Network enciphered data virus detection and elimination system and proxy server and method

Abstract

The utility model discloses a virus-detection and removing system, proxy server and method used for network encryption data. The system comprises a client, a server, a proxy server and a anti-virus unit, among which when the proxy server encrypts the data communication between the client and the server, the proxy client and the server will receive the transmitted data pack which is decrypted to the plaintext data and then sent to the anti-virus unit for virus examination and removing, so that the safety plaintext data are re-encrypted and then sent to the server. The anti-virus unit can detect and remove the virus from the plaintext data and inform the examining and removing results to the proxy sever, so as to reduce or even remove the network viral transmission via SSL / TLS cryptographic protocol.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a system, proxy server and method for detecting and eliminating network encrypted data viruses. Background technique [0002] SSL (Secure Sockets Layer, Secure Sockets Layer) is a network security transmission protocol developed by Netscape. It is currently the most important protocol used for secure data communication between point-to-point on the Internet, especially between Web browsers and servers. . It is implemented using data encryption (Encryption) technology. Because SSL has the advantages of wide application, low implementation cost, security and high efficiency, and simple operation, it has become the most widely used protocol in e-commerce systems. For example, most e-commerce application systems in the United States are based on the SSL protocol. [0003] The basic working principle of the SSL security proxy is: the SSL security proxy server and the Web br...

AI Technical Summary

Problems solved by technology

Since protocols based on SSL / TLS (Secure Sockets Layer / Transport Layer Security, Secure Sockets Layer / Transport Layer Security) (such as HTTPS (Hyper Text Transfer Protocol over SSL / TLS), SMTPS (Short Message Transmission Protocol over SSL / TLS), FTPS (FileTransfer Protocol over SSL / TLS), POP3S (Post Office Protocol version 3 overSSL / TLS), etc.), the communication data is encrypted, so security check and content filtering cannot be performed on this kind of data, which leads to The client is vulnerable to network attacks and security threats through SSL / TLS communication tunnels. These attacks and threats include: 1) network attacks and virus propagation targeting browser vulnerabilities through HTTPS, and phishing attacks (Phishing); 2) Spread of spam (Spam) through SMTPS / POP3S / FTPS, which are likely to carry viruses and phishing attack scripts; 3) Reverse connections that violate gateway access policies in SSL / TLS communication tunnels 4) Other possible attacks

Images