SSL VPN security authentication gateway service compliance detection system, method and computer-readable storage medium

Abstract

The present invention provides an SSLVPN security authentication gateway service compliance detection system, method, and computer-readable storage medium. The method constructs multiple test requests to communicate with an SSL server and uses a packet capture tool to capture data packets during the communication process. Further, a complete SSL data packet is obtained by reassembling the TCP segments of the pcapng data packet and checking for duplicates. The native dkpt.SSL module is then used to identify the protocol and parse and summarize the SSL, TLS, and national secret TLS protocols. Finally, the certificate and certificate chain are verified using a cryptographic tool library, and the results are visualized and displayed on a web page on a front-end display. The method of the present invention can simultaneously detect and analyze the compliance of the SSL / TLS protocol and the national secret TLS protocol. By using a traversal test method to test and verify the protocols and cryptographic algorithm suites that a VPN product may support, the cryptographic suites supported by the SSLVPN server are discovered, thereby improving detection efficiency, comprehensiveness, and accuracy.

Description

Technical Field

[0001] The present invention relates to the field of data security and communication technology, in particular to security detection of SSL VPN security gateways, and more specifically to a SSL VPN security authentication gateway service compliance detection system, method and computer-readable storage medium. Background Art

[0002] my country is currently facing a new wave of digital revolution. Cryptography is the cornerstone and core technology of national cyberspace security. Driven by national cryptography policies and the security needs of the digital economy, public awareness of cryptography has greatly increased, and the use of commercial cryptography to safeguard information system security has become a universal consensus. The SSL VPN security gateway is one of the most widely used cryptographic products in the commercial cryptography field. It integrates multiple cryptographic technologies into one, providing a strong guarantee for the security of information system data communications with its simplicity, speed, and security.

[0003] my country's cryptography administration authorities have established specific technical standards for various types of commercial cryptographic products, and manufacturers' cryptographic products must undergo rigorous testing and certification before sale. This is to ensure that cryptographic products provide more reliable security in practical applications. However, due to the high level of expertise and high barriers to deployment, some information system developers are unfamiliar with commercial cryptographic products and often make mistakes during their use and configuration. This leads to varying degrees of security risks in the SSL channels provided to external users. Some SSL VPN product vulnerabilities even become a gateway for intrusion by foreign entities or hackers, posing serious risks to information network security. Therefore, the compliance, correctness, and effectiveness of SSL VPN products in the information systems used by enterprises and institutions is a direct concern for information system developers, operators, and cryptography assessment agencies.

[0004] Wireshark is a widely used network packet analysis software that can intercept various network packets, automatically parse them, and display detailed information. Wireshark also supports parsing SSL / VPN protocol data. However, for commercial cryptographic application security testing, Wireshark, as a network packet analyzer, can only monitor and intercept actual network traffic and lacks active scanning capabilities, which can easily lead to overlooking high-risk security protocols or cryptographic algorithms during testing. In practice, Wireshark simply analyzes and outputs large amounts of information without further analysis, organization, or visualization. It cannot directly identify the National Encryption Technology (NTTC) protocol and its version, nor can it accurately identify all National Encryption algorithm suites. Furthermore, Wireshark itself cannot extract, parse, or verify the certificate chain for National Encryption Technology (NTTC) dual digital certificates. This requires manual operation and a high level of professional knowledge. For practical use, routine monitoring, and maintenance of information networks, professional cryptographic professionals are required to analyze, compare, and identify these issues, making widespread commercial deployment and use difficult. Summary of the Invention

[0005] In view of the defects of the existing technology, the present invention aims to propose an SSL VPN security authentication gateway service compliance detection system and method, which can detect and identify the application and deployment of domestic cryptographic algorithms and national secret TLS protocols. By using a traversal test method to test and verify the protocols and cryptographic algorithm suites that VPN products may support one by one, the cryptographic suites supported by the SSLVPN server are discovered, thereby improving the detection efficiency, comprehensiveness and accuracy.

[0006] According to the SSL VPN security authentication gateway service compliance detection system and method for the purpose of the present invention, in the example, it is possible to realize the identification and parsing of the national encryption algorithm suite and the parsing and certificate chain verification of the national encryption dual certificate, and to realize rapid certificate validity verification.

[0007] According to the SSL VPN security authentication gateway service compliance detection system and method for the purpose of the present invention, in the example, it supports high-risk algorithm and protocol alarms. In the process of analyzing the protocol data, it marks the high-risk cryptographic algorithms and protocol versions, and solves the problem of incomplete and inaccurate evaluation results due to the uneven level of technical personnel.

[0008] According to the SSL VPN security authentication gateway service compliance detection system and method for the purpose of the present invention, in an example, it supports graphical display of handshake protocol data interaction and detection results, solving the problem of visual representation when the protocol packet structure is complex.

[0009] According to a first aspect of the present invention, a method for detecting compliance of an SSL VPN security authentication gateway service is provided, comprising:

[0010] According to international and national secret network security protocols, different protocol versions are selected to construct HTTP-based access requests and establish connections with SSL servers;

[0011] Receive the network data packet returned by the SSL server in response to the request, and reassemble the TCP segmented data of the network data packet to obtain a complete SSL data packet;

[0012] Use Python's dpkt.SSL module to parse and identify the SSL data packet, and obtain the SSL protocol and TLS protocol types and certificate values;

[0013] Based on the SSL data packet, the tcpdata byte stream data is extracted through the tcp layer and the predetermined protocol number is modified to the header protocol number corresponding to the benchmark international TLS protocol. The subsequent numerical values ​​and the national secret certificate value are further parsed and extracted through the dpkt.SSL module; the verification file is matched according to the preset rules, and the extracted binary value is converted into the corresponding national secret cipher algorithm suite name to complete the identification of the cipher algorithm suite value;

[0014] Verify the obtained SSL and TLS protocol certificate values ​​and national encryption certificate values ​​and the certificate and certificate chain; and

[0015] Visual representation of the verification results of the international SSL protocol, TLS protocol, national secret TLS protocol, and certificates and certificate chains obtained through testing.

[0016] As an optional example, the process of selecting different protocol versions according to international and national secret network security protocols to construct an HTTP-based access request and establish a connection with an SSL server includes:

[0017] According to the international SSL protocol, TLS protocol and national secret TLS protocol, use the TaSSL tool to select different protocol versions and algorithm suites in turn, build an HTTP-based access request, send connection requests respectively, and perform connection tests with the SSL server;

[0018] For each protocol version and algorithm suite connection test, determine whether the current connection is valid based on the handshake status with the SSL server;

[0019] Determine whether the current connection is valid based on the handshake status returned by the SSL server, test and record the connection success or failure results in sequence;

[0020] The SSL protocol version includes at least SSL 2.0 and SSL 3.0.

[0021] The protocol version of the TLS protocol includes at least TLS1.0, TLS1.1, TLS1.2 and TLS1.3;

[0022] The cipher suite of the national secret TLS protocol includes at least four national secret-related cipher suites, namely ECC-SM4-SM3, ECC_SM4_GCM_SM3, ECDHE-SM4-SM3, and ECDHE_SM4_GCM_SM3, which comply with the GB / T 38636-2020 specification, and the TLS_SM4_GCM_SM3 cipher suite that complies with the RFC 8998 specification.

[0023] As an optional example, the receiving of the network data packet returned by the SSL server in response to the request, and reassembling TCP segmented data of the network data packet to obtain a complete SSL data packet includes:

[0024] Use the wireshark tool to capture the pcapng data packet returned by the SSL server;

[0025] Use the dpkt unpacking tool to extract the pcapng packet data layer by layer;

[0026] The segmented message data obtained by layered extraction is grouped and reassembled according to the TCP ACK number of the message, and stored in a list structure list; and

[0027] The list structure list is traversed, and duplicate checking is performed on the captured packet data after the messages are grouped according to the TCP ACK number to obtain a complete SSL data packet.

[0028] As an optional example, based on the SSL data packet, extracting the tcpdata byte stream data through the tcp layer and modifying the predetermined protocol number to the header protocol number corresponding to the benchmark international TLS protocol, and continuing to parse and extract subsequent values ​​and national secret certificate values ​​through the dpkt.SSL module, including:

[0029] Extract tcpdata byte stream data through the tcp layer;

[0030] Extract the header protocol number information "0x0101";

[0031] Based on the international TLS1.1 protocol, which is the benchmark for the national TLS protocol, the header protocol number is modified to "0x0301"; and

[0032] After the header protocol number is modified, the SSL data packet is parsed and identified through the dpkt.SSL module to extract subsequent values.

[0033] According to a second aspect of the present invention, a SSL VPN security authentication gateway service compliance detection system is also provided, comprising:

[0034] one or more processors;

[0035] The memory stores operable instructions, wherein the instructions, when executed, cause the one or more computers to perform operations, including the process of the aforementioned method.

[0036] According to a third aspect of the purpose of the present invention, a computer-readable medium for storing software is also proposed, characterized in that: the software includes instructions that can be executed by one or more computers, and the instructions, through such execution, enable the one or more computers to perform operations, and the operations include the process of the aforementioned method.

[0037] Based on the technical solutions in the above aspects, the SSL VPN security authentication gateway service compliance detection system and method proposed in the present invention solves the problem of detecting the compliance of international SLL, TLS and national TLS of SSL VPN gateway services. In the security assessment of commercial cryptographic applications, it can improve the depth, accuracy and efficiency of detection, and reduce the evaluation errors or deviations caused by differences in the ability and technical level of detection personnel.

[0038] The SSL VPN security authentication gateway service compliance detection method of the present invention solves the problem of national standard TLCP protocol detection and parsing, can realize the identification and parsing of national encryption algorithm suite, solves national encryption dual certificate parsing and certificate chain verification, and can realize rapid certificate validity verification.

[0039] It should be understood that all combinations of the foregoing concepts and the additional concepts described in more detail below, as long as such concepts are not mutually inconsistent, can be considered part of the inventive subject matter of this disclosure. In addition, all combinations of the claimed subject matter are considered part of the inventive subject matter of this disclosure.

[0040] The foregoing and other aspects, embodiments, and features of the present invention will be more fully understood from the following description in conjunction with the accompanying drawings. Other additional aspects of the present invention, such as features and / or beneficial effects of the exemplary embodiments, will become apparent from the following description or through practice of specific embodiments according to the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings are not intended to be drawn to scale. In the accompanying drawings, each identical or nearly identical component shown in various figures may be represented by the same reference numeral. For clarity, not every component is labeled in every figure. Embodiments of various aspects of the present invention will now be described by way of example and with reference to the accompanying drawings.

[0042] Figure 1 This is an exemplary flow chart of a method for detecting compliance of an SSL VPN security authentication gateway service according to an embodiment of the present invention.

[0043] Figure 2 is based on Figure 1 A flowchart of a specific implementation process of the example method.

[0044] Figure 3 This is an interface showing data packet information captured by the Wireshark tool in an embodiment of the present invention.

[0045] Figure 4 Schematic diagram of a pcapng data packet that needs to be reassembled according to an example of the present invention.

[0046] Figure 5 This is a flow chart of grouping and reassembling captured packet data (TCP messages) according to an embodiment of the present invention.

[0047] Figure 6 This is a flowchart of a duplicate checking and message reassembly process according to an embodiment of the present invention.

[0048] Figure 7-8 This is an example of a visual display interface of the detection results (for SSL and TLS) of the SSL VPN security authentication gateway service compliance detection method according to the present invention.

[0049] Figure 9-10 This is an example of a visual display interface of the detection results (for national secrets) of the SSL VPN security authentication gateway service compliance detection method according to the present invention. DETAILED DESCRIPTION

[0050] In order to better understand the technical content of the present invention, specific embodiments are given and described below with reference to the accompanying drawings.

[0051] Various aspects of the present invention are described in this disclosure with reference to the accompanying drawings, in which a number of illustrative embodiments are shown. The embodiments of the present disclosure are not necessarily intended to include all aspects of the present invention. It should be understood that the various concepts and embodiments introduced above, as well as those described in more detail below, can be implemented in any of many ways, because the concepts and embodiments disclosed herein are not limited to any embodiment. In addition, some aspects of the present disclosure may be used alone or in any appropriate combination with other aspects disclosed herein.

[0052] Combine Figure 1The example SSL VPN security authentication gateway service compliance detection method shown is a method of communicating with the SSL server through a constructed virtual test request and capturing the data packets of the communication process through a packet capture tool, such as the pcapng data packet (message data) obtained by using the Wireshark tool to capture the packet. The complete SSL data packet can be obtained by further reassembling the TCP segments of the pcapng data packet and checking for duplicates. The data packet is then parsed through the native dkpt.SSL module to parse and summarize the SSL, TLS protocols, and the national secret TLS protocol to obtain protocol data and certificate value data. Finally, the certificate and certificate chain are verified through the Jsrsasign cryptographic tool library, and the results are visualized and displayed on the web page of the front-end display. Thus, the method of the present invention can simultaneously realize the detection and analysis of the compliance of the SSL / TLS protocol and the national secret TLS protocol.

[0053] Figure 2 The above is shown to achieve Figure 1 An example of the example method, combined with Figure 2 The SSL VPN security authentication gateway service compliance testing method includes the following steps:

[0054] Step S101: According to international and national secret network security protocols, different protocol versions are selected to construct an HTTP-based access request and establish a connection with the SSL server;

[0055] Step S102: receiving the network data packet returned by the SSL server in response to the request, and reassembling the TCP segmented data of the network data packet to obtain a complete SSL data packet;

[0056] Step S103: Use the dpkt.SSL module to parse and identify the SSL, TLS, and national TLS protocols and certificate values ​​respectively;

[0057] Step S104: Verify the obtained SSL and TLS protocol certificate values ​​and national secret certificate values ​​and the certificate and certificate chain; and

[0058] Step S110: Visually represent the verification results of the international SSL protocol, TLS protocol, national secret TLS protocol, and certificates and certificate chains obtained through detection, for example, by transmitting them back to the front-end display screen for visual representation.

[0059] In step S103, the dpkt.SSL module is used to parse and identify SSL, TLS, and national secret TLS protocols and certificate values, including the internationally accepted SSL and TLS protocols, as well as the national secret network security protocol, namely the national secret TLS (also known as GMTLS) protocol:

[0060] (1) using Python's dpkt.SSL module to parse and identify the SSL data packet, and obtain the SSL protocol and TLS protocol types and certificate values;

[0061] (2) Based on the obtained SSL data packet, the tcpdata byte stream data is extracted through the tcp layer and the predetermined protocol number is modified to the header protocol number corresponding to the benchmark international TLS protocol, and the subsequent numerical values ​​and national secret certificate values ​​are further parsed and extracted through the dpkt.SSL module; the verification file is matched according to the preset rules, and the extracted binary value is converted into the corresponding national secret cipher algorithm suite name to complete the identification of the cipher algorithm suite value.

[0062] Below we further elaborate and illustrate the implementation of the aforementioned steps S101-S110.

[0063] Build an HTTP-based access request and test the connection with the SSL server

[0064] As an optional example, in the aforementioned step S101, according to the international and national secret network security protocols, different protocol versions are selected to construct an HTTP-based access request and establish a connection with the SSL server, including:

[0065] According to the international SSL protocol, TLS protocol and national secret TLS protocol, use the TaSSL tool to select different protocol versions and algorithm suites in turn, build an HTTP-based access request, send connection requests respectively, and perform connection tests with the SSL server;

[0066] For each protocol version and algorithm suite connection test, determine whether the current connection is valid based on the handshake status with the SSL server;

[0067] Determine whether the current connection is valid based on the handshake status returned by the SSL server, and test and record the connection success or failure results in sequence.

[0068] Among them, the protocol versions of the aforementioned SSL protocol include at least SSL2.0 and SSL3.0.

[0069] The TLS protocol versions include at least TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3.

[0070] The cipher suites of the national secret TLS protocol include at least four national secret-related cipher suites: ECC-SM4-SM3, ECC_SM4_GCM_SM3, ECDHE-SM4-SM3, and ECDHE_SM4_GCM_SM3, which comply with the GB / T 38636-2020 specification, as well as the TLS_SM4_GCM_SM3 cipher suite that complies with the RFC 8998 specification.

[0071] It should be understood that the SSL (Secure Socket Layer) protocol refers to a network security protocol developed by the American company NetScape. It is a security protocol implemented on the transmission communication protocol (TCP / IP) and uses public key technology. This protocol is widely supported in applications such as browsers, email, instant messaging, VoIP, and online fax to ensure secure communications.

[0072] It should be understood that SSL v1.0 was never publicly released. V2.0 was released in February 1995. However, due to numerous security vulnerabilities in v2.0, v3.0 was released shortly thereafter in 1996. SSL v2.0 suffered from numerous security vulnerabilities, such as using the same encryption key for both message authentication and encryption, lacking any protection during the SSL handshake, a weak message authentication code structure and support for only the insecure MD5 hash function, use of TCP connection closure, and limited service provision and binding to a fixed domain name, making it susceptible to man-in-the-middle attacks and cracking. However, since many systems and web servers still support the SSLv2.0 protocol, in order to enhance the security of users browsing the web, current mainstream browsers no longer support the insecure SSL v2.0 protocol. However, there are still many browsers and applications that support the SSLv2.0 protocol. For example, Microsoft's IE browser (IE 7 and later) and Google browser will set the browser's default settings to not support SSLv2.0. However, perhaps considering that some websites still only support SSLv2.0, the IE browser retains the option that users can set to support SSL2.0 so that they can normally visit websites that only support SSL 2.0.

[0073] TLS (Transport Layer Security) is a secure transport layer protocol used to provide confidentiality and data integrity between two communicating applications. It is a development of the SSL protocol. When the IETF standardized the SSL protocol, it was renamed TLS. Its versions include TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3. Currently, TLS 1.3 is the most widely used version.

[0074] In an embodiment of the present invention, the use of cryptographic algorithms with security issues or insufficient security strength in information systems, such as MD5, DES, SHA-1, RSA (less than 2048) and other cryptographic algorithms, as well as dangerous SSL protocols that have been discovered and gradually abandoned, such as SSL2.0, SSL3.0, TLS1.0, etc., may cause the information system to face high risks. Therefore, for the identified SSL and TLS protocols, the risk information will be marked and prompted according to the preset risk rules in the subsequent process.

[0075] Use the packet capture tool to capture the SSL communication process, check the captured file for duplication and reorganize it to obtain complete SSL data Bag

[0076] As an optional example, in step S102, the receiving of the network data packet returned by the SSL server in response to the request and the reassembly of TCP segmented data on the network data packet to obtain a complete SSL data packet include:

[0077] Use the wireshark tool to capture the pcapng data packet returned by the SSL server;

[0078] Use the dpkt.SSL module to extract the pcapng packet data in layers;

[0079] The segmented message data obtained by layered extraction is grouped and reassembled according to the TCP ACK number of the message, and stored in a list structure list; and

[0080] The list structure list is traversed, and duplicate checking is performed on the captured packet data after the messages are grouped according to the TCP ACK number to obtain a complete SSL data packet.

[0081] As an example, the present invention uses a packet capture tool to capture SSL communication data. Taking the wireshark tool (packet analysis tool) as an example, its packet capture file can better display the data in the SSL interaction process when capturing SSL communication data.

[0082] like Figure 3 The figure shows the data packet information display interface captured by the Wireshark tool. For example, when we need to view the detailed SSL data stream of the SSL server (SSL / TLS) of "180.163.248.139", all TLS data packets related to this IP can be filtered out by entering a search command. Since the working mechanism of the SSL protocol relies on the TCP protocol, TCP will perform message segmentation (Segment) when transmitting large data, and the present invention requires complete data content when analyzing the data packets of the SSL protocol. However, there are some problems at the bottom layer of the data captured by the Wireshark tool. Wireshark will perform segmentation processing on the application layer protocol, and some data shows the TCP protocol. Although Wireshark has performed packet grouping, it is still unable to perform subsequent processing. As Figure 4 The following example shows the pcapng data packet that needs to be reassembled.

[0083] To this end, in an embodiment of the present invention, we propose a method for reassembling TCP segmented message data based on the pcapng data packets captured by the Wireshark tool, and perform group reassembly according to the TCP ACK number of the message.

[0084] Combine Figure 5 The process of the TCP segmented message data reassembly method shown in the flow chart includes the following steps:

[0085] Use the wireshark tool to capture the data packets returned by the SSL server (pcapng);

[0086] Use the dpkt unpacking tool to extract the pcapng data packet data in layers, which is done by traversing and parsing the pcapng data packet (i.e., TCP message);

[0087] The segmented message data obtained by layered extraction is grouped and reassembled according to the TCP ACK number of the message, and stored in a list structure list; and

[0088] The aforementioned list structure list is traversed, and the captured packet data after the messages are grouped according to the TCP ACK number is checked for duplicates to obtain a complete SSL data packet.

[0089] It should be understood that during the traversal processing, the dpkt.SSL module determines whether the message IP is the specified IP address (i.e., the IP address of the SSL server) each time. If so, it continues processing, parses the message, extracts the TCP ACK number and the corresponding TCP data, otherwise it traverses and processes the next message.

[0090] In an embodiment of the present invention, the message data obtained by layered extraction is grouped and reassembled according to the TCP ACK number and stored in a list structure list, including:

[0091] Based on the uniqueness of TCP ACK numbers, the ACK numbers of the segmented messages are the same, identifying them as the same group of TCP messages;

[0092] Using the Python dictionary data structure, the key value is the TCP ACK number, and the value value stores the TCP data of the current TCP ACK number. The captured packets are arranged in chronological order, and the key and value values ​​are stored as dictionary values ​​in the list structure List.

[0093] As an optional example, combined with Figure 6 The process shown in the figure traverses the list structure, performs duplicate checking on the captured data after the messages are grouped according to the TCP ACK number, and obtains a complete SSL data packet, including:

[0094] Input the aforementioned list structure List as the original List-origin, which contains all the identified and stored tapack number information and the corresponding tcpdata data;

[0095] Create an act set structure (set-act) for duplicate checking and a dictionary dict-tcp to store complete tcp-data data;

[0096] Traverse each result of the List-origin one by one, extract a single TCP ACK message dictionary, obtain the key value and value value of the dict-origin of each result, store the key value of the dictionary in the newly created ack set structure (set-act), and use the non-repeatable element property of the set structure to determine whether the current TCP ACK message dictionary has been processed. Before processing a single TCP ACK message in the list structure List each time, it is necessary to check the dictionary key value to see if it exists in the ack set:

[0097] If it does not exist, write the value of the TCP ACK message dictionary into the new ACK dictionary, whose key value is still the ACK number and the value is tcpdata; if it exists, insert the value of the TCP ACK message dictionary into the value of the corresponding key value in the ACK dictionary;

[0098] By traversing the list structure List until all TCP ack message dictionary traversal processing is completed, the result of the dictionary dict-tcp is output to obtain the message data after duplication checking and reorganization, that is, the complete SSL data packet.

[0099] Parse SSL data packets and obtain SSL protocol data

[0100] In the aforementioned step S103, for the parsing and identification of international protocols (SSL, TLS), Python's native dpkt.SSL module is mainly used for parsing to obtain the SSL protocol and TLS protocol types and certificate values.

[0101] In an embodiment of the present invention, the dpkt.ssl.tls_multi_factory function in the dpkt.SSL module of Python is used to identify SSL data packets (i.e., TCP messages that have been reassembled after duplication checking) and parse various types of data results of the handshake protocol cluster in the SSL protocol, including the handshake protocol, the cipher specification change protocol, and the alarm protocol.

[0102] Among them, the handshake protocol can identify message structure types such as ClientHello, ServerHello, Certificate, ServerKeyExchange, CertificateRequest, ServerHelloDone, CertificateVerify, ClientKeyExchange, and Finished through the dpkt.ssl.TLSHandshake function.

[0103] The above data types are stored in a record dictionary data structure. For each message structure type under the handshake protocol, the key information contained in it is output in detail. For example, in the ClientHello message, its random, ciphersuites, sessionid, compressionmethods and other information need to be further output.

[0104] In step S103, based on the SSL data packet, the tcpdata byte stream data is extracted through the tcp layer and the predetermined protocol number is modified to the header protocol number corresponding to the international TLS protocol. The subsequent values ​​and the national secret certificate value are further parsed and extracted through the dpkt.SSL module, including:

[0105] Extract tcpdata byte stream data through the tcp layer;

[0106] Extract the header protocol number information "0x0101";

[0107] Based on the international TLS1.1 protocol, which is the benchmark for the national TLS protocol, the header protocol number is modified to "0x0301"; and

[0108] After the header protocol number is modified, the SSL data packet is parsed and identified through the native dpkt.SSL module to extract subsequent values.

[0109] In an embodiment of the present invention, the version number of the national secret GMTLS1.1 is "0x0101", which is different from the version number "0x03XX" of TLS. The cryptographic algorithm suite is clearly described in GM / T 0024-2014 "SSL VPN Technical Specifications" and GM / T 38636-2020 "Information Security Technology Transport Layer Cryptography Protocol (TLCP)".

[0110] During parsing, since the native dpkt.SSL module does not support the identifier of the national secret TLS protocol, in an embodiment of the present invention, the identifier of the SSL protocol header of the message that has been determined to be a national secret TLS data packet is modified to the identifier of the international TLS 1.1 protocol, that is, "0x0301", and then the SSL protocol related message data can continue to be parsed through the native dpkt.SSL module.

[0111] As an optional example, after continuing to unpack and extract the subsequent values ​​of the national secret TLS protocol through the native dpkt.SSL module, the extracted binary value is converted into the corresponding cipher suite name through the created rule matching verification file to realize the recognition of the national secret cipher suite value.

[0112] The rule matching verification file contains the mapping between cipher suite values ​​and names. This mapping is based on the GM / T 0024-2014 "SSL VPN Technical Specification" and the GB / T 38636-2020 "Information Security Technology Transport Layer Cryptography Protocol (TLCP)" standards.

[0113] Verification of certificates and certificate chains

[0114] Wireshark cannot verify the certificate values ​​obtained through parsing (server digital certificate, client digital certificate, etc.). Therefore, we further verify the certificate values ​​obtained through the dpkt.SSL module using a cryptographic verification tool to verify the certificate chain and certificate validity period.

[0115] As an optional example, we pass the certificate value information obtained by the dpkt.SSL module back to the front-end, which then uses the Jsrsasign cryptographic tool library to parse the certificate information and verify the certificate chain and validity period. For example, the X509 class functions of the Jsrsasign cryptographic tool library can be used to parse and verify certificates using the RSA algorithm and the SM2 algorithm.

[0116] It should be understood that the X509 class related functions can directly implement the parsing and verification of the RSA algorithm, but there will be some problems in the parsing of the public key of the SM2 algorithm certificate. For this reason, we further refer to the SM2 cryptographic standard and readjust the public key value of the SM2 algorithm certificate obtained by the Jsrsasign cryptographic tool library to implement the verification of the certificate chain in the JS code.

[0117] Specifically, for the parsing and verification of certificates in the SM2 encryption algorithm, since the certificate public key format extracted by the native Jsrsasign cryptographic tool library does not conform to the standard definition, we refer to the GM / T 0003-2012 "SM2 Elliptic Curve Public Key Cryptography Algorithm" standard and add the "04" identifier to the string header of the extracted hexadecimal public key value to generate the correct public key value. The modified public key value is used to verify the certificate signature field content digest, that is, the public key value of the root certificate is used to verify the obtained SM2 algorithm certificate content, thereby implementing the verification of the certificate chain in the JS code.

[0118] Finally, in the display of certificate information, the content of the relevant OID information is translated and displayed on the front-end web page.

[0119] In particular, it is optional that in the implementation process of the SSL VPN security authentication gateway service compliance detection method of the present invention, the main packet capture file analysis and processing and the parsing of the SSL protocol are deployed on the back end such as the server, and the parsing and verification of the certificate are deployed on the front end for processing, rather than being responded to after the back end processing. First, considering the continued improvement and optimization of the deployment of this method in the future, it can be used as a server to provide services to the outside world. Placing part of the calculation on the front end can reduce the pressure on the back end server. Second, the parsing of the certificate data ultimately needs to be displayed on the page. Through the js code, the html can be better operated for visualization, thereby improving the efficiency of code writing.

[0120] Identify and indicate data information that poses risks

[0121] In an embodiment of the present invention, according to "GB / T 39786-2021 Information Security Technology Information System Cryptography Application Basic Requirements", the cryptographic algorithms used by the information system with security problems or insufficient security strength are used to protect important data, such as MD5, DES, SHA-1, RSA (less than 2048 bits) and other cryptographic algorithms, as well as dangerous SSL protocols (SSL2.0, SSL3.0, TLS1.0) that have been discovered and gradually abandoned may lead to high risks. Therefore, after parsing the SSL data packet, the present invention will identify the SSL protocol version found, the shared suite type used in the cryptographic algorithm suite, and the key length of the algorithm certificate used by the server and the client, and make a judgment based on the preset early warning rules, and clearly mark and prompt the information with risks.

[0122] like Figure 7 、 8 The figure shows an example of a visual display interface of the detection results (SSL, TLS) of the SSL VPN security authentication gateway service compliance detection method according to the present invention. Figure 9 、 10The figure shows an example of a visual display interface of the detection result (GMTLS) of the SSL VPN security authentication gateway service compliance detection method according to the present invention. Figure 8 The test results shown also include subsequent information such as the certificate version number, serial number, signature algorithm, issuer, user, validity period, key usage, user key identification, and authorizer key identification, which are not shown in the accompanying drawings of the present invention.

[0123] In conjunction with the implementation of the SSL VPN security authentication gateway service compliance detection method of the above embodiment of the present invention, according to the present disclosure, a SSL VPN security authentication gateway service compliance detection system is also proposed, including: one or more processors and a memory.

[0124] The aforementioned memory is even used to store operable instructions, which, through such execution, enable the one or more computers to perform operations, including the process of the SSL VPN security authentication gateway service compliance detection method as described in any of the aforementioned embodiments.

[0125] In combination with the implementation of the SSL VPN security authentication gateway service compliance detection method of the above embodiments of the present invention, according to the present disclosure, a computer-readable medium for storing software is also proposed, wherein the software includes instructions that can be executed by one or more computers, and the instructions enable the one or more computers to perform operations through such execution, and the operations include the process of the SSL VPN security authentication gateway service compliance detection method as any of the aforementioned embodiments.

[0126] While the present invention has been disclosed above with reference to preferred embodiments, this is not intended to limit the present invention. Persons skilled in the art will readily appreciate that various modifications and variations can be made without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention shall be determined by the claims.

Claims

1. A method for detecting compliance of an SSLVPN security authentication gateway service, characterized in that: include: According to international and national secret network security protocols, different protocol versions are selected to construct HTTP-based access requests and establish connections with SSL servers; Receive the network data packet returned by the SSL server in response to the request, and reassemble the TCP segmented data of the network data packet to obtain a complete SSL data packet; Use Python's dpkt.SSL module to parse and identify the SSL data packet, and obtain the SSL protocol and TLS protocol types and certificate values; Based on the SSL data packet, the tcpdata byte stream data is extracted through the tcp layer and the predetermined protocol number is modified to the header protocol number corresponding to the benchmark international TLS protocol. The subsequent values ​​and the national secret certificate value are further identified and extracted through the dpkt.SSL module; the verification file is matched according to the preset rules, and the extracted binary value is converted into the corresponding national secret cipher algorithm suite name to complete the identification of the cipher algorithm suite value; Verify the obtained SSL and TLS protocol certificate values ​​and national secret certificate values ​​and their chain; as well as Visual representation of the verification results of the international SSL protocol, TLS protocol, national secret TLS protocol, and certificates and certificate chains obtained through testing.

2. The SSLVPN security authentication gateway service compliance detection method according to claim 1, characterized in that: According to the international and national secret network security protocols, different protocol versions are selected to construct HTTP-based access requests and establish connections with SSL servers, including: According to the international SSL protocol, TLS protocol and national secret TLS protocol, use the TaSSL tool to select different protocol versions and algorithm suites in turn, build an HTTP-based access request, send connection requests respectively, and perform connection tests with the SSL server; For each protocol version and algorithm suite connection test, determine whether the current connection is valid based on the handshake status with the SSL server; Determine whether the current connection is valid based on the handshake status returned by the SSL server, test and record the connection success or failure results in sequence; The SSL protocol version includes at least SSL 2.0 and SSL 3.

0. The protocol version of the TLS protocol includes at least TLS1.0, TLS1.1, TLS1.2 and TLS1.3; The cipher suite of the national secret TLS protocol includes at least four national secret-related cipher suites, namely ECC-SM4-SM3, ECC_SM4_GCM_SM3, ECDHE-SM4-SM3, and ECDHE_SM4_GCM_SM3, which comply with the GB / T38636-2020 specification, and the TLS_SM4_GCM_SM3 cipher suite that complies with the RFC8998 specification.

3. The SSLVPN security authentication gateway service compliance detection method according to claim 1, characterized in that: The receiving of the network data packet returned by the SSL server in response to the request and reassembling the TCP segmented data of the network data packet to obtain a complete SSL data packet includes: Use the wireshark tool to capture the pcapng data packet returned by the SSL server; Use the dpkt unpacking tool to extract the pcapng packet data layer by layer; The segmented message data obtained by layered extraction is grouped and reassembled according to the tcpack number of the message, and stored in a list structure list; and The list structure list is traversed, and duplicate checking is performed on the captured packet data after the messages are grouped according to the tcpack number to obtain a complete SSL data packet.

4. The SSLVPN security authentication gateway service compliance detection method according to claim 3, characterized in that: The message data obtained by the layered extraction is grouped and reassembled according to the tcpack number and stored in a list structure list, including: Based on the uniqueness of the TCP pack number, the TCP packs of the segmented messages are the same, and are identified as the same group of TCP messages; Using the python dictionary data structure, the key value is the tcpack number, the value value stores the tcpdata of the current tcpack number, and arranges them in chronological order of the captured packet files. The above key value and value value are stored as dictionary values ​​in the list structure List.

5. The SSLVPN security authentication gateway service compliance detection method according to claim 3, characterized in that: The list structure list is traversed, and duplicate checking is performed on the captured packet data after the message is grouped according to the tcpack number to obtain a complete SSL data packet, including: Traverse the list structure List and extract a single tcpack message dictionary. The key value of the dictionary is stored in the newly created ack set structure. The non-repeatable element property of the set structure is used to determine whether the current tcpack message dictionary has been processed. Before processing a single tcpack message in the list structure List each time, it is necessary to determine whether the dictionary key value exists in the ack set: If it does not exist, write the value of the tcpack message dictionary into the new ack dictionary, whose key value is still the ack number and the value is tcpdata; if it exists, splice the value of the tcpack message dictionary into the value of the corresponding key value in the ack dictionary; By traversing the list structure List until all tcpack message dictionary traversal processing is completed, the message data after duplication check and reorganization is obtained, that is, the complete SSL data packet.

6. The SSLVPN security authentication gateway service compliance detection method according to claim 1, characterized in that: Based on the SSL data packet, the tcpdata byte stream data is extracted through the tcp layer and the predetermined protocol number is modified to the header protocol number corresponding to the international TLS protocol, and the subsequent numerical values ​​and national secret certificate values ​​are further parsed and extracted through the dpkt.SSL module, including: Extract tcpdata byte stream data through the tcp layer; Extract the header protocol number information "0x0101"; Based on the international TLS1.1 protocol, which is the benchmark for the national TLS protocol, the header protocol number is modified to "0x0301"; and After the header protocol number is modified, the SSL data packet is unpacked through the dpkt.SSL module to extract subsequent values.

7. The SSLVPN security authentication gateway service compliance detection method according to any one of claims 1 to 6, characterized in that: The verification of the obtained international protocol certificate value and national secret certificate value and the certificate and certificate chain includes: Get the certificate value information obtained by the dpkt.SSL module; Based on the X509 class-related functions of the Jsrsasign cryptographic tool library, the encryption algorithm certificate is parsed and verified, and the certificate chain and certificate validity period are verified. For the parsing and verification of the certificate in the SM2 encryption algorithm, since the certificate public key format extracted by the native Jsrsasign cryptographic tool library does not conform to the standard definition, the "04" identifier is added to the string header of the extracted hexadecimal public key value in accordance with the GM / T0003-2012 "SM2 Elliptic Curve Public Key Cryptography Algorithm" standard to generate the correct public key value. The certificate signature field content summary is verified using the modified public key value, that is, the public key value of the root certificate is used to verify the obtained SM2 algorithm certificate content, realizing the verification of the certificate chain in the JS code. Finally, translate the relevant OID information to display the certificate information on the front-end page.

8. The SSLVPN security authentication gateway service compliance detection method according to any one of claims 1 to 6, characterized in that: The compliance detection method further includes the following steps: Based on the obtained SSL protocol version, the shared suite type used in the cipher suite, and the key length of the certificate, risky data information is identified and prompted based on preset rules.

9. The SSLVPN security authentication gateway service compliance detection method according to any one of claims 1 to 6, characterized in that: The compliance detection method further includes the following steps: Provides a front-end interactive and display interface for inputting test parameter information, as well as visually representing protocol parsing results and certificate verification result information.

10. An SSLVPN security authentication gateway service compliance detection system, characterized in that: include: one or more processors; A memory storing operable instructions, wherein the instructions, when executed, cause the one or more computers to perform operations, wherein the operations include the process of the method according to any one of claims 1 to 9.

11. A computer-readable medium storing software, characterized in that: The software includes instructions that can be executed by one or more computers, and the instructions, through such execution, enable the one or more computers to perform operations, wherein the operations include the process of the method according to any one of claims 1 to 9.

Images