A method and system for auditing internet browsing behavior based on SSL VPN
By deploying audit behavior management devices on the user end, acquiring and parsing SSLVPN packets, and performing identity authentication and policy matching, the problem of low efficiency and security of data transmission auditing in SSLVPN tunnels is solved, and efficient and secure auditing of user internet access behavior is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- WUHAN SIPU TECH CO LTD
- Filing Date
- 2023-06-28
- Publication Date
- 2026-07-21
Smart Images
Figure CN116828088B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of internet behavior auditing, and in particular to an internet behavior auditing method and system based on SSLVPN. Background Technology
[0002] SSLVPN is a VPN technology based on the Secure Sockets Layer protocol. Clients can establish a communication tunnel directly between their client and the headquarters server. The remote client can then access the headquarters server's network and internal resources through this tunnel. However, this exposes the company's internal resources and network to attacks.
[0003] To improve the security of internal resources and networks, it is necessary to audit internet access behavior within the enterprise. However, the application engine on the headquarters server can only parse and audit the IP packets outside the SSL VPN, and cannot audit and control the data transmitted within the SSL VPN tunnel. Within the SSL VPN tunnel, the application engine can only see SSL VPN protocol packets.
[0004] Because the original packets are encapsulated within the SSL VPN packets, the headquarters server cannot audit and control the communication tunnel, thus failing to obtain accurate audit results for the SSL VPN packets. Therefore, an auditing device can be deployed at each branch office corresponding to each user terminal to audit and control each user terminal. However, for a large number of user terminals, the data processing volume of the auditing device is enormous, which will reduce the efficiency and security of auditing user internet behavior. Summary of the Invention
[0005] To address the issues of low efficiency and security in auditing data transmitted through SSL VPN tunnels, in a first aspect, some embodiments of this application provide a method for auditing internet browsing behavior based on SSL VPN, the method comprising:
[0006] Obtain SSL VPN packets sent from the user client to the headquarters server;
[0007] If the SSLVPN message is a local message of the audit behavior management device and the SSLVPN message is a valid message, then connect to the control plane of the SSLVPN message to obtain the user authentication result through the control plane;
[0008] A first data channel is established based on the identity authentication result. The first data channel is used to connect the user terminal and the headquarters server. Data packets are transmitted in the first data channel.
[0009] Policy matching is performed on the inner message, and the audit behavior of the user terminal is recorded according to the policy matching result. The inner message is obtained by decrypting the data packet through the data plane.
[0010] In some embodiments, the method further includes:
[0011] Obtain the protocol type and destination port of the SSLVPN message;
[0012] Iterate through the configured ports of the client terminals;
[0013] If the protocol type is a connectionless transport protocol and the target port is not a local port, then the SSLVPN message is marked as a valid message.
[0014] In some embodiments, obtaining the user terminal authentication result through the control plane includes:
[0015] Obtain user information from the user terminal, including the user terminal's account password and SSL VPN permissions;
[0016] The control plane sends the user's account and password to the network security system, and the control plane sends the user's SSL VPN permissions to the data plane.
[0017] The network security system verifies the user's account password to obtain a first feedback result, and the data plane verifies the user's SSL VPN permissions to obtain a second feedback result.
[0018] The first feedback result and the second feedback result are sent to the control plane via inter-process communication to obtain the user terminal authentication result.
[0019] In some embodiments, establishing a first data channel based on the identity authentication result includes:
[0020] Set the flag bit of the user terminal on the control platform;
[0021] When the control plane receives a successfully authenticated user client identity authentication result, it allocates a virtual address to the flag bit.
[0022] A first data channel is established based on the virtual address.
[0023] In some embodiments, before performing policy matching on the inner message, the method further includes:
[0024] The data packet is sent to the data plane;
[0025] The data packet encapsulation format is parsed using the data plane;
[0026] According to the encapsulation format, the data packet is decrypted to obtain the inner message.
[0027] In some embodiments, performing policy matching on inner messages includes:
[0028] Traverse the policy table of the audit behavior management device, the policy table including the operation policy of the audit behavior management device, the operation policy including user list and resource list;
[0029] If the operation policy is enabled, then query the inner message in the user list and query the target IP in the resource list. The target IP is the IP address generated by the user terminal when accessing the headquarters server.
[0030] If the user client is found in the user list and the target IP is found in the resource list, a matching result is generated to allow the data packet to pass.
[0031] In some embodiments, recording the audit behavior of the user terminal based on the policy matching result includes:
[0032] Create a user object based on the inner message;
[0033] Associate the sessions generated by the headquarters server with the user object to obtain the audit dialogue;
[0034] Internet access behavior auditing is performed on the audit dialogue based on the feature database, which is obtained by parsing inner packets.
[0035] In some embodiments, performing internet behavior auditing on the audited conversation based on a feature library includes:
[0036] Traffic from the user end is aggregated through audit behavior management devices;
[0037] Based on the user's traffic, obtain the internet access behavior statistics of the headquarters server.
[0038] In some embodiments, the method further includes:
[0039] A second data channel is created in the audit behavior management device, the second data channel being used to connect the client and the headquarters server;
[0040] The data packet is encrypted and encapsulated using the packet sending function;
[0041] The encapsulated data packet and the internet activity statistics are sent to the client through the second data channel.
[0042] Secondly, some embodiments of this application provide an Internet access behavior auditing system based on SSLVPN. The system includes a message type discrimination module and an auditing module. The message type discrimination module is configured to determine the message type of SSLVPN messages. The message type includes local messages of the audit behavior management device and forwarded messages of the audit behavior management device.
[0043] The auditing module is configured to connect to the control plane of the SSL VPN message when the SSL VPN message is a local message of the audit behavior management device and the SSL VPN message is a legitimate message, so as to obtain the user authentication result through the control plane.
[0044] A first data channel is established based on the identity authentication result. The first data channel is used to connect the user terminal and the headquarters server. Data packets are transmitted in the first data channel.
[0045] Policy matching is performed on the inner message, and the audit behavior of the user terminal is recorded according to the policy matching result. The inner message is obtained by decrypting the data packet through the data plane.
[0046] As can be seen from the above technical solutions, this application provides a method and system for auditing internet access behavior based on SSLVPN. It obtains SSLVPN packets sent from the user terminal to the headquarters server and determines the packet type. If the SSLVPN packet is a local packet of the audit behavior management device and is a legitimate packet, the control plane connecting to the SSLVPN packet is controlled to obtain the user terminal's authentication result. A first data channel is established based on the authentication result, and data packets are transmitted in the first data channel. Policy matching is performed on the inner packet obtained by decrypting the data packet through the data plane, and the audit behavior of the user terminal is recorded according to the policy matching result. This application improves the efficiency and security of auditing user terminal internet access behavior by determining the SSLVPN packet type, selecting the corresponding plane to decrypt the SSLVPN packet according to the packet type, and performing policy matching based on the obtained inner packet to statistically analyze audit behavior. Attached Figure Description
[0047] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0048] Figure 1 A flowchart illustrating an SSL VPN-based internet access behavior auditing method provided in this application embodiment;
[0049] Figure 2 This is a flowchart illustrating the SSL VPN message legitimacy detection process in an embodiment of this application.
[0050] Figure 3 This is a flowchart illustrating the user information authentication process of the control plane for SSL VPN packets according to an embodiment of this application.
[0051] Figure 4 This is a flowchart illustrating the strategy matching process for inner-layer messages in an embodiment of this application. Detailed Implementation
[0052] To make the objectives and implementation methods of this application clearer, the exemplary implementation methods of this application will be clearly and completely described below with reference to the accompanying drawings of the exemplary embodiments of this application. Obviously, the exemplary embodiments described are only some embodiments of this application, and not all embodiments.
[0053] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.
[0054] The terms "first," "second," "third," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar or related objects or entities, and do not necessarily imply a specific order or sequence, unless otherwise specified. It should be understood that such terms are interchangeable where appropriate.
[0055] The terms “comprising” and “having”, and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device that includes a range of components is not necessarily limited to all of the components that are clearly listed, but may include other components that are not clearly listed or that are inherent to such product or device.
[0056] SSLVPN is a VPN technology based on the Secure Sockets Layer protocol. Clients can establish a communication tunnel directly between the user end and the headquarters server through SSLVPN, allowing remote users to access resources on the headquarters server. During this access process, the user end can access the internal network of the headquarters server through the communication tunnel, which will expose the internal network's IP address and reduce the network security of the headquarters server.
[0057] Therefore, it is necessary to audit the internet access behavior of users to ensure the network security of the headquarters server. However, the application engine of the headquarters server only effectively parses and audits the IP packets on the outer layer of the SSLVPN client. For the data transmitted in the communication tunnel, since the original packets are encapsulated inside the SSLVPN packets, the application engine cannot complete the auditing and control, and therefore cannot obtain accurate audit results for the SSLVPN packets.
[0058] Therefore, in order to audit data transmitted through the communication tunnel, an auditing device can be deployed at each branch office corresponding to each user terminal to audit and control each user terminal. However, for a massive number of user terminals, the data processing volume of the auditing device is large, which will reduce the efficiency and security of auditing user terminal internet behavior.
[0059] To address the issues of low efficiency and security in auditing data transmitted through SSL VPN tunnels, some embodiments of this application provide a method for auditing internet browsing behavior based on SSL VPN, such as... Figure 1 As shown, the method includes:
[0060] S100: Obtain SSL VPN messages sent from the user client to the headquarters server.
[0061] When a user requests an SSLVPN connection from the headquarters server, it sends an SSLVPN message to the headquarters server. At this time, in order to improve the security of accessing the headquarters server, the SSLVPN client will obtain the SSLVPN message, and thus the SSLVPN client can establish a connection between the user and the headquarters server based on the SSLVPN message.
[0062] S200: If the SSLVPN message is a local message of the audit behavior management device and the SSLVPN message is a valid message, then control the control plane connected to the SSLVPN message to obtain the user authentication result through the control plane.
[0063] To manage internet access behavior on the headquarters server, an audit behavior management device can be deployed on the headquarters server. The audit behavior management device can audit and manage the client accessing the headquarters server, and the management options can include access count, access duration, and browsed file items.
[0064] Therefore, SSLVPN messages have different types for audit behavior management devices, which requires determining the SSLVPN message type. SSLVPN message types include local messages from the audit behavior management device or forwarded messages from the audit behavior management device.
[0065] If the SSLVPN message is a local message of the audit behavior management device, the legitimacy of the SSLVPN message can be checked. If the SSLVPN message is a legitimate message, the control plane of the SSLVPN message can be connected to obtain the user authentication result through the control plane.
[0066] SSLVPN messages can connect the control plane (daemon process) and the data plane (dplane process). The control plane can authenticate the client sending the SSLVPN message, thereby controlling the accurate access of the SSLVPN protocol. The data plane can intercept, encrypt, and decrypt legitimate SSLVPN data packets.
[0067] In some embodiments, such as Figure 2 As shown, the legitimacy of SSLVPN messages can be determined using the following methods:
[0068] S201: Obtain the protocol type of the SSLVPN message and the destination port of the SSLVPN message.
[0069] SSL VPN messages can include various protocol types. Therefore, determining the legitimacy of an SSL VPN message requires identifying its protocol type. This can be done by obtaining the protocol type of the SSL VPN message. Additionally, the target port used by the user on the SSL VPN message can also be obtained.
[0070] S202: Traverse the configuration ports of the user terminal.
[0071] In this embodiment, to avoid conflicts between the target port and the port to be used locally on the user's end, the configuration window on the user's end can be traversed to determine whether the port to be used by the SSLVPN message conflicts with the local port.
[0072] S203: If the protocol type has no connectionless transport protocol and the target port is not a local port, then mark the SSLVPN message as a valid message.
[0073] One example of a connectionless transport protocol is the User Datagram Protocol (UDP). UDP provides an application with a way to send encapsulated IP packets without establishing a connection. The client can use UDP and the established communication tunnel to send SSL VPN packets to the headquarters server.
[0074] When the destination port is not a local port, the SSLVPN message will not conflict with the client's port. In some embodiments, the destination port can be a default port or configured to another port according to the user's specific situation, as long as the configured destination port does not conflict with the local port.
[0075] In some embodiments, during the process of authenticating the user's identity through the control plane, user information from the user's terminal can also be obtained, such as... Figure 3 As shown, user information may include the user's account and the password entered by the user for that account. The control plane can verify the account and password to prevent unauthorized personnel from accessing the headquarters server through the user's client, thus preventing the leakage of enterprise resources. User information may also include the user's SSL VPN permissions to ensure that the user can use SSL VPN permissions, thereby blocking access to the headquarters server from those without SSL VPN permissions.
[0076] In some embodiments, the user's account password can also be sent to an AAA process system via the control plane. An AAA process system is a network security system that includes authentication, authorization, and accounting. This network security system can verify the user's account password to obtain a first feedback result. The first feedback result can be successful verification, indicating that the entered password has passed account verification; or it can be a failed verification, indicating that the entered password does not match the correct password for the account.
[0077] The control plane can also send the user's SSL VPN permissions to the data plane, whereby the dplane process verifies these permissions and obtains a second feedback result. This second feedback result can indicate that the SSL VPN permissions have passed verification or failed verification. If the SSL VPN permissions have failed verification, the reason for the failure can be added to the second feedback result, such as the SSL VPN permission certificate being frozen or expired.
[0078] After receiving the first and second feedback results, they can be returned to the control plane via IPC (Inter-Process Communication). The control plane will verify both the first and second feedback results. If both the first and second feedback results pass verification, the control plane generates an authentication result indicating successful user authentication. If either the first or second feedback result fails verification, or if both the first and second feedback results fail verification, the control plane generates an authentication result indicating failed user authentication.
[0079] S300: Establish a first data channel based on the identity authentication result. The first data channel is used to connect the user terminal and the headquarters server.
[0080] Once the user's identity is successfully authenticated, a first data channel is established between the user's client and the headquarters server based on the authentication result. This first data channel connects the user's client and the headquarters server, and data packets are transmitted through it. The user's client can use this first data channel to access, download, and transfer internal enterprise resources on the headquarters server.
[0081] In some embodiments, after the control plane receives the authentication information, it can set the flag bit of the user terminal in the control plane. The authentication information may include the device name and corresponding IP address of the user terminal, so as to obtain the user terminal information based on the device name and IP address and generate the flag bit.
[0082] After generating the flag, the control plane can obtain the first and second feedback results. When both the first and second feedback results are verified, meaning the control plane receives a successful user authentication result, it allocates a virtual address to the flag and then establishes the first data channel based on the virtual address. The virtual address can be the address pool of the SSL VPN configured in the WebUI. WebUI refers to the website user interface design, encompassing common website designs (such as e-commerce websites and social networking sites) and network software designs (such as email and SaaS products). WebUI emphasizes user interaction and can improve the interaction between the user and the headquarters server.
[0083] S400: Perform policy matching on the inner message and record the audit behavior of the user terminal based on the policy matching result.
[0084] In this embodiment, data packets in the first data channel can be acquired, and the data packets can be decrypted by the dplane process to extract the encapsulated inner message from the data packets. Then, policy matching is performed on the inner message to improve the security of client access through policy matching.
[0085] In some embodiments, before performing policy matching on the inner message, the data packet can be sent to the data plane, and then the data plane can parse the encapsulation format of the data packet, so that the dplane process in the data plane can decrypt the data packet according to the encapsulation format to obtain the inner message, thereby improving decryption efficiency and saving time in obtaining the inner message.
[0086] In some embodiments, during the process of matching message execution policies, the policy table of the audit behavior management device can also be traversed, such as... Figure 4 As shown, the policy table includes the operational policies for the audit behavior management device. These policies include a user list and a resource list. The user list can include the names of the user devices accessing the headquarters server, along with the number of accesses and the duration of each access. The resource list can include the IP addresses used by user devices to access the headquarters server; each user device's access corresponds to only one IP address per visit.
[0087] In this embodiment, the activation status of the running policy can be detected. If the running policy is not enabled, the inner packet cannot be matched with the policy, and the corresponding data packet is discarded, resulting in a failed access. If the running policy is enabled, the inner packet is queried in the user list, and the target IP is queried in the resource list. The target IP is the IP address generated when the user accesses the headquarters server. If the user is found in the user list and the target IP is found in the resource list, the policy of the inner packet is matched, generating a matching result for allowing the data packet to pass, and the headquarters server can be accessed based on the data packet.
[0088] If the client is found in the user list but the target IP is not found in the resource list, or vice versa, the current data packet is considered partially matched and poses an access risk. Multiple policy matching attempts can be performed on the current data packet. If the data packet still does not fully match the policy after a preset number of attempts, the data packet is discarded. If the client is not found in the user list and the target IP is not found in the resource list, the current data packet is considered a dangerous data packet, and a discard matching result is generated, and the data packet is discarded.
[0089] In some embodiments, after successful matching of the inner packet policy, the client can access the headquarters server based on the inner packet. At this time, a user object can be created based on the inner packet, and the client can perform internet access behavior through the user object. To facilitate auditing of internet access behavior, the dialogue generated by the headquarters server can be associated with the user object to obtain the audit dialogue. At the same time, deep parsing can be performed on the inner packet to obtain a feature library. Based on the feature library, internet access behavior auditing can be performed on the audit dialogue, such as classifying and marking sessions with new packets, applying policy matching, updating traffic statistics, or applying auditing, etc.
[0090] In some embodiments, the inner message is input to the application engine, which is a module in the dplane process. The engine fully parses the message and classifies and marks the inner message in conjunction with a feature library to facilitate subsequent application control, intrusion prevention, virus protection and other services.
[0091] In some embodiments, internet access behavior auditing can be performed on auditing sessions based on a feature library. For this purpose, an audit behavior management device can aggregate user traffic. When a user accesses resources within the enterprise, a certain amount of traffic is generated due to network access. Different resource formats consume different amounts of traffic; for example, loading text uses less traffic than loading images. After aggregating user traffic, internet access behavior statistics from the headquarters server can be obtained based on the user traffic, thereby completing the recording of user-side audit behavior.
[0092] In some embodiments, after receiving the audit behavior, the audit behavior can be returned to the client. For this purpose, a second data channel can be created in the audit behavior management device to connect the client and the headquarters server. To improve the security of data transmission, a packet sending function can be used to perform encrypted encapsulation on the data packets transmitted in the second data channel.
[0093] In the above process, the second data channel can send the transmitted data packets to the data plane, and encrypt and encapsulate the SSLVPN protocol in the data packets through the packet sending function. Finally, the encapsulated data packets and the corresponding Internet behavior statistics are sent to the client through the second data channel.
[0094] In some embodiments, if the SSLVPN message is a forwarded message from an audit behavior management device, policy matching can be directly performed on the forwarded message. During this process, the forwarded message can be decrypted to obtain the corresponding inner message, and then the subsequent policy matching process can be performed. The policy matching process in this embodiment can refer to the aforementioned policy matching process, and will not be repeated here.
[0095] To facilitate the implementation of the SSLVPN-based internet access behavior auditing method provided in the above embodiments, some embodiments of this application also provide an SSLVPN-based internet access behavior auditing system. The system includes a message type discrimination module and an auditing module. The message type discrimination module is configured to determine the message type of the SSLVPN message. The message type includes local messages of the audit behavior management device and forwarded messages of the audit behavior management device.
[0096] The auditing module is configured to connect to the control plane of the SSL VPN message when the SSL VPN message is a local message of the audit behavior management device and the SSL VPN message is a legitimate message, so as to obtain the user authentication result through the control plane;
[0097] A first data channel is established based on the identity authentication result. The first data channel is used to connect the user terminal and the headquarters server. Data packets are transmitted in the first data channel.
[0098] Policy matching is performed on the inner message, and the audit behavior of the user terminal is recorded according to the policy matching result. The inner message is obtained by decrypting the data packet through the data plane.
[0099] As can be seen from the above technical solutions, this application provides a method and system for auditing internet access behavior based on SSLVPN. It obtains SSLVPN packets sent from the user terminal to the headquarters server and determines the packet type. If the SSLVPN packet is a local packet of the audit behavior management device and is a legitimate packet, the control plane connecting to the SSLVPN packet is controlled to obtain the user terminal's authentication result. A first data channel is established based on the authentication result, and data packets are transmitted in the first data channel. Policy matching is performed on the inner packet obtained by decrypting the data packet through the data plane, and the audit behavior of the user terminal is recorded according to the policy matching result. This application improves the efficiency and security of auditing user terminal internet access behavior by determining the SSLVPN packet type, selecting the corresponding plane to decrypt the SSLVPN packet according to the packet type, and performing policy matching based on the obtained inner packet to statistically analyze audit behavior.
[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.
[0101] For ease of explanation, the above description has been provided in conjunction with specific embodiments. However, the foregoing exemplary discussion is not intended to be exhaustive or to limit the embodiments to the specific forms disclosed above. Various modifications and variations can be made based on the foregoing teachings. The selection and description of the above embodiments are for the purpose of better explaining the contents of this disclosure, thereby enabling those skilled in the art to better utilize the described embodiments.
Claims
1. A method for auditing internet browsing behavior based on SSL VPN, characterized in that, The method includes: Obtain SSL VPN packets sent from the user client to the headquarters server; Determine the message type of the SSL VPN message, where the message type includes local messages from the audit behavior management device and forwarded messages from the audit behavior management device; If the SSL VPN message is a local message of the audit behavior management device and the SSL VPN message is a valid message, then the control plane of the SSL VPN message is connected to obtain the user authentication result through the control plane; wherein, the step of obtaining the user authentication result through the control plane includes: obtaining user information of the user terminal, the user information including the user terminal's account password and the user terminal's SSL VPN permissions; sending the user terminal's account password to the network security system through the control plane, and sending the user terminal's SSL VPN permissions to the data plane through the control plane; obtaining a first feedback result by verifying the user terminal's account password through the network security system, and obtaining a second feedback result by verifying the user terminal's SSL VPN permissions through the data plane; sending the first feedback result and the second feedback result to the control plane through inter-process communication to obtain the user authentication result; A first data channel is established based on the identity authentication result. The first data channel is used to connect the user terminal and the headquarters server. Data packets are transmitted in the first data channel. The inner message is subjected to policy matching, and the audit behavior of the user terminal is recorded according to the policy matching result. The inner message is obtained by decrypting the data packet through the data plane. The step of establishing a first data channel based on the identity authentication result includes: The flag bit of the user terminal is set in the control plane; When the control plane receives a successfully authenticated user client identity authentication result, it allocates a virtual address to the flag bit. A first data channel is established based on the virtual address.
2. The method for auditing internet access behavior based on SSL VPN according to claim 1, characterized in that, The method further includes: Obtain the protocol type and destination port of the SSL VPN message; Iterate through the configured ports of the client terminals; If the protocol type is a connectionless transport protocol and the target port is not a local port, then the SSLVPN message is marked as a valid message.
3. The method for auditing internet access behavior based on SSL VPN according to claim 1, characterized in that, Before performing policy matching on the inner message, the method further includes: The data packet is sent to the data plane; The data packet encapsulation format is parsed using the data plane; According to the encapsulation format, the data packet is decrypted to obtain the inner message.
4. The method for auditing internet access behavior based on SSL VPN according to claim 1, characterized in that, Perform policy matching on inner messages, including: Traverse the policy table of the audit behavior management device, the policy table including the operation policy of the audit behavior management device, the operation policy including user list and resource list; If the operation policy is enabled, then query the inner message in the user list and query the target IP in the resource list. The target IP is the IP address generated by the user terminal when accessing the headquarters server. If the user client is found in the user list and the target IP is found in the resource list, a matching result is generated to allow the data packet to pass.
5. The method for auditing internet access behavior based on SSL VPN according to claim 4, characterized in that, The audit behavior of the user terminal is recorded based on the policy matching results, including: Create a user object based on the inner message; Associate the sessions generated by the headquarters server with the user object to obtain the audit dialogue; Internet access behavior auditing is performed on the audit dialogue based on the feature database, which is obtained by parsing inner packets.
6. The method for auditing internet access behavior based on SSL VPN according to claim 5, characterized in that, Based on the feature database, perform internet behavior auditing on the audit dialogue, including: Traffic from the user end is aggregated through audit behavior management devices; Based on the user's traffic, obtain the internet access behavior statistics of the headquarters server.
7. The method for auditing internet access behavior based on SSL VPN according to claim 6, characterized in that, The method further includes: A second data channel is created in the audit behavior management device, the second data channel being used to connect the client and the headquarters server; The data packet is encrypted and encapsulated using the packet sending function; The encapsulated data packet and the internet activity statistics are sent to the client through the second data channel.
8. An internet access behavior auditing system based on SSL VPN, characterized in that, The system includes a message type discrimination module and an auditing module. The message type discrimination module is configured to determine the message type of the SSL VPN message. The message type includes local messages of the audit behavior management device and forwarded messages of the audit behavior management device. The auditing module is configured to connect to the control plane of the SSL VPN message when the SSL VPN message is a local message of the audit behavior management device and the SSL VPN message is a legitimate message, so as to obtain the user authentication result through the control plane; wherein, the step of obtaining the user authentication result through the control plane includes: obtaining the user information of the user terminal, the user information including the user terminal's account password and the user terminal's SSL VPN permissions; sending the user terminal's account password to the network security system through the control plane, and sending the user terminal's SSL VPN permissions to the data plane through the control plane; obtaining a first feedback result by verifying the user terminal's account password through the network security system, and obtaining a second feedback result by verifying the user terminal's SSL VPN permissions through the data plane; and sending the first feedback result and the second feedback result to the control plane through inter-process communication to obtain the user authentication result; A first data channel is established based on the identity authentication result. The first data channel is used to connect the user terminal and the headquarters server. Data packets are transmitted in the first data channel. The inner message is subjected to policy matching, and the audit behavior of the user terminal is recorded according to the policy matching result. The inner message is obtained by decrypting the data packet through the data plane. The step of establishing a first data channel based on the identity authentication result includes: The flag bit of the user terminal is set in the control plane; When the control plane receives a successfully authenticated user client identity authentication result, it allocates a virtual address to the flag bit. A first data channel is established based on the virtual address.