Method, system, electronic device and storage medium for dynamically obtaining application communication keys

Abstract

The method, system, electronic device and storage medium for dynamically obtaining application communication keys disclosed in an embodiment of the present invention relate to the field of network security technology. The method includes: when a third-party application carries a first public key to transmit the encrypted data: determining whether the first public key carried by the encrypted traffic during the communication of the third-party application is consistent with the currently calculated second public key; if consistent, obtaining an encryption / decryption key based on the first random number used when calculating the first public key; wherein the first public key and the second public key are both generated based on random numbers in a random number sequence generated by a custom random number generator of the operating system according to real-time input parameters. The present invention facilitates the acquisition of plaintext communication traffic data of third-party applications.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, system, electronic device and storage medium for dynamically obtaining application communication keys. Background Art

[0002] In terminal systems, most closed-source, third-party applications with network connectivity utilize TLS / SSL encryption. Using network capture or parsing software, such as tcpdump or wireshark, it is possible to intercept the application's network traffic. However, without the TLS decryption key, it is impossible to obtain plaintext data, and thus, monitor application behavior. Obtaining plaintext network traffic data typically involves hooking the application. This involves reverse engineering the application's execution flow, locating the TLS encryption and decryption routines, and then setting program hooks for the functions that send encrypted data and decrypt the data, thereby obtaining plaintext traffic information.

[0003] However, in the process of realizing the invention, the inventors of this application discovered that the above solution requires customized development for different applications, and that some applications cannot locate encryption and decryption functions due to the use of obfuscation and packaging technologies, and thus cannot obtain communication plaintext traffic data. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a method, system, electronic device, and storage medium for dynamically obtaining application communication keys, which facilitates obtaining communication plaintext traffic data of third-party applications.

[0005] In order to achieve the above-mentioned purpose of the invention, the following technical solutions are adopted:

[0006] In a first aspect, an embodiment of the present invention provides a method for dynamically obtaining an application communication key, the method comprising the steps of:

[0007] Determine whether the first public key carried in the encrypted traffic during communication with the third-party application is consistent with the currently calculated second public key;

[0008] If they are consistent, the encryption / decryption key is calculated based on the first random number used when calculating the first public key;

[0009] The first public key and the second public key are both generated based on random numbers in a random number sequence generated by an operating system's custom random number generator according to real-time input parameters.

[0010] Optionally, the method further includes: monitoring network traffic in the communication link to obtain encrypted traffic carrying encrypted data;

[0011] During the communication process of the third-party application, a first random number is taken from a first random number sequence to generate a first public key and an encryption / decryption key, wherein the first random number sequence is generated by a custom random number generator of the operating system according to real-time input parameters;

[0012] Encrypting the data to be transmitted based on the encryption / decryption key to obtain encrypted data;

[0013] The encrypted data is transmitted carrying the first public key.

[0014] Optionally, after obtaining the encrypted traffic carrying the encrypted data, the method further includes: extracting the first public key carried in the encrypted traffic, and obtaining a second random number from a second random number sequence, where the second random number sequence is generated by a custom random number generator of an operating system according to real-time input parameters;

[0015] Calculate a corresponding second public key based on the second random number and a preset encryption algorithm;

[0016] Determining whether the first public key is consistent with the second public key;

[0017] If they are consistent, the encryption / decryption key is calculated based on the second random number.

[0018] Optionally, after determining whether the first public key and the second public key are consistent, the method further comprises: if they are inconsistent, enumerating random number generator input parameters within a predetermined time range, inputting the parameters into the operating system custom random number generator, and obtaining a third random number sequence;

[0019] Polling and selecting a random number from the third random number sequence, calculating a corresponding third public key based on the selected random number, and determining whether the third public key is consistent with the first public key;

[0020] If they are consistent, the encryption / decryption key is calculated based on the random number corresponding to the polling time.

[0021] Optionally, after the consistency is achieved and before the encryption / decryption key is calculated, the method further includes: determining that the second random number or the corresponding random number is the same as the first random number.

[0022] Optionally, the real-time input parameters include: seed, real-time time and / or hardware information.

[0023] Optionally, before the third-party application communicates, the method further includes: replacing the RNG function of the third-party application with a custom random number generator of the operating system; the custom random number generator of the operating system includes: a built-in random number generator of the operating system;

[0024] A random number sequence is generated based on a custom random number generator of the operating system; the random number sequence includes random numbers with a predetermined number of digits.

[0025] In a second aspect, an embodiment of the present invention further provides a system for dynamically obtaining an application communication key, comprising: a judgment program module for judging whether a first public key carried by encrypted traffic during communication with a third-party application is consistent with a currently calculated second public key;

[0026] a decryption program module, configured to calculate an encryption / decryption key based on a first random number used in calculating the first public key if the judgment is consistent;

[0027] The first public key and the second public key are both generated based on random numbers in a random number sequence generated by an operating system's custom random number generator according to real-time input parameters.

[0028] In a third aspect, an embodiment of the present invention provides an electronic device comprising: one or more processors; a memory; one or more executable programs stored in the memory, the one or more processors reading the executable program code stored in the memory, and running a system for dynamically obtaining application communication keys corresponding to the executable program code, so as to execute any method for dynamically obtaining application communication keys described in the first aspect.

[0029] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement any method of dynamically obtaining application communication keys as described in the first aspect.

[0030] An embodiment of the present invention uses an operating system's custom random number generator to replace the third-party application's own RNG function to generate a random number sequence, allowing the third-party application to generate a first public key and an encryption / decryption key based on the random number sequence for encrypted transmission. When monitoring network traffic, the second public key is calculated based on the random number in the random number sequence dynamically generated by the operating system's custom random number generator based on the current input parameters to determine whether the first public key and the second public key are consistent. If they are consistent, it is equivalent to the current random number being consistent with the first random number, and the first random number is then reversed to obtain the first random number, and the encryption / decryption key is calculated based on the reversed first random number. In this way, compared to existing network plaintext traffic data or encryption / decryption password acquisition schemes, by adopting a system-generated random number mechanism, there is no need for specialized custom development for different applications, nor is there any need to modify the third-party application program code, reverse analyze the application structure, de-shell, and deobfuscate. According to the above steps, the encryption / decryption key of the third-party application can be obtained, thereby facilitating the acquisition of the third-party application's communication plaintext traffic data. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0032] Figure 1 A flowchart of a method for dynamically obtaining an application communication key according to an embodiment of the present invention is shown;

[0033] Figure 2 A flowchart of a method for dynamically obtaining an application communication key according to another embodiment of the present invention is shown;

[0034] Figure 3 A flowchart of a method for dynamically obtaining an application communication key according to another embodiment of the present invention is shown;

[0035] Figure 4 A flowchart of a method for dynamically obtaining an application communication key according to another embodiment of the present invention is shown;

[0036] Figure 5 This is a schematic block diagram of the system architecture for dynamically obtaining application communication keys according to an embodiment of the present invention;

[0037] Figure 6 This is a schematic block diagram of the system architecture for dynamically obtaining application communication keys according to an embodiment of the present invention;

[0038] Figure 7 This is a schematic block diagram of the system architecture and application of dynamically obtaining application communication keys according to another embodiment of the present invention;

[0039] Figure 8 The figure is a schematic block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0040] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0041] It should be understood that the embodiments described are only a portion of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative work are within the scope of protection of the present invention.

[0042] The method for dynamically obtaining application communication keys provided by an embodiment of the present invention can be applied in network security analysis scenarios, such as the monitoring and analysis of malicious applications. By replacing the general method of the random number generation function (RNG function) of third-party applications with the system's own random number generator, the technical problems existing in the decryption and real-time monitoring of TLS (Transport Layer Security, a transport layer cryptographic communication protocol or framework) traffic of various closed-source applications are solved, making it easier to obtain the plaintext communication traffic data of third-party applications, thereby enabling monitoring and analysis of whether the third-party applications are malicious programs and ensuring the safe operation of network assets.

[0043] It should be noted that the method can be solidified in a certain manufactured physical product in the form of software, and when the user uses the product, the method flow of the present application can be reproduced.

[0044] Figure 1 This is a flow chart of a method for dynamically obtaining an application communication key according to an embodiment of the present invention; Figure 1 As shown, the method for dynamically obtaining an application communication key can be applied to the communication process between a third-party application and a server, and the method includes the following steps:

[0045] S101, determining whether a first public key carried in encrypted traffic during communication with a third-party application is consistent with a currently calculated second public key;

[0046] S103: If they are consistent, obtain an encryption / decryption key based on the first random number used to calculate the first public key.

[0047] The first public key and the second public key are both generated based on random numbers in a random number sequence generated by an operating system's custom random number generator according to real-time input parameters.

[0048] In an embodiment of the present invention, a custom random number generator for the operating system is used to replace the third-party application's own RNG function to generate a random number sequence, so that the third-party application generates a first public key and an encryption / decryption key based on the random number sequence for encrypted transmission. When monitoring network traffic, a second public key is calculated based on the random number in the random number sequence dynamically generated by the custom random number generator of the operating system according to the current input parameters. It is determined whether the first public key and the second public key are consistent. If they are consistent, it is equivalent to the current random number being consistent with the first random number, and then the first random number is reversed and calculated based on the reversed first random number to obtain the encryption / decryption key. In this way, compared to existing network plaintext traffic data or encryption / decryption password acquisition schemes, by adopting a system-generated random number mechanism, there is no need for customized development of different applications, nor is there any need to modify the third-party application program code, reverse analyze the application structure, de-shell and deobfuscate the application, and the encryption / decryption key of the third-party application can be obtained according to the above steps, thereby facilitating the acquisition of the third-party application's communication plaintext traffic data.

[0049] As an optional embodiment, the method further includes: monitoring network traffic in the communication link to obtain encrypted traffic carrying encrypted data.

[0050] In which, during the communication process of the third-party application, a first random number is taken out from the first random number sequence to generate a first public key and an encryption / decryption key, where the first random number sequence is generated by the operating system's custom random number generator based on real-time input parameters; the data to be transmitted is encrypted based on the encryption / decryption key to obtain encrypted data; and the encrypted data is transmitted carrying the first public key.

[0051] Please see Figure 2 As shown, in this embodiment, when a third-party application takes out a first random number from a first random number column to generate a first public key and an encryption / decryption key, encrypts data based on the encryption / decryption key, and transmits the encrypted data with the first public key (PUBKEY); step S110 is executed, network traffic in the communication link is monitored, and encrypted traffic carrying the encrypted data is obtained.

[0052] The first random number sequence is generated based on a first input parameter using a custom random number generator (Random Number Generator) in the operating system. This replaces the existing third-party application's RNG function for generating random numbers, which are then used to calculate public keys and other secret keys. This eliminates the need for custom development for different applications, improves adaptability, and reduces development costs.

[0053] In this embodiment, as an optional embodiment, the first input parameters include: a seed, real-time time, and / or hardware information (hw). The hardware information includes hardware information such as instructions and memory of an asset (here primarily referring to a terminal device, but also a server, essentially any electronic device such as a computer). Preferably, the seed, real-time time, and hardware information are the first input parameters to ensure the randomness of the random number generation.

[0054] S120: Generate a second random number sequence based on the operating system's customized random number generator according to current input parameters.

[0055] In this embodiment, the current input parameters also include: seed, real-time time and / or hardware information. After the encrypted traffic is acquired through monitoring, the decryption task is started. Since the relevant key of the encrypted traffic is generated based on the random numbers in the random number sequence generated by the operating system's custom random number generator, a second random number sequence can be calculated by the operating system's custom random number generator based on the current input parameters; the current input parameter selects a parameter value within a predetermined time difference range from the first input parameter. In this way, the amount of data calculation in the decryption process can be reduced, specifically, the efficiency of enumerating the input parameters of the random number generator is improved, thereby improving the efficiency of data decryption.

[0056] S130: Extract the first public key carried in the encrypted traffic, and obtain a second random number from a second random number sequence; the second random number sequence is generated by a custom random number generator of the operating system according to real-time input parameters;

[0057] It is understandable that the public key is generally visible to everyone, while the encryption / decryption key is only known to the user transmitting the data. If you want to obtain plaintext traffic data, you must first obtain the encryption / decryption key.

[0058] S140. Calculate a corresponding second public key based on the second random number using a preset encryption algorithm;

[0059] In this embodiment, the preset encryption algorithm is consistent with the encryption algorithm used by the third-party application to calculate the first public key based on the first random number. The encryption algorithm is a mature technology in the field of data encryption transmission technology and will not be described in detail.

[0060] It is understood that because the first random number previously used by the third-party application to generate the key and the current second random number are generated based on the same random number generator, although the exact value of the first random number is unknown, the second random number can be obtained by selecting corresponding input parameters based on a predetermined time range and inputting them into the random number generator. Subsequent steps can then be used to determine whether the second random number can be used to calculate the encryption / decryption key for the third-party application. Once the random number is determined, the encryption / decryption key for the current encrypted data can be calculated using the same encryption algorithm.

[0061] S150: Determine whether the first public key is consistent with the second public key;

[0062] If they are consistent, step S160a is executed to calculate the encryption / decryption key based on the second random number.

[0063] In this embodiment, if the first public key is consistent with the second public key, it indicates that the second random number is the same as the first random number used by the third-party application. In this way, the encryption / decryption key can be directly calculated based on the second random number.

[0064] The technical solution provided by the embodiment of the present invention is that when a third-party application communicates with an electronic device such as a server based on the TLS / SSL protocol, the random numbers for generating the public key and encryption / decryption key by the third-party application are generated based on the first input parameter by the operating system's custom random number generator, replacing the original method of generating random numbers by the third-party application's own RNG function (random number generation function). Due to the use of the system's custom random number generator, the third-party application's own RNG function is replaced to generate the first random number sequence, so that the third-party application generates the public key and encryption / decryption key based on the random number sequence for encrypted transmission, obtains encrypted traffic by monitoring the network traffic in the communication link, and dynamically generates a second random number sequence based on the current input parameter based on the operating system's custom random number generator, and calculates the corresponding second public key based on the random number of the second random number sequence according to a preset encryption algorithm, compares the second public key with the first public key previously generated by the third-party program, and if they are consistent, the first random number can be reversed to obtain, and the encryption / decryption key is calculated based on the reversed first random number (i.e., the same as the second random number corresponding to the public key when it is consistent). In this way, compared with the existing network plaintext traffic data or encryption / decryption password acquisition scheme, by adopting the system-generated random number mechanism, there is no need for special customized development of different applications, nor is there any need to modify the third-party application program code, reverse analyze the application structure, unpack and deobfuscate. According to the above steps, the encryption / decryption key of the third-party application can be obtained, which makes it easier to obtain the communication plaintext traffic data of the third-party application.

[0065] In addition, the existing solution of obtaining network plaintext traffic data by hooking in the application cannot mount the hook for some applications with anti-debugging and integrity verification functions, resulting in the inability to successfully obtain network plaintext traffic data.

[0066] In this embodiment, by customizing the random number generator and its loading mechanism based on the operating system, there is no need to mount a hook (HOOK) in the application. The above method steps provided in this embodiment can successfully obtain network plaintext traffic data. Compared with the solution of mounting a hook in the application, the key acquisition success rate is high.

[0067] To ensure the random number function outputs high-quality random numbers, the system's custom random number generator uses a highly secure one-way hash function as its random number generator. The input parameters use a seed as the initial value, supplemented by real-time time and hardware information as variable inputs. Because hardware information such as instruction content and memory contents are strongly dependent on the terminal device environment, and because these parameters change with each device restart, the random number function ensures high-quality random number output without compromising the security of existing applications.

[0068] In addition, although based on the same custom random number generator, the parameters such as seed, real-time time, hardware information, etc. that serve as input parameters of the custom random number generator may be inconsistent, resulting in inconsistent random number outputs generated by the same random number generator. For example, the first random number and the second random number may be different, resulting in the inability to accurately calculate the encryption / decryption key.

[0069] To solve the problem that the encryption / decryption key cannot be calculated due to the deviation of the random number output, please refer to Figure 3 As shown, in some embodiments, after determining whether the first public key and the second public key are consistent, the method further includes: if they are inconsistent, executing step S160b1, enumerating random number generator input parameters within a predetermined time range, and inputting the parameters into the operating system custom random number generator to obtain a third random number sequence;

[0070] S160b3. Select a random number from the third random number sequence by polling, calculate a corresponding third public key based on the selected random number, and determine whether the third public key is consistent with the first public key;

[0071] S160b5. If they are consistent, the encryption / decryption key is calculated based on the random number corresponding to the polling time. The random number output of the third-party application is calculated by enumerating finite parameters in conjunction with the monitored traffic parameters, thereby deriving the decryption key.

[0072] In this embodiment, when the first public key and the second public key are inconsistent, that is, the first random number and the second random number are also inconsistent, the first random number used by the third-party application can be reversed by enumerating parameters, so that the decryption key can be calculated, thereby solving the problem of inconsistent random number sequences due to different input parameters and the inability to successfully obtain the key.

[0073] As disclosed above, the public key and the random number correspond to each other. After determining whether the public keys are consistent, it is also possible to determine whether the corresponding random numbers are the same. Therefore, in some embodiments, after determining that the public keys are consistent and before calculating the encryption / decryption key, the method further includes: determining that the second random number or the corresponding random number is the same as the first random number.

[0074] In some embodiments, before the third-party application extracts the first random number from the first random number sequence to generate the first public key and the encryption / decryption key, the method further includes: replacing the RNG function of the third-party application with an operating system-defined random number generator; the operating system-defined random number generator includes: a random number generator built into the operating system; generating a random number sequence based on the operating system-defined random number generator; the random number sequence includes a predetermined number of random numbers.

[0075] To replace the RNG function of a closed-source third-party application, the built-in random number generator (RNG) can be used, depending on the operating system, using its own loading mechanism. For example, on Windows, the DLL hijacking mechanism can be used to replace the third-party application's RNG function in memory; on Linux, the LD_PRELOAD loading mechanism can be used; and on Android, the .so file loading mechanism can be used. Input parameters for the random number generator include the seed, real-time clock, and hardware information such as instructions and memory.

[0076] In this embodiment, the RNG function of the third-party application itself is replaced by a custom random number generator based on the operating system, and when the third application communicates with the server, etc., the public key and encryption / decryption password are obtained according to a preset encryption algorithm based on the random number generated by the custom random number generator of the operating system. Subsequently, the random number generated by the same custom random number generator of the operating system is still used to deduce the same random number as the random number used by the third-party application, and then the encryption / decryption key is calculated. The program code of the third-party application does not need to be modified, and there is no need to reverse analyze the application structure and unpack and deobfuscate. That is, the TLS key can be dynamically obtained, and the plaintext traffic data can be successfully obtained.

[0077] Of course, in order to enable a third-party application to read random numbers from the system-specified random number generator when communicating, in some embodiments, it is necessary to configure the operating system environment of the terminal device and utilize the operation loading mechanism to enable the third-party application to read random numbers from the system-specified random number generator to implement the method steps in this embodiment, thereby successfully obtaining the decryption key, decrypting and obtaining the plaintext traffic data.

[0078] The third-party application communicates with the server based on the TLS / SSL protocol, and the communication key is a key for communication based on the TLS / SSL protocol.

[0079] Please see Figure 4 As shown, after obtaining the encryption / decryption key, the method further includes step S170 of decrypting the encrypted traffic using the encryption / decryption key to obtain corresponding plaintext traffic data. Thus, the obtained communication plaintext traffic data can be used to analyze and monitor the third-party application network traffic in real time.

[0080] To help understand the technical solutions provided by the embodiments of the present invention, the technical solutions and technical effects of the embodiments of the present invention are described in detail below with reference to specific examples:

[0081] A server (Linux system) runs a third-party application that uses the TLS encryption protocol to communicate with a remote server. To detect whether the application is malicious, the security software needs to analyze the communication traffic data between the third-party application and the server. The implementation process of this solution is as follows:

[0082] 1. Replace the RNG function of closed-source third-party applications based on the operating system loading mechanism. For example, in Linux, use the LD_PRELOAD dynamic library preloading mechanism to replace the RNG function and use the system's own random number generator. The input parameters include: seed, real-time time, instructions, memory and other hardware information.

[0083] 2. During the TLS communication initialization process, the closed-source third-party application reads the output of the system's built-in random number generator, takes the random number A as the root key, generates PUBKEY and other keys, which include encryption / decryption keys, and uses the encryption / decryption keys to encrypt and send data packets to the server.

[0084] 3. Monitor network traffic in network links in real time and obtain TLS encrypted traffic.

[0085] 4. Call the random number generator provided by the system, read the parameters such as the seed, real-time time, instruction, memory and other hardware information within a predetermined time range, and calculate a second random number sequence.

[0086] 5. Extract the key data PUBKEY carried in the network traffic, take the random number B from the second random number sequence, calculate the PUBKEY corresponding to the random number B, and determine whether the PUBKEY is consistent with the PUBKEY generated by the third-party application.

[0087] If they are consistent, it means that the random number of the key processing module is the same as the random number generated by the application, and the decryption key can be calculated directly.

[0088] If they are inconsistent, the RNG function input information real-time time, instruction data, memory and other hardware data within the predetermined deviation range will be enumerated to obtain the random number Ci;

[0089] Pi is calculated based on Ci until Pi is equal to PUBKEY, indicating that Ci is the same as the random number A. The encryption / decryption key is then derived based on Ci.

[0090] 6. Obtain encryption / decryption keys, decrypt TLS traffic, and obtain network plaintext traffic data, so that application network traffic can be analyzed and monitored in real time.

[0091] Therefore, in an embodiment of the present invention, based on a customized random number generator, a method for dynamically obtaining TLS keys is facilitated, thereby achieving successful decryption of TLS traffic; further, in this process, the problem of deviation in the output of the random number source and inability to successfully obtain the encryption / decryption key is solved, thereby improving the success rate of obtaining the TLS encryption / decryption key.

[0092] Specifically, the method of this embodiment can be developed into a program that is run to perform the method steps of this embodiment. Alternatively, the program can be integrated as a plug-in into common traffic monitoring and analysis software such as Wireshark and ssldump to expand new functions based on the original services of the software.

[0093] According to the above disclosure, the method for obtaining application communication keys provided by the embodiment of the present invention is based on replacing the original third-party application's own RNG function with a custom random number generator, and executing the above method steps to facilitate the successful dynamic acquisition of TLS encryption / decryption keys and achieve TLS traffic decryption. Furthermore, there is no need to modify the third-party application program code, reverse analyze the application structure, unpack and deobfuscate, and adopt a system loading mechanism to dynamically obtain TLS keys by executing the above method steps. Based on the system's built-in random number generator, the TLS key is calculated when needed, and there is no need to store it in a database or file. To a certain extent, it can prevent the leakage of TLS keys and ensure communication security.

[0094] Example 2

[0095] Figure 5This is a schematic block diagram of the system architecture for dynamically obtaining application communication keys according to an embodiment of the present invention. Figure 5 As shown, based on the same technical concept as each embodiment in the aforementioned embodiment 1, a system for dynamically obtaining an application communication key is also provided, including: a judgment program module 201, used to judge whether the first public key carried by the encrypted traffic during communication with the third-party application is consistent with the currently calculated second public key;

[0096] The decryption program module 203 is configured to calculate an encryption / decryption key based on the first random number used in calculating the first public key if the judgment is consistent;

[0097] The first public key and the second public key are both generated based on random numbers in a random number sequence generated by an operating system's custom random number generator according to real-time input parameters.

[0098] The system of this embodiment can be used to perform Figure 1 The technical solution of the method embodiment shown has similar implementation principles and technical effects to those of embodiment 1, which will not be described in detail here and can be referenced by each other.

[0099] Please see Figure 6 As shown, in some embodiments, the method includes: a monitoring program module 210, configured to monitor network traffic in a communication link and obtain encrypted traffic carrying the encrypted data when a third-party application extracts a first random number from a random number sequence to generate a first public key and an encryption / decryption key, encrypts data based on the encryption / decryption key, and transmits the encrypted data carrying the first public key; wherein the first random number sequence is generated based on a first input parameter by a custom random number generator of an operating system; a first generation program module 220, configured to generate a second random number sequence based on the random number generator according to current input parameters; an extraction program module 230, configured to extract the first public key carried in the encrypted traffic and extract a second random number from the second random number sequence; a calculation program module 240, configured to calculate a corresponding second public key based on the second random number using a preset encryption algorithm; a determination program module 260, configured to determine whether the first public key and the second public key are consistent; and a decryption program module 270, configured to calculate an encryption / decryption key based on the second random number if the determination is consistent. When the first public key and the second public key are consistent, the first random number and the second random number obtained based on the same encryption algorithm are the same.

[0100] The system of this embodiment can be used to perform Figure 1 The technical solution of the method embodiment shown has similar implementation principles and technical effects to those of embodiment 1, which will not be described in detail here and can be referenced by each other.

[0101] In addition, it is understandable that Figure 6The system shown is also applicable to the execution step processes of other embodiments in Example 1. For details, please refer to the relevant description in Example 1, which will not be repeated here.

[0102] The program modules in the embodiment of the present invention may also be combined or named in other ways according to the tasks performed by the program. Figure 7 As shown, for example, the system includes: a random number loading module for replacing the RNG function of a third-party application with a custom random number generator for the operating system; a key processing module for synchronously loading the custom random number generator for the operating system, and can execute the tasks performed by the above-mentioned first generation program module, extraction program module, calculation program module, judgment program module and decryption program module at the same time; a traffic monitoring module for executing the tasks performed by the above-mentioned monitoring program module. Here, the division of program modules is only used as an example to help understanding, and can vary according to the specific execution tasks. For example, the traffic monitoring module can also be integrated with the cryptographic processing module; but the overall execution step flow is basically the same. For details, please refer to Example 1 or the above description, and no further details will be given.

[0103] The system for dynamically obtaining application communication keys provided by an embodiment of the present invention cooperates with each other, works in synergy, and is closely connected through the above-mentioned program modules. Based on a custom random number generator, the original RNG function of the third-party application is replaced by the custom random number generator, and the above-mentioned method steps are executed to facilitate the successful dynamic acquisition of TLS encryption / decryption keys and achieve TLS traffic decryption. Furthermore, there is no need to modify the third-party application program code, reverse analyze the application structure, unpack and deobfuscate, and the system loading mechanism is used to dynamically obtain the TLS key by executing the above-mentioned method steps. The TLS key is calculated when needed based on the system's built-in random number generator, and does not need to be stored in a database or file. To a certain extent, the leakage of TLS keys can be prevented, ensuring communication security.

[0104] Example 3

[0105] The present invention also provides an electronic device according to an embodiment, comprising: one or more processors; a memory; one or more executable programs stored in the memory, the one or more processors reading the executable program code stored in the memory, and running a system for dynamically obtaining application communication keys corresponding to the executable program code, so as to execute the method for dynamically obtaining application communication keys described in any one of the first embodiments.

[0106] Figure 8 FIG. 1 is a schematic structural diagram of an embodiment of an electronic device of the present invention, which can implement any of the methods described in Embodiment 1 of the present invention, such as Figure 8As shown, as an optional embodiment, the above-mentioned electronic device may include: a shell 41, a processor 42, a memory 43, a circuit board 44 and a power supply circuit 45, wherein the circuit board 44 is placed inside the space enclosed by the shell 41, and the processor 42 and the memory 43 are arranged on the circuit board 44; the power supply circuit 45 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 43 is used to store executable program code; the processor 42 runs the system for dynamically obtaining application communication keys corresponding to the executable program code by reading the executable program code stored in the memory 43, and is used to execute the method for dynamically obtaining application communication keys described in any of the above-mentioned embodiments one.

[0107] The specific execution process of the above steps by the processor 42 and the steps further executed by the processor 42 by running the executable program code can be found in the description of the first embodiment of the method for dynamically obtaining the application communication key of the present invention, which will not be repeated here.

[0108] The electronic device exists in various forms, including but not limited to: (1) Mobile communication devices: These devices are characterized by having mobile communication functions and are mainly aimed at providing voice and data communications. Such terminals include: smart phones, multimedia phones, functional phones, and low-end phones. (2) Ultra-mobile personal computer devices: These devices belong to the category of personal computers, have computing and processing functions, and generally also have mobile Internet access features. Such terminals include: PDA, MID and UMPC devices, such as iPad. (3) Portable entertainment devices: These devices can display and play multimedia content. Such devices include: audio and video playback modules (such as iPod), handheld game consoles, e-books, as well as smart toys and portable car navigation devices. (4) Servers: Devices that provide computing services. The server's composition includes processors, hard disks, memory, system buses, etc. The server is similar to the general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability. (5) Other electronic devices with data interaction functions.

[0109] An embodiment of the present invention also provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the method of dynamically obtaining application communication keys as described in any of the above-mentioned embodiments.

[0110] In summary, according to the description of each of the above embodiments, it can be seen that the method and system for dynamically obtaining application communication keys disclosed in the embodiments of the present invention facilitate the successful dynamic acquisition of TLS encryption / decryption keys and realize TLS traffic decryption. Furthermore, there is no need to modify the third-party application program code, reverse analyze the application structure and de-shell and de-obfuscate, and the system loading mechanism is adopted to execute the above method steps to dynamically obtain the TLS key with a high success rate. Furthermore, by adopting the enumeration parameter range method, combined with monitoring the key parameters of the traffic, the random number used by the third-party application to generate the key is calculated, and the decryption key is derived, which solves the technical problem that the random number source output has a deviation and the TLS encryption / decryption key cannot be successfully obtained; further, based on the system's built-in random number generator, the TLS key is calculated when needed, and there is no need to store it in a database or file, which can prevent the leakage of TLS keys to a certain extent and ensure communication security.

[0111] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0112] Each embodiment in this specification is described in a related manner. The same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

[0113] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium, and when executed, the program can include the processes in the above-described method embodiments. The storage medium can also be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0114] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A method for dynamically obtaining an application communication key, characterized in that: The steps include: Determine whether the first public key carried in the encrypted traffic during communication with the third-party application is consistent with the currently calculated second public key; If they are consistent, the encryption / decryption key is calculated based on the first random number used when calculating the first public key; Wherein, the first public key and the second public key are both generated based on random numbers in a random number sequence generated by a custom random number generator of an operating system according to real-time input parameters; The method also includes: monitoring network traffic in the communication link to obtain encrypted traffic carrying encrypted data; During the communication process of the third-party application, a first random number is taken from a first random number sequence to generate a first public key and an encryption / decryption key, wherein the first random number sequence is generated by a custom random number generator of the operating system according to real-time input parameters; Encrypting the data to be transmitted based on the encryption / decryption key to obtain encrypted data; transmitting the encrypted data by carrying the first public key; After obtaining the encrypted traffic carrying the encrypted data, the method further includes: extracting the first public key carried in the encrypted traffic and obtaining a second random number from a second random number sequence, where the second random number sequence is generated by a custom random number generator of an operating system according to real-time input parameters; Calculate a corresponding second public key based on the second random number and a preset encryption algorithm; Determining whether the first public key is consistent with the second public key; If they are consistent, the encryption / decryption key is calculated based on the second random number; Before the third-party application program communicates, the method further includes: replacing the RNG function of the third-party application program with a custom random number generator of the operating system; the custom random number generator of the operating system includes: a built-in random number generator of the operating system; A random number sequence is generated based on a custom random number generator of the operating system; the random number sequence includes random numbers with a predetermined number of digits.

2. A method for dynamically obtaining an application communication key according to claim 1, characterized in that: After determining whether the first public key and the second public key are consistent, the method further includes: if they are inconsistent, enumerating random number generator input parameters within a predetermined time range and inputting them into the operating system custom random number generator to obtain a third random number sequence; Selecting a random number from the third random number sequence in round-robin fashion, calculating a corresponding third public key based on the selected random number, and determining whether the third public key is consistent with the first public key; If they are consistent, the encryption / decryption key is calculated based on the random number corresponding to the polling time.

3. A method for dynamically obtaining an application communication key according to claim 2, characterized in that: After the matching, but before the encryption / decryption key is calculated, the method further includes: determining that a second random number or a random number corresponding thereto is the same as the first random number.

4. A method for dynamically obtaining an application communication key according to claim 1, characterized in that: The real-time input parameter uses a seed as an initial value and is supplemented by real-time time and hardware information as variable inputs.

5. An electronic device, characterized in that: include: One or more processors; Memory; One or more executable programs are stored in the memory, and the one or more processors read the executable program code stored in the memory and run the system for dynamically obtaining application communication keys corresponding to the executable program code to execute the method for dynamically obtaining application communication keys described in any one of claims 1 to 4.

6. A computer-readable storage medium, characterized in that The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method for dynamically obtaining an application communication key as described in any one of claims 1 to 4.

Images