HTTPS data flow auditing method and system oriented on operator backbone network

Abstract

The invention discloses a HTTPS data flow auditing method and system oriented on an operator backbone network. The method comprises the following steps of: obtaining a DNS request sent by a client side and carrying a target domain name in the operator backbone network through a bypass spectroscopic manner; according to the obtained DNS request and a pre-set corresponding relationship between the domain name and a deception IP, obtaining a corresponding deception IP, and sending response information carrying the corresponding deception IP to the client side; analyzing an access data message sent by the client side according to the deception IP, and judging whether the access data message is a plaintext or not; and, when the access data message is the plaintext, auditing the access data message through an SSLstrip auditing server. By means of the method disclosed by the invention, auditing equipment does not need to be inserted in the backbone network; the transmission speed of the backbone network is not interfered; the audio work for sending the plaintext to the client side can be carried out smoothly; and furthermore, encrypted access of the client side to a target website is not interfered.

Description

technical field [0001] The invention relates to the technical field of HTTPS auditing, in particular to an HTTPS data flow auditing method and system for an operator's backbone network. Background technique [0002] Hyper Text Transfer Protocol over Secure Socket Layer (HTTPS for short) is a transmission protocol for encrypted transmission by using Secure Socket Layer (Secure Socket Layer, "SSL" for short), which is equivalent to An SSL layer is added to the traditional Hyper Text Transfer Protocol (Hyper Text Transfer Protocol, referred to as "HTTP"), which is widely used in the transmission of sensitive information between the client and the website due to its security. [0003] The current general method for auditing HTTPS data streams is to use the middleman technology to proxy and forward the data flows sent from the client to the server. For example, the SSLstrip technology is a middleman technology that does not require the client to install an audit device certificat...

AI Technical Summary

Problems solved by technology

[0004] However, the above method is mainly used in a network environment with small network traffic (for example: the network traffic is lower than 1Gbps). If the data in the backbone network is to be audited, due to the large network traffic, once the backbone network link Inserting audit equipment in the middle will seriously affect the data transmission speed of the backbone network, and even cause the situation in the middle of the backbone network link, so that a large area of ​​network users will be affected

Images