CN116015872A - Data processing method and device between terminals in local area network - Google Patents

Abstract

The application relates to a data processing method and a device between terminals in a local area network, wherein the local area network is provided with a first terminal and a second terminal directly connected with the first terminal; and when the access request meets the access condition of accessing the second terminal, sending the access request to the second terminal. When the first terminal and the second terminal have the same security program, the access request of the first terminal is sent to the second terminal, so that the network transmission flow between the first terminal and the second terminal can be realized, namely, only the terminals meeting the access condition can copy the data mutually, the illegally accessed terminals are prevented from copying the divulged data, and the data security of the terminals in the local area network is further effectively ensured.

Description

Data processing method and device between terminals in local area network

technical field

The present application relates to the technical field of data security processing, in particular to a data processing method and device between terminals in a local area network.

Background technique

In the related technology, multiple terminals in the local area network can access and copy data from each other or copy data from each other directly through a network cable. There are security risks such as data leakage, which in turn brings many risks to enterprise data security.

Contents of the invention

In order to overcome the problems existing in the related technologies, the present application provides a data processing method and device between LAN terminals, which can effectively guarantee terminal data security in the LAN.

The first aspect of the present application provides a method for processing data between terminals in a local area network. The local area network has a first terminal and a second terminal directly connected to the first terminal. This method is applied to the first terminal. The method include:

receiving an access request for accessing the second terminal;

judging whether the access request satisfies an access condition for accessing the second terminal, where the access condition is used to indicate that the first terminal and the second terminal have the same security program;

When the access request meets the access condition for accessing the second terminal, the access request is sent to the second terminal.

The second aspect of the present application provides a data processing device between local area network terminals. The local area network has a first terminal and a second terminal directly connected to the first terminal. The method is applied to the first terminal. The method include:

a first processing unit, configured to receive an access request for accessing the second terminal;

A second processing unit, configured to determine whether the access request satisfies an access condition for accessing the second terminal, where the access condition is used to indicate that the first terminal and the second terminal have the same security program;

A third processing unit, configured to send the access request to the second terminal when the access request meets an access condition for accessing the second terminal.

The third aspect of the present application provides an electronic device, including:

processor; and

A memory on which executable codes are stored, and when the executable codes are executed by the processor, the processor is made to execute the above-mentioned method for processing data between LAN terminals.

The fourth aspect of the present application provides a non-transitory machine-readable storage medium, on which executable code is stored, and when the executable code is executed by a processor of an electronic device, the processor executes the above-mentioned A data processing method between LAN terminals.

The technical solution provided by this application may include the following beneficial effects: there is a first terminal in the local area network and a second terminal directly connected to the first terminal, the method is applied to the first terminal, and the method judges the method used to access the second terminal Whether the access request meets the access conditions for accessing the second terminal (used to indicate that the first terminal and the second terminal have the same security program); when the access request meets the access conditions for accessing the second terminal, send the access request to the second terminal . In this application, when the first terminal and the second terminal have the same security program, the access request of the first terminal is sent to the second terminal, so that the network transmission traffic between the first terminal and the second terminal can be realized, that is, only if the Only terminals with access conditions can copy data to each other, preventing illegally accessed terminals from copying and leaking data, and thus effectively ensuring the security of terminal data in the LAN.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the application.

Description of drawings

The above and other objects, features and advantages of the present application will become more apparent by describing the exemplary embodiments of the present application in more detail with reference to the accompanying drawings, wherein, in the exemplary embodiments of the present application, the same reference numerals generally represent same parts.

Fig. 1 is a schematic diagram of the local area network structure shown in the embodiment of the present application;

FIG. 2 is another schematic flowchart of a data processing method between LAN terminals shown in an embodiment of the present application;

FIG. 3 is an overall flow chart of data processing between LAN terminals shown in the embodiment of the present application;

FIG. 4 is a schematic structural diagram of a data processing device between LAN terminals shown in an embodiment of the present application;

FIG. 5 is a schematic structural diagram of an electronic device shown in an embodiment of the present application.

Detailed ways

Preferred embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although preferred embodiments of the present application are shown in the drawings, it should be understood that the present application may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this application will be thorough and complete, and will fully convey the scope of this application to those skilled in the art.

The terminology used in this application is for the purpose of describing particular embodiments only, and is not intended to limit the application. As used in this application and the appended claims, the singular forms "a", "the", and "the" are intended to include the plural forms as well, unless the context clearly dictates otherwise. It should also be understood that the term "and/or" as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

It should be understood that although the terms "first", "second", "third" and so on may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of the present application, first information may also be called second information, and similarly, second information may also be called first information. Thus, a feature defined as "first" and "second" may explicitly or implicitly include one or more of these features. In the description of the present application, "plurality" means two or more, unless otherwise specifically defined.

This application provides a data processing method and device between terminals in a local area network, which is used to realize data transmission between terminals in a local area network, and is applied to a local area network as shown in Figure 1. The local area network includes: a first terminal 10, and a first The second terminal 20 directly connected to the terminal 10, wherein the first terminal 10 is a terminal with a security program for horizontal protection, and the second terminal 20 can be a terminal for which a security program for horizontal protection is not installed, except for a security program for which horizontal protection is not installed When the first terminal 10 accesses the second terminal 20, only the terminals with security programs for horizontal protection installed, and the exceptions for terminals without horizontal protection Only special access terminals such as security program terminals, exception IP or DHCP servers, domain name system servers, and console servers can realize data transmission between terminals in the LAN.

The present application provides a data processing method and device between LAN terminals, the purpose of which is to effectively ensure data security during data transmission between LAN terminals.

In view of the above problems, the embodiment of the present application provides a data processing method between LAN terminals, which can effectively guarantee data security.

The technical solutions of the embodiments of the present application are described in detail below with reference to the accompanying drawings.

FIG. 2 is a schematic flowchart of a data processing method between LAN terminals shown in an embodiment of the present application.

Referring to FIG. 2 , an embodiment of the present application provides a data processing method between LAN terminals, which is applied to the LAN shown in FIG. 1 . The LAN has a first terminal and a second terminal directly connected to the first terminal. The method is applied to the first terminal, and the method specifically includes the following steps:

S201: Receive an access request for accessing a second terminal.

In the embodiment of the present application, the first terminal 10 is a terminal with a security program for horizontal protection, and the second terminal 20 can be a terminal without a security program for horizontal protection installed, an exception terminal for which a security program for horizontal protection is not installed, an exception IP or DHCP server, domain name system server, console server and other special access terminals.

Wherein, the access request is an access request sent by the user for the first terminal to access the second terminal, and the access request includes at least the IP addresses of the first terminal and the second terminal, and an identification of whether a security program is installed.

It should be noted that a local area network is a computer network that interconnects computers and various devices within a limited geographical range to achieve data transmission and resource sharing. The society's extensive demand for information resources and the widespread popularization of computer technology have promoted the rapid development of LAN technology. In today's computer network technology, LAN technology has occupied a very important position.

In the embodiment of this application, the local area network is within a relatively small area (an office, a building, a school, etc.), using communication lines to connect numerous computers and external devices to achieve resource sharing, information transfer and The purpose of remote data communication, such as file management, application software sharing, printer sharing, scanner sharing, scheduling within the workgroup, e-mail and fax communication services and other functions.

S202: Determine whether the access request satisfies the access condition for accessing the second terminal, and if yes, perform S203.

Wherein, the above access condition is used to indicate that the first terminal and the second terminal have the same security program.

S203: Send the access request to the second terminal.

In the embodiment of this application, only when the first terminal and the second terminal have the same security program, can the data transmission between the terminals in the local area network be realized, which is used in the scenario where the network security device is not used between the terminals to limit the The function of direct network data transmission between terminals that have installed horizontal protection and terminals that have not been installed through direct connections, hubs, etc.

It should be noted that the embodiment of the present application restricts the network transmission traffic between terminals with security programs installed and terminals without security programs installed, that is, only the access terminal and the accessed terminal with security programs installed can copy data to each other, preventing Illegally accessed terminals copy leaked data.

An embodiment of the present application provides a method for processing data between terminals in a local area network. In the local area network, there is a first terminal and a second terminal directly connected to the first terminal. The method is applied to the first terminal, and the method is used for Whether the access request for accessing the second terminal satisfies the access conditions for accessing the second terminal (used to indicate that the first terminal and the second terminal have the same security program); when the access request meets the access conditions for accessing the second terminal, the access request sent to the second terminal. In this embodiment of the present application, when the first terminal and the second terminal have the same security program, the access request of the first terminal is sent to the second terminal, so that the network transmission traffic between the first terminal and the second terminal can be realized, that is, Only terminals that meet the access conditions can copy data to each other, preventing illegal access terminals from copying and leaking data, and effectively ensuring the security of terminal data in the LAN.

Further, in order to expand the application scope of the present application, the embodiment of the present application also allows the network transmission traffic and the access of the exception IP between the terminal with the horizontal protection installed and the terminal without the horizontal protection, that is, the IP address of the access terminal or If the IP address of the accessed terminal exists in the white list, the network transmission traffic between the terminals can be allowed.

As shown in Figure 2, when the access request does not meet the access conditions for accessing the second terminal, the method further includes the following steps:

S204: Determine whether the IP address of the second terminal exists in the white list of the first terminal, if yes, send the access request to the second terminal; if not, perform S205.

In this embodiment of the present application, the access right is used to indicate that the IP of the second terminal exists in the whitelist of the first terminal.

It should be noted that the white list (White List) is set to allow users to pass, and users outside the white list cannot pass. If a white list is set up, users (or IP addresses, IP packets, emails, etc.) in the white list will pass through first, and will not be rejected as spam, and the security and speed are greatly improved. Whitelisting can help defend against advanced memory injection attacks; the technology provides functionality to verify all approved processes running in memory and ensure those processes have not been modified while running, thereby defending against advanced memory exploits.

S205: Initiate a whitelist connection to the second terminal, and determine whether to add the IP address of the second terminal to the whitelist of the first terminal.

S206: Add the IP address of the second terminal to the white list of the first terminal when the first terminal and the second terminal are successfully connected with the white mark.

Specifically, adding the IP address of the second terminal to the whitelist of the first terminal includes:

Send dotted data to the second terminal;

judging whether the dot data packet fed back by the second terminal is received;

If the dotted data packet fed back by the second terminal is received, the access IP address of the second terminal is added to the white list of the first terminal, and the access request is sent to the second terminal.

S207: When the connection between the first terminal and the second terminal is unsuccessful by adding dots, prohibiting the access request from being sent to the second terminal.

It should be noted that the embodiment of this application allows network transmission traffic between terminals with security programs installed, terminals without security programs installed, and exception IPs, that is, only access terminals and visited terminals whose IP addresses are in the whitelist can Realize mutual copying of data and prevent illegally accessed terminals from copying and leaking data.

The embodiment of the present application provides a data processing method between terminals in a local area network. There is a first terminal in the local area network and a second terminal directly connected to the first terminal. The method is applied to the first terminal. The method judges the first terminal When the connection between the terminal and the second terminal is successfully added, the access IP of the second terminal is added to the white list of the first terminal, and the terminals in the white list can realize network traffic transmission. The embodiment of the present application allows the network transmission traffic and the access of the exception IP between the terminal with the horizontal protection installed and the terminal without the horizontal protection, that is, the IP address of the access terminal or the IP address of the accessed terminal exists in the white list, Then it can allow the network transmission traffic between terminals, prevent illegally accessed terminals from copying and leaking data, and thus effectively ensure the security of terminal data in the LAN.

In a specific embodiment, as shown in Figure 3, the basic design scheme adopted by the present application includes the following steps:

S1: When terminal A initiates a TCP/UDP access request, if the IP address of terminal B is not within the range of white IP addresses preset for the driver, the request packet is extracted and sent to the R3 layer of terminal A synchronously.

S2: R3 of terminal A sends a packet with a specified format to terminal B. This port is the x port preset by the control center, that is, initiates RBI.

S3: The driver of terminal B gets the package with the specified format at the preset port x, takes the package away and sends it to the R3 layer of terminal A, that is, receives and manages it.

S4: R3 of terminal B adds the IP address of terminal A to the dynamic white IP range, and at the same time updates the dynamic white IP range in entbw, that is, terminal A adds white.

S5: R3 of terminal B sends a packet with a specified format to terminal A, and the port is the x port preset by the control center, that is, reverse RBI.

S6: The driver of terminal A gets the package with the specified format at the preset port x, and takes the package away and sends it to the R3 layer of terminal A, that is, receives and manages it.

S7: R3 of terminal A adds the IP of terminal B to the dynamic white IP range, and at the same time updates the dynamic white IP range in entbw, that is, adds white to terminal A.

S8: The R3 layer of terminal A releases the real network packet held at the beginning, and the follow-up is normal communication, that is, the real packet is released.

Further, in order to expand the application scope of the present application, the embodiment of the present application can also perform release processing on special access terminals, that is, when the access terminal or the accessed terminal is a special access terminal, the network transmission traffic between terminals can be allowed.

When the access request does not meet the access conditions for accessing the second terminal, the method further includes:

judging whether the first terminal is a special access terminal, where the special access terminal includes: a DHCP server, a domain name system server, and a console server;

If the first terminal is any one of the feature access terminals, sending the access request to the second terminal.

It should be noted that the embodiments of the present application allow special access terminals to copy data from each other, preventing unauthorized access terminals from copying leaked data.

The embodiment of the present application provides a method for processing data between terminals in a local area network. In the local area network, there is a first terminal and a second terminal directly connected to the first terminal. The method allows network transmission traffic between special access terminals to prevent Illegally accessed terminals copy the leaked data, thereby effectively ensuring the security of terminal data in the LAN.

Corresponding to the aforementioned embodiments of the method for implementing application functions, the present application also provides a data processing device between terminals in a local area network, electronic equipment, and corresponding embodiments.

Fig. 4 is a schematic structural diagram of a data processing device between terminals in a local area network shown in an embodiment of the present application.

Referring to FIG. 4 , an embodiment of the present application provides a data processing device between terminals in a local area network. The local area network has a first terminal and a second terminal directly connected to the first terminal. The device is applied to the first terminal , the device includes:

The first processing unit 401 is configured to receive an access request for accessing the second terminal;

The second processing unit 402 is configured to determine whether the access request satisfies an access condition for accessing the second terminal, where the access condition is used to indicate that the first terminal and the second terminal have the same security program;

The third processing unit 403 is configured to send the access request to the second terminal when the access request meets an access condition for accessing the second terminal.

Further, when the access request does not meet the access conditions for accessing the second terminal, the device further includes:

A fourth processing unit 404, configured to determine whether the IP address of the second terminal exists in the white list of the first terminal;

When the IP address of the second terminal exists in the white list of the first terminal, the access request is sent to the second terminal.

Further, when the IP address of the second terminal does not exist in the white list of the first terminal, the device further includes:

The fifth processing unit 405 is configured to initiate a whitelist connection to the second terminal, and determine whether to add the IP address of the second terminal to the whitelist of the first terminal;

When the connection between the first terminal and the second terminal is successfully added, add the IP address of the second terminal to the white list of the first terminal;

When the white mark connection between the first terminal and the second terminal fails, the access request is prohibited from being sent to the second terminal.

Regarding the apparatus in the above embodiments, the specific manner in which each module executes operations has been described in detail in the embodiments related to the method, and will not be described in detail here.

FIG. 5 is a schematic structural diagram of an electronic device shown in an embodiment of the present application.

Referring to FIG. 5 , an electronic device 500 includes a memory 510 and a processor 520 .

The processor 520 can be a central processing unit (Central Processing Unit, CPU), and can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), on-site Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.

The memory 510 may include various types of storage units, such as system memory, read only memory (ROM), and persistent storage. Wherein, the ROM can store static data or instructions required by the processor 520 or other modules of the computer. The persistent storage device may be a readable and writable storage device. Persistent storage may be a non-volatile storage device that does not lose stored instructions and data even if the computer is powered off. In some embodiments, the permanent storage device adopts a large-capacity storage device (such as a magnetic or optical disk, flash memory) as the permanent storage device. In some other implementations, the permanent storage device may be a removable storage device (such as a floppy disk, an optical drive). The system memory can be a readable and writable storage device or a volatile readable and writable storage device, such as dynamic random access memory. System memory can store some or all of the instructions and data that the processor needs at runtime. In addition, memory 510 may include any combination of computer-readable storage media, including various types of semiconductor memory chips (DRAM, SRAM, SDRAM, flash memory, programmable read-only memory), and magnetic and/or optical disks may also be used. In some embodiments, memory 510 may include a readable and/or writable removable storage device, such as a compact disc (CD), a read-only digital versatile disc (e.g., DVD-ROM, dual-layer DVD-ROM), Read-Only Blu-ray Disc, Super Density Disc, Flash memory card (such as SD card, min SD card, Micro-SD card, etc.), magnetic floppy disk, etc. Computer-readable storage media do not contain carrier waves and transient electronic signals transmitted by wireless or wire.

Executable codes are stored in the memory 510 , and when the executable codes are processed by the processor 520 , the processor 520 can be made to execute part or all of the methods mentioned above.

The solution of the present application has been described in detail above with reference to the accompanying drawings. In the foregoing embodiments, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments. Those skilled in the art should also know that the actions and modules involved in the description are not necessarily required by the present application. In addition, it can be understood that the order of the steps in the method of the embodiment of the present application can be adjusted, combined and deleted according to actual needs, and the modules in the device of the embodiment of the present application can be combined, divided and deleted according to actual needs.

In addition, the method according to the present application can also be implemented as a computer program or computer program product, which includes computer program code instructions for executing some or all of the steps in the above-mentioned method of the present application.

Alternatively, the present application may also be implemented as a non-transitory machine-readable storage medium (or computer-readable storage medium, or machine-readable storage medium), on which executable code (or computer program, or computer instruction code) is stored. ), when the executable code (or computer program, or computer instruction code) is executed by the processor of the electronic device (or electronic device, server, etc.), causing the processor to perform the steps of the above method according to the present application part or all of .

Those of skill would also appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the applications herein may be implemented as electronic hardware, computer software, or combinations of both.

The flowchart and block diagrams in the figures show the architecture, functions and operations of possible implementations of systems and methods according to various embodiments of the present application. In this regard, each block in a flowchart or block diagram may represent a module, program segment, or part of code that includes one or more Executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending upon the functionality involved. It should also be noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented by a dedicated hardware-based system that performs the specified functions or operations , or may be implemented by a combination of dedicated hardware and computer instructions.

Having described various embodiments of the present application above, the foregoing description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and alterations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principle of each embodiment, practical application or improvement of technology in the market, or to enable other ordinary skilled in the art to understand each embodiment disclosed herein.

Claims (10)

1. A method for processing data between terminals in a local area network, wherein the local area network has a first terminal and a second terminal directly connected to the first terminal, the method being applied to the first terminal, the method comprising:

receiving an access request for accessing the second terminal;

judging whether the access request meets the access condition of accessing the second terminal or not, wherein the access condition is used for representing that the first terminal and the second terminal have the same security program;

and when the access request meets the access condition of accessing the second terminal, sending the access request to the second terminal.

2. The data processing method according to claim 1, wherein when the access request does not satisfy an access condition for accessing the second terminal, the method further comprises:

judging whether the IP address of the second terminal exists in the white list of the first terminal;

and when the IP address of the second terminal exists in the white list of the first terminal, the access request is sent to the second terminal.

3. The data processing method according to claim 2, wherein when the IP address of the second terminal does not exist in the whitelist of the first terminal, further comprising:

initiating a whitewashing dotting connection to the second terminal, and judging whether the IP address of the second terminal is added to the whitelist of the first terminal;

when the first terminal and the second terminal are successfully connected by adding white dotting, the IP address of the second terminal is added to a white list of the first terminal;

and when the first terminal and the second terminal are successfully connected by white dotting, the access request is forbidden to be sent to the second terminal.

4. A data processing method according to claim 3, wherein said adding the IP address of the second terminal to the whitelist of the first terminal comprises:

transmitting dotting data to the second terminal;

judging whether a dotting data packet fed back by the second terminal is received or not;

and if the dotting data packet fed back by the second terminal is received, adding the access IP address of the second terminal to the white list of the first terminal, and sending the access request to the second terminal.

5. The data processing method according to claim 1, wherein when the access request does not satisfy an access condition for accessing the second terminal, the method further comprises:

judging whether the IP address of the first terminal is the IP address of a special access terminal or not, wherein the special access terminal comprises: a DHCP server, domain name system server, or console server;

and if the IP of the first terminal is the IP of the characteristic access terminal, sending the access request to the second terminal.

6. A data processing device between terminals in a local area network, wherein the local area network has a first terminal and a second terminal directly connected to the first terminal, the device being applied to the first terminal, the device comprising:

a first processing unit, configured to receive an access request for accessing the second terminal;

the second processing unit is used for judging whether the access request meets the access condition of accessing the second terminal or not, and the access condition is used for representing that the first terminal and the second terminal have the same security program;

and the third processing unit is used for sending the access request to the second terminal when the access request meets the access condition of accessing the second terminal.

7. The data processing apparatus according to claim 6, wherein when the access request does not satisfy an access condition for accessing the second terminal, the apparatus further comprises:

a fourth processing unit, configured to determine whether an IP address of the second terminal exists in a whitelist of the first terminal;

and when the IP address of the second terminal exists in the white list of the first terminal, the access request is sent to the second terminal.

8. The data processing apparatus of claim 7, wherein when the IP address of the second terminal does not exist in the whitelist of the first terminal, the apparatus further comprises:

a fifth processing unit, configured to initiate a whitewashing dotting connection to the second terminal, and determine whether to add the IP address of the second terminal to the whitelist of the first terminal;

when the first terminal and the second terminal are successfully connected by adding white dotting, the IP address of the second terminal is added to a white list of the first terminal;

and when the first terminal and the second terminal are successfully connected by white dotting, the access request is forbidden to be sent to the second terminal.

9. An electronic device, comprising:

a processor; and

a memory having executable code stored thereon which, when executed by the processor, causes the processor to perform the data processing method of any of claims 1-5.

10. A non-transitory machine-readable storage medium having stored thereon executable code, which when executed by a processor of an electronic device, causes the processor to perform the data processing method of any of claims 1-5.

Images