Method for identifying traffic message, electronic device and storage medium

Abstract

The application discloses a method for identifying a traffic message and an electronic device. The method comprises the following steps: determining whether a traffic message to be identified contains a first field; in the case that the traffic message contains the first field, sending a first authentication request message to a server; based on the first authentication request message, obtaining a first response message returned from the server, and determining whether the first response message contains a second field; based on the first response message, converting the first authentication request message into a second authentication request message, and determining whether a third field is contained at a first position of a data structure of the second authentication request message; in the case that the third field is contained at the first position of the data structure of the second authentication request message, determining that a transmission protocol of the traffic message is the first transmission protocol, and sending an identification result of the second authentication request message to a front end to monitor an authentication process.

Description

Technical Field

[0001] This application relates to the field of network security authentication, and in particular to a method, electronic device, and storage medium for identifying traffic packets. Background Technology

[0002] In the field of network security authentication, HTTP protocol is required for secure login authentication in certain scenarios. When a device connects a client and server, messages sent between them first pass through the device. The device receives and identifies these messages to perform HTTP authentication. In existing technologies, the typical identification process is as follows: The client sends a SYN packet to the server to request a connection. The device receives this packet, identifies it as port 80, and prioritizes determining whether HTTP Basic or Digest authentication is required. The client then sends a GET or POST request to the server. This request includes a Request Version field in the header, and if the value of this field includes "HTTP," the device recognizes it as an HTTP connection. Upon receiving the GET or POST request, the server returns a 401 challenge message. This message contains a WWW-Authenticate field in the header. The device identifies this field and determines authentication based on its value. If the value includes "Basic," it's identified as Basic authentication; if it includes "Digest," it's identified as Digest authentication. Devices using this HTTP authentication identification scheme may experience authentication errors and may not display HTTP authentication results immediately. If the authentication method of an HTTP connection is identified solely from the value of the WWW-Authenticate field, this field value could be altered by others, causing the device to misjudge the authentication method and leading to subsequent identification errors. When a large amount of traffic flows through the device (e.g., 10Gbps), because the above steps are required to transmit the HTTP authentication result to the front end via the interface, if each connection packet in 10Gbps traffic needs to go through three steps to transmit the result to the front end, it will cause a large number of packets to have their authentication method identified as blank within a short period of time. Summary of the Invention

[0003] To address the aforementioned technical issues, embodiments of this application provide a method, electronic device, and storage medium for identifying traffic packets. This method can, during the process of identifying traffic packets, judge the fields of authentication and response packets sent between the client and the server. Only when the fields of the packet meet the authentication requirements will the next authentication step be performed, and the identification result of the packet will be sent to the front end to monitor the authentication process, effectively avoiding judgment errors caused by malicious forgery of packets.

[0004] Embodiments of this application provide a method for identifying traffic packets, characterized in that the method includes:

[0005] Determine whether the traffic packet to be identified contains a first field, wherein the first field indicates that the transmission protocol of the traffic packet is a first transmission protocol;

[0006] If it is determined that the traffic packet contains the first field, a first authentication request packet is sent to the server, wherein the first authentication request packet represents an authentication request of the first transport protocol;

[0007] Based on the first authentication request message, obtain the first response message returned from the server, and determine whether the first response message contains a second field, wherein the second field represents the response result corresponding to the authentication request of the first transport protocol;

[0008] Based on the first response message, the first authentication request message is converted into a second authentication request message, and it is determined whether the first position of the data structure of the second authentication request message contains a third field, wherein the third field represents the recognition result of the second authentication request message;

[0009] If the third field is found to be present at the first position of the data structure of the second authentication request message, the transmission protocol of the traffic message is determined to be the first transmission protocol, and the identification result of the second authentication request message is sent to the front end to monitor the authentication process.

[0010] Preferably, the method further includes:

[0011] If it is determined that the first response message contains the second field, the second field is parsed to obtain the corresponding field value;

[0012] Based on the field value, the authentication method for the traffic packet is determined, wherein the authentication method includes at least a first authentication method and a second authentication method;

[0013] The authentication method is sent to the front end for display.

[0014] Preferably, the method further includes:

[0015] If the third field is found to be present at a first position in the data structure of the second authentication request message, the authentication method is verified.

[0016] If it is determined that the authentication method is the same as the authentication method for the traffic packet, the transmission protocol of the traffic packet is determined to be the first transmission protocol, and the verification result of the authentication method is sent to the front end for display.

[0017] Preferably, determining the authentication method for the traffic packet based on the field value includes:

[0018] If the value of the field is the first field value, the authentication method for the traffic packet is determined to be the first authentication method, and the first authentication method is sent to the front end for display.

[0019] Based on the first authentication method, the traffic packet is authenticated. If it is determined that the first response packet contains the second field, the third field is added to the first authentication request packet to form the second authentication request packet.

[0020] The second authentication request message is sent to the server to authenticate the traffic message.

[0021] Preferably, determining the authentication method for the traffic packet based on the field value further includes:

[0022] If the value of the first field is the value of the second field, the authentication method for the traffic packet is determined to be the second authentication method, and the second authentication method is sent to the front end for display.

[0023] Based on the second authentication method, the traffic packet is authenticated. If it is determined that the first response packet contains the second field, the third field and the fourth field are added to the first authentication request packet to form the second authentication request packet. The fourth field represents the identification result of the second authentication request packet under the second authentication method.

[0024] The second authentication request message is sent to the server to authenticate the traffic message.

[0025] Preferably, the method further includes:

[0026] Based on the first response message, the first authentication request message is converted into a second authentication request message, and it is determined whether the first position of the data structure of the second authentication request message contains the third field and the fourth field;

[0027] If the data structure of the second authentication request message contains the third field and the fourth field at a first position, the transmission protocol of the traffic message is determined to be the first transmission protocol.

[0028] Preferably, the step of sending a first authentication request message to the server when it is determined that the traffic packet contains the first field includes:

[0029] Determine whether the first field is contained at the first position in the data structure of the traffic packet;

[0030] If the first field is found to be present at a first position in the data structure of the traffic packet, a first transmission protocol tag is set on the traffic packet, and the traffic packet is authenticated using the corresponding authentication method.

[0031] The purpose of this application is to provide an electronic device, characterized in that it includes:

[0032] The acquisition module is configured to determine whether the traffic packet to be identified contains a first field, wherein the first field indicates that the transmission protocol of the traffic packet is a first transmission protocol;

[0033] The first processing module is configured to send a first authentication request message to the server when it is determined that the traffic packet contains the first field, wherein the first authentication request message represents an authentication request of the first transmission protocol.

[0034] The second processing module is configured to, based on the first authentication request message, obtain a first response message returned from the server, and determine whether the first response message contains a second field, wherein the second field represents the response result corresponding to the authentication request of the first transmission protocol;

[0035] The conversion module is configured to convert the first authentication request message into a second authentication request message based on the first response message, and determine whether a third field is contained at a first position in the data structure of the second authentication request message, wherein the third field represents the recognition result of the second authentication request message;

[0036] The determination module is configured to, when it is determined that the third field is contained in the first position of the data structure of the second authentication request message, determine that the transmission protocol of the traffic message is the first transmission protocol, and send the identification result of the second authentication request message to the front end to monitor the authentication process.

[0037] The purpose of this application is to provide an electronic device, including a memory and a processor, wherein the memory stores an executable program, and the processor executes the executable program to implement the steps of the method described above.

[0038] The purpose of this application is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the method described above.

[0039] Compared with existing technologies, the beneficial effects of this application's embodiments are as follows: During the process of identifying traffic packets, this application judges the fields of authentication and response packets sent between the client and server. Only when the packet fields meet the authentication requirements will the next authentication step be performed, and the packet identification result is sent to the front end to monitor the authentication process, effectively avoiding judgment errors caused by maliciously forged packets. This application solves the problem of authentication misjudgment by adding multiple judgment fields in subsequent judgments, thereby reducing the impact of modifying a single field value on authentication identification. The application proposes submitting the result to the front end for each judgment to speed up the display of HTTP authentication identification on the front end in each connection, enabling the page to quickly transmit the result to the front end when a large amount of traffic flows through the device. This application, by setting more verification and authentication steps, is more difficult for attackers to target, and can dynamically and in real-time transmit the verification result to the front end interface without any downtime; it judges multiple field values ​​for HTTP traffic, not relying on a single field value as the judgment point; and by transmitting the judgment result to the front end for real-time display, it reduces the impact of field value judgment on performance. Attached Figure Description

[0040] Figure 1 This is a flowchart of a method for identifying traffic packets according to an embodiment of this application;

[0041] Figure 2 This is another flowchart of the method for identifying traffic packets according to an embodiment of this application;

[0042] Figure 3 This is another flowchart illustrating the method for identifying traffic packets according to an embodiment of this application;

[0043] Figure 4 This is a flowchart of one embodiment of step S700 of this application;

[0044] Figure 5 This is a flowchart of another embodiment of step S700 of this application;

[0045] Figure 6 This is a flowchart of a specific embodiment of the method for identifying traffic packets according to the present application;

[0046] Figure 7 This is a structural block diagram of an electronic device according to an embodiment of this application;

[0047] Figure 8This is a structural block diagram of another electronic device according to an embodiment of this application. Detailed Implementation

[0048] Various embodiments and features of this application are described herein with reference to the accompanying drawings.

[0049] It should be understood that various modifications can be made to the embodiments described herein. Therefore, the above description should not be considered as limiting, but merely as an example of embodiments. Other modifications within the scope and spirit of this application will be apparent to those skilled in the art.

[0050] The accompanying drawings, which are included in and form part of this specification, illustrate embodiments of the present application and, together with the general description of the present application given above and the detailed description of the embodiments given below, serve to explain the principles of the present application.

[0051] These and other features of this application will become apparent from the following description of preferred forms of embodiments given as non-limiting examples, with reference to the accompanying drawings.

[0052] It should also be understood that although this application has been described with reference to some specific examples, those skilled in the art can certainly implement many other equivalent forms of this application.

[0053] The above and other aspects, features and advantages of this application will become more apparent when taken in conjunction with the accompanying drawings and in view of the following detailed description.

[0054] Specific embodiments of this application are described thereafter with reference to the accompanying drawings; however, it should be understood that the claimed embodiments are merely examples of this application, which can be implemented in various ways. Well-known and / or repeated functions and structures are not described in detail to avoid unnecessary or redundant details that could obscure the application. Therefore, the specific structural and functional details claimed herein are not intended to be limiting, but merely serve as the basis and representative basis for the claims to teach those skilled in the art to use this application in a variety of substantially any suitable detailed structures.

[0055] This specification may use the phrases “in one embodiment,” “in another embodiment,” “in yet another embodiment,” or “in other embodiments,” all of which may refer to one or more of the same or different embodiments according to this application.

[0056] like Figure 1 and Figure 6 As shown in the figure, this application provides a method for identifying traffic packets, the method including:

[0057] S100, determine whether the traffic packet to be identified contains the first field;

[0058] In this embodiment, firstly, a connection device is established between the client and the server. Traffic packets sent between the client and the server first pass through this device. When the acquired traffic packets pass through the device that identifies the traffic, the device changes the identification order based on the port of the traffic packets. For example, port 80 will be preferentially determined using the field values ​​unique to the HTTP protocol. Other ports will be preferentially determined using the unique and inherent field values ​​of the protocol closer to that port in the standard port, until all other protocol determinations with higher priority than the HTTP protocol fail. Then, the HTTP protocol field values ​​are used for protocol determination. After acquiring the traffic to be identified, it is determined whether the traffic packet to be identified contains a first field, where the first field represents the transmission protocol of the traffic packet as a first transmission protocol. Specifically, the first transmission protocol is the HTTP protocol, and the first field is a unique and inherent field of the HTTP protocol. The first field can be a Request Version field. For example, the first field is in the header of an HTTP GET request packet or a POST request packet. The meaning of this field value is the HTTP version. If its field value contains the HTTP field, it is directly determined to be the HTTP protocol, and information is sent to the interface, which displays it as basic authentication or digest authentication on the front end. If the value of this field is not recognized, it is determined to be another protocol.

[0059] S200, if it is determined that the traffic packet contains the first field, a first authentication request packet is sent to the server;

[0060] In this embodiment, upon determining that the traffic packet contains the first field, a first authentication request packet is sent to the server. This first authentication request packet represents an authentication request for the first transport protocol and can be a GET request packet or a POST request packet. Specifically, the client sends a GET request packet or a POST request packet to the server. Since the header of a GET request packet or a POST request packet may contain a Request Version field, the client can send a GET request packet or a POST request packet to prompt the server to respond, thereby identifying and authenticating the traffic packet.

[0061] S300, based on the first authentication request message, obtain the first response message returned from the server, and determine whether the first response message contains the second field;

[0062] In this embodiment, based on the first authentication request message, a first response message returned from the server is obtained, and it is determined whether the first response message contains a second field. The second field represents the response result corresponding to the authentication request of the first transport protocol. The first response message may be a 401 challenge message, and the second field may be a WWW-Authenticate field. Specifically, after receiving a GET request message or a POST request message, the server returns a 401 challenge message. This message header contains a WWW-Authenticate field, which is recognized by the device. That is, based on the GET request message or POST request message sent by the client, the server responds. If the server returns a 401 challenge message and the first response message contains the second field, it indicates that the traffic message has passed identification in this step. The identification result of the first authentication request message can be sent to the front end to monitor the authentication process.

[0063] S400, based on the first response message, convert the first authentication request message into a second authentication request message, and determine whether the first position of the data structure of the second authentication request message contains a third field;

[0064] In this embodiment, the client receives a first response message returned from the server, and based on the first response message, converts the first authentication request message into a second authentication request message. It then determines whether a third field is present at a first position in the data structure of the second authentication request message. This third field represents the identification result of the second authentication request message. Specifically, the third field is the Authorization field, which corresponds to the second field WWW-Authenticate. The second authentication request message can be a converted GET request message or a POST request message. If the first position in the data structure of the second authentication request message contains the third field, meaning the message header of the second authentication request message carries the Authorization field, then the second authentication request message is a legitimate message. If the first position in the data structure of the second authentication request message does not contain the third field, meaning the field value is not identified or the field value is incorrect, then the second authentication request message is a forged message.

[0065] S500, if it is determined that the third field is contained in the first position of the data structure of the second authentication request message, the transmission protocol of the traffic message is determined to be the first transmission protocol, and the identification result of the second authentication request message is sent to the front end to monitor the authentication process.

[0066] In this embodiment, if the third field is found to be present at the first position of the data structure of the second authentication request message, meaning the message header carries the Authorization field, then the second authentication request message is a legitimate message. This indicates that the traffic message has passed identification in this step, and the transmission protocol of the traffic message can be determined to be the first transmission protocol, i.e., HTTP. If the third field is not present at the first position of the data structure of the second authentication request message, meaning the field value is not identified or is incorrect, then the traffic message is a forged message. The identification result of the second authentication request message can be sent to the front end to monitor the authentication process.

[0067] This application, during the process of identifying traffic packets, evaluates the fields of authentication and response packets sent between the client and server. Only when the packet fields meet the authentication requirements will the next authentication step be performed. The identification result is then sent to the front end to monitor the authentication process, effectively preventing errors caused by maliciously forged packets. This application solves the problem of authentication misjudgment by adding multiple judgment fields in subsequent judgments, thereby reducing the impact of modifying a single field value on authentication identification. The application proposes submitting the result to the front end for each judgment to accelerate the speed of HTTP authentication identification and display on the front end for each connection, enabling the page to quickly deliver results to the front end when heavy traffic flows through the device. This application, by setting more verification and authentication steps, is more difficult for attackers to target and can dynamically and in real-time pass the verification results to the front end interface without any downtime; it performs judgments on multiple field values ​​in HTTP traffic, rather than relying on a single field value as the judgment point; and by passing the judgment result to the front end for real-time display, it reduces the performance impact of field value judgments.

[0068] In one embodiment of this application, such as Figure 2 and Figure 6 As shown, the method further includes:

[0069] S600, if it is determined that the first response message contains a second field, the second field is parsed to obtain the corresponding field value;

[0070] In this embodiment, when it is determined that the first response message contains the second field, that is, when the 401 challenge message returned by the service order contains the WWW-Authenticate field, the second field is parsed to obtain the corresponding field value. The field value of the second field can be the Basic field value or the Digest field value.

[0071] S700, based on the field value, determine the authentication method for the traffic packet;

[0072] In this embodiment, after determining that the first response message contains a second field and parsing the second field, if the corresponding field value is either a Basic field value or a Digest field value, the authentication method for the traffic message can be determined based on the obtained field value. The authentication method includes at least a first authentication method and a second authentication method. When the field value is a Basic field value, it is determined to be the first authentication method, i.e., basic authentication. When the field value is a Digest field value, it is determined to be the second authentication method, i.e., digest authentication.

[0073] S800, the authentication method is sent to the front end for display.

[0074] In this embodiment, after determining the authentication method for the traffic packet, the authentication method is sent to the front end for display. When the field value is the Basic field value, it is determined to be basic authentication, and Basic authentication is passed to the interface; the front end displays Basic authentication. When the field value is the Digest field value, it is determined to be digest authentication, and Digest authentication is passed to the interface; the front end displays Digest authentication.

[0075] In one embodiment of this application, such as Figure 3 and Figure 6 As shown, the method further includes:

[0076] S900, if it is determined that the third field is contained at the first position of the data structure of the second authentication request message, the authentication method is verified;

[0077] In this embodiment, the authentication method is verified when the third field is found to be present at the first position of the data structure of the second authentication request message, that is, when the header of the second authentication request message carries the Authorization field. Specifically, the authentication method can be compared with the authentication method for traffic messages to determine whether the authentication method and the authentication method for traffic messages are the same authentication method.

[0078] S1000: If it is determined that the authentication method is the same as the authentication method for the traffic packet, the transmission protocol of the traffic packet is determined to be the first transmission protocol, and the verification result of the authentication method is sent to the front end for display.

[0079] In this embodiment, if it is determined that the authentication method is the same as the authentication method for the traffic packet, the transmission protocol of the traffic packet is determined to be the first transmission protocol, i.e., the HTTP protocol. Specifically, both the first and second authentication methods will carry an Authorization field in the packet header when returning the username and password. The field value of this field will carry a special field value corresponding to the authentication, such as Basic authentication using the Basic field value and Digest authentication using the Digest field value. If the Basic field value is identified in both step S700 and step S900, it is directly determined to be Basic authentication, and parameters are passed to the interface, with the front end displaying Basic authentication. If the Digest field value is identified in both step S700 and step S900, it is first determined to be Digest authentication, and parameters are passed to the port, with the front end displaying Digest authentication. If the authentication identified in steps S700 and S900 is inconsistent, it is directly determined to be a malicious forged packet, and parameters are passed to the interface, with the front end displaying a forged packet.

[0080] In one embodiment of this application, such as Figure 4 and Figure 6 As shown, determining the authentication method for the traffic packet based on the field value includes:

[0081] S710, if the field value is the first field value, determine that the authentication method for the traffic packet is the first authentication method, and send the first authentication method to the front end for display;

[0082] In this embodiment, when the field value is the first field value, that is, the Basic field value, the authentication method for the traffic packet is determined to be the first authentication method, that is, basic authentication. After determining the specific authentication method by judging the field value, the first authentication method is sent to the front end for display.

[0083] S720, based on the first authentication method, the traffic packet is authenticated, and if it is determined that the first response packet contains the second field, the third field is added to the first authentication request packet to form the second authentication request packet;

[0084] In this embodiment, traffic packets are authenticated based on the first authentication method, namely basic authentication. If the first response packet contains a second field, the third field is added to the first authentication request packet to form the second authentication request packet. Specifically, after the client receives the first response packet returned by the server, i.e., a 401 challenge packet, and if it determines that the 401 challenge packet contains the WWW-Authenticate field, the client adds the third field to the first authentication request packet to form the second authentication request packet. For example, the Authorization field is added to a GET request packet or a POST request packet, so that the converted GET request packet or POST request packet is sent back to the server for further authentication.

[0085] S730, the second authentication request message is sent to the server to authenticate the traffic message.

[0086] In this embodiment, after adding the third field to the first authentication request message to form the second authentication request message, the second authentication request message is sent to the server for further authentication of the traffic message. Specifically, the converted GET request message or POST request message is sent to the server for further authentication. Since each step of the above process judges the field values ​​of the message, the next authentication step is only performed if the fields of the message meet the authentication requirements, and the message recognition result is sent to the front end to monitor the authentication process, effectively avoiding judgment errors caused by maliciously forged messages.

[0087] In a preferred embodiment of this application, such as Figure 6As shown, the identification and authentication of traffic packets can include the following process: The system starts up, and HTTP protocol port 80 is configured on the device's feth2 network interface. Traffic originating from IP 10.1.2.2 and destined for IP 10.1.2.3 is received. Upon receiving the traffic, the device's feth2 interface prioritizes determining the field values ​​according to the HTTP protocol (because the actual traffic uses the default HTTP port). After the TCP three-way handshake is completed for this traffic connection, the client sends a GET request packet to the server. This packet's header contains the Request Version field: HTTP 1.0. The device retrieves this field based on its detection depth, and since the field value contains the HTTP keyword, it directly tags the traffic with the HTTP protocol and begins subsequent HTTP authentication. Upon receiving the GET request, the server returns a 401 challenge packet. This packet's header contains the WWW-Authenticate field, and its value is Basic realm='WalleyWorld'. After recognizing this field value as the Basic field value, the device passes parameters to the specified port, displaying it as Basic authentication on the front end. After receiving a 401 challenge message, the client encrypts the username and password using Base64 encoding and then places them into the Authorization field in the message header, in the format: Basic xxxxxxxxx. When the device receives this message, it checks this field and finds the keyword "Basic" within it, directly determining it as basic authentication. It then sends parameters to the interface, and the front-end still displays "Basic authentication."

[0088] In one embodiment of this application, such as Figure 5 and Figure 6 As shown, determining the authentication method for the traffic packet based on the field value further includes:

[0089] S740, if the value of the field is the second field value, determine that the authentication method for the traffic packet is the second authentication method, and send the second authentication method to the front end for display;

[0090] In this embodiment, when the field value is the second field value, namely the Digest field value, the authentication method for the traffic packet is determined to be the second authentication method, namely digest authentication. After determining the specific authentication method by judging the field value, the second authentication method is sent to the front end for display.

[0091] S750, based on the second authentication method, the traffic packet is authenticated. If it is determined that the first response packet contains the second field, the third field and the fourth field are added to the first authentication request packet to form the second authentication request packet.

[0092] In this embodiment, traffic packets are authenticated based on a second authentication method, namely digest authentication. If the first response packet contains a second field, the third and fourth fields are added to the first authentication request packet to form a second authentication request packet. The fourth field represents the identification result of the second authentication request packet under the second authentication method and can be a response field. Specifically, after the client receives the first response packet returned by the server (a 401 challenge packet), if it determines that the 401 challenge packet contains a WWW-Authenticate field, the client adds the third and fourth fields to the first authentication request packet to form a second authentication request packet. For example, the Authorization and response fields are added to a GET or POST request packet to send the converted GET or POST request packet back to the server for further authentication. The fourth field is an additional judgment field value added for Digest authentication. This judgment is only performed if the preceding step determines it is Digest authentication. The value of this field is the response, which is found in the Authorization field in step S750. This field value is unique to Digest authentication. If this field value is not recognized or is incorrect, the judgment fails, and the message is directly identified as malicious forgery. Parameters are then sent to the interface, and the message is displayed as a forgery on the front end. If the judgment succeeds, the judgment process ends directly, and no more parameters are sent to the front end.

[0093] S760, the second authentication request message is sent to the server to authenticate the traffic message.

[0094] In this embodiment, after adding the third and fourth fields to the first authentication request message to form the second authentication request message, the second authentication request message is sent to the server for further authentication of the traffic message. Specifically, the converted GET request message or POST request message is sent to the server for further authentication. Since each step of the above process judges the field values ​​of the message, the next authentication step is only performed if the fields of the message meet the authentication requirements. Furthermore, this step adds a judgment field value unique to Digest authentication. This embodiment effectively avoids judgment errors caused by maliciously forged messages.

[0095] In one embodiment of this application, the method further includes:

[0096] Based on the first response message, the first authentication request message is converted into a second authentication request message, and it is determined whether the first position of the data structure of the second authentication request message contains the third field and the fourth field;

[0097] In this embodiment, after the client receives the first response message returned by the server, the client will convert the first authentication request message into a second authentication request message. If the authentication method for the traffic message is determined to be the second authentication method, the client will determine whether the first position of the data structure of the second authentication request message contains the third field and the fourth field. That is, the client will determine whether the header of the GET request message or the POST request message contains the Authorization field and the response field.

[0098] If the data structure of the second authentication request message contains the third field and the fourth field at a first position, the transmission protocol of the traffic message is determined to be the first transmission protocol.

[0099] In this embodiment, when it is determined that the third field and the fourth field are included in the first position of the data structure of the second authentication request message, that is, when it is determined that the header of the GET request message or POST request message includes the Authorization field and the response field, since the second authentication request message includes fields corresponding to the WWW-Authenticate field in the first response message and fields unique to the second authentication method, after this determination step, it can be determined that the transmission protocol of the traffic message is the first transmission protocol, that is, the HTTP protocol.

[0100] In one embodiment of this application, sending a first authentication request message to the server when it is determined that the traffic packet contains the first field includes:

[0101] Determine whether the first field is contained at the first position in the data structure of the traffic packet;

[0102] In this embodiment, determining whether a traffic packet contains a first field is specifically done by checking whether the first field is present at the first position of the traffic packet's data structure. Since the first field is a unique and inherent field of the HTTP protocol, it can be the Request Version field. If it is determined that the header of the traffic packet contains the first field, a first authentication request packet can be sent to the server.

[0103] If the first field is found to be present at a first position in the data structure of the traffic packet, a first transmission protocol tag is set on the traffic packet, and the traffic packet is authenticated using the corresponding authentication method.

[0104] In this embodiment, when it is determined that the first field is contained at the first position of the data structure of the traffic packet, that is, when it is determined that the header of the traffic packet contains the first field, the first transport protocol tag, that is, the HTTP protocol tag, can be set on the traffic packet, and the traffic packet can be authenticated using the corresponding authentication method, such as authenticating the traffic packet through basic authentication or digest authentication.

[0105] Based on the same inventive concept, embodiments of this application also provide an electronic device, such as... Figure 7 As shown, it includes:

[0106] The acquisition module is configured to determine whether the traffic packet to be identified contains a first field, wherein the first field indicates that the transmission protocol of the traffic packet is a first transmission protocol;

[0107] The first processing module is configured to send a first authentication request message to the server when it is determined that the traffic packet contains the first field, wherein the first authentication request message represents an authentication request of the first transmission protocol.

[0108] The second processing module is configured to obtain a first response message returned from the server based on the first authentication request message, and determine whether the first response message contains a second field, wherein the second field represents the response result corresponding to the authentication request of the first transmission protocol;

[0109] The conversion module is configured to convert the first authentication request message into a second authentication request message based on the first response message, and determine whether a third field is contained at a first position in the data structure of the second authentication request message, wherein the third field represents the recognition result of the second authentication request message;

[0110] The determination module is configured to, when it is determined that the third field is contained in the first position of the data structure of the second authentication request message, determine that the transmission protocol of the traffic message is the first transmission protocol, and send the identification result of the second authentication request message to the front end to monitor the authentication process.

[0111] In one embodiment of this application, the first processing module is further configured to:

[0112] If it is determined that the first response message contains the second field, the second field is parsed to obtain the corresponding field value;

[0113] Based on the field value, the authentication method for the traffic packet is determined, wherein the authentication method includes at least a first authentication method and a second authentication method;

[0114] The authentication method is sent to the front end for display.

[0115] In one embodiment of this application, the second processing module is further configured to:

[0116] If the third field is found to be present at a first position in the data structure of the second authentication request message, the authentication method is verified.

[0117] If it is determined that the authentication method is the same as the authentication method for the traffic packet, the transmission protocol of the traffic packet is determined to be the first transmission protocol, and the verification result of the authentication method is sent to the front end for display.

[0118] In one embodiment of this application, the second processing module is further configured to:

[0119] If the value of the field is the first field value, the authentication method for the traffic packet is determined to be the first authentication method, and the first authentication method is sent to the front end for display.

[0120] Based on the first authentication method, the traffic packet is authenticated. If it is determined that the first response packet contains the second field, the third field is added to the first authentication request packet to form the second authentication request packet.

[0121] The second authentication request message is sent to the server to authenticate the traffic message.

[0122] In one embodiment of this application, the conversion module is further configured to:

[0123] If the value of the first field is the value of the second field, the authentication method for the traffic packet is determined to be the second authentication method, and the second authentication method is sent to the front end for display.

[0124] Based on the second authentication method, the traffic packet is authenticated. If it is determined that the first response packet contains the second field, the third field and the fourth field are added to the first authentication request packet to form the second authentication request packet. The fourth field represents the identification result of the second authentication request packet under the second authentication method.

[0125] The second authentication request message is sent to the server to authenticate the traffic message.

[0126] In one embodiment of this application, the conversion module is further configured to:

[0127] Based on the first response message, the first authentication request message is converted into a second authentication request message, and it is determined whether the first position of the data structure of the second authentication request message contains the third field and the fourth field;

[0128] If the data structure of the second authentication request message contains the third field and the fourth field at a first position, the transmission protocol of the traffic message is determined to be the first transmission protocol.

[0129] In one embodiment of this application, the determining module is further configured to:

[0130] Determine whether the first field is contained at the first position in the data structure of the traffic packet;

[0131] If the first field is found to be present at a first position in the data structure of the traffic packet, a first transmission protocol tag is set on the traffic packet, and the traffic packet is authenticated using the corresponding authentication method.

[0132] Based on the same inventive concept, such as Figure 8 As shown, this embodiment also includes an electronic device, comprising:

[0133] Memory, used to store executable programs;

[0134] A processor for executing the executable program to implement the above method.

[0135] Since the principle of the electronic device in this application to solve the problem is similar to that of the method described above, the implementation of the electronic device can be found in the implementation of the method, and the repeated parts will not be described again.

[0136] This application provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the method provided in any embodiment of this application, including the method steps described above.

[0137] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk. Optionally, in this embodiment, the processor executes the method steps described in the above embodiments according to the program code stored in the storage medium. Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, which will not be repeated here. Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed on a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be executed in a different order than those described here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any specific hardware and software combination.

[0138] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0139] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for identifying traffic packets, characterized in that, The method includes: Determine whether the traffic packet to be identified contains a first field, wherein the first field represents that the transmission protocol of the traffic packet is a first transmission protocol, the first field is a Request Version field, and the first transmission protocol is the HTTP protocol; If it is determined that the traffic packet contains the first field, a first authentication request packet is sent to the server, wherein the first authentication request packet is a GET request packet or a POST request packet, the header of the first authentication request packet contains a Request Version field, and the first authentication request packet represents the authentication request of the first transport protocol. Based on the first authentication request message, obtain the first response message returned from the server, and determine whether the first response message contains a second field, wherein the second field is the WWW-Authenticate field, and the second field represents the response result corresponding to the authentication request of the first transport protocol; If it is determined that the first response message contains a second field, the second field is parsed to obtain the corresponding field value; if the field value is the first field value, the authentication method for the traffic message is determined to be the first authentication method, and the first authentication method is sent to the front end for display. The first authentication method is basic authentication, and the first field value is the Basic field value. The receiving client converts the first authentication request message into a second authentication request message based on the first response message. It then determines whether the first position of the data structure of the second authentication request message contains a third field, wherein the third field is the Authorization field, which represents the identification result of the second authentication request message, and the second authentication request message is a converted GET request message or a POST request message. If the third field is found to be present at the first position of the data structure of the second authentication request message, the transmission protocol of the traffic message is determined to be the first transmission protocol, and the identification result of the second authentication request message is sent to the front end to monitor the authentication process. If it is determined that the authentication method is the same as the authentication method for the traffic packet, the transmission protocol of the traffic packet is determined to be the first transmission protocol, and the verification result of the authentication method is sent to the front end for display. Based on the first authentication method, the traffic packet is authenticated. If it is determined that the first response packet contains the second field, the third field is added to the first authentication request packet to form the second authentication request packet. The second authentication request message is sent to the server to authenticate the traffic message.

2. The method according to claim 1, characterized in that, The method further includes: Based on the field value, the authentication method for the traffic packet is determined, wherein the authentication method includes at least a first authentication method and a second authentication method; The authentication method is sent to the front end for display.

3. The method according to claim 2, characterized in that, The step of determining the authentication method for the traffic packet based on the field value further includes: If the value of the first field is the value of the second field, the authentication method for the traffic packet is determined to be the second authentication method, and the second authentication method is sent to the front end for display. Based on the second authentication method, the traffic packet is authenticated. If it is determined that the first response packet contains the second field, the third field and the fourth field are added to the first authentication request packet to form the second authentication request packet. The fourth field represents the identification result of the second authentication request packet under the second authentication method. The second authentication request message is sent to the server to authenticate the traffic message.

4. The method according to claim 3, characterized in that, The method further includes: Based on the first response message, the first authentication request message is converted into a second authentication request message, and it is determined whether the first position of the data structure of the second authentication request message contains the third field and the fourth field; If the data structure of the second authentication request message contains the third field and the fourth field at a first position, the transmission protocol of the traffic message is determined to be the first transmission protocol.

5. The method according to claim 1, characterized in that, The step of sending a first authentication request message to the server when it is determined that the traffic packet contains the first field includes: Determine whether the first field is contained at the first position in the data structure of the traffic packet; If the first field is found to be present at a first position in the data structure of the traffic packet, a first transmission protocol tag is set on the traffic packet, and the traffic packet is authenticated using the corresponding authentication method.

6. An electronic device, characterized in that, include: The acquisition module is configured to determine whether the traffic packet to be identified contains a first field, wherein the first field represents that the transmission protocol of the traffic packet is a first transmission protocol, the first field is a Request Version field, and the first transmission protocol is the HTTP protocol; The first processing module is configured to send a first authentication request message to the server when it is determined that the traffic message contains the first field. The first authentication request message is a GET request message or a POST request message. The header of the first authentication request message contains a Request Version field. The first authentication request message represents the authentication request of the first transmission protocol. The second processing module is configured to: obtain a first response message returned from the server based on the first authentication request message; determine whether the first response message contains a second field, wherein the second field is a WWW-Authenticate field, and the second field represents the response result corresponding to the authentication request of the first transport protocol; if it is determined that the first response message contains a second field, parse the second field to obtain the corresponding field value; if the field value is a first field value, determine that the authentication method for the traffic message is a first authentication method, and send the first authentication method to the front end for display, wherein the first authentication method is basic authentication, and the first field value is the Basic field value; The conversion module is configured to receive a second authentication request message obtained by the client converting the first authentication request message based on the first response message, and determine whether the first position of the data structure of the second authentication request message contains a third field, wherein the third field is an Authorization field, the third field represents the identification result of the second authentication request message, and the second authentication request message is a converted GET request message or a POST request message; The determination module is configured to, when determining that the third field is contained in the first position of the data structure of the second authentication request message, determine that the transmission protocol of the traffic message is the first transmission protocol, and send the identification result of the second authentication request message to the front end to monitor the authentication process; when determining that the authentication method is the same as the authentication method for the traffic message, determine that the transmission protocol of the traffic message is the first transmission protocol, and send the verification result of the authentication method to the front end for display; Based on the first authentication method, the traffic packet is authenticated. If it is determined that the first response packet contains the second field, the third field is added to the first authentication request packet to form the second authentication request packet. The second authentication request message is sent to the server to authenticate the traffic message.

7. An electronic device, characterized in that, The method includes a memory and a processor, wherein the memory stores an executable program, and the processor executes the executable program to implement the steps of the method as claimed in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the method as described in any one of claims 1 to 5.

Images