Data processing method and device

Abstract

The data processing method and apparatus provided by the present invention can be applied to an intermediate proxy device. In a session established by the intermediate proxy device for a client and a server, the method determines a session to be decrypted; detects a session to be decrypted including an encrypted connection request session and uses it as a target session; obtains message key information of the target session, where the message key information is obtained by the intermediate proxy device during the encrypted connection proxy process between the client and the server; and decrypts the transmission message of the target session based on the message key information. The present invention can detect the target session through data detection, thereby effectively detecting and decrypting the transmission message between the client and the server that needs to be decrypted. While effectively decrypting the message, the method avoids decrypting the transmission message between the client and the server that does not need to be decrypted, effectively avoiding unnecessary consumption of decryption resources and ensuring the utilization rate of decryption resources.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a data processing method and device. Background Art

[0002] With the development of science and technology, data processing technology continues to improve.

[0003] Currently, data exchange between some clients and servers requires the use of an intermediate proxy device. Specifically, when an intermediate proxy device is performing data exchange between a client and a server, it can first establish a corresponding session between the client and the server, and then perform data exchange on behalf of the client and the server by proxying the transmission messages in the session.

[0004] Among them, some clients and servers need to be encrypted and transmitted through an intermediate proxy device. Among these clients and servers, some of the transmission messages between the clients and servers need to be decrypted by the intermediate proxy device, while some of the transmission messages between the clients and servers do not need to be decrypted by the intermediate proxy device.

[0005] However, the intermediate proxy device cannot determine which transmission messages between the client and the server should be decrypted, which may result in unnecessary consumption of decryption resources and low utilization of decryption resources. Summary of the Invention

[0006] The present invention provides a data processing method and device to solve the problem that the intermediate proxy device in the prior art cannot determine which client and server transmission messages should be decrypted, which may lead to unnecessary consumption of decryption resources and low utilization of decryption resources. The method and device can effectively detect the transmission messages between the client and the server that need to be decrypted and decrypt them, avoiding decryption of the transmission messages between the client and the server that do not need to be decrypted, effectively avoiding unnecessary consumption of decryption resources and ensuring utilization of decryption resources.

[0007] The present invention provides a data processing method, which is applied to an intermediate proxy device. The data processing method includes:

[0008] Determining a session to be decrypted in a session established by the intermediate proxy device for the client and the server;

[0009] Detecting whether the transmission message of the session to be decrypted includes an encrypted connection request message;

[0010] In a case where it is detected that the transmission message of the session to be decrypted includes an encrypted connection request message, taking the corresponding session to be decrypted as a target session;

[0011] Acquire message key information of the target session, where the message key information is acquired during an encrypted connection proxy process between the intermediate proxy device and the client and the server;

[0012] Decrypt the transmission message of the target session based on the message key information.

[0013] Optionally, detecting whether the transmission message of the to-be-decrypted session includes an encrypted connection request message includes:

[0014] detecting whether the first transmission message of the session to be decrypted is the encrypted connection request message;

[0015] In the case that it is detected that the first transmission message is not the encrypted connection request message, it is continued to detect whether the transmission message after the first transmission message includes the encrypted connection request message.

[0016] Optionally, when detecting that the first transmitted message is not the encrypted connection request message, continuing to detect whether a transmitted message subsequent to the first transmitted message includes the encrypted connection request message includes:

[0017] In the case of detecting that the first transmission message is not the encrypted connection request message, detecting whether the transmission message after the first transmission message includes an encryption negotiation message;

[0018] In the case of detecting that the transmission message subsequent to the first transmission message includes the encryption negotiation message, detecting whether the transmission message subsequent to the encryption negotiation message includes the encryption connection request message.

[0019] Optionally, the encryption negotiation message includes an encryption negotiation identifier; and the detecting whether a transmission message subsequent to the first transmission message includes an encryption negotiation message when detecting that the first transmission message is not the encrypted connection request message includes:

[0020] In the case of detecting that the first transmission message is not the encrypted connection request message, initializing an encryption negotiation identifier detection device;

[0021] The encryption negotiation identifier detector detects whether the transmission message after the first transmission message includes the encryption negotiation identifier, so as to detect whether the transmission message after the first transmission message includes the encryption negotiation message.

[0022] Optionally, when detecting that a transmission message subsequent to the first transmission message includes the encryption negotiation message, detecting whether the transmission message subsequent to the encryption negotiation message includes the encrypted connection request message includes:

[0023] generating an encrypted connection detection identifier and identifying the to-be-decrypted session including the encrypted negotiation message when detecting that the transmission message after the first transmission message includes the encrypted negotiation message;

[0024] In the to-be-decrypted session including the encrypted connection detection identifier, it is detected whether the transmission message following the encrypted negotiation message includes the encrypted connection request message.

[0025] Optionally, the encrypted connection request message includes a handshake data packet for requesting to establish an encrypted connection;

[0026] Detecting whether the transmission message of the to-be-decrypted session includes the encrypted connection request message includes:

[0027] In a case where it is detected that the transmission message of the session to be decrypted includes the handshake data packet, determining that the transmission message of the session to be decrypted is the encrypted connection request message;

[0028] When it is detected that the transmission message of the session to be decrypted does not include the handshake data packet, it is determined that the transmission message of the session to be decrypted is not the encrypted connection request message.

[0029] Optionally, determining a session to be decrypted in a session established by the intermediate proxy device for the client and the server includes:

[0030] In the session established by the intermediate proxy device for the client and the server, if a session whose connection information matches the pre-configured decryption connection information is detected, the corresponding session is determined as the session to be decrypted.

[0031] Optionally, obtaining the message key information of the target session includes:

[0032] Based on the encrypted connection request message in the target session, perform an encrypted connection proxy with a target client and a target server, obtain a first symmetric key negotiated with the target client, and obtain a second symmetric key negotiated with the target server; wherein the target client is the client corresponding to the target session, and the target server is the server corresponding to the target session;

[0033] The first symmetric key and the second symmetric key are determined as the message key information.

[0034] Optionally, the target client stores the first symmetric key; and decrypting the transmission message of the target session based on the message key information includes:

[0035] Obtaining a first encrypted transmission message sent by the target client in the target session; the first encrypted transmission message is a message generated by the target client based on the first symmetric key after the encrypted connection proxy is completed;

[0036] Decrypt the first encrypted transmission message based on the first symmetric key.

[0037] Optionally, the target server stores the second symmetric key; and decrypting the transmission message of the target session based on the message key information includes:

[0038] Obtaining a second encrypted transmission message sent by the target server in the target session; the second encrypted transmission message is a message generated by the target server based on the second symmetric key after the encrypted connection proxy is completed;

[0039] Decrypt the second encrypted transmission message based on the second symmetric key.

[0040] Optionally, after decrypting the first encrypted transmission message based on the first symmetric key, the data processing method further includes:

[0041] Obtaining a first decrypted message; wherein the first decrypted message is a message obtained by decrypting the first encrypted transmission message based on the first symmetric key;

[0042] Detecting whether the first decrypted message is a network attack message;

[0043] When it is detected that the first decrypted message is not a network attack message, the first decrypted message is encrypted based on the second symmetric key to obtain a corresponding first encrypted message and send it to the target server.

[0044] Optionally, after decrypting the second encrypted transmission message based on the second symmetric key, the data processing method further includes:

[0045] Obtaining a second decrypted message; wherein the second decrypted message is a message obtained by decrypting the second encrypted transmission message based on the second symmetric key;

[0046] detecting whether the second decrypted message is a network attack message;

[0047] When it is detected that the second decrypted message is not a network attack message, the second decrypted message is encrypted based on the first symmetric key, a corresponding second encrypted message is obtained, and the encrypted message is sent to the target client.

[0048] The present invention further provides a data processing device, which is applied to an intermediate proxy device. The data processing method includes: a first determining unit, a first detecting unit, a first performing unit, a first obtaining unit, and a first decrypting unit; wherein:

[0049] The first determining unit is configured to determine a session to be decrypted in a session established by the intermediate proxy device for the client and the server;

[0050] The first detection unit is configured to detect whether the transmission message of the session to be decrypted includes an encrypted connection request message;

[0051] The first acting unit is configured to, when detecting that the transmission message of the session to be decrypted includes an encrypted connection request message, use the corresponding session to be decrypted as a target session;

[0052] The first acquiring unit is configured to acquire the message key information of the target session, where the message key information is acquired during the encrypted connection proxy process between the intermediate proxy device and the client and the server;

[0053] The first decryption unit is configured to decrypt the transmission message of the target session based on the message key information.

[0054] The data processing method and apparatus provided by the present invention can determine at least one session to be decrypted from a session established by an intermediate proxy device for a client and a server, and then detect whether the session to be decrypted includes an encrypted connection request message to detect the session to be decrypted that includes the encrypted connection request message, i.e., the session to be decrypted that has initiated an encrypted connection. The session to be decrypted that has initiated an encrypted connection is used as the target session, and the message key information of the target session is obtained through the encrypted connection proxy. The transmission message of the target session is decrypted based on the message key information. The present invention can detect the target session through data detection, thereby effectively detecting and decrypting the transmission message between the client and the server that needs to be decrypted. While effectively decrypting the message, it can avoid decrypting the transmission message between the client and the server that does not need to be decrypted, effectively avoiding the unnecessary consumption of decryption resources and ensuring the utilization rate of decryption resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0056] Figure 1This is one of the flow charts of the data processing method proposed in the embodiment of the present invention;

[0057] Figure 2 This is the second flow chart of the data processing method proposed in the embodiment of the present invention;

[0058] Figure 3 This is a schematic diagram of the process of the encrypted connection proxy proposed in an embodiment of the present invention;

[0059] Figure 4 is a structural diagram of a data processing device proposed in an embodiment of the present invention;

[0060] Figure 5 It is a schematic structural diagram of an electronic device proposed in an embodiment of the present invention. DETAILED DESCRIPTION

[0061] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0062] The following combination Figure 1-Figure 3 The data processing method of the present invention is described.

[0063] like Figure 1 As shown, the present invention proposes a first data processing method, which can be applied to an intermediate proxy device. The data processing method may include the following steps:

[0064] S101. Determine a session to be decrypted in a session established by an intermediate proxy device for a client and a server;

[0065] It should be noted that the intermediate proxy device can establish sessions between multiple clients and multiple servers, and transmit messages between the clients and servers in the corresponding sessions. For example, the intermediate proxy device can establish a first session between a first client and a first server, and a second session between a second client and a second server. In the first session, the first client and the first server transmit messages, and in the second session, the second client and the second server transmit messages.

[0066] Specifically, a session established between a client and a server by an intermediate proxy device may include two sub-sessions: a sub-session established by the intermediate proxy device with the client, and a sub-session established by the intermediate proxy device with the server. Upon receiving a connection request message from the client requesting a connection with the server, the intermediate proxy device may obtain the five-tuple information of the connection request message and determine the IP address of the client and the IP address of the server based on the five-tuple information. The intermediate proxy device may then establish a connection with the client and the server, establish a sub-session with the client, and establish a sub-session with the server, and associate the five-tuple information of the two sub-sessions, thereby associating the two sub-sessions (one five-tuple information can uniquely identify one sub-session). At this point, upon receiving a message in a sub-session, the intermediate proxy device may determine another corresponding sub-session based on the sub-session and transmit the received message in the other sub-session, thereby enabling message transmission between the client and the server.

[0067] The session to be decrypted is a session in which message decryption is to be performed.

[0068] Optionally, the present invention may determine any established session as a session to be decrypted;

[0069] Optionally, the present invention may also detect one or more sessions to be decrypted that meet a certain determination condition from all established sessions based on a certain determination condition of the session to be decrypted.

[0070] S102, detecting whether the transmission message of the session to be decrypted includes an encrypted connection request message;

[0071] The encrypted connection request message may be a message sent by a client to request an encrypted connection with a server.

[0072] Specifically, the present invention can respectively detect whether the transmission message of each session to be decrypted includes an encrypted connection request message.

[0073] It is understood that the encrypted connection request message may be a message having a specific message format and message content. The present invention can detect whether a transmission message of a session to be decrypted is an encrypted connection request message based on the specific message format and message content of the encrypted connection request message, thereby realizing detection of whether the transmission message of the session to be decrypted includes an encrypted connection request message.

[0074] S103: When it is detected that the transmission message of the session to be decrypted includes an encrypted connection request message, the corresponding session to be decrypted is used as the target session;

[0075] The target session is the session to be decrypted that includes the encrypted connection request message.

[0076] Specifically, the present invention can treat a session to be decrypted as a target session when it is detected that a transmission message of a session to be decrypted includes an encrypted connection request message.

[0077] It is understandable that the present invention can detect one target session or multiple target sessions.

[0078] Optionally, in the present invention, when it is not detected that the transmission message of a certain session to be decrypted includes an encrypted connection request message, the session to be decrypted may be prohibited from being used as a target session.

[0079] S104: Obtain message key information of the target session, where the message key information is obtained during the encrypted connection proxy process between the intermediate proxy device and the client and server;

[0080] Specifically, the message key information of the target session may include two sub-key information, which are the key information of the transmission messages of two sub-sessions of the target session respectively.

[0081] Specifically, the present invention can perform encrypted connection proxy for the client and server corresponding to the target session, that is, perform encrypted connection with the corresponding client and server respectively, and obtain the key information of the corresponding two sub-sessions during the encrypted connection proxy process, thereby obtaining the message key information of the target session.

[0082] S105: Decrypt the transmission message of the target session based on the message key information.

[0083] Specifically, the present invention can decrypt the transmission message of the target session based on the message key information after obtaining the message key information of the target session.

[0084] It should be noted that after the encrypted connection proxy for the target session is completed, encrypted transmission can be performed between the intermediate proxy device and the corresponding client and server.

[0085] It is understandable that the transmission message in the target session after the encrypted connection proxy is completed is the encrypted transmission message. Therefore, the transmission message in the target session after the encrypted connection is completed can be the transmission message between the client and the server that the present invention determines needs to be decrypted.

[0086] It is understandable that the present invention can only decrypt the transmission message in the target session after the encrypted connection proxy is completed, effectively avoiding erroneous decryption and unnecessary consumption of decryption resources.

[0087] Specifically, the present invention can decrypt the transmission message in the target session after the encrypted connection proxy is completed based on the message key information.

[0088] The data processing method proposed in the present invention can determine at least one session to be decrypted from the session established by the intermediate proxy device for the client and the server, and then detect whether the session to be decrypted includes an encrypted connection request message to detect the session to be decrypted that includes the encrypted connection request message, that is, the session to be decrypted that has initiated an encrypted connection. The session to be decrypted that has initiated an encrypted connection is used as the target session, and the message key information of the target session is obtained through the encrypted connection proxy. The transmission message of the target session is decrypted based on the message key information. The present invention can detect the target session through data detection, thereby effectively detecting and decrypting the transmission message between the client and the server that needs to be decrypted. While effectively realizing message decryption, it can avoid decrypting the transmission message between the client and the server that does not need to be decrypted, effectively avoiding the unnecessary consumption of decryption resources and ensuring the utilization rate of decryption resources.

[0089] like Figure 2 As shown, the present invention proposes a second data processing method. In this data processing method, step S102 may include steps S201 and S202; wherein:

[0090] S201, detecting whether the first transmission message of the session to be decrypted is an encrypted connection request message;

[0091] Specifically, when detecting whether the transmission message of the session to be decrypted includes the encrypted connection request message, the present invention may first detect whether the first transmission message of the session to be decrypted is the encrypted connection request message.

[0092] S202: When it is detected that the first transmission message is not an encrypted connection request message, continue to detect whether the transmission messages after the first transmission message include an encrypted connection request message.

[0093] Specifically, when the present invention detects that the first transmission message of the session to be decrypted is not an encrypted connection request message, it can continue to detect whether the transmission messages after the first transmission message in the session to be decrypted include encrypted connection request messages.

[0094] It should be noted that, when the present invention detects that the first transmitted message of the session to be decrypted is a non-encrypted connection request message, it can be determined that the first transmitted message of the session to be decrypted is a plaintext message, that is, it can be determined that after the session to be decrypted is established, the corresponding client and server first perform plaintext transmission through the intermediate proxy device.

[0095] When the present invention detects that the first transmission message of the session to be decrypted is an encrypted connection request message, it can be determined that after the session to be decrypted is established, the corresponding client and server are directly encrypted connected through the intermediate proxy device for encrypted transmission.

[0096] Specifically, the present invention can be applied to a decryption scenario in which, after a session to be decrypted is established, the corresponding client and server first perform plain text transmission and then perform encrypted transmission through an intermediate proxy device. It can also be applied to a decryption scenario in which, after a session to be decrypted is established, the corresponding client and server directly perform an encrypted connection through an intermediate proxy device for encrypted transmission.

[0097] The data processing method proposed in the present invention can be applied to decryption scenarios in which the client and the server first transmit plain text through an intermediate proxy device and then perform encrypted transmission, and can also be applied to decryption scenarios in which the client and the server directly establish an encrypted connection through an intermediate proxy device for encrypted transmission, thereby realizing the diversification of decryption application scenarios.

[0098] based on Figure 2 The present invention proposes a third data processing method. In this method, step S202 may include steps S2021 and S2022, wherein:

[0099] S2021. When detecting that the first transmitted message is a non-encrypted connection request message, detecting whether the transmitted messages subsequent to the first transmitted message include an encryption negotiation message;

[0100] The encryption negotiation message may be a message for requesting encryption negotiation.

[0101] It should be noted that in the present invention, in a scenario where the client and server first perform plain text transmission and then encrypt transmission through an intermediate proxy device, an encryption negotiation message can be transmitted to indicate that the message transmission mode will be converted from plain text transmission to encrypted transmission.

[0102] Specifically, the encrypted negotiation message may be a message with a specific message format and message content. The present invention can detect whether the transmission message after the first transmission message of the session to be decrypted includes the encrypted negotiation message based on the specific message format and message content of the encrypted negotiation message.

[0103] S2022: When it is detected that the transmission message after the first transmission message includes the encryption negotiation message, detect whether the transmission message after the encryption negotiation message includes the encryption connection request message.

[0104] Specifically, if an encrypted negotiation message is detected in a transmission message subsequent to the initial transmission message of a session to be decrypted, the present invention can determine that the message transmission mode between the intermediate proxy device and the corresponding client and server will be switched from plaintext transmission to encrypted transmission. In this case, the present invention can determine that the corresponding client and server will establish an encrypted connection through the intermediate proxy device. In this case, the present invention can detect whether the transmission message subsequent to the encrypted negotiation message of the corresponding session to be decrypted includes an encrypted connection request message.

[0105] It should be noted that the present invention can detect whether the transmission message of the session to be decrypted includes an encrypted connection request message only when it is detected that the transmission message after the first transmission message of the session to be decrypted includes an encrypted negotiation message, which can effectively reduce the resources required to detect the encrypted connection request message.

[0106] It should also be noted that, in the present invention, if it is not detected that the transmission message after the first transmission message of a session to be decrypted includes an encrypted negotiation message, there is no need to detect whether the transmission message of the session to be decrypted includes an encrypted connection request message, thereby further reducing the resources required to detect the encrypted connection request message.

[0107] Optionally, in other data processing methods proposed by the present invention, the encryption negotiation message includes an encryption negotiation identifier. In this case, step S2021 may include:

[0108] In the case of detecting that the first transmission message is a non-encrypted connection request message, initializing the encryption negotiation identifier detection machine;

[0109] The encryption negotiation identifier detector detects whether the transmission message after the first transmission message includes the encryption negotiation identifier, so as to detect whether the transmission message after the first transmission message includes the encryption negotiation message.

[0110] The encryption negotiation identifier may be a character string used to identify encryption negotiation to be performed.

[0111] Specifically, the encryption negotiation message may be a message including an encryption negotiation identifier.

[0112] The encryption negotiation identifier detector may be a pre-set executable code, program or module for detecting whether a transmission message includes an encryption negotiation identifier.

[0113] Specifically, the present invention can initialize the encryption negotiation identifier detector when detecting that the first transmission message of the session to be decrypted is not an encrypted connection request message, and after initialization, use the encryption negotiation identifier detector to detect whether the transmission message includes the encryption negotiation identifier.

[0114] Specifically, the present invention can initialize the encryption negotiation identifier detection machine accordingly based on the transport layer protocol in the five-tuple information of the first transmitted message, so that it can detect the encryption negotiation identifier of the corresponding transport layer protocol, and use the encryption negotiation identifier detection machine that has been initialized accordingly to detect whether the transmitted message includes the encryption negotiation identifier.

[0115] It should be noted that the present invention can effectively detect the encrypted negotiation message through the encrypted negotiation identifier detector.

[0116] Optionally, in other data processing methods proposed in the present invention, step S2022 may include:

[0117] When it is detected that the transmission message after the first transmission message includes the encryption negotiation message, an encryption connection detection identifier is generated and the session to be decrypted including the encryption negotiation message is identified;

[0118] In a to-be-decrypted session including an encrypted connection detection identifier, it is detected whether a transmission message following an encrypted negotiation message includes an encrypted connection request message.

[0119] The encryption connection detection identifier may be used to identify that a session to be decrypted requires detection of an encryption connection request message.

[0120] Specifically, when detecting that the transmission message after the first transmission message of a session to be decrypted includes an encryption negotiation message, the present invention can generate an encryption connection detection identifier and use the encryption connection detection identifier to identify the session to be decrypted.

[0121] It is understandable that, when the session to be decrypted includes an encrypted connection detection identifier, the present invention detects whether its transmission message includes an encrypted connection request message, which can effectively reduce the resources consumed by detecting the encrypted connection request message.

[0122] Optionally, for a session to be decrypted that does not include an encrypted connection detection identifier, the present invention may not need to detect whether its transmission message includes an encrypted connection request message, thereby further reducing resources consumed by detecting the encrypted connection request message.

[0123] The data processing method proposed in the present invention can detect whether the transmission message of the session to be decrypted includes an encrypted connection request message only when it is detected that the transmission message after the first transmission message of the session to be decrypted includes an encrypted negotiation message, which can effectively reduce the resources required to detect the encrypted connection request message.

[0124] based on Figure 1 The present invention proposes a fourth data processing method. In this method, the encrypted connection request message includes a handshake data packet for requesting to establish an encrypted connection; in this case:

[0125] Check whether the transmission message of the session to be decrypted includes an encrypted connection request message, including:

[0126] In a case where it is detected that the transmission message of the session to be decrypted includes a handshake data packet, determining that the transmission message of the session to be decrypted is an encrypted connection request message;

[0127] When it is detected that the transmission message of the session to be decrypted does not include a handshake data packet, it is determined that the transmission message of the session to be decrypted is not an encrypted connection request message.

[0128] The handshake data packet may be a data packet sent by the client for establishing an encrypted connection with the server. Optionally, the handshake data packet may be a Client Hello packet.

[0129] The encrypted connection request message may be a message including a handshake data packet.

[0130] Specifically, the present invention can detect whether the transmission messages of the session to be decrypted include the encrypted connection request message by detecting whether each transmission message of the session to be decrypted is an encrypted connection request message.

[0131] The present invention can detect whether a transmission message of a session to be decrypted includes a handshake data packet, thereby detecting whether the transmission message is an encrypted connection request message.

[0132] Specifically, the present invention can determine that a transmission message of a session to be decrypted includes a handshake data packet when detecting that the transmission message is an encrypted connection request message. In this case, it can be determined that the transmission message of the session to be decrypted includes an encrypted connection request message.

[0133] Specifically, when detecting that a transmission message of a session to be decrypted does not include a handshake data packet, the present invention can determine that the transmission message is not an encrypted connection request message. At this time, it cannot be determined that the transmission message of the session to be decrypted includes an encrypted connection request message.

[0134] It is understandable that the specific manner of detecting whether the transmission message of the session to be decrypted includes the encrypted connection request message can also be applied to other data processing methods of the present invention, such as the second and third data processing methods described above.

[0135] The data processing method proposed in the present invention can effectively realize the detection of encrypted connection request messages, thereby effectively ensuring the detection of target sessions and the detection of transmission messages between the client and the server that need to be decrypted.

[0136] based on Figure 1 The present invention proposes a fifth data processing method. In this method, step S101 may include:

[0137] In a session established by the intermediate proxy device for the client and the server, if a session whose connection information matches the pre-configured decryption connection information is detected, the corresponding session is determined as a session to be decrypted.

[0138] The connection information may be information used to connect the client and the server for message transmission.

[0139] Optionally, the connection information may be five-tuple information for communication between the client and the server;

[0140] Optionally, the connection information may include identification information of the client, identification information of the server, and a message transmission protocol. The identification information of the client and the identification information of the server may be the IP address of the client and the IP address of the server, respectively.

[0141] In actual applications, the messages involved in the processing of some services need to be decrypted, while the messages involved in the processing of some services do not need to be decrypted. The present invention can determine whether the messages involved in the processing of the services need to be decrypted based on the type of the services.

[0142] It should be noted that the client and the server can process corresponding services through message transmission, and the connection information between the client and the server can be used to identify the services processed by the client and the server. The present invention can pre-set the connection information corresponding to the service that requires message decryption as decryption connection information, such as the decryption connection information table shown in Table 1.

[0143] Table 1

[0144] Policy Name Source IP Source Port Destination IP Destination port protocol AAA 192.168.0.0 / 24 any 10.10.0.1 25 SMTP BBB 192.168.0.0 / 24 any 10.10.0.1 110 POP3 CCC 192.168.0.0 / 24 any 10.10.0.1 143 IMAP

[0145] The policy name in Table 1 is the name of a decryption connection information.

[0146] Among them, SMTP is Simple Mail Transfer Protocol (SMTP), POP3 is Post Office Protocol-Version 3 (POP3), and IMAP is Internet Mail Access Protocol (IMAP).

[0147] In practical applications, the present invention can decrypt Hypertext Transfer Protocol Secure (HTTPS) messages transmitted between a client and a server using SMTP, POP3 or IMAP.

[0148] Specifically, the present invention can detect whether there is a session whose connection information matches the decrypted connection information in the session established by the intermediate proxy device. If so, the session whose connection information matches the decrypted connection information can be determined as the session to be decrypted.

[0149] The data processing method proposed in the present invention can determine the session to be decrypted from the session established by the intermediate proxy device based on the decrypted connection information, and then only detect whether the transmission message of the session to be decrypted includes the encrypted connection request message, without the need to detect the session that is not the session to be decrypted, which can effectively reduce the resources required to detect whether the connection request message is encrypted.

[0150] based on Figure 1 The present invention proposes a sixth data processing method. In this method, step S104 may include steps S1041 and S1042, wherein:

[0151] S1041. Based on the encrypted connection request message in the target session, perform an encrypted connection proxy with the target client and the target server; wherein the target client is the client corresponding to the target session, and the target server is the server corresponding to the target session;

[0152] Specifically, the present invention can perform encrypted connection proxy with the target client and the target server when an encrypted connection request message in the target session is detected, that is, perform encrypted connections with the target client and the target server respectively.

[0153] It is understandable that, during the process of establishing encrypted connections with the target client and the target server respectively, the intermediate proxy device acts as a server to establish an encrypted connection with the target client, and acts as a client to establish an encrypted connection with the target server.

[0154] like Figure 3In the flowchart of the encrypted connection proxy shown in the figure, the intermediate proxy device can act as a server to establish an encrypted connection with the target client. The intermediate proxy device can obtain the Client Hello packet sent by the target client, return the Server Hello packet to the target client, obtain the key negotiation message sent by the target client for key negotiation, conduct key negotiation with the target client, and return a message to the target client indicating that the change of the client specification has been completed after the key negotiation is completed. At this time, the intermediate proxy device completes the encrypted connection with the target client; in addition, the intermediate proxy device can act as a client to establish an encrypted connection with the target server. The intermediate proxy device can send a Client Hello packet to the target server, obtain a Server Hello packet returned by the target server, send a key negotiation message for key negotiation to the target server, and obtain a message returned by the target server indicating that the change of the client specification has been completed after the key negotiation is completed. At this time, the intermediate proxy device completes the encrypted connection with the target server.

[0155] It should be noted that the above-mentioned encrypted connection proxy can be implemented by a Secure Sockets Layer (SSL) proxy or a Transport Layer Security (TLS) proxy. It is understandable that the above-mentioned encrypted connection proxy can also be implemented by other encrypted connection proxy methods.

[0156] S1042. Obtain a first symmetric key negotiated with the target client;

[0157] The first symmetric key is the symmetric key negotiated between the intermediate proxy device and the target client during the encrypted connection process.

[0158] Specifically, the present invention can negotiate a symmetric key during the encryption connection between the intermediate proxy device and the target client, and determine the negotiated symmetric key as the first symmetric key.

[0159] Among them, when the intermediate proxy device has previously established an encrypted connection with the target client and has negotiated a symmetric key, at this time, during the process of the intermediate proxy device establishing an encrypted connection with the target client this time, the present invention does not need to perform key negotiation again, and can directly obtain the symmetric key that was negotiated during the previous encrypted connection and determine it as the first symmetric key.

[0160] S1043. Obtain the second symmetric key negotiated with the target server;

[0161] The second symmetric key is the symmetric key negotiated between the intermediate proxy device and the target server during the encrypted connection process.

[0162] Specifically, the present invention can negotiate a symmetric key during the encryption connection between the intermediate proxy device and the target server, and determine the negotiated symmetric key as the second symmetric key.

[0163] Among them, when the intermediate proxy device has previously established an encrypted connection with the target server and has negotiated a symmetric key, at this time, during the process of the intermediate proxy device establishing an encrypted connection with the target server this time, the present invention does not need to perform key negotiation again. The symmetric key that was negotiated during the previous encrypted connection can be directly obtained and determined as the second symmetric key.

[0164] S1044. Determine the first symmetric key and the second symmetric key as message key information.

[0165] Specifically, the present invention can determine the first symmetric key and the second symmetric key as message key information after obtaining the first symmetric key and the second symmetric key.

[0166] The data processing method proposed in the present invention can effectively obtain the message key information, thereby effectively ensuring the realization of message decryption.

[0167] Based on the sixth data processing method, the present invention proposes a seventh data processing method. In the seventh data processing method, the target client stores the first symmetric key; in this case, step S105 may include:

[0168] Obtaining a first encrypted transmission message sent by the target client in the target session; the first encrypted transmission message is a message generated by the target client based on the first symmetric key after the encrypted connection proxy is completed;

[0169] The first encrypted transmission message is decrypted based on the first symmetric key.

[0170] It should be noted that after the target client completes the encrypted connection with the intermediate proxy device and determines the first symmetric key, it can encrypt the message based on the first symmetric key. At this time, the target client can encrypt the message to be sent based on the first symmetric key, generate an encrypted transmission message, and send it to the intermediate proxy device.

[0171] It is understandable that the first encrypted transmission message may be a message sent by the target client after completing the encrypted connection.

[0172] Specifically, the present invention can obtain a first encrypted transmission message sent by the target client after completing the encrypted connection, and decrypt the first encrypted transmission message using the first symmetric key.

[0173] Optionally, in other data processing methods proposed by the present invention, after decrypting the first encrypted transmission message based on the first symmetric key, the method may further include:

[0174] Obtaining a first decrypted message; wherein the first decrypted message is a message obtained by decrypting the first encrypted transmission message based on the first symmetric key;

[0175] Detecting whether the first decrypted message is a network attack message;

[0176] When it is detected that the first decrypted message is not a network attack message, the first decrypted message is encrypted based on the second symmetric key, and a corresponding first encrypted message is obtained and sent to the target server.

[0177] It can be understood that the present invention encrypts and sends the first decrypted message only when it detects that the first decrypted message is not a network attack message, which can effectively avoid transmitting the network attack message to the target server, prevent network attackers from using the encrypted transmission between the client and the server to attack and escape, avoid the harm caused by network attacks, and improve network security.

[0178] Optionally, when the present invention detects that the first decrypted message is a network attack message, the first decrypted message can be directly discarded, thereby further avoiding the transmission of the network attack message to the target server and improving network security.

[0179] The data processing method proposed in the present invention can effectively avoid the harm caused by network attacks and improve network security.

[0180] Based on the sixth data processing method, the present invention proposes an eighth data processing method. In the eighth data processing method, the target server stores the second symmetric key. In this case, step S105 may include:

[0181] Obtaining a second encrypted transmission message sent by the target server in the target session; the second encrypted transmission message is a message generated by the target server based on the second symmetric key after the encrypted connection proxy is completed;

[0182] The second encrypted transmission message is decrypted based on the second symmetric key.

[0183] It should be noted that after the target server completes the encrypted connection with the intermediate proxy device and determines the second symmetric key, it can encrypt the message based on the second symmetric key. At this time, the target server can encrypt the message to be sent based on the second symmetric key, generate an encrypted transmission message, and send it to the intermediate proxy device.

[0184] It is understandable that the second encrypted transmission message may be a message sent by the target server after completing the encrypted connection.

[0185] Specifically, the present invention can obtain the second encrypted transmission message sent by the target server after completing the encrypted connection, and use the second symmetric key to decrypt the second encrypted transmission message.

[0186] Optionally, in other data processing methods proposed by the present invention, after decrypting the second encrypted transmission message based on the second symmetric key, the following steps may also be included:

[0187] Obtaining a second decrypted message; wherein the second decrypted message is a message obtained by decrypting the second encrypted transmission message based on the second symmetric key;

[0188] Detecting whether the second decrypted message is a network attack message;

[0189] When it is detected that the second decrypted message is not a network attack message, the second decrypted message is encrypted based on the first symmetric key, and a corresponding second encrypted message is obtained and sent to the target client.

[0190] It can be understood that the present invention encrypts and sends the second decrypted message only when it detects that the second decrypted message is not a network attack message, which can effectively avoid transmitting the network attack message to the target client, prevent network attackers from using the encrypted transmission between the client and the server to attack and escape, avoid the harm caused by network attacks, and improve network security.

[0191] Optionally, when the present invention detects that the second decrypted message is a network attack message, the second decrypted message can be directly discarded, thereby further avoiding transmission of the network attack message to the target client and improving network security.

[0192] The data processing method proposed in the present invention can effectively avoid the harm caused by network attacks and improve network security.

[0193] and Figure 1 The method shown corresponds to Figure 4 As shown, the present invention proposes a data processing device, which is applied to an intermediate proxy device. The data processing device includes: a first determination unit 401, a first detection unit 402, a first action unit 403, a first acquisition unit 404 and a first decryption unit 405; wherein:

[0194] The first determining unit 401 is configured to determine a session to be decrypted in a session established by the intermediate proxy device for the client and the server;

[0195] The first detection unit 402 is configured to detect whether the transmission message of the to-be-decrypted session includes an encrypted connection request message;

[0196] The first acting unit 403 is configured to, when detecting that the transmission message of the to-be-decrypted session includes an encrypted connection request message, take the corresponding to-be-decrypted session as a target session;

[0197] The first acquiring unit 404 is configured to acquire the message key information of the target session, where the message key information is acquired during the encrypted connection proxy process between the intermediate proxy device and the client and the server;

[0198] The first decryption unit 405 is configured to decrypt the transmission message of the target session based on the message key information.

[0199] Optionally, the first detection unit 402 includes: a second detection unit and a third detection unit;

[0200] The second detection unit is configured to detect whether the first transmission message of the session to be decrypted is the encrypted connection request message;

[0201] The third detection unit is configured to, when detecting that the first transmission message is not the encrypted connection request message, continue to detect whether the transmission message subsequent to the first transmission message includes the encrypted connection request message.

[0202] Optionally, the third detection unit includes: a fourth detection unit and a fifth detection unit;

[0203] The fourth detection unit is configured to detect whether the transmission message after the first transmission message includes an encryption negotiation message when detecting that the first transmission message is not the encrypted connection request message;

[0204] The fifth detection unit is configured to, when detecting that the transmission message after the first transmission message includes the encryption negotiation message, detect whether the transmission message after the encryption negotiation message includes the encryption connection request message.

[0205] Optionally, the encryption negotiation message includes an encryption negotiation identifier; the fourth detection unit includes: an initialization unit and a sixth detection unit;

[0206] The initialization unit is configured to initialize the encryption negotiation identifier detection device when detecting that the first transmission message is not the encrypted connection request message;

[0207] The sixth detection unit is configured to detect whether the transmission message after the first transmission message includes the encryption negotiation identifier through the encryption negotiation identifier detection machine, so as to detect whether the transmission message after the first transmission message includes the encryption negotiation message.

[0208] Optionally, the fifth detection unit includes: a first generation unit, a first identification unit and a seventh detection unit;

[0209] The first generating unit is configured to generate an encryption connection detection identifier when detecting that a transmission message subsequent to the first transmission message includes the encryption negotiation message;

[0210] The first identification unit is configured to use the encrypted connection detection identifier to identify the to-be-decrypted session including the encrypted negotiation message;

[0211] The seventh detection unit is configured to detect, in the to-be-decrypted session including the encrypted connection detection identifier, whether a transmission message subsequent to the encrypted negotiation message includes the encrypted connection request message.

[0212] Optionally, the encrypted connection request message includes a handshake data packet for requesting to establish an encrypted connection;

[0213] Detecting whether the transmission message of the session to be decrypted includes the encrypted connection request message, set to:

[0214] In a case where it is detected that the transmission message of the session to be decrypted includes the handshake data packet, determining that the transmission message of the session to be decrypted is the encrypted connection request message;

[0215] When it is detected that the transmission message of the session to be decrypted does not include the handshake data packet, it is determined that the transmission message of the session to be decrypted is not the encrypted connection request message.

[0216] Optionally, the first determining unit 401 is configured to determine, in a session established by the intermediate proxy device for the client and the server, if a session whose connection information matches pre-configured decryption connection information is detected, the corresponding session as the session to be decrypted.

[0217] Optionally, the first obtaining unit 404 includes: an agent unit, a first obtaining unit, a second obtaining unit, and a second determining unit;

[0218] The proxy unit is configured to perform an encrypted connection proxy with a target client and a target server based on the encrypted connection request message in the target session; wherein the target client is the client corresponding to the target session, and the target server is the server corresponding to the target session;

[0219] The first obtaining unit is configured to obtain a first symmetric key negotiated with the target client;

[0220] The second obtaining unit is configured to obtain a second symmetric key negotiated with the target server;

[0221] The second determining unit is configured to determine the first symmetric key and the second symmetric key as the message key information.

[0222] Optionally, the target client stores the first symmetric key; the first decryption unit 405 includes: a second acquisition unit and a second decryption unit;

[0223] The second acquiring unit is configured to acquire a first encrypted transmission message sent by the target client in the target session; the first encrypted transmission message is a message generated by the target client based on the first symmetric key after the encrypted connection proxy is completed;

[0224] The second decryption unit is used to decrypt the first encrypted transmission message based on the first symmetric key.

[0225] Optionally, the target server stores the second symmetric key; the first decryption unit 405 includes: a third acquisition unit and a third decryption unit;

[0226] The third acquiring unit is configured to acquire a second encrypted transmission message sent by the target server in the target session; the second encrypted transmission message is a message generated by the target server based on the second symmetric key after the encrypted connection proxy is completed;

[0227] The third decryption unit is used to decrypt the second encrypted transmission message based on the second symmetric key.

[0228] Optionally, the data processing device further includes: a third obtaining unit, an eighth detecting unit, a first encryption unit, a fourth obtaining unit and a first sending unit;

[0229] The third obtaining unit is configured to obtain a first decrypted message after decrypting the first encrypted transmission message based on the first symmetric key; wherein the first decrypted message is a message obtained by decrypting the first encrypted transmission message based on the first symmetric key;

[0230] The eighth detection unit is used to detect whether the first decrypted message is a network attack message;

[0231] The first encryption unit is configured to encrypt the first decrypted message based on the second symmetric key when detecting that the first decrypted message is not a network attack message;

[0232] The fourth obtaining unit is used to obtain the corresponding first encrypted message;

[0233] The first sending unit is configured to send the first encrypted message to the target server.

[0234] Optionally, the data processing device further includes: a fifth obtaining unit, a ninth detecting unit, a second encryption unit, a sixth obtaining unit, and a second sending unit;

[0235] The fifth obtaining unit is configured to obtain a second decrypted message after decrypting the second encrypted transmission message based on the second symmetric key; wherein the second decrypted message is a message obtained by decrypting the second encrypted transmission message based on the second symmetric key;

[0236] The ninth detection unit is configured to detect whether the second decrypted message is a network attack message;

[0237] The second encryption unit is configured to encrypt the second decrypted message based on the first symmetric key when detecting that the second decrypted message is not a network attack message;

[0238] The fourth obtaining unit is used to obtain the corresponding second encrypted message;

[0239] The first sending unit is configured to send the second encrypted message to the target client.

[0240] The data processing device proposed in the present invention can determine at least one session to be decrypted from the session established by the intermediate proxy device for the client and the server, and then detect whether the session to be decrypted includes an encrypted connection request message to detect the session to be decrypted that includes the encrypted connection request message, that is, the session to be decrypted that has initiated an encrypted connection. The session to be decrypted that has initiated an encrypted connection is used as the target session, and the message key information of the target session is obtained through the encrypted connection proxy. The transmission message of the target session is decrypted based on the message key information. The present invention can detect the target session through data detection, thereby effectively detecting and decrypting the transmission message between the client and the server that needs to be decrypted. While effectively realizing message decryption, it can avoid decrypting the transmission message between the client and the server that does not need to be decrypted, effectively avoiding the unnecessary consumption of decryption resources and ensuring the utilization rate of decryption resources.

[0241] Figure 5 An example of a physical structure diagram of an electronic device is shown below. Figure 5As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute a data processing method, which is applied to an intermediate proxy device and includes:

[0242] Determining a session to be decrypted in a session established by the intermediate proxy device for the client and the server;

[0243] Detecting whether the transmission message of the session to be decrypted includes an encrypted connection request message;

[0244] In a case where it is detected that the transmission message of the session to be decrypted includes an encrypted connection request message, taking the corresponding session to be decrypted as a target session;

[0245] Acquire message key information of the target session, where the message key information is acquired during an encrypted connection proxy process between the intermediate proxy device and the client and the server;

[0246] Decrypt the transmission message of the target session based on the message key information.

[0247] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0248] In another aspect, the present invention further provides a computer program product, comprising a computer program, which may be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is capable of performing a data processing method, which is applied to an intermediate proxy device and includes:

[0249] Determining a session to be decrypted in a session established by the intermediate proxy device for the client and the server;

[0250] Detecting whether the transmission message of the session to be decrypted includes an encrypted connection request message;

[0251] In a case where it is detected that the transmission message of the session to be decrypted includes an encrypted connection request message, taking the corresponding session to be decrypted as a target session;

[0252] Acquire message key information of the target session, where the message key information is acquired during an encrypted connection proxy process between the intermediate proxy device and the client and the server;

[0253] Decrypt the transmission message of the target session based on the message key information.

[0254] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the computer program is implemented to perform a data processing method. The data processing method is applied to an intermediate proxy device, and the data processing method includes:

[0255] Determining a session to be decrypted in a session established by the intermediate proxy device for the client and the server;

[0256] Detecting whether the transmission message of the session to be decrypted includes an encrypted connection request message;

[0257] In a case where it is detected that the transmission message of the session to be decrypted includes an encrypted connection request message, taking the corresponding session to be decrypted as a target session;

[0258] Acquire message key information of the target session, where the message key information is acquired during an encrypted connection proxy process between the intermediate proxy device and the client and the server;

[0259] Decrypt the transmission message of the target session based on the message key information.

[0260] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0261] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0262] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A data processing method, characterized in that: Applied to an intermediate proxy device, the data processing method includes: Determining a session to be decrypted in a session established by the intermediate proxy device for the client and the server; Detecting whether the transmission message of the session to be decrypted includes an encrypted connection request message; In a case where it is detected that the transmission message of the session to be decrypted includes an encrypted connection request message, taking the corresponding session to be decrypted as a target session; Acquire message key information of the target session, where the message key information is acquired during an encrypted connection proxy process between the intermediate proxy device and the client and the server; Decrypting the transmission message of the target session based on the message key information; Determining a session to be decrypted in a session established by the intermediate proxy device for the client and the server includes: In the session established by the intermediate proxy device for the client and the server, if a session whose connection information matches the pre-configured decryption connection information is detected, the corresponding session is determined as the session to be decrypted; The detecting whether the transmission message of the to-be-decrypted session includes an encrypted connection request message includes: detecting whether the first transmission message of the session to be decrypted is the encrypted connection request message; In the case of detecting that the first transmission message is not the encrypted connection request message, continuing to detect whether the transmission message after the first transmission message includes the encrypted connection request message; The acquiring the message key information of the target session includes: Based on the encrypted connection request message in the target session, perform an encrypted connection proxy with a target client and a target server, obtain a first symmetric key negotiated with the target client, and obtain a second symmetric key negotiated with the target server; wherein the target client is the client corresponding to the target session, and the target server is the server corresponding to the target session; The first symmetric key and the second symmetric key are determined as the message key information.

2. The data processing method according to claim 1, wherein: The step of continuing to detect whether a transmission message subsequent to the first transmission message includes the encrypted connection request message when detecting that the first transmission message is not the encrypted connection request message comprises: In the case of detecting that the first transmission message is not the encrypted connection request message, detecting whether the transmission message after the first transmission message includes an encryption negotiation message; In the case of detecting that the transmission message subsequent to the first transmission message includes the encryption negotiation message, detecting whether the transmission message subsequent to the encryption negotiation message includes the encryption connection request message.

3. The data processing method according to claim 2, characterized in that: The encrypted negotiation message includes an encrypted negotiation identifier; and when detecting that the first transmitted message is not the encrypted connection request message, detecting whether a transmitted message subsequent to the first transmitted message includes an encrypted negotiation message, comprises: In the case of detecting that the first transmission message is not the encrypted connection request message, initializing an encryption negotiation identifier detection device; The encryption negotiation identifier detector detects whether the transmission message after the first transmission message includes the encryption negotiation identifier, so as to detect whether the transmission message after the first transmission message includes the encryption negotiation message.

4. The data processing method according to claim 2, wherein: The step of detecting whether the transmission message after the first transmission message includes the encryption negotiation message, in the case where it is detected that the transmission message after the encryption negotiation message includes the encryption connection request message, comprises: generating an encrypted connection detection identifier and identifying the to-be-decrypted session including the encrypted negotiation message when detecting that the transmission message after the first transmission message includes the encrypted negotiation message; In the to-be-decrypted session including the encrypted connection detection identifier, it is detected whether the transmission message following the encrypted negotiation message includes the encrypted connection request message.

5. The data processing method according to any one of claims 1 to 4, characterized in that: The encrypted connection request message includes a handshake data packet for requesting to establish an encrypted connection; Detecting whether the transmission message of the to-be-decrypted session includes the encrypted connection request message includes: In a case where it is detected that the transmission message of the session to be decrypted includes the handshake data packet, determining that the transmission message of the session to be decrypted is the encrypted connection request message; When it is detected that the transmission message of the session to be decrypted does not include the handshake data packet, it is determined that the transmission message of the session to be decrypted is not the encrypted connection request message.

6. The data processing method according to claim 1, wherein: The target client stores the first symmetric key; The decrypting the transmission message of the target session based on the message key information includes: Obtaining a first encrypted transmission message sent by the target client in the target session; the first encrypted transmission message is a message generated by the target client based on the first symmetric key after the encrypted connection proxy is completed; Decrypt the first encrypted transmission message based on the first symmetric key.

7. The data processing method according to claim 1, wherein: The target server stores the second symmetric key; and decrypting the transmission message of the target session based on the message key information includes: Obtaining a second encrypted transmission message sent by the target server in the target session; the second encrypted transmission message is a message generated by the target server based on the second symmetric key after the encrypted connection proxy is completed; Decrypt the second encrypted transmission message based on the second symmetric key.

8. The data processing method according to claim 6, characterized in that: After decrypting the first encrypted transmission message based on the first symmetric key, the data processing method further includes: Obtaining a first decrypted message; wherein the first decrypted message is a message obtained by decrypting the first encrypted transmission message based on the first symmetric key; Detecting whether the first decrypted message is a network attack message; When it is detected that the first decrypted message is not a network attack message, the first decrypted message is encrypted based on the second symmetric key to obtain a corresponding first encrypted message and send it to the target server.

9. The data processing method according to claim 7, characterized in that: After decrypting the second encrypted transmission message based on the second symmetric key, the data processing method further includes: Obtaining a second decrypted message; wherein the second decrypted message is a message obtained by decrypting the second encrypted transmission message based on the second symmetric key; detecting whether the second decrypted message is a network attack message; When it is detected that the second decrypted message is not a network attack message, the second decrypted message is encrypted based on the first symmetric key, a corresponding second encrypted message is obtained, and the encrypted message is sent to the target client.

10. A data processing device, characterized in that: Applied to an intermediate proxy device, the data processing method includes: a first determining unit, a first detecting unit, a first acting unit, a first acquiring unit, and a first decrypting unit; wherein: The first determining unit is configured to determine a session to be decrypted in a session established by the intermediate proxy device for the client and the server; The first detection unit is configured to detect whether the transmission message of the to-be-decrypted session includes an encrypted connection request message; The first acting unit is configured to, when detecting that the transmission message of the to-be-decrypted session includes an encrypted connection request message, use the corresponding to-be-decrypted session as a target session; The first acquiring unit is configured to acquire the message key information of the target session, where the message key information is acquired during the encrypted connection proxy process between the intermediate proxy device and the client and the server; The first decryption unit is configured to decrypt the transmission message of the target session based on the message key information; The first determining unit is configured to: determine, in a session established by the intermediate proxy device for the client and the server, if a session whose connection information matches pre-configured decryption connection information is detected, the corresponding session as the session to be decrypted; The first detection unit includes: a second detection unit and a third detection unit; The second detection unit is configured to detect whether the first transmission message of the session to be decrypted is the encrypted connection request message; The third detection unit is configured to, when detecting that the first transmission message is not the encrypted connection request message, continue to detect whether the transmission message after the first transmission message includes the encrypted connection request message; The first obtaining unit includes: an agent unit, a first obtaining unit, a second obtaining unit, and a second determining unit; The proxy unit is configured to perform an encrypted connection proxy with a target client and a target server based on the encrypted connection request message in the target session; The first obtaining unit is configured to obtain a first symmetric key negotiated with the target client; The second obtaining unit is configured to obtain a second symmetric key negotiated with the target server; wherein the target client is the client corresponding to the target session, and the target server is the server corresponding to the target session; The second determining unit is configured to determine the first symmetric key and the second symmetric key as the message key information.

Images