A method for detecting encrypted traffic, a security system, and a proxy module.

Abstract

This application provides a method, security system, and proxy module for detecting encrypted traffic, relating to the field of network security technology. The encrypted traffic detection method provided in this application detects encrypted traffic that matches proxy policies and access control policies. When the access control policy references a deep packet inspection policy, the proxy module can interact with the deep packet inspection module based on the access control policy ID to achieve deep packet inspection. In other words, the proxy module can match the access control policy ID with the security configuration. Through a single dynamic configuration query process, it completes the matching between decrypted traffic and the access control policy, thereby avoiding the repeated matching of proxy policies and access control policies in the security system after decryption. This speeds up processing, improves efficiency, and, due to the reduced number of session connections required by the security system, increases the concurrency of the security system and saves significant system resources.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a method for detecting encrypted traffic, a security system, and a proxy module. Background Technology

[0002] With the rapid development of the internet, public awareness of cybersecurity has steadily increased, and the concern for data protection has become increasingly strong. To ensure security and privacy, network traffic typically requires SSL encryption. Currently, encrypted traffic has become the main type of traffic on the internet. Encryption is a double-edged sword; while protecting user privacy, it also provides opportunities for malicious users. This is because encryption can hide malicious traffic just like it hides other information, leading to a series of worms, Trojans, and viruses. To combat malicious network attacks exploiting the encryption features of SSL, firewalls have introduced SSL encrypted traffic detection functionality. This function can decrypt SSL encrypted traffic and then perform content security checks and audits on the decrypted traffic.

[0003] Currently, most firewalls utilize proxy functionality to decrypt encrypted traffic, and then use multiple security engines integrated within the firewall to perform deep packet inspection on the decrypted traffic. Because this function involves interaction between multiple security modules, although many firewalls already possess deep packet inspection capabilities for SSL encrypted traffic, existing methods for detecting encrypted traffic are slow, inefficient, have low concurrency, and consume significant system resources. Summary of the Invention

[0004] The purpose of this application is to provide a method, security system, and proxy module for detecting encrypted traffic, in order to solve the problems of existing methods for detecting encrypted traffic, which are slow, inefficient, have low concurrency, and consume a lot of system resources.

[0005] This application provides a method for detecting encrypted traffic, applied to a security system. The method includes:

[0006] Receive encrypted traffic sent by the client, perform proxy policy matching on the encrypted traffic, and determine whether the encrypted traffic matches the proxy policy.

[0007] If the encrypted traffic is determined to match the proxy policy, the matching proxy policy is notified to the proxy module, which then performs access control policy matching on the encrypted traffic and determines whether the access control policy is matched.

[0008] If the encrypted traffic is determined to match the access control policy, the corresponding access control policy ID is recorded in the encrypted traffic packet.

[0009] Encrypted traffic containing the access control policy ID is sent to the proxy module.

[0010] In the above technical solution, the encrypted traffic matches the proxy policy, meaning the encrypted traffic needs to be decrypted. The encrypted traffic also matches an access control policy, which may reference a deep packet inspection policy. Therefore, the access control policy ID is sent along with the encrypted traffic to the proxy module. This allows the proxy module to interact with the deep packet inspection module based on the access control policy ID when the access control policy references a deep packet inspection policy, thus enabling deep packet inspection. In other words, the proxy module can match the access control policy ID with the security configuration. Through a single dynamic configuration query process, the matching between the decrypted traffic and the access control policy is completed, avoiding the repeated matching of proxy policies and access control policies in the security system. This speeds up processing, improves efficiency, and increases the concurrency of the security system by using fewer security system session connections, saving significant system resources.

[0011] In some optional implementations, after determining whether the encrypted traffic matches the proxy policy, the method further includes:

[0012] If it is determined that the encrypted traffic does not match the proxy policy, then access control policy matching is performed;

[0013] Based on the matched access control policy, encrypted traffic is forwarded.

[0014] In the above technical solution, if the encrypted traffic does not match the proxy policy, the encrypted traffic does not need to be decrypted. The access control policy will be matched normally and forwarded according to the access control policy.

[0015] In some alternative implementations, after determining whether the encrypted traffic matches the access control policy, the method further includes:

[0016] If the encrypted traffic is determined not to have met the access control policy, the encrypted traffic will be sent to the proxy module.

[0017] In the above technical solution, the encrypted traffic hits the proxy policy but not the access control policy. That is, the encrypted traffic needs to be decrypted, but deep packet inspection is not required after decryption.

[0018] In some optional implementations, after sending encrypted traffic containing the access control policy ID to the proxy module, the method further includes:

[0019] Receive packets that have passed deep packet inspection sent by the proxy module and forward them to the server.

[0020] In some alternative implementations, the method further includes, before receiving encrypted traffic sent by the client:

[0021] Obtain deep packet inspection policies, access control policies, and proxy policies;

[0022] A deep packet inspection configuration file is generated based on the deep packet inspection strategy and shared with the proxy module;

[0023] Generate access control configuration files based on access control policies and share them with the proxy module; generate proxy configuration files based on proxy policies and share them with the proxy module.

[0024] The deep packet inspection configuration file is configured to be referenced by the access control configuration file.

[0025] In the above technical solution, users can input deep packet inspection policies, access control policies, and proxy policies into the security system through an interactive interface. The security system generates deep packet inspection configuration files, access control policy files, and proxy policy files respectively based on the deep packet inspection policies, access control policies, and proxy policies. The deep packet inspection configuration files, access control policy files, and proxy policy files are shared with the proxy module, and the deep packet inspection configuration files are configured to be referenced by the access control configuration files.

[0026] This application provides a method for detecting encrypted traffic, applied to a proxy module. The method includes:

[0027] Based on the proxy configuration corresponding to the proxy policy hit by the security system, receive the encrypted traffic sent by the security system, decrypt the encrypted traffic to obtain the decrypted message, and determine whether the access control policy ID exists in the decrypted message;

[0028] If the decryption message contains an access control policy ID, then the corresponding security configuration is found based on the access control policy ID.

[0029] Based on the found security configuration, the decrypted message is sent to the deep message detection module;

[0030] Receive the detection results returned by the deep packet inspection module; the detection results include whether to allow or prohibit sending.

[0031] Based on the detection results, determine whether to forward the decryption message.

[0032] In the above technical solution, when an access control policy is matched, the proxy module obtains the access control policy ID. If the access control policy also references a deep packet inspection policy, the proxy module can interact with the deep packet inspection module based on the access control policy ID to achieve deep packet inspection. In other words, the proxy module can match the access control policy ID with the security configuration. Through a single dynamic configuration query process, it completes the matching between decrypted traffic and the access control policy, thus avoiding the repeated matching of proxy policies and access control policies in the security system. This speeds up processing, improves efficiency, and increases the concurrency of the security system by using fewer security system session connections, saving significant system resources.

[0033] In some alternative implementations, the method further includes, before receiving encrypted traffic from the security system:

[0034] Obtain the deep packet inspection configuration file, access control configuration file, and proxy configuration file generated by the security system; wherein, the deep packet inspection configuration file is configured to be referenced by the access control configuration file;

[0035] Generate the corresponding security configuration based on the access control configuration file; generate the corresponding proxy configuration based on the proxy configuration file.

[0036] In the above technical solution, the proxy module maintains a master configuration, which includes proxy configuration and security configuration. If a proxy policy is configured, a corresponding proxy configuration file will be generated. This configuration file specifies the IP address, port, encryption method for SSL handshake negotiation, certificate, key, and other information that the proxy module needs to listen on. It is mainly used to provide SSL encryption and decryption services. If no proxy policy is configured, no proxy configuration can be generated, and SSL encryption and decryption services cannot be completed. The security configuration is included in the master configuration maintained by the proxy module. It is used by the proxy module to determine whether the decrypted traffic needs to undergo deep security inspection. If no access control policy is configured or the access control policy does not reference a deep packet inspection policy, the corresponding security configuration will not be generated, thus preventing the security inspection of decrypted traffic.

[0037] In some optional implementations, based on the detection results, it is determined whether to forward the decryption message, including:

[0038] If the detection result indicates that sending is allowed, the decrypted message will be sent to the forwarding module according to the agent configuration, or the decrypted message will be encrypted and then sent to the forwarding module.

[0039] This application provides a security system comprising:

[0040] The first judgment module is used to receive encrypted traffic sent by the client, perform proxy policy matching on the encrypted traffic, and determine whether the encrypted traffic matches the proxy policy.

[0041] The second judgment module is used to notify the proxy module of the matched proxy policy if it is determined that the encrypted traffic matches the proxy policy, and to perform access control policy matching on the encrypted traffic and determine whether the access control policy is matched.

[0042] The recording module is used to record the corresponding access control policy ID in the encrypted traffic packet if it is determined that the encrypted traffic matches the access control policy.

[0043] The sending module is used to send encrypted traffic containing the access control policy ID to the proxy module.

[0044] An embodiment of this application provides a proxy module, including:

[0045] The third judgment module is used to receive encrypted traffic sent by the security system according to the proxy configuration corresponding to the proxy policy hit by the security system, decrypt the encrypted traffic to obtain the decrypted message, and determine whether there is an access control policy ID in the decrypted message.

[0046] The configuration module is used to find the corresponding security configuration based on the access control policy ID if the decrypted message contains an access control policy ID.

[0047] The sending detection module is used to send the decrypted message to the deep message detection module based on the found security configuration;

[0048] The receiving result module is used to receive the detection results returned by the deep packet inspection module; the detection results include allowing transmission and prohibiting transmission.

[0049] The processing module is used to determine whether to forward the decryption message based on the detection results. Attached Figure Description

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0051] Figure 1 A flowchart illustrating the steps of applying the detection method provided in this application to a security system;

[0052] Figure 2 A flowchart illustrating the steps of applying the detection method provided in this application embodiment to the proxy module;

[0053] Figure 3 A schematic diagram illustrating the workflow of the security system and agent module provided in the embodiments of this application;

[0054] Figure 4 This is a schematic diagram illustrating the relationship between the various policy configuration files provided in this embodiment.

[0055] Icons: 1-Client, 2-Server, 3-Security System, 4-Proxy Module, 5-Deep Packet Inspection Module. Detailed Implementation

[0056] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0057] Please refer to Figure 1 , Figure 1 A flowchart illustrating the steps of applying the detection method provided in this application to a security system, the method comprising:

[0058] Step 110: Receive encrypted traffic sent by the client, perform proxy policy matching on the encrypted traffic, and determine whether the encrypted traffic matches the proxy policy.

[0059] Step 120: If it is determined that the encrypted traffic hits the proxy policy, the proxy policy that has been hit is notified to the proxy module, the access control policy is matched for the encrypted traffic, and it is determined whether the access control policy is hit.

[0060] Step 130: If it is determined that the encrypted traffic matches the access control policy, then record the corresponding access control policy ID in the encrypted traffic packet.

[0061] Step 140: Send the encrypted traffic containing the access control policy ID to the proxy module.

[0062] In this embodiment, the encrypted traffic matches a proxy policy, meaning it needs to be decrypted. The encrypted traffic also matches an access control policy, which may reference a deep packet inspection (DCI) policy. Therefore, the DCI policy ID is sent to the proxy module along with the encrypted traffic. This allows the proxy module to interact with the DCI module based on the DCI policy ID when the DCI policy references a DCI policy, enabling DCI detection. In other words, the proxy module can match the DCI policy ID with the security configuration. Through a single dynamic configuration query, the matching between the decrypted traffic and the access control policy is completed, avoiding redundant matching of the proxy policy and access control policy in the security system. This speeds up processing, improves efficiency, and increases the number of security system session connections used, thus saving significant system resources.

[0063] In some optional implementations, after determining whether the encrypted traffic matches the proxy policy, the method further includes: if it is determined that the encrypted traffic does not match the proxy policy, then performing access control policy matching; and forwarding the encrypted traffic according to the matched access control policy.

[0064] In this embodiment of the application, if the encrypted traffic does not match the proxy policy, the encrypted traffic does not need to be decrypted, and the access control policy matching will proceed normally, and the traffic will be forwarded according to the access control policy.

[0065] In some optional implementations, after determining whether the encrypted traffic hits the access control policy, the method further includes: if it is determined that the encrypted traffic does not hit the access control policy, then sending the encrypted traffic to the proxy module.

[0066] In this embodiment of the application, the encrypted traffic hits the proxy policy but does not hit the access control policy. That is, the encrypted traffic needs to be decrypted, but deep packet inspection after decryption is not required.

[0067] In some optional implementations, after sending encrypted traffic containing the access control policy ID to the proxy module, the method further includes: receiving packets that have passed deep packet inspection sent by the proxy module and forwarding them to the server.

[0068] In some optional implementations, before receiving encrypted traffic sent by the client, the method further includes: obtaining a deep packet inspection policy, an access control policy, and a proxy policy; generating a deep packet inspection configuration file based on the deep packet inspection policy and sharing it with the proxy module; generating an access control configuration file based on the access control policy and sharing it with the proxy module; generating a proxy configuration file based on the proxy policy and sharing it with the proxy module; wherein the deep packet inspection configuration file is configured to be referenced by the access control configuration file.

[0069] In this embodiment, the user can input the deep packet inspection policy, access control policy and proxy policy into the security system through the interactive interface. The security system generates a deep packet inspection configuration file, an access control policy file and a proxy policy file respectively according to the deep packet inspection policy, access control policy and proxy policy. The deep packet inspection configuration file, access control policy file and proxy policy file are shared with the proxy module. The deep packet inspection configuration file is configured to be referenced by the access control configuration file.

[0070] Please refer to Figure 2 , Figure 2 The flowchart illustrates the steps of applying the detection method provided in this application embodiment to the proxy module. The method includes:

[0071] Step 210: According to the proxy configuration corresponding to the proxy policy hit by the security system, receive the encrypted traffic sent by the security system, decrypt the encrypted traffic to obtain the decryption message, and determine whether there is an access control policy ID in the decryption message;

[0072] Step 220: If the decrypted message contains an access control policy ID, then find the corresponding security configuration based on the access control policy ID;

[0073] Step 230: Based on the found security configuration, send the decrypted message to the deep packet inspection module;

[0074] Step 240: Receive the detection results returned by the deep packet inspection module; the detection results include allowing transmission and prohibiting transmission.

[0075] Step 250: Based on the detection results, determine whether to forward the decryption message.

[0076] In this embodiment, when an access control policy is matched, the proxy module obtains the access control policy ID. If the access control policy also references a deep packet inspection policy, the proxy module can interact with the deep packet inspection module based on the access control policy ID to perform deep packet inspection. In other words, the proxy module can match the access control policy ID with the security configuration. Through a single dynamic configuration query process, it completes the matching between decrypted traffic and the access control policy, thus avoiding the repeated matching of proxy policies and access control policies in the security system. This speeds up processing, improves efficiency, and increases the number of security system session connections used, thereby increasing the concurrency of the security system and saving significant system resources.

[0077] In some optional implementations, before receiving encrypted traffic sent by the security system, the method further includes: obtaining a deep packet inspection configuration file, an access control configuration file, and a proxy configuration file generated by the security system; wherein the deep packet inspection configuration file is configured to be referenced by the access control configuration file; generating a corresponding security configuration based on the access control configuration file; and generating a corresponding proxy configuration based on the proxy configuration file.

[0078] In this embodiment, the proxy module maintains a master configuration, which includes proxy configuration and security configuration. If a proxy policy is configured, a corresponding proxy configuration file is generated. This configuration file specifies the IP address, port, encryption method for SSL handshake negotiation, certificate, key, and other information that the proxy module needs to listen to. It is mainly used to provide SSL encryption and decryption services. If no proxy policy is configured, no proxy configuration can be generated, and SSL encryption and decryption services cannot be completed. The security configuration is included in the master configuration maintained by the proxy module. It is used by the proxy module to determine whether the decrypted traffic needs to undergo deep security inspection. If no access control policy is configured or the access control policy does not reference a deep packet inspection policy, the corresponding security configuration will not be generated, thus preventing the security inspection of decrypted traffic from being implemented.

[0079] In some optional implementations, based on the detection result, it is determined whether to forward the decryption message, including: if the detection result indicates that sending is allowed, then according to the proxy configuration, the decryption message is sent to the forwarding module, or the decryption message is encrypted and then sent to the forwarding module.

[0080] Please refer to Figure 3 , Figure 3 This is a schematic diagram illustrating the workflow of the security system 3 and the proxy module 4 provided in this embodiment. Both the proxy module 4 and the deep packet inspection module 5 exist as independent third-party processes within the firewall, i.e., independent of the security system 3. The specific workflow is as follows:

[0081] Client 1 sends SSL encrypted traffic to server 2, and this traffic first reaches the firewall.

[0082] After receiving SSL-encrypted traffic, the firewall directs the traffic to security system 3 for proxy policy matching. If no proxy policy is matched, it means the traffic does not require SSL decryption, and access control policy matching and forwarding according to the policy will proceed normally. If a proxy policy is matched, it means the traffic requires SSL decryption. In this case, access control policy matching will be performed on the traffic. If an access control policy is matched, the access control policy ID will be recorded in the appropriate position in the packet, and then the encrypted traffic will be directed to proxy module 4 for SSL decryption.

[0083] After decrypting the traffic, proxy module 4 retrieves the access control policy ID, i.e., fw_id, from the packet. If fw_id does not exist, it means that the packet only requires SSL decryption and does not need to undergo deep packet inspection after decryption; if fw_id exists, it means that the packet hits an access control policy that references a deep packet inspection policy, and deep packet inspection is required for the decrypted packet.

[0084] Agent module 4 looks up the security configuration corresponding to fw_id in the configuration file based on fw_id, and then parses the configuration items in the configuration and stores them in the data structure.

[0085] According to the security configuration, the proxy module 4 introduces the decrypted message into the deep message inspection module 5, which performs content security checks and audits on the message and returns the inspection results to the proxy module 4. The proxy module 4 then decides whether to encrypt the message according to the proxy configuration and whether to forward the message according to the message security inspection results.

[0086] For example Figure 3 As shown, in this embodiment, for the firewall's security system 3, one encrypted traffic inspection service only occupies two session connections of the security system 3. One session connection is "Client 1 - Proxy Policy - Access Control Policy - Proxy Module 4", and the other session connection is "Proxy Module 4 - Forwarding Module - Server 2". For the firewall's proxy module 4, one encrypted traffic inspection service only occupies two session connections of the proxy module 4. One session connection is "Security System 3's Access Control Policy - Proxy Module 4", and the other session connection is "Proxy Module 4 - Security System 3's Forwarding Module".

[0087] In program design, the configuration of policies corresponding to different modules is unique, and the configuration files are static. If there are multiple deep packet inspection policies, access control policies, and proxy policies, multiple corresponding configuration files will be generated. Since proxy services and security services are in different and independent processes, if the correspondence between the configuration files cannot be clearly defined, the expected security detection purpose cannot be achieved. This invention mainly utilizes the unique identifier fw_id of the access control policy as the matching keyword between the configurations of each service. This allows the proxy module 4 to obtain the fw_id matched by the packet after decryption and to look up the corresponding security configuration through this identifier, thus completing a dynamic configuration query process. Then, according to the security configuration, the packet is introduced into the deep packet inspection module 5, which performs security detection on the decrypted packet, thereby realizing the mapping between security services and proxy services.

[0088] For details, please refer to Figure 4 , Figure 4 This is a schematic diagram illustrating the relationship between the various policy configuration files provided in this embodiment.

[0089] Within the firewall device, proxy module 4 maintains a master configuration file, which includes proxy and security configurations. If a proxy policy is configured, a corresponding proxy configuration file is generated. This file specifies the IP address, port, SSL handshake encryption method, certificate, and key that proxy module 4 needs to listen on, primarily used to provide SSL encryption and decryption services. If no proxy policy is configured, a proxy configuration file cannot be generated, and SSL encryption and decryption services cannot be completed.

[0090] Configuring a deep packet inspection strategy will generate a deep packet inspection configuration file.

[0091] Configure an access control policy and reference the configured deep packet inspection policy. This will generate a configuration file corresponding to the access control policy, which contains the relevant configurations for the referenced deep packet inspection policy. Simultaneously, a security configuration file will be generated. This configuration file will be included in the overall configuration maintained by proxy module 4, and will be used by proxy module 4 to determine whether decrypted traffic requires deep security inspection. If no access control policy is configured or the access control policy does not reference a deep packet inspection policy, no corresponding security configuration file will be generated, thus preventing the implementation of security inspection of decrypted traffic.

[0092] With the above strategy correctly configured, proxy module 4 will first decrypt the traffic using SSL based on the proxy configuration, then find the corresponding security configuration based on the fw_id obtained during traffic processing, and introduce the decrypted traffic into the deep packet inspection process according to the configuration to perform security inspection on the decrypted traffic.

[0093] In one specific embodiment, the encrypted traffic detection method is applied to a scenario of encrypted traffic file filtering. The method includes the following steps:

[0094] Configure a proxy policy in the firewall, and configure an access control policy that references the file filtering policy.

[0095] When the encrypted data message of the device matches the proxy policy and the access control policy that references the file filtering policy, the access control policy ID is first recorded in the message, and then the message is introduced into the proxy module 4.

[0096] The proxy module 4 performs SSL decryption on the encrypted data packet and then obtains the access control policy ID through the data socket.

[0097] The proxy module 4 uses the obtained access control ID to find the corresponding configuration block in the security configuration of the configuration file and obtains the security configuration related to the file filtering policy.

[0098] Based on the obtained security configuration information, the proxy module 4 identifies that the decrypted message needs to be filtered for files, and then sends the request for file filtering detection, file information and other relevant data to the deep message detection module 5.

[0099] After receiving the request, the deep message detection module 5 parses the detection type specified in the request, calls the file filtering module to perform the detection, and then returns the detection result to the agent module 4.

[0100] The proxy module 4 receives the file filtering detection results and processes the traffic packets according to the actions specified in the configuration.

[0101] One embodiment of this application also provides a security system, including a first judgment module, a second judgment module, a recording module, and a sending module.

[0102] The system comprises the following modules: a first judgment module, which receives encrypted traffic sent by the client, performs proxy policy matching on the encrypted traffic, and determines whether the encrypted traffic matches a proxy policy; a second judgment module, which, if the encrypted traffic matches a proxy policy, notifies the proxy module of the matched proxy policy, performs access control policy matching on the encrypted traffic, and determines whether the access control policy matches; a recording module, which, if the encrypted traffic matches an access control policy, records the corresponding access control policy ID in the encrypted traffic packet; and a sending module, which sends the encrypted traffic containing the recorded access control policy ID to the proxy module.

[0103] An embodiment of this application also provides a module including a third judgment module, a configuration module, a sending detection module, a receiving result module, and a processing module.

[0104] The system comprises the following modules: The third judgment module receives encrypted traffic from the security system based on the proxy configuration corresponding to the proxy policy matched by the security system, decrypts the encrypted traffic to obtain a decrypted message, and determines whether an access control policy ID exists in the decrypted message. The configuration module, if an access control policy ID exists in the decrypted message, searches for the corresponding security configuration based on that ID. The sending detection module sends the decrypted message to the deep packet inspection module based on the found security configuration. The receiving result module receives the detection results returned by the deep packet inspection module; these results include allowing and prohibiting transmission. The processing module determines whether to forward the decrypted message based on the detection results.

[0105] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0106] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0107] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0108] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0109] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for detecting encrypted traffic, characterized in that, Applied to a security system, the method includes: Receive encrypted traffic sent by the client, perform proxy policy matching on the encrypted traffic, and determine whether the encrypted traffic matches the proxy policy; If the encrypted traffic is determined to match the proxy policy, the matching proxy policy is notified to the proxy module, and the encrypted traffic is matched with the access control policy to determine whether the access control policy is matched. If the encrypted traffic is determined to match an access control policy, the corresponding access control policy ID is recorded in the encrypted traffic message. Encrypted traffic containing the access control policy ID is sent to the proxy module; The proxy module decrypts the encrypted traffic and matches it with the security configuration based on the access control policy ID. Based on the matched security configuration, the decrypted message is sent to the deep packet inspection module for deep packet inspection.

2. The method as described in claim 1, characterized in that, After determining whether the encrypted traffic matches the proxy policy, the method further includes: If it is determined that the encrypted traffic does not match the proxy policy, then access control policy matching is performed; Based on the matched access control policy, encrypted traffic is forwarded.

3. The method as described in claim 1, characterized in that, After determining whether the encrypted traffic matches the access control policy, the method further includes: If it is determined that the encrypted traffic does not match the access control policy, the encrypted traffic will be sent to the proxy module.

4. The method as described in claim 1, characterized in that, After sending the encrypted traffic containing the access control policy ID to the proxy module, the method further includes: Receive packets that have passed deep packet inspection sent by the proxy module and forward them to the server.

5. The method as described in claim 1, characterized in that, Before receiving encrypted traffic sent by the client, the method further includes: Obtain deep packet inspection policies, access control policies, and proxy policies; A deep packet inspection configuration file is generated based on the deep packet inspection strategy and shared with the proxy module; Generate access control configuration files based on access control policies and share them with the proxy module; generate proxy configuration files based on proxy policies and share them with the proxy module. The deep packet inspection configuration file is configured to be referenced by the access control configuration file.

6. A method for detecting encrypted traffic, characterized in that, Applied to a proxy module, the method includes: Based on the proxy configuration corresponding to the proxy policy hit by the security system, receive the encrypted traffic sent by the security system, decrypt the encrypted traffic to obtain the decrypted message, and determine whether the access control policy ID exists in the decrypted message; If the decryption message contains an access control policy ID, then the corresponding security configuration is found based on the access control policy ID. Based on the found security configuration, the decrypted message is sent to the deep message detection module; Receive the detection results returned by the deep packet inspection module; the detection results include whether to allow or prohibit sending. Based on the detection results, determine whether to forward the decryption message.

7. The method as described in claim 6, characterized in that, Before receiving encrypted traffic sent by the security system, the method further includes: Obtain the deep packet inspection configuration file, access control configuration file, and proxy configuration file generated by the security system; wherein, the deep packet inspection configuration file is configured to be referenced by the access control configuration file; Generate the corresponding security configuration based on the access control configuration file; generate the corresponding proxy configuration based on the proxy configuration file.

8. The method as described in claim 7, characterized in that, The step of determining whether to forward the decryption message based on the detection result includes: If the detection result indicates that sending is allowed, the decrypted message will be sent to the forwarding module according to the agent configuration, or the decrypted message will be encrypted and then sent to the forwarding module.

9. A security system, characterized in that, include: The first judgment module is used to receive encrypted traffic sent by the client, perform proxy policy matching on the encrypted traffic, and determine whether the encrypted traffic matches the proxy policy. The second judgment module is used to notify the proxy module of the matched proxy policy if it is determined that the encrypted traffic matches the proxy policy, and to perform access control policy matching on the encrypted traffic and determine whether the access control policy matches. The recording module is used to record the corresponding access control policy ID in the encrypted traffic packet if it is determined that the encrypted traffic hits the access control policy. The sending module is used to send encrypted traffic containing the access control policy ID to the proxy module; wherein, the proxy module decrypts the encrypted traffic, matches it with the security configuration based on the access control policy ID, and sends the decrypted message to the deep packet inspection module for deep packet inspection based on the matched security configuration.

10. A proxy module, characterized in that, include: The third judgment module is used to receive encrypted traffic sent by the security system according to the proxy configuration corresponding to the proxy policy hit by the security system, decrypt the encrypted traffic to obtain the decrypted message, and determine whether there is an access control policy ID in the decrypted message. The configuration module is used to find the corresponding security configuration based on the access control policy ID if the decrypted message contains an access control policy ID. The sending detection module is used to send the decrypted message to the deep message detection module based on the found security configuration; The receiving result module is used to receive the detection results returned by the deep packet inspection module; the detection results include allowing transmission and prohibiting transmission. The processing module is used to determine whether to forward the decryption message based on the detection result.

Images