Data processing method and device, electronic equipment and storage medium

Abstract

The application provides a data processing method and device, electronic equipment and storage medium, and relates to the technical field of communication. The method monitors SSL connection in the scene of HTTP tunnel communication, so that when two end devices perform data interaction through the HTTP tunnel, the data packets using the SSL protocol for communication can be detected, and the data packets that truly need SSL proxy processing can be detected. Subsequently, the SSL proxy can perform attack detection on the data packets after decryption, which can effectively reduce the problem of attack escape of attackers using the HTTP tunnel for attack, and improve data security.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a data processing method and device, electronic equipment and storage medium. BACKGROUND

[0002] The emergence of Hyper Text Transfer Protocol (HTTP) Tunnel facilitates users to use the network and breaks through many network access restrictions. However, it also provides attackers with a powerful tool to implement network attacks. For example, the current popular Trojan technology basically uses tunnel technology to penetrate the user's security protection facilities to achieve the purpose of stealing user private information.

[0003] However, the current HTTP tunnel detection technology is generally based on protocol detection. If the two end devices use other protocols for communication, the HTTP tunnel detection technology cannot obtain the plaintext data for attack detection, which makes it easy for attackers to use this method to escape attacks and cannot ensure data security. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a data processing method and device, electronic equipment and storage medium to improve the problem that the HTTP tunnel detection technology in the prior art cannot detect attacks on data communicated using other protocols, resulting in low data security.

[0005] In a first aspect, the embodiments of the present application provide a data processing method, which comprises:

[0006] After monitoring that the TCP data packet sent by the client to the server contains the interaction information of the HTTP tunnel, the first data packet of the SSL handshake protocol sent by the client to the server is monitored.

[0007] If the first data packet of the SSL handshake protocol sent by the client to the server is monitored, the subsequent received TCP data packet that needs to be processed by the SSL proxy is decrypted by the SSL proxy.

[0008] In the above implementation process, by monitoring the SSL connection in the HTTP tunnel communication scenario, it can be ensured that when the two end devices communicate data through the HTTP tunnel, the data packet communicated using the SSL protocol can be detected, and the data packet that really needs to be processed by the SSL proxy can be detected. Subsequently, the SSL proxy can decrypt these data packets and perform attack detection, which can effectively reduce the problem of attack escape by attackers using the HTTP tunnel and improve data security.

[0009] Optionally, after detecting that the TCP packet sent by the client to the server contains the interaction information of the HTTP tunnel, the method further comprises:

[0010] setting a flag of monitoring SSL connection, which is used to indicate monitoring the first packet of SSL handshake protocol sent by the client to the server.

[0011] In the above implementation process, the flag of monitoring SSL connection is set after detecting the HTTP tunnel communication, so that the network security device does not need to monitor each packet from the beginning, thereby improving the detection efficiency.

[0012] Optionally, after detecting the first packet of SSL handshake protocol sent by the client to the server, the method further comprises:

[0013] clearing the flag of monitoring SSL connection, so that the network security device does not need to perform SSL connection detection on each subsequent packet, thereby reducing resource occupation and improving detection efficiency.

[0014] Optionally, before detecting that the TCP packet sent by the client to the server contains the interaction information of the HTTP tunnel, the method further comprises:

[0015] receiving a TCP connection request packet sent by the client when the client establishes a connection with the server;

[0016] judging whether the TCP connection request packet represents that the connection established by the client with the server expects SSL proxy processing;

[0017] if yes, setting a flag of monitoring SSL connection, which is used to indicate monitoring the first packet of SSL handshake protocol sent by the client to the server.

[0018] In the above implementation process, SSL connection detection is performed at the initial establishment of the TCP connection, so that the accuracy of detecting SSL connection can be increased through multiple detections, and it can be truly judged whether SSL proxy needs to be performed, thereby preventing attacks from escaping by using the proxy and improving data security.

[0019] Optionally, the judging whether the TCP connection request packet represents that the connection established by the client with the server expects SSL proxy processing comprises:

[0020] The TCP connection request packet is matched with decryption strategy information, and if the match is successful, it is determined that the TCP connection request packet represents a connection expectation of the client and the server for SSL proxy processing, wherein the decryption strategy information includes at least one of the following: source IP address, destination IP address, source port, destination port, and protocol information.

[0021] Optionally, after the flag of monitoring the SSL connection is set, the method further comprises:

[0022] Detecting whether the first TCP data packet sent by the client is a first data packet of a non-SSL handshake protocol and an HTTP packet.

[0023] If yes, detecting whether the TCP data packet sent by the client to the server contains HTTP tunnel interaction information.

[0024] In the above implementation process, the first TCP data packet is detected to determine whether it is an SSL connection or an HTTP tunnel communication. If the first TCP data packet is an SSL connection, there is no need to detect the subsequent data packets. If the first TCP data packet is not an SSL connection, it is determined whether the subsequent data packets need to be further detected. In this way, detection is performed only when needed, improving the detection efficiency.

[0025] Optionally, the monitoring of whether the TCP data packet sent by the client to the server contains HTTP tunnel interaction information comprises:

[0026] The pre-configured HTTP tunnel detection machine is used to monitor whether the TCP data packet sent by the client to the server contains HTTP tunnel interaction information. In this way, the network security device can free up resources to process other tasks, and the resource utilization rate is higher.

[0027] Optionally, after it is detected that the first TCP data packet sent by the client is a first data packet of a non-SSL handshake protocol and an HTTP packet, the method further comprises:

[0028] The flag of monitoring the SSL connection is cleared.

[0029] In the above implementation process, since the first TCP data packet is a first data packet of a non-SSL handshake protocol and an HTTP packet, it indicates that the client and the server are in normal HTTP communication, not SSL connection communication. Therefore, the flag of the SSL connection can be cleared at this time, so that the subsequent each TCP data packet does not need to be detected for SSL connection, which can effectively improve the detection efficiency and reduce resource occupation.

[0030] Optionally, the TCP data packet received subsequently and requiring SSL proxy processing is determined by the following method:

[0031] performing matching of the decryption policy information on the subsequently received TCP data packet, and if the matching is successful, determining that the subsequently received TCP data packet needs to be processed by the SSL proxy, wherein the decryption policy information comprises at least one of the following: a source IP address, a destination IP address, a source port, a destination port, protocol information, and a server name indication (SNI).

[0032] In a second aspect, an embodiment of the present application provides a data processing apparatus, the apparatus comprising:

[0033] a monitoring module configured to monitor a first data packet of an SSL handshake protocol sent by a client to a server after monitoring that the TCP data packet sent by the client to the server contains the interaction information of the HTTP tunnel;

[0034] a processing module configured to perform decryption processing on a subsequently received TCP data packet that needs to be processed by the SSL proxy through the SSL proxy if the first data packet of the SSL handshake protocol sent by the client to the server is monitored.

[0035] In a third aspect, an embodiment of the present application provides an electronic device comprising a processor and a memory, wherein the memory stores computer readable instructions, and when the computer readable instructions are executed by the processor, the steps in the method provided in the first aspect are executed.

[0036] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the steps in the method provided in the first aspect are executed.

[0037] Other features and advantages of the present application will be described in the following description, and in part will become apparent from the description, or will be learned from the practice of the application. The purposes and other advantages of the present application can be realized and attained by the structure particularly pointed out in the written description and claims, and in the appended drawings. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some of the embodiments of the present application, and therefore should not be considered as limiting the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0039] Figure 1 a flowchart of a data processing method provided by an embodiment of the present application;

[0040] Figure 2 A structural block diagram of a data processing device provided by an embodiment of the present application is shown in the figure.

[0041] Figure 3 A structural schematic diagram of an electronic device for executing the data processing method provided by an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0042] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings.

[0043] It should be noted that the terms "system" and "network" in the embodiments of the present application can be used interchangeably. "Multiple" means two or more, and therefore, "multiple" can also be understood as "at least two" in the embodiments of the present application. "And / or" describes the association relationship of the associated objects, which means that there can be three kinds of relationships, for example, A and / or B can represent the following three cases: A exists alone, A and B exist together, and B exists alone. In addition, the character " / ", if not specially stated, generally represents an "or" relationship between the associated objects before and after it.

[0044] The embodiments of the present application provide a data processing method, which monitors the first data packet of an SSL handshake protocol sent by a client to a server after monitoring that the TCP data packet sent by the client to the server contains interaction information of an HTTP tunnel, and if monitoring is performed, then the subsequent TCP data packet that needs SSL proxy is processed by SSL proxy for decryption, so that in the scenario of data interaction through an HTTP tunnel, the data packet that truly needs SSL proxy processing can be detected, and the subsequent attack detection can be performed after decryption of the data packet by SSL proxy, which can effectively reduce the problem of attack escape by an attacker using an HTTP tunnel for attack, and improve data security.

[0045] Please refer to Figure 1 , Figure 1 A flowchart of a data processing method provided by an embodiment of the present application is shown in the figure, and the method comprises the following steps.

[0046] Step S110: After monitoring that the TCP data packet sent by the client to the server contains interaction information of an HTTP tunnel, the first data packet of an SSL handshake protocol sent by the client to the server is monitored.

[0047] Before the client and the server perform data communication, a connection needs to be established, such as an HTTP tunnel for data transmission. The HTTP tunnel in the embodiments of the present application refers to an HTTP protocol used to establish a tunnel between the client and the server to be communicated, and then the communication between the client and the server is performed on the tunnel.

[0048] When the connection is established, the client needs to send a connection request, such as an HTTP connect request, to the server. The HTTP tunnel technology is used to encapsulate all data to be transmitted into the HTTP protocol for transmission. After the HTTP tunnel is established between the client and the server, a TCP stream is established between the client and the server, and any data can be transmitted.

[0049] In order to ensure data security, the client and the server can communicate through an SSL connection. In order to detect whether the communication contains a network attack, the SSL proxy technology is used to decrypt the data of the communication for attack detection. If the client and the server communicate through the HTTP tunnel, the network security device (such as a firewall) only performs encapsulation processing on the received data through the HTTP protocol. If the attacker sends data through the Secure Sockets Layer (SSL) protocol, the data cannot be encapsulated, and the specific data content cannot be obtained, so that the attacker can easily escape through this way. Therefore, in order to improve the problem, the SSL connection between the client and the server is monitored in the embodiments of the present application when the client and the server communicate through the HTTP tunnel, to identify whether the client and the server have an SSL connection, and further identify whether SSL proxy processing is required.

[0050] First, after the client and the server establish a TCP connection, the client can send a TCP data packet to the server if the client needs to interact with the server. If the TCP data packet contains HTTP tunnel interaction information, it indicates that the client wants to communicate with the server through the HTTP tunnel. Therefore, the network security device can monitor the data sent by the client to the server to monitor whether the TCP data packet sent by the client to the server contains HTTP tunnel interaction information.

[0051] Here, the network security device is deployed between the client and the server. The network security device can perform security management on the data sent by the client to the server and the data sent by the server to the client, and further ensure the security of data interaction between the two parties.

[0052] The interaction information of the HTTP tunnel can be understood as an identifier of the HTTP tunnel or other information representing the HTTP tunnel, such as an HTTP connect request sent by the client, which indicates that the client wants to communicate with the server through the HTTP tunnel.

[0053] Therefore, after the TCP connection is established between the client and the server, the network security device can monitor the TCP data packet sent by the client. Once it is detected that the TCP data packet contains the interaction information of the HTTP tunnel, the network security device can start monitoring the first data packet of the SSL handshake protocol sent by the client to the server. The first data packet of the SSL handshake protocol indicates that the client wants to establish an SSL connection with the server and communicate through the SSL connection.

[0054] Step S120: If the first data packet of the SSL handshake protocol sent by the client to the server is monitored, the subsequent received TCP data packet that needs to be processed by the SSL proxy is decrypted by the SSL proxy.

[0055] After the network security device detects that the TCP data packet contains the interaction information of the HTTP tunnel, it can detect all the subsequent TCP data packets sent by the client to the server to monitor whether the client sends the first data packet of the SSL handshake protocol to the server. The first data packet of the SSL handshake protocol, such as the client hello packet of the SSL handshake protocol. If the network security device detects that the data packet sent by the client to the server is the first data packet of the SSL handshake protocol, it indicates that the client wants to communicate with the server through the SSL connection, and the data packet communicated through the SSL connection needs to be processed by the SSL proxy service.

[0056] Here, the SSL proxy service can be deployed in the network security device, or the SSL proxy service can be deployed on other devices. After the network device monitors the first data packet of the SSL handshake protocol, the subsequent received TCP data packet that needs to be processed by the SSL proxy is submitted to the SSL proxy service for processing, such as initializing the SSL protocol stack for SSL proxy processing. The SSL proxy service can decrypt the received TCP data packet and extract the plaintext data therein. The network security device or the SSL proxy service can perform security detection on the plaintext data. If the data contains attack information, the network security device or the SSL proxy service can perform corresponding processing on the data packet, such as interception, discarding, or outputting alarm information, etc. If the data does not contain attack information, the network security device or the SSL proxy service can perform forwarding processing on the data packet.

[0057] The TCP data packet that needs to be processed by the SSL proxy can be determined in the following manner:

[0058] The decryption policy information in the subsequently received TCP packet is matched, and if the decryption policy information is matched, it is determined that the subsequently received TCP packet needs to be processed by the SSL proxy, wherein the decryption policy information includes at least one of the following: source IP address, destination IP address, source port, destination port, protocol information, server name indication (SNI) information, and the like.

[0059] It can be understood that the network security device is configured with a plurality of decryption policy information, and the decryption policy information is used to indicate that the data packet containing the decryption policy information needs to be decrypted by the SSL proxy service.

[0060] For example, the network security device is pre-configured with the following decryption policy information:

[0061]

[0062] The network security device parses the decryption policy information from the TCP packet after receiving the TCP packet, and then matches the parsed decryption policy information with the pre-configured decryption policy information. If the decryption policy information matches a certain decryption policy information, it indicates that the TCP packet needs to be processed by the SSL proxy, and the TCP packet can be submitted to the SSL proxy service for related processing.

[0063] Of course, if the decryption policy information in a certain TCP packet does not match any pre-configured decryption policy information, it indicates that the data packet does not need to be processed by the SSL proxy, and the data packet can be processed according to the pre-configured processing logic on the network security device, such as discarding or forwarding.

[0064] In the above implementation process, the SSL connection is monitored in the HTTP tunnel communication scenario, so that when the two devices interact data through the HTTP tunnel, the data packet using the SSL protocol for communication can be detected, and the data packet that really needs the SSL proxy processing can be detected. Subsequently, the SSL proxy can decrypt and detect the attack of the data packet, which can effectively reduce the problem of attacker escaping attack by HTTP tunnel, and improve the data security.

[0065] On the basis of the above embodiment, in order to facilitate the related processes in the network security device to know when to monitor the SSL connection, a monitoring SSL connection flag can be set after the HTTP tunnel interaction information is detected in the TCP packet sent by the client to the server. The flag is used to indicate the first data packet of the SSL handshake protocol sent by the client to the server.

[0066] After the flag of monitoring the SSL connection is set, the network security device can monitor the SSL connection according to the flag, and if the flag of monitoring the SSL connection is not set after the HTTP tunnel communication is monitored, the network security device will not monitor the SSL connection, and thus cannot identify the SSL connection communication in the scenario of the HTTP tunnel communication.

[0067] In another case, the network security device can default to monitoring the SSL connection, but this is inefficient, so the flag of monitoring the SSL connection is set after the HTTP tunnel communication is monitored, so that the network security device does not need to monitor each data packet from the beginning, thereby improving the detection efficiency.

[0068] On the basis of the above embodiment, after the first data packet of the SSL handshake protocol sent by the client to the server is monitored, the flag of monitoring the SSL connection can also be cleared, that is, the flag set above is cleared.

[0069] If the flag of monitoring the SSL connection is not cleared, after the network security device detects the first data packet of the SSL handshake protocol, it will also detect whether each subsequent data packet is the first data packet of the SSL handshake protocol, but there is no need to detect the first data packet of the SSL handshake protocol for each data packet, so the efficiency is low if the flag is not cleared.

[0070] On the basis of the above embodiment, in order to improve the accuracy of detecting the SSL connection, before monitoring whether the TCP data packet sent by the client to the server contains the interaction information of the HTTP tunnel, the network security device can also receive the TCP connection request packet sent by the client when the client establishes a connection with the server, and then determine whether the TCP connection request packet indicates that the connection established by the client and the server expects SSL proxy processing, and if so, set the flag of monitoring the SSL connection, which is used to indicate monitoring of the first data packet of the SSL handshake protocol sent by the client to the server.

[0071] When the client and the server initially establish a TCP connection, the client sends a TCP connection request packet, that is, a TCP syn packet, to the server. The TCP connection request packet is first intercepted by the network security device, which first determines whether the connection expects SSL proxy processing, and if so, the network security device sets the flag of monitoring the SSL connection.

[0072] The flag here is the same as the flag in the above embodiment, and is used to indicate monitoring of the first data packet of the SSL handshake protocol sent by the client to the server. In order to distinguish between the two, the flag in the above embodiment can be referred to as the flag set during the second detection, and the flag here can be referred to as the flag set during the first detection.

[0073] The first detection of setting the flag is when a TCP connection request packet is monitored, and the second detection of setting the flag is when interaction information of an HTTP tunnel is contained in a TCP data packet. The first detection of setting the flag is to detect whether SSL proxy processing is required for an initial connection, and if so, subsequent monitoring is performed to determine whether HTTP tunnel communication is required, and if not, it indicates that the connection is not expected to be processed by the SSL proxy, and the network security device can be processed according to the original logic of the network security device, such as not monitoring the first data packet of the SSL handshake protocol. Therefore, the first detection of setting the flag can indicate that the network security device needs to detect the first data packet of the SSL handshake protocol for subsequent data packets to determine the data packet that actually needs to be processed by the SSL proxy.

[0074] In the above embodiment, whether the TCP connection request packet represents that the connection established by the client and the server is expected to be processed by the SSL proxy can be determined by the following method:

[0075] The TCP connection request packet is matched with decryption policy information, and if the match is successful, it is determined that the TCP connection request packet represents that the connection established by the client and the server is expected to be processed by the SSL proxy, wherein the decryption policy information includes at least one of the following: source IP address, destination IP address, source port, destination port, and protocol information.

[0076] In the above embodiment, the network security device is preconfigured with multiple decryption policy information, as shown in the table in the above embodiment. The information matching here is only matching without SNI information, and the matching of the remaining information is the same. That is, the TCP connection request packet is first parsed to obtain at least one of the source IP address, destination IP address, source port, destination port, and protocol information carried by the TCP connection request packet, and then matched with each decryption policy information in the above table. If a decryption policy information is matched, it represents that the connection established by the client and the server is expected to be processed by the SSL proxy.

[0077] In the above implementation process, by detecting the SSL connection at the initial establishment of the TCP connection, the accuracy of detecting the SSL connection is increased through multiple detections, and it is truly determined whether the SSL proxy is required, preventing attacks from escaping by using the proxy and improving data security.

[0078] In the above embodiment, after setting the flag of monitoring the SSL connection in the first detection, it can be further detected whether the first TCP data packet sent by the client is a first data packet of a non-SSL handshake protocol and an HTTP packet, and if so, it is detected whether the TCP data packet sent by the client to the server contains interaction information of an HTTP tunnel.

[0079] That is, the first time the set flag is detected for detecting whether the first TCP packet is the first packet of the non-SSL handshake protocol and is an HTTP packet. If the first TCP packet is not the first packet of the SSL handshake protocol, but an HTTP packet, it indicates that the client and the server are in normal HTTP communication, so that it can be further detected whether it is HTTP tunnel communication. If the first TCP packet is the first packet of the SSL handshake protocol, it indicates that the client and the server need to communicate through SSL connection, and then the subsequent data packets that need to be processed through SSL proxy can be processed through SSL proxy.

[0080] In the above embodiment, after it is monitored that the first TCP packet sent by the client to the server is the first packet of the non-SSL handshake protocol and is an HTTP packet, the set flag for monitoring the SSL connection can be cleared.

[0081] Since the first TCP packet is the first packet of the non-SSL handshake protocol and is an HTTP packet, it indicates that the client and the server are in normal HTTP communication, not SSL connection communication, so the flag of the SSL connection can be cleared at this time, so that it is not necessary to detect each TCP packet for SSL connection, which can effectively improve the detection efficiency and reduce resource occupation. However, after the subsequent detection of the TCP packet containing the interaction information of the HTTP tunnel, the flag is re-set, and the SSL connection detection for the communication in the HTTP tunnel scenario can be performed again.

[0082] Of course, if the first TCP packet is the first packet of the SSL handshake protocol, the flag for monitoring the SSL connection can also be cleared, because it is determined to be an SSL connection at this time, so it is not necessary to detect the SSL connection subsequently, thereby improving the detection efficiency.

[0083] It can be understood that if the first detection is not to clear the set flag for monitoring the SSL connection, the detection of the first packet of the SSL handshake protocol is performed for each TCP packet subsequently. If it is detected that the TCP packet is the first packet of the non-SSL handshake protocol and is an HTTP packet, the detection of the HTTP tunnel communication is entered. If it is detected that it is the HTTP tunnel communication, the flag can not be set again at this time, because it has been set before, so the detection of the first packet of the SSL handshake protocol is continued at this time.

[0084] That is, the flag set in the two detections in the foregoing embodiment can be cleared after the corresponding information is detected, so as to improve the detection efficiency. If the flag set in the first detection is not cleared, the flag can not be set again in the second detection. Of course, the flag can be set again in the second detection, but the flag set twice is repeated, which does not affect the execution logic of the whole method.

[0085] On the basis of the above-mentioned embodiments, when detecting the HTTP tunnel communication, whether the interaction information of the HTTP tunnel is contained in the TCP data packet sent by the client to the server can be monitored by the HTTP tunnel detection machine pre-configured in the network security device.

[0086] For example, when it is detected that the first TCP data packet is the first data packet of the non-SSL handshake protocol and is HTTP, the HTTP tunnel detection machine is started to detect the HTTP tunnel communication by the HTTP tunnel detection machine, so that the network security device can release resources to process other tasks, and the resource utilization is higher.

[0087] Please refer to Figure 2 , Figure 2 A structure block diagram of a data processing apparatus 200 provided by the embodiments of the present application is provided, the apparatus 200 can be a module, a program segment or code on an electronic device. It should be understood that the apparatus 200 corresponds to the above-mentioned Figure 1 method embodiments, and can perform each step involved in the Figure 1 method embodiments, and the specific functions of the apparatus 200 can be referred to the description in the above, and the detailed description is appropriately omitted here to avoid repetition.

[0088] Optionally, the apparatus 200 comprises:

[0089] The monitoring module 210 is configured to monitor the first data packet of the SSL handshake protocol sent by the client to the server after it is monitored that the TCP data packet sent by the client to the server contains the interaction information of the HTTP tunnel.

[0090] The processing module 220 is configured to perform decryption processing on the TCP data packet received subsequently and needing SSL proxy processing by the SSL proxy if it is monitored that the first data packet of the SSL handshake protocol sent by the client to the server.

[0091] Optionally, the apparatus 200 further comprises:

[0092] The marking module is configured to set a mark of monitoring the SSL connection after it is monitored that the TCP data packet sent by the client to the server contains the interaction information of the HTTP tunnel, and the mark is used to indicate monitoring the first data packet of the SSL handshake protocol sent by the client to the server.

[0093] Optionally, the marking module is further configured to clear the mark of monitoring the SSL connection after it is monitored that the first data packet of the SSL handshake protocol sent by the client to the server.

[0094] Optionally, the apparatus 200 further comprises:

[0095] a marking module, configured to receive a TCP connection request packet sent by a client when the client establishes a connection with a server before monitoring whether the client sends interaction information of an HTTP tunnel in a TCP packet sent to the server; determine whether the TCP connection request packet represents that the connection established by the client with the server expects SSL proxy processing; if yes, set a mark for monitoring SSL connection, which is used to indicate monitoring a first packet of an SSL handshake protocol sent by the client to the server.

[0096] Optionally, the marking module is configured to perform decryption strategy information matching on the TCP connection request packet, and if matching, determine that the TCP connection request packet represents that the connection established by the client with the server expects SSL proxy processing, wherein the decryption strategy information includes at least one of a source IP address, a destination IP address, a source port, a destination port and protocol information.

[0097] Optionally, the marking module is further configured to, after setting the mark for monitoring SSL connection, detect whether the first TCP packet sent by the client is a first non-SSL handshake protocol packet and an HTTP packet, and if yes, detect whether the TCP packet sent by the client to the server contains interaction information of an HTTP tunnel.

[0098] Optionally, the marking module is further configured to monitor whether the TCP packet sent by the client to the server contains interaction information of an HTTP tunnel by using a preconfigured HTTP tunnel detection machine.

[0099] Optionally, the marking module is further configured to, after monitoring that the first TCP packet sent by the client is a first non-SSL handshake protocol packet and an HTTP packet, clear the mark for monitoring SSL connection.

[0100] Optionally, the TCP packet received subsequently and requiring SSL proxy processing is determined in the following manner:

[0101] perform decryption strategy information matching on the subsequently received TCP packet, and if matching, determine that the subsequently received TCP packet requires SSL proxy processing, wherein the decryption strategy information includes at least one of a source IP address, a destination IP address, a source port, a destination port, protocol information and a server name indication (SNI).

[0102] It should be noted that, for the convenience and brevity of description, the specific working process of the apparatus described above can refer to the corresponding process in the foregoing method embodiments, which will not be described herein again.

[0103] Please refer to Figure 3 , Figure 3 A structural schematic diagram of an electronic device for performing a data processing method is provided in the embodiments of the present application. The electronic device can include at least one processor 310, such as a CPU, at least one communication interface 320, at least one memory 330, and at least one communication bus 340. The communication bus 340 is used to realize direct connection and communication of the components. The communication interface 320 of the device in the embodiments of the present application is used to communicate signaling or data with other node devices. The memory 330 can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The memory 330 can also be at least one storage device located away from the aforementioned processor. The memory 330 stores computer readable instructions. When the computer readable instructions are executed by the processor 310, the electronic device performs the method processes shown in the above Figure 1 .

[0104] It can be understood that Figure 3 The structure shown is only schematic. The electronic device can include more or fewer components than those shown in the Figure 3 , or have a different configuration from the Figure 3 . Figure 3 The components shown in the may be implemented in hardware, software, or a combination thereof.

[0105] Figure 1 The embodiments of the present application provide a computer readable storage medium, which stores a computer program. When the computer program is executed by a processor, the method processes performed by the electronic device in the method embodiments shown in the are executed.

[0106] The embodiments of the present application disclose a computer program product, which includes a computer program stored on a non-transitory computer readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the method provided in each of the method embodiments, for example, including:

[0107] After it is monitored that the TCP data packet sent by a client to a server contains HTTP tunnel interaction information, a first data packet of an SSL handshake protocol sent by the client to the server is monitored.

[0108] If the first data packet of the SSL handshake protocol sent by the client to the server is monitored, the subsequent received TCP data packet that needs to be processed by SSL proxy is decrypted by the SSL proxy.

[0109] In conclusion, the embodiment of the present application provides a data processing method and device, electronic equipment and storage medium, which monitors the SSL connection in the scene of HTTP tunnel communication, so as to ensure that when the two end devices interact data through the HTTP tunnel, the data packets using the SSL protocol for communication can be detected, and the data packets that really need to be processed by the SSL proxy can be detected, and the subsequent SSL proxy can decrypt and detect the attack of the data packets, which can effectively reduce the problem of attack escaping of the attacker using the HTTP tunnel, and improve the data security.

[0110] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only illustrative. For example, the division of the units is only a logical function division, and there can be another division manner in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some communication interfaces, devices or units, and can be electrical, mechanical or other forms.

[0111] In addition, the units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0112] Furthermore, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0113] In this paper, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between the entities or operations.

[0114] The above description is only for the embodiments of the present application and does not limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A data processing method, characterized by, The method comprises: After monitoring that the TCP data packet sent by the client to the server contains the interaction information of the HTTP tunnel, monitoring the first data packet of the SSL handshake protocol sent by the client to the server; If the first data packet of the SSL handshake protocol sent by the client to the server is monitored, then the subsequent received TCP data packet which needs to be processed by the SSL agent is decrypted by the SSL agent; Before monitoring that the TCP data packet sent by the client to the server contains the interaction information of the HTTP tunnel, the method further comprises: Receiving the TCP connection request packet sent by the client when the client establishes a connection with the server; Determining whether the TCP connection request packet represents that the connection established by the client with the server expects to be processed by the SSL agent; If yes, setting a monitoring SSL connection mark, which is used to indicate that the first data packet of the SSL handshake protocol sent by the client to the server is monitored.

2. The method of claim 1, wherein, After monitoring that the first data packet of the SSL handshake protocol sent by the client to the server is monitored, the method further comprises: Clearing the monitoring SSL connection mark.

3. The method of claim 1, wherein, The determination of whether the TCP connection request packet represents that the connection established by the client with the server expects to be processed by the SSL agent comprises: Matching the decryption policy information of the TCP connection request packet, if matched, then it is determined that the TCP connection request packet represents that the connection established by the client with the server expects to be processed by the SSL agent, wherein the decryption policy information comprises at least one of the following: source IP address, destination IP address, source port, destination port and protocol information.

4. The method of claim 1, wherein, After setting the monitoring SSL connection mark, the method further comprises: Detecting whether the first TCP data packet sent by the client is the first data packet of the non-SSL handshake protocol and the HTTP packet; If yes, detecting whether the TCP data packet sent by the client to the server contains the interaction information of the HTTP tunnel.

5. The method of claim 4, wherein, The monitoring of whether the TCP data packet sent by the client to the server contains the interaction information of the HTTP tunnel comprises: Monitoring whether the TCP data packet sent by the client to the server contains the interaction information of the HTTP tunnel by a pre-configured HTTP tunnel detection machine.

6. The method of claim 4, wherein, After monitoring that the first TCP data packet sent by the client is the first data packet of the non-SSL handshake protocol and the HTTP packet, the method further comprises: Clearing the monitoring SSL connection mark.

7. The method according to any of claims 1 to 6, characterized in that The subsequent received TCP data packet which needs to be processed by the SSL agent is determined in the following way: Matching the decryption policy information of the subsequent received TCP data packet, if matched, then it is determined that the subsequent received TCP data packet needs to be processed by the SSL agent, wherein the decryption policy information comprises at least one of the following: source IP address, destination IP address, source port, destination port, protocol information and server name indication SNI.

8. A data processing apparatus, characterized by, The device comprises: The monitoring module is configured to monitor a first data packet of an SSL handshake protocol sent by the client to the server after monitoring that the TCP data packet sent by the client to the server contains the interaction information of the HTTP tunnel. The processing module is configured to, if the first data packet of the SSL handshake protocol sent by the client to the server is monitored, perform decryption processing on the subsequently received TCP data packet requiring SSL proxy processing by the SSL proxy. The marking module is configured to, before monitoring that the TCP data packet sent by the client to the server contains the interaction information of the HTTP tunnel, receive a TCP connection request packet sent by the client when the client establishes a connection with the server; determine whether the TCP connection request packet represents that the connection established by the client with the server expects SSL proxy processing; if yes, set a monitoring SSL connection mark, the mark being used to indicate monitoring of the first data packet of the SSL handshake protocol sent by the client to the server.

9. An electronic device, comprising: The computer program is executed by the processor to run the method of any one of claims 1-7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to run the method of any one of claims 1-7.

Images