HTTPS data flow audit method and system for carrier backbone network

Abstract

The invention discloses an HTTPS data flow audit method and system oriented to an operator's backbone network. The method includes: adopting a bypass splitting method to obtain a DNS request carrying a target domain name sent by a client in an operator's backbone network; according to the obtained NDS request and the corresponding relationship between a preset domain name and a spoofed IP, Obtain the corresponding spoofed IP, and send the response information carrying the corresponding spoofed IP to the client; analyze the access data packet sent by the client according to the spoofed IP, and judge whether the access data packet is plaintext; when the access data packet is plaintext , audit access data packets through the SSLstrip audit server. The method of the invention does not need to insert auditing equipment into the backbone network, does not interfere with the transmission speed of the backbone network, can ensure the smooth progress of the audit work of sending clear text to the client, and does not interfere with the client's encrypted access to the target website.

Description

technical field [0001] The invention relates to the technical field of HTTPS auditing, in particular to an HTTPS data flow auditing method and system for an operator's backbone network. Background technique [0002] Hyper Text Transfer Protocol over Secure Socket Layer (HTTPS for short) is a transmission protocol for encrypted transmission by using Secure Socket Layer (Secure Socket Layer, "SSL" for short), which is equivalent to An SSL layer is added to the traditional Hyper Text Transfer Protocol (Hyper Text Transfer Protocol, referred to as "HTTP"), which is widely used in the transmission of sensitive information between the client and the website due to its security. [0003] The current general method for auditing HTTPS data streams is to use the middleman technology to proxy and forward the data flows sent from the client to the server. For example, the SSLstrip technology is a middleman technology that does not require the client to install an audit device certificat...

AI Technical Summary

Problems solved by technology

[0004] However, the above method is mainly used in a network environment with small network traffic (for example: the network traffic is lower than 1Gbps). If the data in the backbone network is to be audited, due to the large network traffic, once the backbone network link Inserting audit equipment in the middle will seriously affect the data transmission speed of the backbone network, and even cause the situation in the middle of the backbone network link, so that a large area of ​​network users will be affected

Images