据，进而实现数据泄露防护的过程。
具体的，若IP报文为SSL协议的加密报文，则代理模块102分别调用OpenSSL密码库的第一接口和第二接口。代理模块102将调用的第一接口与第一TCP连接绑定，并将调用的第二接口与第二TCP连接绑定，从而完成SSL协议连接的建立。
代理模块102接收到IP报文对应的结构体后，根据结构体确定IP报文的存储位置，并根据存储位置，找到IP报文。代理模块102基于第一TCP连接绑定的第一接口调用OpenSSL密码库，对IP报文包括的用户数据进行解密处理，得到明文的用户数据。代理模块102将明文的用户数据的存储位置发送给DPI模块103。
代理模块102在接收到DPI模块103发送的第三消息后，基于第二TCP连接绑定的第二接口调用OpenSSL密码库，对IP报文包括的用户数据进行加密处理，得到密文的用户数据，并对密文的用户数据进行封装处理。
若代理模块102接收到IP报文是明文报文，如HTTP报文、SMTP报文 和FTP报文等，则代理模块102可不对IP报文进行处理。
基于上述提供的DLP设备实施例，本申请实施例还提供了一种报文处理方法。参考图8，图8为本申请实施例提供的一种报文处理方法的流程示意图。该方法应用于DLP设备，该报文处理方法包括如下步骤。
步骤801，接收用户设备发送的IP报文。
其中，IP报文包括IP头部、TCP头部等信息。其中，TCP头部包括TCP端口信息。IP报文可以为协议报文，也可以为数据报文。
DLP设备设置在用户设备和服务器之间。用户设备通过DLP设备向服务器发送IP报文。
步骤802，根据TCP端口信息，检测DLP设备与用户设备之间是否建立第一TCP连接。若未建立第一TCP连接，则DLP设备执行步骤803。
DLP设备接收到IP报文后，获取IP报文的TCP端口信息。DLP设备根据获取的TCP端口信息，检测DLP设备与用户设备之间是否建立第一TCP连接。若未建立第一TCP连接，则DLP设备执行步骤803。
步骤803，在IP报文是数据报文时，通过将IP报文的报文特征与各个应用层协议对应的报文特征匹配，确定用于传输IP报文的应用层协议。
DLP设备若检测到未建立第一TCP连接，则检测IP报文的报文类型，即检测IP报文是数据报文，还是协议报文。在本申请实施例中，协议报文可具体为握手报文，下述实施例以握手报文为例进行说明。若检测到IP报文是数据报文，则DLP设备通过将IP报文的报文特征与各个应用层协议对应的报文特征匹配，确定用于传输IP报文的应用层协议。
步骤804，当用于传输IP报文的应用层协议被监听时，根据TCP端口信息，建立TCP连接对，TCP连接对包括第一TCP连接，以及DLP设备与服务器之间的第二TCP连接。
当用于传输IP报文的应用层协议被监听时，DLP设备根据TCP端口信息，与用户设备建立第一TCP连接。DLP设备根据TCP端口信息，与服务器建立第二TCP连接。DLP设备后续通过第一TCP连接和第二TCP连接传输IP报文，不改变IP报文的TCP端口信息，降低了服务器发现IP报文被代理的风险。
可选地，在本申请实施例中，在IP报文是协议报文，如握手报文时，DLP设备放行IP报文，即向服务器发送IP报文。服务器根据IP报文，与用户设备建立TCP连接。这样，减少了DLP设备处理的报文数量，降低了DLP设备的负担，且用户设备直接与服务器建立TCP连接，降低了服务器发现IP报文被代理的风险。
可选地，在本申请实施例中，若DLP设备检测到建立了第一TCP连接，则通过将IP报文的报文特征与各个应用层协议对应的报文特征匹配，确定用于传输IP报文的应用层协议。DLP设备不需要检测IP报文的报文类型，减小了DLP设备的负担。
可选地，在本申请实施例中，当用于传输IP报文的应用层协议未被监听时，DLP设备放行IP报文，即向服务器发送IP报文。DLP设备不对IP报文进行处理，降低了DLP设备的负担。
可选地，在本申请实施例中，在IP报文是数据报文时，DLP设备还可以对IP报文包括的第一用户数据的位置进行标记，对IP报文进行解封装处理，获取并缓存与所标记的位置对应的第一用户数据。DLP设备获取预设的安全策略。安全策略包括匹配项和动作项。DLP设备从安全策略中，查找与第一用户数据匹配的目标匹配项，并执行目标匹配项对应的动作项。
其中，动作项包括报文放行和报文阻断。一个示例中，当目标匹配项对应的动作项为报文放行时，DLP设备根据第二TCP连接的TCP端口信息，对第一用户数据进行封装处理，得到IP报文，向服务器发送IP报文。
具体的，当目标匹配项对应的动作项为报文放行时，DLP设备根据第二TCP连接的TCP端口信息，对第一用户数据进行封装处理，得到第二用户数据，第二用户数据包括TCP头部以及第一用户数据。之后，DLP设备对第二用户数据进行封装处理，得到IP报文，向服务器发送IP报文。
另一个示例中，当目标匹配项对应的动作项为报文阻断时，DLP设备根据第一TCP连接的TCP端口信息，生成阻断报文。DLP设备代替服务器，向用户设备发送阻断报文，提高了网络的安全性。
可选地，在本申请实施例中，若IP报文为采用SSL协议的加密报文，为了准确的对用户数据进行数据泄露防护处理，DLP设备分别调用OpenSSL密 码库的第一接口以及第二接口，将调用的第一接口与第一TCP连接绑定，并将调用的第二接口与第二TCP连接绑定。这样DLP设备就可以完成对用户数据的SSL加解密的过程，能够得到明文的用户数据，正确的对用户数据进行数据泄露防护处理。
本申请实施例提供的技术方案中，DLP设备在确定用于传输IP报文的应用层协议被监听时，基于IP报文包括的TCP端口信息，建立DLP设备与用户设备之间的第一TCP连接，以及DLP设备与服务器之间的第二TCP连接，进而依据第一TCP连接和第二TCP连接，实现对用户设备的数据泄露防护。可见，在本申请实施例中，DLP设备在实现数据泄露防护的过程中，实现了对任一TCP端口的监听。另外，DLP设备无需设置额外的网桥和防火墙规则，解决了由网桥瘫痪甚至内核崩溃引起的用户无法访问网络的问题。
需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
本说明书中的各个实施例均采用相关的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于方法实施例而言，由于其基本相似于DLP设备实施例，所以描述的比较简单，相关之处参见DLP设备实施例的部分说明即可。
以上所述仅为本申请的较佳实施例而已，并非用于限定本申请的保护范围。凡在本申请的精神和原则之内所作的任何修改、等同替换、改进等，均包含在本申请的保护范围内。

Claims (15)

  1. 一种数据泄露防护DLP设备，所述DLP设备包括：
    网卡用于，接收用户设备发送的网络协议IP报文，并向驱动模块发送所述IP报文，所述IP报文包括传输控制协议TCP端口信息；
    所述驱动模块用于，接收所述IP报文，并将所述IP报文缓存至用户态缓存器；
    转发模块用于，从所述用户态缓存器读取所述IP报文，形成与所述IP报文对应的结构体，并向代理模块发送所述结构体；
    所述代理模块用于，接收所述结构体；根据所述结构体，获取所述TCP端口信息；根据所述TCP端口信息，检测所述DLP设备与所述用户设备之间是否建立第一TCP连接；若未建立所述第一TCP连接，则在所述IP报文是数据报文时，向深度包检测DPI模块发送所述结构体；
    所述DPI模块用于，接收所述结构体；根据所述结构体，获取所述IP报文的报文特征；通过将所述IP报文的报文特征与各个应用层协议对应的报文特征匹配，确定用于传输所述IP报文的应用层协议；当用于传输所述IP报文的应用层协议被监听时，向所述代理模块发送第一消息；
    所述代理模块还用于，在接收到所述第一消息后，根据所述TCP端口信息，建立TCP连接对，所述TCP连接对包括所述第一TCP连接，以及所述DLP设备与服务器之间的第二TCP连接。
  2. 根据权利要求1所述的DLP设备，所述代理模块还用于，在所述IP报文是协议报文时，则向所述转发模块发送第二消息；
    所述转发模块还用于，接收所述第二消息；根据所述第二消息，向所述服务器发送所述IP报文，以使所述服务器根据所述IP报文与所述用户设备建立TCP连接。
  3. 根据权利要求1所述的DLP设备，所述DPI模块还用于，
    对所述IP报文包括的第一用户数据的位置进行标记；
    对所述IP报文进行解封装处理，获取并缓存与所标记的位置对应的所述第一用户数据；
    获取预设的安全策略，所述安全策略包括匹配项和动作项；
    从所述安全策略中，查找与所述第一用户数据匹配的目标匹配项，并执行所述目标匹配项对应的动作项。
  4. 根据权利要求3所述的DLP设备，所述DPI模块具体用于，
    当所述目标匹配项对应的动作项为报文放行时，则向所述代理模块发送第三消息，所述第三消息包括所述第一用户数据的第一存储位置；
    所述代理模块还用于，接收所述第三消息；根据所述第一存储位置，查找所述第一用户数据；根据所述第二TCP连接的TCP端口信息，对所述第一用户数据进行封装处理，得到第二用户数据，所述第二用户数据包括TCP头部以及所述第一用户数据，并向所述转发模块发送所述第四消息，所述第四消息包括所述第二用户数据的第二存储位置；
    所述转发模块还用于，接收所述第四消息；根据所述第二存储位置，查找所述第二用户数据；对所述第二用户数据进行封装处理，得到所述IP报文，并向所述服务器发送所述IP报文。
  5. 根据权利要求3所述的DLP设备，所述DPI模块具体用于，
    当所述目标匹配项对应的动作项为报文阻断时，则向所述代理模块发送第五消息，所述第五消息包括所述第一用户数据的第一存储位置和第一阻断数据；
    所述代理模块还用于，接收所述第五消息；根据所述第一存储位置，释放所述第一用户数据；根据所述第一TCP连接的TCP端口信息，对所述第一阻断数据进行封装处理，得到第二阻断数据，所述第二阻断数据包括TCP头部以及所述第一阻断数据；向所述转发模块发送所述第二阻断数据；
    所述转发模块还用于，接收所述第二阻断数据；对所述第二阻断数据进行封装处理，得到阻断报文；向所述用户设备发送所述阻断报文。
  6. 根据权利要求3所述的DLP设备，所述DPI模块具体用于，
    判断是否已接收到属于同一原始数据的全部用户数据；
    若已接收到属于同一原始数据的全部用户数据，则获取预设的安全策略。
  7. 根据权利要求3-6任一项所述的DLP设备，所述DPI模块还用于，当用于传输所述IP报文的应用层协议未被监听时，向所述代理模块发送第六消息；
    所述代理模块还用于，接收并向所述转发模块发送所述第六消息；
    所述转发模块还用于，接收所述第六消息；根据所述第六消息向所述服务器发送所述IP报文。
  8. 根据权利要求1所述的DLP设备，所述代理模块还用于，
    若所述IP报文为采用安全套接字层SSL协议的加密报文，则分别调用开放式安全套接字层OpenSSL密码库的第一接口以及第二接口；
    将调用的第一接口与所述第一TCP连接绑定，将调用的第二接口与所述第二TCP连接绑定。
  9. 一种报文处理方法，应用于数据泄露防护DLP设备，包括：
    接收用户设备发送的网络协议IP报文，所述IP报文包括传输控制协议TCP端口信息；
    根据所述TCP端口信息，检测所述DLP设备与所述用户设备之间是否建立第一TCP连接；
    若未建立所述第一TCP连接，则在所述IP报文是数据报文时，将所述IP报文的报文特征与各个应用层协议对应的报文特征匹配，确定用于传输所述IP报文的应用层协议；
    当用于传输所述IP报文的应用层协议被监听时，根据所述TCP端口信息，建立TCP连接对，所述TCP连接对包括所述第一TCP连接，以及所述DLP设备与服务器之间的第二TCP连接。
  10. 根据权利要求9所述的方法，所述方法还包括：
    在所述IP报文是协议报文时，向所述服务器发送所述IP报文，以使所述服务器根据所述IP报文与所述用户设备建立TCP连接。
  11. 根据权利要求9所述的方法，所述方法还包括：
    对所述IP报文包括的第一用户数据的位置进行标记；
    对所述IP报文进行解封装处理，获取并缓存与所标记的位置对应的所述第一用户数据；
    获取预设的安全策略，所述安全策略包括匹配项和动作项；
    从所述安全策略中，查找与所述第一用户数据匹配的目标匹配项，并执行所述目标匹配项对应的动作项。
  12. 根据权利要求11所述的方法，所述执行所述目标匹配项对应的动作项，包括：
    当所述目标匹配项对应的动作项为报文放行时，根据所述第二TCP连接的TCP端口信息，对所述第一用户数据进行封装处理，得到所述IP报文；
    向所述服务器发送所述IP报文。
  13. 根据权利要求11所述的方法，所述执行所述目标匹配项对应的动作 项，包括：
    当所述目标匹配项对应的动作项为报文阻断时，根据所述第一TCP连接的TCP端口信息，生成阻断报文；
    向所述用户设备发送所述阻断报文。
  14. 根据权利要求11所述的方法，所述获取预设的安全策略，包括：
    判断是否已接收到属于同一原始数据的全部用户数据；
    若已接收到属于同一原始数据的全部用户数据，则获取预设的安全策略。
  15. 根据权利要求9所述的方法，所述方法还包括：
    若所述IP报文为采用安全套接字层SSL协议的加密报文，则分别调用开放式安全套接字层OpenSSL密码库的第一接口以及第二接口；
    将调用的第一接口与所述第一TCP连接绑定，将调用的第二接口与所述第二TCP连接绑定。
PCT/CN2020/089040 2019-05-21 2020-05-07 数据泄露防护 WO2020233412A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP20808962.3A EP3890278B1 (en) 2019-05-21 2020-05-07 Data leakage prevention
JP2021565789A JP7395615B2 (ja) 2019-05-21 2020-05-07 データ漏洩防止
US17/423,817 US11973741B2 (en) 2019-05-21 2020-05-07 Data leakage prevention

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910426343.7A CN111988346B (zh) 2019-05-21 2019-05-21 数据泄露防护设备及报文处理方法
CN201910426343.7 2019-05-21

Publications (1)

Publication Number Publication Date
WO2020233412A1 true WO2020233412A1 (zh) 2020-11-26

Family

ID=73436243

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/089040 WO2020233412A1 (zh) 2019-05-21 2020-05-07 数据泄露防护

Country Status (5)

Country Link
US (1) US11973741B2 (zh)
EP (1) EP3890278B1 (zh)
JP (1) JP7395615B2 (zh)
CN (1) CN111988346B (zh)
WO (1) WO2020233412A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111988346B (zh) * 2019-05-21 2021-10-22 新华三信息安全技术有限公司 数据泄露防护设备及报文处理方法
US20220360990A1 (en) * 2021-05-05 2022-11-10 Rohde & Schwarz Gmbh & Co. Kg 4g / 5g core network deep packet inspection system

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110173490A1 (en) * 2010-01-08 2011-07-14 Juniper Networks, Inc. High availability for network security devices
US20160226918A1 (en) * 2010-12-09 2016-08-04 International Business Machines Corporation Method and apparatus for associating data loss protection (DLP) policies with endpoints
US20170041297A1 (en) * 2015-08-05 2017-02-09 Dell Software Inc. Unified source user checking of tcp data packets for network data leakage prevention
CN107592303A (zh) * 2017-08-28 2018-01-16 北京明朝万达科技股份有限公司 一种高速镜像网络流量中外发文件的提取方法及装置
WO2018208552A1 (en) * 2017-05-09 2018-11-15 Cisco Technology, Inc. Routing network traffic based on performance

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4561980B2 (ja) * 2004-11-08 2010-10-13 日本電気株式会社 セッション中継装置およびセッション中継方法
JP4855147B2 (ja) * 2006-05-30 2012-01-18 株式会社Ｉｎｔｏ クライアント装置、メールシステム、プログラム及び記録媒体
JP2010200300A (ja) * 2009-01-28 2010-09-09 Meidensha Corp Ｔｃｐ通信方式
US9210127B2 (en) * 2011-06-15 2015-12-08 Mcafee, Inc. System and method for limiting data leakage
US9350644B2 (en) * 2012-04-13 2016-05-24 Zscaler. Inc. Secure and lightweight traffic forwarding systems and methods to cloud based network security systems
US9264365B2 (en) 2012-07-31 2016-02-16 International Business Machines Corporation Split transport control protocol (TCP) flow control management in a cellular broadband network
JP2016082438A (ja) * 2014-10-17 2016-05-16 日本電気株式会社 通信制御装置、無線通信システム、通信制御方法及び無線基地局
US9509661B2 (en) 2014-10-29 2016-11-29 Aruba Networks, Inc. Method and apparatus for displaying HTTPS block page without SSL inspection
CN105678188B (zh) * 2016-01-07 2019-01-29 杨龙频 数据库防泄露协议识别方法及装置
US10708233B2 (en) * 2017-03-30 2020-07-07 Zscaler, Inc. Identification of certificate pinned mobile applications in cloud based security systems
US10819749B2 (en) * 2017-04-21 2020-10-27 Netskope, Inc. Reducing error in security enforcement by a network security system (NSS)
CN111988346B (zh) * 2019-05-21 2021-10-22 新华三信息安全技术有限公司 数据泄露防护设备及报文处理方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110173490A1 (en) * 2010-01-08 2011-07-14 Juniper Networks, Inc. High availability for network security devices
US20160226918A1 (en) * 2010-12-09 2016-08-04 International Business Machines Corporation Method and apparatus for associating data loss protection (DLP) policies with endpoints
US20170041297A1 (en) * 2015-08-05 2017-02-09 Dell Software Inc. Unified source user checking of tcp data packets for network data leakage prevention
WO2018208552A1 (en) * 2017-05-09 2018-11-15 Cisco Technology, Inc. Routing network traffic based on performance
CN107592303A (zh) * 2017-08-28 2018-01-16 北京明朝万达科技股份有限公司 一种高速镜像网络流量中外发文件的提取方法及装置

Also Published As

Publication number Publication date
US20220116363A1 (en) 2022-04-14
EP3890278A1 (en) 2021-10-06
JP7395615B2 (ja) 2023-12-11
JP2022531678A (ja) 2022-07-08
EP3890278B1 (en) 2023-12-27
EP3890278A4 (en) 2022-04-20
US11973741B2 (en) 2024-04-30
CN111988346B (zh) 2021-10-22
CN111988346A (zh) 2020-11-24

Similar Documents

Publication Publication Date Title
EP1657878B1 (en) Method and apparatus for secure internet protocol (IPSEC) offloading with integrated host protocol stack management
US7346770B2 (en) Method and apparatus for traversing a translation device with a security protocol
Tuexen et al. Datagram transport layer security (DTLS) for stream control transmission protocol (SCTP)
EP1854243B1 (en) Mapping an encrypted https network packet to a specific url name and other data without decryption outside of a secure web server
US8984268B2 (en) Encrypted record transmission
CN100594690C (zh) 一种安全网关中进行安全策略统一处理的方法及装置
US7483423B2 (en) Authenticity of communications traffic
US7016958B1 (en) Methods and apparatus for redirecting network cache traffic
EP1203477B1 (en) Protection of communications
EP0838930A2 (en) Pseudo network adapter for frame capture, encapsulation and encryption
US7631182B1 (en) Secure protocol handshake offload using TNICs
WO2020233412A1 (zh) 数据泄露防护
KR100471790B1 (ko) 다중 터널 브이피엔 게이트웨이를 이용한 데이터 전송 장치
Keromytis et al. Implementing ipsec
US20030110377A1 (en) Method of and apparatus for data transmission
US8170057B2 (en) Communication-processing apparatus and its method
CN111464550A (zh) 一种用于报文处理设备的https透明防护方法
Stewart et al. RFC 5061: Stream control transmission protocol (SCTP) dynamic address reconfiguration
KR20000054521A (ko) 해킹 로봇 프로그램의 공격 차단 시스템 및 그 방법
Singh et al. File Transfer Using Secure Sockets in Linux Environment
Tuexen et al. Network Working Group R. Stewart Request for Comments: 5061 Cisco Systems, Inc. Category: Standards Track Q. Xie Motorola, Inc.
KR20000054522A (ko) Ｔｃｐ기반 통신포트 탐지행위 감지시스템 및 그 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20808962

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020808962

Country of ref document: EP

Effective date: 20210630

ENP Entry into the national phase

Ref document number: 2021565789

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE