Message processing method, electronic device, and readable storage medium

Patent metadata

Field	Value
Publication number	US-11240202-B2
Application number	US-201816650768-A
Country	US
Kind code	B2
Filing date	Apr 28, 2018
Priority date	Sep 26, 2017
Publication date	Feb 1, 2022
Grant date	Feb 1, 2022

Abstract

Embodiments of the present application provide a packet processing method, an electronic device and a readable storage medium. The method is applied to an electronic device installed with a Virtual Private Network VPN application, and includes: a non-VPN application in the electronic device sending a packet that is to be sent by the non-VPN application to the VPN application through a hardware network module and a virtual network module in the electronic device; the VPN application receiving and analyzing the packet; if the analysis indicates that the packet contains a Domain Name System (DNS) resolution request, the VPN application redirecting the DNS resolution request packet to a preset secure DNS server through the virtual network module and the hardware network module. With embodiments of the present application, the security of software, hardware, and data of an electronic device can be effectively ensured with a reduced cost.

First claim

The invention claimed is:

1. A packet processing method, applicable to an electronic device installed with a Virtual Private Network (VPN) application and comprising:
a non-VPN application in the electronic device sending a packet that is to be sent by the non-VPN application to the VPN application through a hardware network module and a virtual network module in the electronic device;
the VPN application receiving and analyzing the packet; and
if the analysis indicates that the packet contains a Domain Name System (DNS) resolution request, the VPN application redirecting the DNS resolution request packet to a preset secure DNS server through the virtual network module and the hardware network module;
wherein, the non-VPN application in the electronic device sending a packet that is to be sent by the non-VPN application to the VPN application through a hardware network module and a virtual network module in the electronic device comprises:
the non-VPN application in the electronic device sending the to-be-sent packet to the hardware network module in the electronic device;
the hardware network module sending the packet to the virtual network module in the electronic device based on a packet sending policy corresponding to a mangle input chain in a preset iptables; and
the virtual network module sending the packet to the VPN application.

2. The method according to claim 1 , wherein, after the VPN application redirecting the DNS resolution request packet to a preset secure DNS server, the method further comprises:
the hardware network module sending a first feedback packet, which is received by the hardware network module from the secure DNS server and corresponds to the DNS resolution request packet, to the VPN application through the virtual network module; and
the VPN application modifying a source address and a destination address of the first feedback packet, and sending the modified first feedback packet to the non-VPN application through the virtual network module and the hardware network module.

3. The method according to claim 2 , wherein, the VPN application modifying a source address and a destination address of the first feedback packet, and sending the modified first feedback packet to the non-VPN application through the virtual network module and the hardware network module comprises:
the VPN application modifying the source address of the first feedback packet to a destination address of the DNS resolution request packet, and modifying the destination address of the first feedback packet to an IP address of the hardware network module; and
the VPN application sending the modified first feedback packet to the non-VPN application through the virtual network module and the hardware network module.

4. The method according to claim 1 , wherein, the VPN application redirecting the DNS resolution request packet to a preset secure DNS server through the virtual network module and the hardware network module comprises:
the VPN application modifying a source address of the DNS resolution request packet to an IP address of the virtual network module, and modifying a destination address of the DNS resolution request packet to an IP address of the secure DNS server;
the VPN application sending the modified DNS resolution request packet to the hardware network module through the virtual network module; and
the hardware network module receiving and sending the modified DNS resolution request packet to the secure DNS server.

5. The method according to claim 1 , wherein, after the VPN application receiving and analyzing the packet, the method further comprises:
if the analysis indicates that the packet contains a Hyper Text Transfer Protocol (HTTP) request, the VPN application obtaining a Uniform Resource Locator (URL) corresponding to the HTTP request packet and generating an HTTP authentication request packet containing the URL; wherein, the HTTP authentication request packet is a packet that requests a URL secure authentication server to perform a secure authentication on the URL;
the VPN application sending the HTTP authentication request packet to the URL secure authentication server through the virtual network module and the hardware network module.

6. The method according to claim 5 , wherein, after sending the HTTP authentication request packet to the URL secure authentication server, the method further comprises:
the hardware network module sending a secure authentication result, which is received by the hardware network module from the URL secure authentication server and corresponds to the HTTP authentication request packet, to the VPN application through the virtual network module; and
if the secure authentication result is positive, the VPN application sending the HTTP request packet to a device corresponding to the URL through the virtual network module and the hardware network module, so that the device feeds back access content for the HTTP request packet to the hardware network module.

7. The method according to claim 5 , wherein, the VPN application obtaining a Uniform Resource Locator (URL) corresponding to the HTTP request packet and generating an HTTP authentication request packet containing the URL comprises:
the VPN application obtaining the URL corresponding to the HTTP request packet by reconstructing HTTP data stream; and generating an HTTP authentication request packet containing the URL.

8. A non-transitory computer-readable storage medium having a computer program stored thereon which, when executed by a processor, causes the processor to perform the packet processing method of claim 1 .

9. An electronic device, comprising a hardware network module, a virtual network module, a virtual private network (VPN) application, and a non-VPN Application;
the non-VPN Application is configured for sending a packet that is to be sent by the non-VPN application to the VPN application through the hardware network module and the virtual network module;
the VPN application is configured for receiving and analyzing the packet;
the VPN application is further configured for, if the analysis indicates that the packet contains a Domain Name System (DNS) resolution request, redirecting the DNS resolution request packet to a preset secure DNS server through the virtual network module and the hardware network module;
wherein, the non-VPN application is further configured for sending the to-be-sent packet to the hardware network module;
the hardware network module is further configured for sending the packet to the virtual network module based on a packet sending policy corresponding to a mangle input chain in a preset iptables;
the virtual network module is configured for sending the packet to the VPN application.

10. The device according to claim 9 , wherein,
the hardware network module is configured for sending a first feedback packet, which is received by the hardware network module from the secure DNS server and corresponds to the DNS resolution request packet, to the VPN application through the virtual network module;
the VPN application is further configured for modifying a source address and a destination address of the first feedback packet, and sending the modified first feedback packet to the non-VPN application through the virtual network module and the hardware network module.

11. The electronic device according to claim 10 , wherein,
the VPN application is further configured for modifying the source address of the first feedback packet to a destination address of the DNS resolution request packet; modifying the destination address of the first feedback packet to an IP address of the hardware network module; and sending the modified first feedback packet

Assignees

• Beijing Kingsoft Internet Security Software Co Ltd

Inventors

• Yang Qi
• Zhang Kangzong

Classifications

• H04L63/0272 Primary

  Virtual private networks · CPC title

• H04L61/4511

  using domain name system [DNS] · CPC title

• H04L67/63

  Routing a service request depending on the request content or context · CPC title

• H04L61/5007

  Internet protocol [IP] addresses · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title