Method, apparatus and electronic device for identifying a cryptographic device

Abstract

The application provides a method, device and electronic equipment for identifying a cryptographic device, wherein the method comprises: obtaining target encrypted traffic when a target encrypted tunnel is established, the target encrypted traffic comprising initiator encrypted traffic; identifying an initiator protocol of the initiator encrypted traffic, and parsing the initiator protocol to obtain a security association payload supported by the initiator protocol, and determining a payload fingerprint of the initiator encrypted traffic based on the security association payload; and determining, based on the payload fingerprint, a cryptographic device corresponding to a target encrypted tunnel to which the target encrypted traffic belongs. The method, device and electronic equipment for identifying a cryptographic device provided by the application utilize certain attributes of an initiator protocol in initiator encrypted traffic processed by a cryptographic device, can be associated with inherent characteristics of a corresponding cryptographic device, are not affected by a complex network and time delay, can more accurately determine a cryptographic device, and are high in identification efficiency and easy to implement.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer network security, in particular to a method and device for identifying a cryptographic device, an electronic device and a computer readable storage medium. BACKGROUND

[0002] A general IPSEC (Internet Protocol Security) cryptographic device is a VPN (Virtual Private Network) cryptographic gateway using an IPSEC protocol standard, mainly used for constructing a virtual private network on a public IP network, enabling internal networks of units distributed in different regions to realize secure bidirectional communication on a public network, ensuring the confidentiality, integrity and non-repudiation of information transmission. The IPSEC cryptographic device is mainly applied in cryptographic security systems of government office automation, finance and large enterprises and institutions.

[0003] At present, in the process of identifying an IPSEC cryptographic device, the prior art mainly uses the time of an IKE (Internet Key Exchange) response data packet of a target host to calculate a fingerprint, and identifies the IPSEC cryptographic device through the fingerprint. However, this method is prone to cause a high false positive rate in the case of a complex network and time influence. SUMMARY

[0004] To solve the existing technical problems, the embodiments of the present application provide a method and device for identifying a cryptographic device, an electronic device and a computer readable storage medium.

[0005] In a first aspect, the embodiments of the present application provide a method for identifying a cryptographic device, comprising: obtaining target encrypted traffic when a target encrypted tunnel is established, the target encrypted traffic comprising initiator encrypted traffic; identifying an initiation protocol of the initiator encrypted traffic, and analyzing the initiation protocol to obtain a security association payload supported by the initiation protocol, and determining a payload fingerprint of the initiator encrypted traffic based on the security association payload; and determining a cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs based on the payload fingerprint.

[0006] Optionally, the target encrypted traffic further comprises responder encrypted traffic, and the determining of the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs based on the payload fingerprint comprises: determining a message fingerprint of the responder encrypted traffic based on the responder encrypted traffic; and determining the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs based on the message fingerprint and the payload fingerprint.

[0007] Optionally, before the determining the cryptographic device corresponding to the target encryption tunnel to which the target encrypted traffic belongs based on the payload fingerprint, the method further comprises: determining a comprehensive feature of the initiation protocol, the comprehensive feature comprising a vendor number feature and / or a message code feature; and the determining the cryptographic device corresponding to the target encryption tunnel to which the target encrypted traffic belongs based on the payload fingerprint comprises: determining the cryptographic device corresponding to the target encryption tunnel to which the target encrypted traffic belongs based on the payload fingerprint and the comprehensive feature.

[0008] Optionally, the target encrypted traffic comprises responder encrypted traffic, and the determining the cryptographic device corresponding to the target encryption tunnel to which the target encrypted traffic belongs based on the payload fingerprint and the comprehensive feature comprises: determining a message fingerprint of the responder encrypted traffic based on the responder encrypted traffic; and determining the cryptographic device corresponding to the target encryption tunnel to which the target encrypted traffic belongs based on the message fingerprint, the payload fingerprint and the comprehensive feature.

[0009] Optionally, the method further comprises: obtaining sample encrypted traffic when a sample encryption tunnel is established; identifying a sample initiation protocol of the sample initiator encrypted traffic, parsing the sample initiation protocol to obtain a sample security association payload supported by the sample initiation protocol, and determining a sample comprehensive feature of the sample initiation protocol; calculating a sample payload fingerprint of the sample initiator encrypted traffic based on the sample security association payload; determining a sample message fingerprint of the sample responder encrypted traffic based on the sample responder encrypted traffic; determining the cryptographic device corresponding to the sample encryption tunnel to which the sample encrypted traffic belongs based on the sample message fingerprint, the sample payload fingerprint and the sample comprehensive feature; establishing a mapping relationship between the sample message fingerprint, the sample payload fingerprint, the sample comprehensive feature and the corresponding cryptographic device, and comprehensively generating a cryptographic device fingerprint library based on the mapping relationship.

[0010] Optionally, the obtaining the target encrypted traffic when the target encryption tunnel is established comprises: sending different probe data packets to the host capable of establishing the target encryption tunnel multiple times, each time sending a data packet containing at least one attribute possessed by one of the cryptographic devices; and determining the target encrypted traffic when the host establishes the target encryption tunnel based on a response data packet returned by the host after receiving the probe data packet each time.

[0011] In a second aspect, an apparatus for identifying a cryptographic device is provided, comprising: an obtaining module, a processing module and an identifying module.

[0012] The obtaining module is configured to obtain target encrypted traffic when a target encryption tunnel is established, the target encrypted traffic comprising initiator encrypted traffic.

[0013] The processing module is configured to identify an initiation protocol of the initiator encrypted traffic, and parse the initiation protocol to obtain a security association payload supported by the initiation protocol, and determine a payload fingerprint of the initiator encrypted traffic based on the security association payload.

[0014] The identification module is configured to determine, based on the payload fingerprint, a cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs.

[0015] Optionally, the target encrypted traffic further comprises responder encrypted traffic, and the identification module comprises a first determination unit and a first identification unit.

[0016] The first determination unit is configured to determine, based on the responder encrypted traffic, a message fingerprint of the responder encrypted traffic.

[0017] The first identification unit is configured to determine, based on the message fingerprint and the payload fingerprint, the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs.

[0018] In a third aspect, an electronic device is provided, which comprises a bus, a transceiver, a memory, a processor, and a computer program stored in the memory and capable of running on the processor; the transceiver, the memory, and the processor are connected through the bus, and the computer program, when executed by the processor, implements the steps in the method for identifying a cryptographic device as described above.

[0019] In a fourth aspect, a computer readable storage medium is provided, which comprises a computer program stored on the readable storage medium; the computer program, when executed by a processor, implements the steps in the method for identifying a cryptographic device as described above.

[0020] The method, device, electronic device, and computer readable storage medium for identifying a cryptographic device provided by the embodiments of the present application can identify an initiation protocol of initiator encrypted traffic when an encrypted tunnel is established, determine a security association payload from the initiation protocol, calculate a payload fingerprint based on the security association payload, and finally determine a cryptographic device corresponding to a target encrypted tunnel to which target encrypted traffic belongs through the payload fingerprint. The method utilizes certain properties of the initiation protocol in the initiator encrypted traffic processed by the cryptographic device, can be associated with inherent characteristics of the corresponding cryptographic device, is not affected by complex networks and time delays, can more accurately determine the cryptographic device, and is efficient and easy to implement. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the background art, the drawings needed to be used in the embodiments of the present application or the background art will be described below.

[0022] Figure 1 A flow chart of a method for identifying a cryptographic device is shown according to an embodiment of the present application.

[0023] Figure 2 A detailed flow chart of a method for identifying a cryptographic device is shown according to an embodiment of the present application.

[0024] Figure 3 A structure diagram of an apparatus for identifying a cryptographic device is shown according to an embodiment of the present application.

[0025] Figure 4 A structure diagram of an electronic device is shown according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] The embodiments of the present application will be described below with reference to the accompanying drawings.

[0027] Figure 1 A flow chart of a method for identifying a cryptographic device is shown according to an embodiment of the present application. As shown in the figure, the method comprises the following steps 101-103. Figure 1

[0028] Step 101: Obtain target encrypted traffic when establishing a target encrypted tunnel, the target encrypted traffic comprising initiator encrypted traffic.

[0029] In the case where internal networks distributed in different regions need to be implemented to securely communicate on a public network, an encrypted tunnel can be established between two network devices in different regions. One of the two parties that establishes the encrypted tunnel can be taken as an initiator, and the other party can be taken as a responder. The initiator or the responder represents the two parties in the encrypted tunnel. The encrypted tunnel can encrypt the session between the initiator and the responder into an encrypted session through an encryption protocol based on the cryptographic device used by the initiator and the responder. The specific way of establishing the encrypted tunnel can be to send some encrypted traffic between the initiator and the responder, such as a main mode or a rough mode, so as to successfully establish the encrypted tunnel. In the process of establishing the encrypted tunnel, the encrypted traffic transmitted between the initiator and the responder is encrypted traffic for key negotiation between the two parties, and the encrypted traffic is also processed by the encryption protocol provided by the cryptographic device used by the initiator and the responder.

[0030] ​For example, in an encryption session between two devices, one of the devices that first starts to transmit certain encrypted traffic processed by an encryption protocol provided by a certain cryptographic device can be an initiator, and when the encrypted traffic is transmitted to another device, the other device can be a responder, and based on the received encrypted traffic, the responder transmits corresponding encrypted traffic to the initiator, the corresponding encrypted traffic uses the same encryption protocol as the encrypted traffic transmitted by the initiator, and through multiple transmission processes of the encrypted traffic, an encryption tunnel can be established between the initiator and the responder, and the encryption tunnel can be used to encrypt a session between the initiator and the responder to obtain an encrypted session.

[0031] In the embodiments of the present application, when a cryptographic device corresponding to a certain encryption tunnel needs to be identified, the encryption tunnel is taken as a target encryption tunnel, and encrypted traffic transmitted when the target encryption tunnel is established is taken as target encrypted traffic. In the embodiments of the present application, the target encrypted traffic includes initiator encrypted traffic transmitted by an initiator that establishes the target encryption tunnel. For example, initiator encrypted traffic transmitted by an initiator that first starts to transmit encrypted traffic when the target encryption tunnel is established can be obtained, and the initiator encrypted traffic is taken as the target encrypted traffic.

[0032] Step 102: identifying an initiation protocol of the initiator encrypted traffic, parsing the initiation protocol to obtain a security association payload supported by the initiation protocol, and determining a payload fingerprint of the initiator encrypted traffic based on the security association payload.

[0033] The encryption protocol used by the initiator encryption traffic can be identified, and the initiator encryption protocol used by the initiator encryption traffic can be obtained. The initiator protocol can be an Internet Security Association and Key Management Protocol (ISAKMP) protocol. The security association payload supported by the initiator protocol can be obtained by further analyzing the initiator protocol. The method used to identify the initiator encryption traffic can be port identification and / or a Deep Packet Inspection (DPI) method. The process of analyzing the initiator protocol can be based on an existing scheme, which is not limited in the embodiment. In the embodiment, the security association payload is an agreement established by both parties of the target encryption tunnel, that is, an agreement supported and provided by the initiator of the target encryption tunnel. The security association payload can include an encryption algorithm, a hash algorithm, a group description algorithm, an authentication algorithm, and a lifetime of the initiator security association payload. Based on the security association payload containing the above attributes, the protocol, transcoding mode, key, and key validity period of the cryptographic device used by the target encryption tunnel can be determined. In the embodiment, the payload fingerprint of the initiator encryption traffic can be obtained by calculating the security association payload. The payload fingerprint can be used to identify the cryptographic device used to establish the target encryption tunnel. The specific calculation method can be a hash function.

[0034] For example, the initiator encryption traffic is identified by port, the initiator protocol of the initiator encryption traffic is obtained, and the initiator protocol is analyzed to obtain the security association payload supported by the initiator protocol. The encryption algorithm, hash algorithm, group description algorithm, authentication algorithm, and lifetime of the initiator security association payload in the security association payload are analyzed to obtain the payload fingerprint of the initiator encryption traffic.

[0035] Step 103: Based on the payload fingerprint, the cryptographic device corresponding to the target encryption tunnel to which the target encryption traffic belongs is determined.

[0036] In the case of calculating the initiator protocol and obtaining the payload fingerprint, the payload fingerprint can be input into a prediction model that can identify the cryptographic device corresponding to the payload fingerprint. Based on the output result of the prediction model, the cryptographic device corresponding to the target encryption tunnel to which the target encryption traffic belongs is determined. Alternatively, the cryptographic device corresponding to the target encryption tunnel can be determined based on the mapping relationship between the payload fingerprint and the cryptographic device.

[0037] The embodiment of the present application can determine the security association payload from the initiation protocol of the initiator encrypted traffic when establishing the encrypted tunnel, and calculate the payload fingerprint based on the security association payload, and finally determine the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs through the payload fingerprint. The method uses some attributes of the initiation protocol in the initiator encrypted traffic processed by the cryptographic device, can be associated with the inherent characteristics of the corresponding cryptographic device, is not affected by complex network and time delay, can more accurately judge the cryptographic device, and is high in recognition efficiency and easy to implement.

[0038] Optionally, the target encrypted traffic can also include responder encrypted traffic, and the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs is determined based on the payload fingerprint, including the following steps A1-A2.

[0039] Step A1: determining the message fingerprint of the responder encrypted traffic based on the responder encrypted traffic.

[0040] The target encrypted traffic obtained from the process of establishing the target encrypted tunnel can also include responder encrypted traffic, which is the encrypted traffic transmitted by the responder when establishing the target encrypted tunnel. The responder encrypted traffic can obtain the time of the IKE (Internet Key Exchange) response packet from the responder recorded in the responder encrypted traffic, which represents the time taken by the responder to transmit the corresponding responder encrypted traffic in response to each initiator encrypted traffic transmitted by the initiator when the target encrypted tunnel starts to be established.

[0041] For example, in the case where the initiator and the responder transmit encrypted traffic in the main mode when establishing the target encrypted tunnel, the encrypted traffic transmitted between the initiator and the responder for key negotiation is usually six data packets, i.e., three data packets transmitted by the initiator and three data packets transmitted by the responder. The message fingerprint of the responder encrypted traffic can be calculated based on the time of the response data packet of the responder. The message fingerprint can be calculated according to a hash function, and the message fingerprint can be used to identify the cryptographic device used when establishing the target encrypted tunnel.

[0042] Step A2: determining the cryptographic device corresponding to the encrypted session to which the target encrypted traffic belongs based on the message fingerprint and the payload fingerprint.

[0043] Wherein, in the case of obtaining the load fingerprint, the load fingerprint and the message fingerprint obtained by the step A1 can be input into a certain prediction model capable of identifying the cryptographic device corresponding to the load fingerprint and the message fingerprint, and based on the output result of the prediction model, the cryptographic device corresponding to the target encryption tunnel to which the target encrypted traffic (such as the initiator encrypted traffic transmitted by the initiator when constructing the target encryption tunnel, and the responder encrypted traffic transmitted by the responder when constructing the target encryption tunnel) belongs is determined. Alternatively, the cryptographic device corresponding to the target encryption tunnel can also be determined based on the mapping relationship between the load fingerprint, the message fingerprint and a certain cryptographic device.

[0044] The embodiment of the present application determines that the time of the responder response packet can be used for calculation based on the characteristics that using different cryptographic devices will result in different times of response packets, and the times of response packets for encrypted traffic of different contents will also be different, and obtains the basis capable of determining the cryptographic device corresponding to the target encryption tunnel, i.e. the message fingerprint. The method combines the load fingerprint provided by the initiator encrypted traffic and the message fingerprint calculated by the responder encrypted traffic to identify the cryptographic device corresponding to the target encryption tunnel, and thus the identification result is more accurate. Moreover, the method has the advantages of the load fingerprint, i.e. is not affected by complex network and time delay, and can more accurately determine the cryptographic device, has high identification efficiency and is easy to implement.

[0045] Optionally, before determining the cryptographic device corresponding to the target encryption tunnel to which the target encrypted traffic belongs based on the load fingerprint, the method can further include step B.

[0046] Step B: determining the comprehensive features of the initiator protocol, the comprehensive features including the vendor number features and / or the message code features.

[0047] In the embodiment of the present application, a comprehensive feature can also be extracted from the initiation protocol, and the comprehensive feature is a certain feature possessed by the initiation protocol, which can represent the features possessed by the initiator encrypted traffic. The comprehensive feature can specifically include at least one of a vendor number feature and a message code feature. The vendor number feature is a feature that can represent the cryptographic device used by the initiator, and can be obtained by identifying a VID (Vendor Identity document) payload in the initiation protocol. In the embodiment of the present application, the message code feature is also a feature that can represent the cryptographic device used by the initiator. Since different cryptographic devices use different notification message codes, the notification message code can be used as a basis for judging the cryptographic device. The message code feature can be obtained by identifying a notification message code in the initiation protocol.

[0048] For example, by analyzing the initiation protocol, a certain notification message code can be identified, and based on the notification message code, the message code feature in the initiation protocol can be determined, and the message code feature can be used as the comprehensive feature of the initiation protocol.

[0049] Moreover, based on the payload fingerprint, the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs can be determined, which can include step C.

[0050] Step C: Based on the payload fingerprint and the comprehensive feature, the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs is determined.

[0051] In the case where the payload fingerprint is obtained, the payload fingerprint and the comprehensive feature obtained through step B can be input into a certain prediction model that can identify the cryptographic device corresponding to the payload fingerprint and the comprehensive feature, and based on the output result of the prediction model, the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic (i.e., the initiator encrypted traffic transmitted by the initiator when the target encrypted tunnel is constructed) belongs is determined. Alternatively, the cryptographic device corresponding to the target encrypted tunnel can also be determined based on the mapping relationship between the payload fingerprint, the comprehensive feature and a certain cryptographic device.

[0052] The embodiment of the present application can determine the vendor number feature and the message code feature of the initiation protocol by identifying the VID payload and the message code in the initiation protocol, take the vendor number feature and the message code feature as the comprehensive feature, and further identify the cryptographic device corresponding to the target encrypted tunnel on the basis of the payload fingerprint and the comprehensive feature, so that the result of determining the cryptographic device corresponding to the target encrypted tunnel through the initiator encrypted traffic is more accurate. In addition, the payload fingerprint has the advantages that it is not affected by complex network and time delay, and can more accurately determine the cryptographic device, and has high identification efficiency and is easy to implement.

[0053] Optionally, the target encrypted traffic includes the responder encrypted traffic, and the step C of determining the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs based on the payload fingerprint and the comprehensive feature can include the following steps D1-D2.

[0054] Step D1: determining the message fingerprint of the responder encrypted traffic based on the responder encrypted traffic.

[0055] The message fingerprint of the responder encrypted traffic can be determined based on the process described in the step A1, and details are not repeated here.

[0056] Step D2: determining the cryptographic device corresponding to the encrypted tunnel to which the target encrypted traffic belongs based on the message fingerprint, the payload fingerprint and the comprehensive feature.

[0057] The payload fingerprint of the initiation protocol, the comprehensive feature obtained by the method described in the step B, and the message fingerprint obtained by the method described in the step D1 can be input into a certain prediction model capable of identifying the cryptographic device corresponding to the payload fingerprint, the comprehensive feature and the message fingerprint, and the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic (such as the initiator encrypted traffic transmitted by the initiator when the target encrypted tunnel is constructed, and the responder encrypted traffic transmitted by the responder when the target encrypted tunnel is constructed) belongs can be determined based on the output result of the prediction model. Alternatively, the cryptographic device corresponding to the target encrypted tunnel can also be determined based on the mapping relationship between the payload fingerprint, the comprehensive feature, the message fingerprint and a certain cryptographic device.

[0058] The embodiment of the present application is based on the payload fingerprint provided by the initiator encrypted traffic, combined with the comprehensive characteristics of the initiator protocol and the message fingerprint calculated from the responder encrypted traffic, combined with the two kinds of encrypted traffic and integrated with the comprehensive characteristics, using multiple bases to identify the corresponding cryptographic device of the target encrypted tunnel, thereby making the identification result more accurate. Moreover, it has the advantages of using payload fingerprint, that is, it is not affected by complex network and time delay, and can more accurately judge the cryptographic device, with high identification efficiency and easy implementation.

[0059] Optionally, the process of establishing the cryptographic device fingerprint library is further included, and the process includes steps E1-E6.

[0060] Step E1: Obtain the sample encrypted traffic when establishing a sample encrypted tunnel.

[0061] When it is necessary to establish the cryptographic device fingerprint library, the obtained encrypted traffic can be used as the sample encrypted traffic, and the sample encrypted traffic is the traffic transmitted when establishing a sample encrypted tunnel. Moreover, multiple encrypted tunnels established using different cryptographic devices can be obtained as sample encrypted tunnels, and the sample encrypted tunnels corresponding to each cryptographic device are different from each other, and the sample encrypted traffic transmitted when establishing each sample encrypted tunnel is also different. Specifically, the sample encrypted traffic when establishing a sample encrypted tunnel can be obtained based on the method described in step 101, which will not be described here.

[0062] Step E2: Identify the sample initiator protocol of the sample initiator encrypted traffic, analyze the sample initiator protocol, obtain the sample security association payload supported by the sample initiator protocol, and determine the sample comprehensive characteristics of the sample initiator protocol.

[0063] The specific process of identifying and analyzing the sample initiator protocol and obtaining the sample security association payload supported by the sample initiator protocol is the same as the process of determining the initiator protocol in step 102, which will not be described here. Moreover, the specific method of determining the sample comprehensive characteristics of the sample initiator protocol is the same as the method of determining the comprehensive characteristics of the initiator protocol in step B, which will not be described here.

[0064] Step E3: Calculate the sample payload fingerprint of the sample initiator encrypted traffic based on the sample security association payload.

[0065] The sample payload fingerprint can be determined based on the sample security association payload based on the method of determining the payload fingerprint of the initiator encrypted traffic based on the security association payload described in step 102, which will not be described here.

[0066] Step E4: Determine the sample message fingerprint of the sample responder encrypted traffic based on the sample responder encrypted traffic.

[0067] The specific method for determining the sample message fingerprint of the sample responder encrypted traffic based on the sample responder encrypted traffic is the same as the method described in the above step A1 of "determining the message fingerprint of the responder encrypted traffic based on the responder encrypted traffic", and will not be repeated here.

[0068] Step E5: determining the cryptographic device corresponding to the sample encrypted tunnel to which the sample encrypted traffic belongs based on the sample message fingerprint, the sample payload fingerprint and the sample comprehensive feature.

[0069] The specific method for determining the cryptographic device corresponding to the sample encrypted tunnel to which the sample encrypted traffic belongs based on the sample message fingerprint, the sample payload fingerprint and the sample comprehensive feature is the same as the method described in the above step D2 of "determining the cryptographic device corresponding to the encrypted tunnel to which the target encrypted traffic belongs based on the message fingerprint, the payload fingerprint and the comprehensive feature", and will not be repeated here.

[0070] Step E6: establishing a mapping relationship between the sample message fingerprint, the sample payload fingerprint and the sample comprehensive feature and the corresponding cryptographic device, and comprehensively generating a cryptographic device fingerprint library based on the mapping relationship.

[0071] The mapping relationship between the sample message fingerprint and the corresponding cryptographic device, the mapping relationship between the sample payload fingerprint and the corresponding cryptographic device, and the mapping relationship between the sample comprehensive feature and the corresponding cryptographic device can be combined to comprehensively generate the cryptographic device fingerprint library. The cryptographic device fingerprint library is a database capable of identifying the cryptographic device corresponding to an encrypted tunnel by the message fingerprint, the payload fingerprint and the comprehensive feature of the encrypted traffic transmitted by the encrypted tunnel.

[0072] The embodiment of the application collects sample encrypted traffic transmitted when various sample encrypted tunnels are established based on different cryptographic devices, processes the sample encrypted traffic corresponding to different cryptographic devices, respectively obtains the mapping relationship between the message fingerprint, the payload fingerprint, the comprehensive feature of the sample encrypted traffic and the cryptographic device, and further generates a cryptographic device fingerprint library. When it is actually necessary to identify the cryptographic device used by an encrypted tunnel to which certain encrypted traffic belongs, the cryptographic device fingerprint library can be directly called to quickly find the cryptographic device having a mapping relationship with the payload fingerprint under the condition that at least the payload fingerprint of the encrypted traffic is determined (for example, the cryptographic device fingerprint library can be used in step 103 to determine the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs). The method can make the process of identifying the cryptographic device more convenient, and the types of the cryptographic devices stored and identifiable are rich.

[0073] Optionally, obtaining the target encrypted traffic established when the target encrypted tunnel is established includes the following steps F1-F2.

[0074] Step F1: sending different probe data packets to the host capable of establishing the target encryption tunnel multiple times, each of the probe data packets containing at least one attribute of the cryptographic device.

[0075] In the embodiment of the present application, the hosts in the preset IP range that can use the cryptographic device to build the encryption tunnel can be searched based on the prior art. The searched hosts can be sent multiple probe data packets, each of the probe data packets containing only one attribute, which is an attribute of the cryptographic device, and can specifically include an encryption algorithm, a hash algorithm, a group description algorithm, an authentication algorithm, and a port attribute.

[0076] For example, it is determined through searching that the host A is a host capable of establishing the target encryption tunnel, and five probe data packets are sent to the host A, each of the probe data packets containing one attribute, i.e., a probe data packet containing an encryption algorithm, a probe data packet containing a hash algorithm, a probe data packet containing a group description algorithm, a probe data packet containing an authentication algorithm, and a probe data packet containing a port attribute.

[0077] Step F2: determining the target encryption traffic when the host establishes the target encryption tunnel based on the response data packet returned by the host after receiving each of the probe data packets.

[0078] The host capable of establishing the target encryption tunnel returns a response data packet for the received probe data packet, and the attribute of the host capable of establishing the target encryption tunnel can be determined based on the response data packet. For example, if the host A capable of establishing the target encryption tunnel receives a probe data packet containing an authentication algorithm, and the cryptographic device used by the host A also has the attribute, i.e., supports the authentication algorithm, a response data packet matching the attribute (authentication algorithm) can be returned, which indicates that the cryptographic device used by the host A also has the attribute, and the target encryption traffic when the host A establishes the target encryption tunnel can be determined based on the response data packet.

[0079] The embodiment of the present application actively explores the hosts in the preset IP range that can build the target encryption tunnel, actively sends different probe data packets to the hosts, and determines the target encryption traffic that can be transmitted by the host when the host establishes the target encryption tunnel based on the response data packet fed back by the host for each of the probe data packets. The method can obtain the response data packet fed back by the host when the host does not establish the encryption tunnel, determine the target encryption traffic based on multiple response data packets, and further determine the cryptographic device used by the host.

[0080] The method for identifying the password device is described in detail below through an embodiment. Referring to Figure 2 The method includes steps 201-205.

[0081] Step 201: A password device fingerprint library is preset, and the password recognition fingerprint library includes a mapping relationship between a message fingerprint, a payload fingerprint and a comprehensive feature obtained based on encrypted traffic and a corresponding password device.

[0082] Step 202: The initiator encrypted traffic when establishing a certain encrypted tunnel is obtained, the initiation protocol of the initiator encrypted traffic is identified and analyzed, the security association payload supported by the initiation protocol is obtained, and the comprehensive feature of the initiation protocol is determined based on the initiation protocol.

[0083] Step 203: The payload fingerprint of the initiator encrypted traffic is determined based on the security association payload.

[0084] Step 204: The responder encrypted traffic in the establishment of a certain encrypted tunnel is obtained, and the message fingerprint of the responder encrypted traffic is determined.

[0085] Step 205: The encrypted tunnel corresponding to the password device is determined in the preset password device fingerprint library based on the payload fingerprint, the comprehensive feature and the message fingerprint.

[0086] The embodiment of the application further provides a device for identifying a password device, as shown in Figure 3 The device includes an acquisition module 31, a processing module 32 and an identification module 33.

[0087] The acquisition module 31 is used to acquire target encrypted traffic when establishing a target encrypted tunnel, and the target encrypted traffic includes initiator encrypted traffic.

[0088] The processing module 32 is used to identify the initiation protocol of the initiator encrypted traffic, analyze the initiation protocol, obtain the security association payload supported by the initiation protocol, and determine the payload fingerprint of the initiator encrypted traffic based on the security association payload.

[0089] The identification module 33 is used to determine the password device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs based on the payload fingerprint.

[0090] Optionally, the target encrypted traffic further includes responder encrypted traffic, and the identification module 33 includes a first determination unit and a first identification unit.

[0091] The first determination unit is used to determine the message fingerprint of the responder encrypted traffic based on the responder encrypted traffic.

[0092] The first identifying unit is configured to determine, based on the message fingerprint and the payload fingerprint, a cryptographic device corresponding to the target encryption tunnel to which the target encrypted traffic belongs.

[0093] Optionally, the apparatus further comprises a determining module.

[0094] The determining module is configured to determine a comprehensive feature of the initiation protocol, the comprehensive feature comprising a vendor number feature and / or a message code feature.

[0095] Further, the identifying module 33 further comprises a second identifying unit.

[0096] The second identifying unit is configured to determine, based on the payload fingerprint and the comprehensive feature, a cryptographic device corresponding to the target encryption tunnel to which the target encrypted traffic belongs.

[0097] Optionally, the target encrypted traffic comprises a responder encrypted traffic, and the second identifying unit comprises a determining sub-unit and a second identifying sub-unit.

[0098] The determining sub-unit is configured to determine, based on the responder encrypted traffic, a message fingerprint of the responder encrypted traffic.

[0099] The second identifying sub-unit is configured to determine, based on the message fingerprint, the payload fingerprint and the comprehensive feature, a cryptographic device corresponding to the encryption tunnel to which the target encrypted traffic belongs.

[0100] Optionally, the apparatus further comprises an obtaining sample module, an analyzing sample module, a first calculating module, a second calculating module, a predicting module and a generating module.

[0101] The obtaining sample module is configured to obtain a sample encrypted traffic when a sample encryption tunnel is established.

[0102] The analyzing sample module is configured to identify a sample initiation protocol of the sample initiator encrypted traffic, analyze the sample initiation protocol to obtain a sample secure association payload supported by the sample initiation protocol, and determine a sample comprehensive feature of the sample initiation protocol.

[0103] The first calculating module is configured to calculate, based on the sample secure association payload, a sample payload fingerprint of the sample initiator encrypted traffic.

[0104] The second calculating module is configured to determine, based on the sample responder encrypted traffic, a sample message fingerprint of the sample responder encrypted traffic.

[0105] The predicting module is configured to determine, based on the sample message fingerprint, the sample payload fingerprint and the sample comprehensive feature, a cryptographic device corresponding to the sample encryption tunnel to which the sample encrypted traffic belongs.

[0106] The generating module is configured to establish a mapping relationship between the sample message fingerprint, the sample payload fingerprint and the sample comprehensive feature and a corresponding cryptographic device, and to generate a cryptographic device fingerprint library based on the mapping relationship.

[0107] Optionally, the obtaining module 31 comprises an active sending unit and a response processing unit.

[0108] The active sending unit is configured to send different probe data packets to the host capable of establishing a target encryption tunnel multiple times, and each time the sent probe data packet is a data packet containing at least one attribute of the cryptographic device.

[0109] The response processing unit is configured to determine target encryption traffic when the host establishes a target encryption tunnel based on a response data packet returned by the host after receiving each time the probe data packet.

[0110] The embodiment of the present application can determine the security association payload from the initiation protocol of the initiator encryption traffic when establishing an encryption tunnel, calculate the payload fingerprint based on the security association payload, and finally determine the cryptographic device corresponding to the target encryption tunnel to which the target encryption traffic belongs through the payload fingerprint. The device uses certain attributes of the initiation protocol in the initiator encryption traffic processed by the cryptographic device, can be associated with the inherent characteristics of the corresponding cryptographic device, is not affected by complex network and time delay, can more accurately judge the cryptographic device, has high recognition efficiency and is easy to implement.

[0111] In addition, the embodiment of the present application also provides an electronic device, which comprises a bus, a transceiver, a memory, a processor and a computer program stored in the memory and executable on the processor. The transceiver, the memory and the processor are connected through the bus. The computer program is executed by the processor to realize each process of the method for identifying a cryptographic device and achieve the same technical effect. To avoid repetition, details are not described here.

[0112] Specifically, referring to FIG. 11, Figure 4 The embodiment of the present application also provides an electronic device, which comprises a bus 1110, a processor 1120, a transceiver 1130, a bus interface 1140, a memory 1150 and a user interface 1160.

[0113] In the embodiment of the present application, the electronic device further comprises a computer program stored in the memory 1150 and executable on the processor 1120. The computer program is executed by the processor 1120 to realize each process of the method for identifying a cryptographic device.

[0114] The transceiver 1130 is configured to receive and send data under the control of the processor 1120.

[0115] In embodiments of the application, a bus architecture (represented by bus 1110) can include any number of interconnecting buses and bridges, and the bus 1110 can be implemented using any suitable bus structure, such as an Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Peripheral Component Interconnect (PCI) bus, or any number of busses using any suitable bus architecture. The bus 1110 can include any number of bus bridges, bus controllers, and / or bus drivers. The bus 1110 can include a bus bridge that is used to connect the various circuits of the computer 1100 together. The bus 1110 can include a bus bridge that is used to connect the various circuits of the computer 1100 to one or more input / output (I / O) devices.

[0116] The bus 1110 represents one or more of several types of bus structures including a memory bus or memory controller, a peripheral bus, an accelerated graphics port (AGP), a processor or local bus using any of a variety of bus architectures. By way of example, and without limitation, such architectures include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) bus, and Peripheral Component Interconnect (PCI) bus.

[0117] The processor 1120 can be an integrated circuit chip having signal processing capability. In implementation, each step of the method embodiments described above can be completed by integrated logic circuits or instructions in software form of the hardware in the processor. The processor described above includes: general processor, central processing unit (CPU), network processor (NP), digital signal processor (DSP), application specific integrated circuit (ASIC), field programmable gate array (FPGA), complex programmable logic device (CPLD), programmable logic array (PLA), microcontroller unit (MCU) or other programmable logic device, discrete gate, transistor logic device, discrete hardware component. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. For example, the processor can be a single-core processor or a multi-core processor, and the processor can be integrated into a single chip or located in multiple different chips.

[0118] The processor 1120 can be a microprocessor or any conventional processor. The method steps disclosed in combination with the embodiments of the present application can be directly executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in a readable storage medium known in the art, such as random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), register, etc. The readable storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with the hardware thereof.

[0119] The bus 1110 can also connect various other circuits or devices such as peripheral devices, voltage stabilizers or power management circuits together, and the bus interface 1140 provides an interface between the bus 1110 and the transceiver 1130, which are well known in the art. Therefore, the embodiments of the present application will not be further described.

[0120] The transceiver 1130 can be one element or multiple elements, such as multiple receivers and transmitters, providing a means for communicating with various other apparatuses over a transmission medium. For example, the transceiver 1130 receives external data from other devices, and the transceiver 1130 transmits processed data from the processor 1120 to other devices. Depending on the nature of the computer system, a user interface 1160, such as a touchscreen, physical keyboard, display, mouse, speaker, microphone, trackball, joystick, stylus, etc., can also be provided.

[0121] It should be understood that, in embodiments of the present application, the memory 1150 can further include a memory that is remotely located with respect to the processor 1120, which can be connected to a server through a network. One or more portions of the above-mentioned network can be an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless LAN (WLAN), a wide area network (WAN), a wireless wide area network (WWAN), a metropolitan area network (MAN), the Internet, a public switched telephone network (PSTN), a public or shared cellular network, a wireless network, a Wi-Fi network, and a combination of two or more of the above-mentioned networks. For example, the cellular network and the wireless network can be a Global System for Mobile Communications (GSM) system, a Code Division Multiple Access (CDMA) system, a Worldwide Interoperability for Microwave Access (WiMAX) system, a General Packet Radio Service (GPRS) system, a Wideband Code Division Multiple Access (WCDMA) system, a Long Term Evolution (LTE) system, an LTE Frequency Division Duplex (FDD) system, an LTE Time Division Duplex (TDD) system, an LTE-Advanced (LTE-A) system, a Universal Mobile Telecommunications (UMTS) system, an Enhanced Mobile Broadband (eMBB) system, a massive Machine Type of Communication (mMTC) system, an Ultra-Reliable Low Latency Communication (uRLLC) system, etc.

[0122] It should be appreciated that the memory 1150 in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both a volatile memory and a non-volatile memory. The non-volatile memory includes a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically EPROM (EEPROM), or a Flash Memory, among others.

[0123] The volatile memory includes a Random Access Memory (RAM) used as an external cache. By way of example, and not limitation, many forms of RAM are available, for example, a Static RAM (SRAM), a Dynamic RAM (DRAM), a Synchronous DRAM (SDRAM), a Double Data Rate SDRAM (DDR SDRAM), an Enhanced SDRAM (ESDRAM), a Synchlink DRAM (SLDRAM), and a Direct Rambus RAM (DRRAM). The memory 1150 of the electronic device described in the embodiments of the present application includes, but is not limited to, the above and any other suitable type of memory.

[0124] In the embodiments of the present application, the memory 1150 stores an operating system 1151 and the following elements of an application 1152: executable modules, data structures, or a subset thereof, or an extended set thereof.

[0125] Specifically, the operating system 1151 contains various system programs, such as a framework layer, a core library layer, a driver layer, and the like, for implementing various basic services and processing hardware-based tasks. The application 1152 contains various application programs, such as a Media Player and a Browser, for implementing various application services. The program implementing the method of the embodiments of the present application can be included in the application 1152. The application 1152 includes applets, objects, components, logic, data structures, and other computer system executable instructions that perform specific tasks or implement specific abstract data types.

[0126] In addition, the embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement each process of the method for identifying a password device and achieve the same technical effects. To avoid repetition, details are not described herein.

[0127] The computer readable storage medium includes a tangible device that is capable of storing and executing instructions for execution by an instruction execution device. The computer readable storage medium includes, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, and any suitable combination of the foregoing. The computer readable storage medium includes, but is not limited to, a phase-change memory (PRAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), other types of random access memory (RAM), a read-only memory (ROM), a non-volatile random access memory (NVRAM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, or other memory technologies, a compact disc read-only memory (CD-ROM), a digital versatile disc (DVD), or other optical storage, a magnetic cassette memory, a magnetic tape memory, or other magnetic storage device, a memory stick, a mechanically encoded device such as a punch card or a punch tape having holes according to a code pattern recorded thereon, or any other non-transmission medium that can store information that can be accessed by a computing device. According to the definition in the embodiment of the present application, the computer readable storage medium does not include a transitory signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission media (such as optical pulses passing through an optical fiber cable), or an electrical signal through a wire.

[0128] In several embodiments provided in the present application, it should be understood that the disclosed devices, electronic devices and methods can be implemented in other manners. For example, the above-described device embodiments are merely illustrative. For example, the division of the modules or units is merely a logical function division. There can be another division manner for actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed coupling or direct coupling or communication connection between the units can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms of connection.

[0129] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units. They can be located in one place, or distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to solve the problems to be solved by the embodiments of the present application.

[0130] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0131] When the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application essentially or the part that contributes to the prior art, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (including a personal computer, a server, a data center, or other network devices) to execute all or part of the steps of the methods described in the various embodiments of the present application. The storage medium includes various media listed above.

[0132] In the description of the embodiments of the present application, those skilled in the art should know that the embodiments of the present application can be implemented as methods, devices, electronic devices and computer readable storage media. Therefore, the embodiments of the present application can be specifically implemented as follows: complete hardware, complete software (including firmware, resident software, microcode, etc.), and a combination of hardware and software. In addition, in some embodiments, the embodiments of the present application can also be implemented as a computer program product in one or more computer readable storage media, which includes computer program code.

[0133] The above computer readable storage medium can adopt any combination of one or more computer readable storage media. The computer readable storage medium includes an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, device or component, or any combination thereof. More specific examples of the computer readable storage medium include a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory (Flash Memory), an optical fiber, a compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any combination thereof. In the embodiments of the present application, the computer readable storage medium can be any tangible medium containing or storing a program that can be used or combined with an instruction execution system, device or component.

[0134] The computer program code embodied in the above computer-readable storage medium can be transmitted using any appropriate medium, including but not limited to wireless, wire line, optical fiber cable, radio frequency (RF), or any suitable combination thereof.

[0135] Computer program code for carrying out operations of embodiments of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0136] Embodiments of the present application are described with reference to flow diagrams and / or block diagrams.

[0137] It should be understood that each block of the flowchart and / or block diagrams, and combinations of blocks in the flowchart and / or block diagrams, can be implemented by computer readable program instructions. These computer readable program instructions can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0138] These computer readable program instructions can also be stored in a computer readable storage medium that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable storage medium produce an article of manufacture including instructions which implement the function / act specified in the flowchart and / or block diagram block or blocks.

[0139] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable data processing apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0140] The above descriptions are only specific embodiments of the application, and the protection scope of the application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the embodiments of the application, and all changes and replacements should be covered within the protection scope of the embodiments of the application. Therefore, the protection scope of the embodiments of the application should be subject to the protection scope of the claims.

Claims

1. A method for identifying a cryptographic device, characterized in that, include: Obtain the target encrypted traffic when establishing the target encrypted tunnel, wherein the target encrypted traffic includes the initiator's encrypted traffic; The initiation protocol of the initiator's encrypted traffic is identified and parsed to obtain the security-associated payload supported by the initiation protocol. The payload fingerprint of the initiator's encrypted traffic is then calculated using the security-associated payload. This payload fingerprint serves as the basis for identifying the cryptographic device used to establish the target encrypted tunnel. The cryptographic device provides an encryption protocol to both the initiator and responder using the target encrypted tunnel. The security-associated payload is used to determine the inherent characteristics of the cryptographic device used by the target encrypted tunnel. These inherent characteristics include: the protocol, transcoding method, key, and key validity period provided by the cryptographic device to protect data packets. The payload fingerprint is input into a prediction model that can identify the cryptographic device corresponding to the payload fingerprint. Based on the output of the prediction model, the cryptographic device corresponding to the target encrypted tunnel to which the initiator's encrypted traffic belongs is determined.

2. The method according to claim 1, characterized in that, The target encrypted traffic also includes responder encrypted traffic. The step of determining the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs, based on the payload fingerprint, includes: Based on the encrypted traffic of the responder, the message fingerprint of the encrypted traffic of the responder is determined; Based on the message fingerprint and the payload fingerprint, the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs is determined.

3. The method according to claim 1, characterized in that, Before determining the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs based on the payload fingerprint, the method further includes: Determine the comprehensive characteristics of the initiation protocol, including supplier ID characteristics and / or message code characteristics; The step of determining the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs based on the payload fingerprint includes: Based on the payload fingerprint and the comprehensive features, the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs is determined.

4. The method according to claim 3, characterized in that, The target encrypted traffic includes responder encrypted traffic. The step of determining the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs, based on the payload fingerprint and the comprehensive features, includes: Based on the encrypted traffic of the responder, the message fingerprint of the encrypted traffic of the responder is determined; Based on the message fingerprint, the payload fingerprint, and the comprehensive features, the cryptographic device corresponding to the encrypted tunnel to which the target encrypted traffic belongs is determined.

5. The method according to claim 4, characterized in that, Also includes: Obtain the encrypted traffic of the sample when establishing the sample encryption tunnel; Identify the sample initiation protocol of the encrypted traffic of the sample initiator, parse the sample initiation protocol, obtain the sample security associated payload supported by the sample initiation protocol, and determine the sample comprehensive characteristics of the sample initiation protocol; Based on the sample security associated payload, calculate the sample payload fingerprint of the encrypted traffic of the sample initiator; Based on the encrypted traffic of the sample responder, determine the sample message fingerprint of the encrypted traffic of the sample responder; Based on the sample message fingerprint, the sample payload fingerprint, and the sample comprehensive features, the cryptographic device corresponding to the sample encryption tunnel to which the sample encrypted traffic belongs is determined; Establish a mapping relationship between the sample message fingerprint, the sample payload fingerprint, and the sample comprehensive features and the corresponding cryptographic devices, and generate a cryptographic device fingerprint database based on the mapping relationship.

6. The method according to claim 1, characterized in that, The acquisition of the target encrypted traffic when establishing the target encrypted tunnel includes: The host capable of establishing the target encrypted tunnel is sent with different probe data packets multiple times, and each probe data packet sent contains at least one attribute of the cryptographic device. Based on the response data packets returned by the host after each receipt of the probe data packet, the target encrypted traffic when the host establishes the target encrypted tunnel is determined.

7. A device for identifying cryptographic devices, characterized in that, include: Acquisition module, processing module, and recognition module; The acquisition module is used to acquire the target encrypted traffic when establishing the target encrypted tunnel, and the target encrypted traffic includes the initiator's encrypted traffic. The processing module is used to identify the initiation protocol of the initiator's encrypted traffic, parse the initiation protocol to obtain the security-related payload supported by the initiation protocol, and calculate the payload fingerprint of the initiator's encrypted traffic by calculating the security-related payload. The payload fingerprint is used as the basis for identifying the cryptographic device used when establishing the target encrypted tunnel. The cryptographic device provides an encryption protocol to the initiator and responder using the target encrypted tunnel. The security-related payload is used to determine the inherent characteristics of the cryptographic device used by the target encrypted tunnel. The inherent characteristics include: the protocol, transcoding method, key, and key validity period provided by the cryptographic device to protect data packets. The identification module is used to input the payload fingerprint into a prediction model that can identify the cryptographic device corresponding to the payload fingerprint, and based on the output of the prediction model, determine the cryptographic device corresponding to the target encrypted tunnel to which the initiator's encrypted traffic belongs.

8. The apparatus according to claim 7, characterized in that, The target encrypted traffic also includes the responder's encrypted traffic, and the identification module includes: a first determining unit and a first identifying unit; The first determining unit is used to determine the message fingerprint of the encrypted traffic of the responder based on the encrypted traffic of the responder; The first identification unit is used to determine the cryptographic device corresponding to the target encrypted tunnel to which the target encrypted traffic belongs, based on the message fingerprint and the payload fingerprint.

9. An electronic device comprising a bus, a transceiver, a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the transceiver, the memory, and the processor are connected via the bus, characterized in that, When the computer program is executed by the processor, it implements the steps of the method for identifying a cryptographic device as described in any one of claims 1 to 6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps in the method for identifying a cryptographic device as described in any one of claims 1 to 6.

Images