Method and device for detecting man-in-the-middle attack

Abstract

The invention discloses a method for detecting a man-in-the-middle attack, which comprises the steps of: when a first SSL (Secure Socket Layer) service needs to be subjected to the man-in-the-middle attack, acquiring a first encryption feature of the first SSL service and a second encryption feature of a preset second SSL service; and judging whether the first encryption feature and the second encryption feature meet a set condition of being attacked by a man in the middle, and if yes, determining that the first SSL service is attacked by the man in the middle. The invention simultaneously further discloses a device for detecting the man-in-the-middle attack.

Description

technical field [0001] The invention relates to network security technology, in particular to a detection method and device for man-in-the-middle attacks. Background technique [0002] Man-in-the-middle attack (MITM, Man-in-the-middle attack) means that the attacker establishes independent connections with the two ends of the communication and exchanges the received data, so that the two ends of the communication think that they are passing through a private connection Talk directly to the other party, but in fact the entire conversation is completely controlled by the attacker. Additionally, during a man-in-the-middle attack, the attacker can intercept the conversation between the communicating parties and insert new content. figure 1 It is a schematic diagram of MITM. The attacker puts himself in the middleman position between the client and the server by means of session hijacking, so as to obtain the interactive messages between the client and the server during normal c...

AI Technical Summary

Problems solved by technology

In addition, the detection method for man-in-the-middle attacks on HTTPS services is not necessarily applicable to services such as SMTPS, because although the security of HTTPS services is high, it does not improve the security of SMTPS services

If the attacker cannot perform a man-in-the-middle attack through HTTPS, but because the detection technology of the man-in-the-middle attack through SMTPS and IMAPS is relatively weak, the attacker can conduct a man-in-the-middle attack through SMTPS and IMAPS, which will lead to the leakage of SSL encrypted data and cannot Thoroughly solve all SSL encryption services and prevent them from being attacked by man-in-the-middle

Images