A transparent encryption proxy method, client and proxy server

Abstract

The application provides a transparent encryption proxy method, a client and a proxy server. By intercepting a request data packet sent by the client, the request data packet is parsed and reorganized, a first connection channel between the client and the proxy server and a protocol control block corresponding to the first connection channel are established, the reorganized data packet is encrypted to obtain an encrypted request data packet, the encrypted request data packet is sent to the proxy server through the first connection channel, and the communication between the proxy server and the client is realized without the user's awareness, the transparent proxy is realized, the encrypted data packet is transmitted between the client and the proxy server, the data encryption in the proxy is realized, and the data security is improved.

Description

Technical Field

[0001] This application relates to the field of network communication technology, and more specifically, to a transparent encrypted proxy method, a client, and a proxy server. Background Technology

[0002] With the rapid development of the internet, various types of business traffic (HTTP / FTP / RTSP / P2P, etc.) are transmitted over the network, giving rise to diverse and personalized needs. This necessitates proxy services to sort and manage this traffic. However, in existing proxy technologies, the proxy service acts as a forwarding platform between the client and server. The client sends a request to the proxy server, specifying the server to access, and the proxy service then accesses the server. In this process, both the client and server are clearly aware of the proxy's presence, making transparent proxying impossible. Summary of the Invention

[0003] The purpose of this application is to provide a transparent encrypted proxy method, client, and proxy server to solve the problem in the prior art where both the client and server are clearly aware of the existence of the proxy, making transparent proxy impossible.

[0004] This application provides a transparent encrypted proxy method applied to a client, including:

[0005] Intercept the request data packets sent by the client, and remove the physical layer data and link layer data from the request data packets to obtain the network layer request data packets;

[0006] Based on the network layer data and transport layer data in the network layer request packet, the source address information and destination address information are obtained;

[0007] Based on the source address information, establish the first connection channel between the client and the proxy server;

[0008] Based on the source address information and destination address information, the protocol control block and its PCB identifier are obtained; the protocol control block is used to record the source address information and destination address information.

[0009] Remove the network layer data and transport layer data from the network layer request data packet to obtain the request data;

[0010] The destination address information, request data, and PCB identification code are reassembled into a data packet according to the set protocol format and then encrypted to obtain an encrypted request data packet.

[0011] An encrypted request data packet is sent to the proxy server through the first connection channel.

[0012] In the above technical solution, by intercepting the request data packets sent by the client, parsing and reassembling the request data packets, a first connection channel and a corresponding protocol control block are established between the client and the proxy server. The reassembled data packets are then encrypted to obtain encrypted request data packets. These encrypted request data packets are sent to the proxy server through the first connection channel. This achieves communication between the proxy server and the client without the user's awareness, realizing transparent proxying. Furthermore, the encrypted data packets transmitted between the client and the proxy server encrypt data within the proxy, enhancing data security.

[0013] In some optional implementations, the destination address information, request data, and PCB identification code are reassembled into a data packet according to a predefined protocol format, including:

[0014] Obtain the user token and application identifier, reassemble the data packet according to the set protocol format using the user token, application identifier, destination address information, request data, and PCB identifier code, and encrypt it to obtain an encrypted request data packet.

[0015] In the above technical solution, when data is reassembled and encrypted according to a custom protocol, the user token and application identifier used for authentication are also included in the data packet. This allows the proxy server to perform data authentication after parsing the data, thereby effectively controlling the security, controllability, and reliability of business access. The specific process for obtaining the user token and application identifier is as follows: The user enters their account and password information on the client, which is sent to the authentication service. After receiving the user's input, the authentication service verifies the correctness of the account and password. If the verification is successful, the authentication service generates a user token (usually a JWT token) and returns it to the client. After receiving the token, the client stores it locally, such as in localStorage or sessionStorage. When the user accesses a resource service with the token, the resource service verifies the token's validity. If the token is valid, the resource service determines whether the user has permission to access the resource based on the user information in the token, and sends the application identifier corresponding to the application server that the user can access to to the client.

[0016] In some optional implementations, after sending the encrypted request packet to the proxy server, the method further includes:

[0017] Receive encrypted response data packets sent by the proxy server through the first connection channel;

[0018] Decrypt the encrypted response data packet to obtain the response data and PCB identification code;

[0019] The protocol control block can be located based on the PCB identification code;

[0020] Based on the protocol control block, construct the network layer data and transport layer data of the response data to obtain the network layer response data packet;

[0021] The client's physical layer data and link layer data are added to the network layer response packet to obtain the response packet, which is then sent to the network interface card.

[0022] In the above technical solution, after receiving the request data, the application server returns response data. The proxy server encrypts the response data to obtain an encrypted response data packet. The proxy server sends the encrypted response data packet to the client through the first connection channel. After receiving the encrypted response data packet, the client decrypts and parses it to obtain the response data and PCB identification code. The client uses the PCB identification code to find the corresponding protocol control block, uses the protocol control block to construct the network layer data and transport layer data of the response data, and adds the client's physical layer data and link layer data to obtain the response data packet.

[0023] This application provides a transparent encrypted proxy method applied to a proxy server, including:

[0024] Receive encrypted request data packets sent by the client through the first connection channel, decrypt them, and obtain the decrypted data packets;

[0025] The decrypted data packet is parsed according to the set protocol format to obtain the destination address information, request data, and PCB identification code;

[0026] Based on the destination address information, a second connection channel is established between the proxy server and the application server corresponding to the destination address information; after associating the first connection channel, the second connection channel, and the PCB identifier, the connection channel is stored in the channel association table.

[0027] The request data is sent to the application server through the second connection channel.

[0028] In the above technical solution, the proxy server receives encrypted request data packets through a first channel, decrypts and parses the encrypted request data packets to obtain the destination address information and PCB identifier code. Based on the destination address information, a second connection channel is established between the proxy server and the application server corresponding to the destination address information. Through the second connection channel, communication between the proxy server and the target application server is achieved without the user's awareness, realizing transparent proxying. Furthermore, after associating the first connection channel, the second connection channel, and the PCB identifier, the association is stored in a channel association table. Subsequently, through this channel association table, the corresponding first and second connection channels can be found based on the address information of the application server sending the response data, thereby returning the response data to the corresponding client.

[0029] In some optional implementations, the decrypted data packet is parsed according to a set protocol format to obtain the user token and application identifier;

[0030] Before establishing a second connection channel between the proxy server and the application server corresponding to the destination address information, based on the destination address information, the process also includes:

[0031] Obtain user permission data, and authenticate the user based on the user token, application identifier, and user permission data. If authentication is successful, a second connection channel is established; if authentication fails, the user is not authorized to access the application server, and the process ends.

[0032] In the above technical solution, the decrypted data packet is parsed according to a set protocol format to obtain a user token and an application identifier. The user token is an encrypted string used for authentication and authorization, typically used for cross-network user authentication. The application identifier is the identifier code corresponding to the application that the user can access. In the proxy server, all user tokens and their corresponding application permissions are obtained from the resource service beforehand. Then, authentication is performed using the user token and application identifier. If authentication is successful, the user has permission to access the corresponding application server, establishing a second connection channel between the proxy server and the application server to request relevant resources from the application server.

[0033] In some optional implementations, after sending the request data to the application server, the method further includes:

[0034] Receive response data sent by the application server through the second connection channel;

[0035] Based on the second connection channel, the first connection channel and PCB identifier are retrieved from the channel association table;

[0036] The response data and PCB identification code are reassembled into a data packet according to the set protocol format and then encrypted to obtain an encrypted response data packet;

[0037] An encrypted response data packet is sent to the client through the first connection channel.

[0038] In the above technical solution, the application server sends response data to the proxy server through the second connection channel. The proxy server receives the response data transmitted through the second connection channel, queries the corresponding first connection channel and PCB identifier based on the second connection channel, reassembles the response data and PCB identifier into a data packet and encrypts it, and then sends the encrypted response data packet to the client through the first connection channel. The client and the proxy server transmit the encrypted data packet, realizing data encryption in the proxy and improving data security.

[0039] An embodiment of this application provides a client application, including:

[0040] The kernel driver is used to intercept request packets sent by the client and remove the physical layer and link layer data from the request packets to obtain the network layer request packets;

[0041] The protocol stack is used to obtain source and destination address information based on the network layer and transport layer data in the network layer request packet; establish the first connection channel between the client and the proxy server based on the source address information; obtain the protocol control block and its PCB identifier based on the source and destination address information; the protocol control block is used to record the source and destination address information; and remove the network layer and transport layer data from the network layer request packet to obtain the request data.

[0042] The data reassembler is used to reassemble the destination address information, request data, and PCB identification code into a data packet according to a set protocol format, and encrypt it to obtain an encrypted request data packet; the encrypted request data packet is then sent to the proxy server through the first connection channel.

[0043] In some alternative implementations, the data reassembler is also used for:

[0044] Obtain the user token and application identifier, reassemble the data packet according to the set protocol format using the user token, application identifier, destination address information, request data, and PCB identifier code, and encrypt it to obtain an encrypted request data packet.

[0045] In some optional implementations, the data reassembler is also used to: receive an encrypted response data packet sent by the proxy server through the first connection channel; decrypt the encrypted response data packet to obtain response data and PCB identification code;

[0046] The protocol stack is also used for: finding the protocol control block based on the PCB identifier; and constructing network layer data and transport layer data of the response data based on the protocol control block to obtain the network layer response data packet.

[0047] The kernel driver is also used to: add the client's physical layer data and link layer data to the network layer response packet, obtain the response packet, and send the response packet to the network card.

[0048] This application provides a proxy server, including:

[0049] The decryption module is used to receive encrypted request data packets sent by the client through the first connection channel, and decrypt them to obtain decrypted data packets;

[0050] The parsing module is used to parse the decrypted data packets according to the set protocol format to obtain the destination address information, request data, and PCB identification code;

[0051] The sending module is used to establish a second connection channel between the proxy server and the application server corresponding to the destination address information based on the destination address information; after associating the first connection channel, the second connection channel and the PCB identifier, it stores them in the channel association table; and sends request data to the application server through the second connection channel.

[0052] In some optional implementations, the parsing module is also used to: parse the decrypted data packet according to a set protocol format to obtain the user token and application identifier; obtain user permission data, and perform authentication based on the user token, application identifier, and user permission data. If the authentication is successful, a second connection channel is established; if the authentication fails, the user is not authorized to access the application server, and the process ends.

[0053] In some optional implementations, the sending module is further configured to: receive response data sent by the application server through the second connection channel; query the first connection channel and PCB identifier in the channel association table according to the second connection channel; reassemble the response data and PCB identifier code into a data packet according to a set protocol format and encrypt it to obtain an encrypted response data packet; and send the encrypted response data packet to the client through the first connection channel.

[0054] An electronic device provided in this application includes a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and the machine-readable instructions, when executed by the processor, perform any of the methods described above.

[0055] This application provides a computer-readable storage medium storing a computer program, which is executed by a processor as described above. Attached Figure Description

[0056] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 A flowchart illustrating the steps of applying a transparent encrypted proxy method to a client, as provided in this application embodiment;

[0058] Figure 2 A flowchart illustrating the steps of applying a transparent encrypted proxy method to a proxy server, as provided in this application embodiment;

[0059] Figure 3 A flowchart illustrating the steps of a proxy server forwarding response data, as provided in this embodiment of the application.

[0060] Figure 4 A flowchart illustrating the steps of a client processing an encrypted response data packet, as provided in an embodiment of this application.

[0061] Figure 5 A functional module diagram of a client provided in an embodiment of this application;

[0062] Figure 6 A functional block diagram of a proxy server provided in an embodiment of this application;

[0063] Figure 7 This is a schematic diagram of a possible structure of an electronic device provided in an embodiment of this application.

[0064] Icons: 1-Kernel driver, 2-Protocol stack, 3-Data reassembler, 4-Decryption module, 5-Analysis module, 6-Send module, 71-Processor, 72-Memory, 73-Communication interface, 74-Communication bus. Detailed Implementation

[0065] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0066] Please refer to Figure 1 , Figure 1 A flowchart illustrating the steps of applying a transparent encrypted proxy method to a client, as provided in this application embodiment, specifically includes:

[0067] Step 110: Intercept the request data packet sent by the client, and remove the physical layer data and link layer data from the request data packet to obtain the network layer request data packet;

[0068] Specifically, the kernel driver intercepts the applications that need to be proxied by using the target application's IP address and port as conditions. The target application is the application server that the request data packet wants to request.

[0069] Step 120: Obtain the source address information and destination address information based on the network layer data and transport layer data in the network layer request data packet;

[0070] The source address information includes the client's source IP address and port, while the destination address information includes the target application's IP address and port.

[0071] Step 130: Based on the source address information, establish the first connection channel between the client and the proxy server;

[0072] Specifically, the PCB identifier is used as an identifier to create the first connection channel with the proxy server. If the PCB identifier already exists, the connection channel corresponding to that PCB identifier can be used. If the PCB identifier is newly created, a new first connection channel needs to be established. The connection between the client and the proxy server can be established using the SSL / TLS protocol to establish a socket, which can prevent data replay and tampering.

[0073] Step 140: Based on the source address information and destination address information, obtain the protocol control block and its PCB identifier; wherein, the protocol control block is used to record the source address information and destination address information;

[0074] Step 150: Remove the network layer data and transport layer data from the network layer request data packet to obtain the request data;

[0075] Step 160: Reassemble the data packet according to the set protocol format, including the destination address information, request data, and PCB identification code, and encrypt it to obtain an encrypted request data packet;

[0076] Step 170: Send an encrypted request data packet to the proxy server through the first connection channel.

[0077] In this embodiment, by intercepting the request data packets sent by the client, parsing and reassembling the request data packets, a first connection channel and a corresponding protocol control block are established between the client and the proxy server. The reassembled data packets are then encrypted to obtain encrypted request data packets. These encrypted request data packets are sent to the proxy server through the first connection channel. This achieves communication between the proxy server and the client without the user's awareness, realizing transparent proxying. Furthermore, the encrypted data packets are transmitted between the client and the proxy server, achieving data encryption within the proxy and improving data security.

[0078] In some optional implementations, step 160 specifically includes: obtaining a user token and an application identifier, reassembling the user token, application identifier, destination address information, request data, and PCB identifier code into a data packet according to a set protocol format, and encrypting it to obtain an encrypted request data packet.

[0079] In this embodiment, when data is reassembled and encrypted according to a custom protocol, the user token and application identifier used for authentication are also included in the data packet. This allows the proxy server to perform data authentication after parsing the data, thereby effectively controlling the security, controllability, and reliability of business access. The specific process for obtaining the user token and application identifier is as follows: The user enters their account and password information on the client, which is then sent to the authentication service. Upon receiving the user's input, the authentication service verifies the correctness of the account and password. If the verification is successful, the authentication service generates a user token (usually a JWT token) and returns it to the client. The client receives the token and stores it locally, such as in localStorage or sessionStorage. When the user accesses a resource service with the token, the resource service verifies its validity. If the token is valid, the resource service determines whether the user has permission to access the resource based on the user information in the token, and then sends the application identifier corresponding to the application server that the user can access to to the client.

[0080] Please refer to Figure 2 , Figure 2 A flowchart illustrating the steps of applying a transparent encrypted proxy method to a proxy server, as provided in this application embodiment, specifically includes:

[0081] Step 210: Receive the encrypted request data packet sent by the client through the first connection channel, and decrypt it to obtain the decrypted data packet;

[0082] Step 220: Parse the decrypted data packet according to the set protocol format to obtain the destination address information, request data, and PCB identification code;

[0083] Step 230: Based on the destination address information, establish a second connection channel between the proxy server and the application server corresponding to the destination address information; associate the first connection channel, the second connection channel, and the PCB identifier, and store them in the channel association table;

[0084] Step 240: Send request data to the application server through the second connection channel.

[0085] In this embodiment, the proxy server receives encrypted request data packets through a first channel, decrypts and parses the packets to obtain destination address information and PCB identifier. Based on the destination address information, a second connection channel is established between the proxy server and the application server corresponding to that address. Through this second connection channel, communication between the proxy server and the target application server is achieved without the user's awareness, realizing transparent proxying. Furthermore, the first connection channel, the second connection channel, and the PCB identifier are associated and stored in a channel association table. Subsequently, using this table, the corresponding first and second connection channels can be found based on the address information of the application server sending the response data, thereby returning the response data to the corresponding client.

[0086] In some optional implementations, in step 220, the decrypted data packet is parsed according to a set protocol format to obtain the user token and application identifier.

[0087] In this embodiment, before step 230, which establishes a second connection channel between the proxy server and the application server corresponding to the destination address information based on the destination address information, the method further includes: obtaining user permission data, performing authentication based on the user token, application identifier, and user permission data; if the authentication is successful, then establishing a second connection channel; if the authentication fails, then the user has no right to access the application server, and the process ends.

[0088] In this embodiment, the decrypted data packet is parsed according to a predefined protocol format to obtain a user token and an application identifier. The user token is an encrypted string used for authentication and authorization, typically for cross-network user authentication. The application identifier is the identifier code corresponding to the application that the user can access. In the proxy server, all user tokens and their corresponding application permissions are obtained from the resource service beforehand. Then, authentication is performed using the user token and application identifier. If authentication is successful, the user has permission to access the corresponding application server, establishing a second connection channel between the proxy server and the application server to request relevant resources from the application server.

[0089] Please refer to Figure 3 , Figure 3 This is a flowchart illustrating the steps of a proxy server forwarding response data according to an embodiment of this application. After sending request data to the application server in step 240, the process specifically includes:

[0090] Step 310: Receive response data sent by the application server through the second connection channel;

[0091] Step 320: Based on the second connection channel, query the first connection channel and PCB identifier in the channel association table;

[0092] Step 330: Reassemble the response data and PCB identification code into a data packet according to the set protocol format, and encrypt it to obtain an encrypted response data packet;

[0093] Step 340: Send an encrypted response data packet to the client through the first connection channel.

[0094] In this embodiment, the application server sends response data to the proxy server through the second connection channel. The proxy server receives the response data transmitted through the second connection channel, queries the corresponding first connection channel and PCB identifier based on the second connection channel, reassembles the response data and PCB identifier into a data packet and encrypts it, and then sends the encrypted response data packet to the client through the first connection channel. The client and the proxy server transmit the encrypted data packet, thereby realizing data encryption in the proxy and improving data security.

[0095] Please refer to Figure 4 , Figure 4 The flowchart of the client's processing steps for the encrypted response data packet provided in this application embodiment includes the following steps after step 340:

[0096] Step 410: Receive the encrypted response data packet sent by the proxy server through the first connection channel;

[0097] Step 420: Decrypt the encrypted response data packet to obtain the response data and PCB identification code;

[0098] Step 430: Locate the protocol control block based on the PCB identification code;

[0099] Step 440: Based on the protocol control block, construct the network layer data and transport layer data of the response data to obtain the network layer response data packet;

[0100] Step 450: Add the client's physical layer data and link layer data to the network layer response data packet to obtain the response data packet, and send the response data packet to the network card.

[0101] In this embodiment, after receiving the request data, the application server returns response data. The proxy server encrypts the response data to obtain an encrypted response data packet. The proxy server sends the encrypted response data packet to the client through the first connection channel. After receiving the encrypted response data packet, the client decrypts and parses it to obtain the response data and PCB identification code. The client uses the PCB identification code to find the corresponding protocol control block, uses the protocol control block to construct the network layer data and transport layer data of the response data, and adds the client's physical layer data and link layer data to obtain the response data packet.

[0102] Please refer to Figure 5 , Figure 5 A functional block diagram of a client provided in this application embodiment includes a kernel driver 1, a protocol stack 2, and a data reassembler 3.

[0103] The kernel driver 1 intercepts request data packets sent by the client and removes the physical layer and link layer data from the request data packets to obtain network layer request data packets. Protocol stack 2 obtains source and destination address information based on the network layer and transport layer data in the network layer request data packets; establishes a first connection channel between the client and the proxy server based on the source address information; and obtains the protocol control block and its PCB identifier based on the source and destination address information. The protocol control block records the source and destination address information. It removes the network layer and transport layer data from the network layer request data packets to obtain the request data. Data reassembler 3 reassembles the destination address information, request data, and PCB identifier according to a set protocol format and encrypts it to obtain an encrypted request data packet; it then sends the encrypted request data packet to the proxy server through the first connection channel.

[0104] In some optional implementations, the data reassembler 3 is also used to: obtain the user token and application identifier, reassemble the user token, application identifier, destination address information, request data and PCB identifier code into a data packet according to a set protocol format, and encrypt it to obtain an encrypted request data packet.

[0105] In some optional implementations, the data reassembler 3 is also used to: receive encrypted response data packets sent by the proxy server through the first connection channel; and decrypt the encrypted response data packets to obtain response data and PCB identification codes.

[0106] Protocol stack 2 is also used for: querying the protocol control block based on the PCB identifier; and constructing network layer data and transport layer data of the response data based on the protocol control block to obtain the network layer response data packet.

[0107] Kernel driver 1 is also used to: add the client's physical layer data and link layer data to the network layer response packet, obtain the response packet, and send the response packet to the network card.

[0108] Please refer to Figure 6 , Figure 6 A functional block diagram of a proxy server provided in this application embodiment includes a decryption module 4, a parsing module 5, and a sending module 6.

[0109] The decryption module 4 receives and decrypts encrypted request data packets sent by the client through the first connection channel. The parsing module 5 parses the decrypted data packets according to a predefined protocol format to obtain the destination address information, request data, and PCB identifier. The sending module 6 establishes a second connection channel between the proxy server and the application server corresponding to the destination address information; associates the first connection channel, the second connection channel, and the PCB identifier in a channel association table; and sends the request data to the application server through the second connection channel.

[0110] In some optional implementations, the parsing module 5 is also used to: parse the decrypted data packet according to a set protocol format to obtain the user token and application identifier; obtain user permission data, and perform authentication based on the user token, application identifier and user permission data. If the authentication is successful, a second connection channel is established; if the authentication fails, the user is not authorized to access the application server and the process ends.

[0111] In some optional implementations, the sending module 6 is further configured to: receive response data sent by the application server through the second connection channel; query the first connection channel and PCB identifier in the channel association table according to the second connection channel; reassemble the response data and PCB identifier code into a data packet according to a set protocol format and encrypt it to obtain an encrypted response data packet; and send the encrypted response data packet to the client through the first connection channel.

[0112] Figure 7 This illustration shows a possible structure of an electronic device provided in an embodiment of this application. (Refer to...) Figure 7 The electronic device includes a processor 71, a memory 72, and a communication interface 73, which are interconnected and communicate with each other via a communication bus 74 and / or other forms of connection mechanism (not shown).

[0113] The memory 72 includes one or more (only one is shown in the figure), which may be, but is not limited to, Random Access Memory (RAM), Read Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), etc. The processor 71 and other possible components may access the memory 72 to read and / or write data therein.

[0114] Processor 71 includes one or more (only one is shown in the figure), which can be an integrated circuit chip with signal processing capabilities. The processor 71 can be a general-purpose processor, including a Central Processing Unit (CPU), a Microcontroller Unit (MCU), a Network Processor (NP), or other conventional processors; it can also be a special-purpose processor, including a Neural-network Processing Unit (NPU), a Graphics Processing Unit (GPU), a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. Furthermore, when there are multiple processors 71, some can be general-purpose processors and others can be special-purpose processors.

[0115] Communication interface 73 includes one or more (only one is shown in the figure) that can be used to communicate directly or indirectly with other devices to exchange data. Communication interface 73 may include interfaces for wired and / or wireless communication.

[0116] One or more computer program instructions may be stored in memory 72, and processor 71 may read and execute these computer program instructions to implement the methods provided in the embodiments of this application.

[0117] Understandable. Figure 7 The structure shown is for illustrative purposes only; the electronic device may also include structures that are more complex than those shown. Figure 7 The more or fewer components shown, or having the same Figure 7 The different structures shown. Figure 7 The components shown can be implemented using hardware, software, or a combination thereof. Electronic devices may be physical devices, such as PCs, laptops, tablets, mobile phones, servers, embedded devices, etc., or they may be virtual devices, such as virtual machines, virtualized containers, etc. Furthermore, electronic devices are not limited to a single device; they can also be a combination of multiple devices or a cluster of a large number of devices.

[0118] This application also provides a computer-readable storage medium storing computer program instructions. These computer program instructions are read and executed by a computer's processor to perform the method provided in this application. For example, the computer-readable storage medium can be implemented as follows: Figure 7 Memory 72 in electronic devices.

[0119] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0120] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0121] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0122] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0123] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A transparent encrypted proxy method, characterized in that, Applied to the client side, including: Intercept the request data packet sent by the client, and remove the physical layer data and link layer data from the request data packet to obtain the network layer request data packet; Based on the network layer data and transport layer data in the network layer request data packet, the source address information and destination address information are obtained; Based on the source address information, a first connection channel is established between the client and the proxy server; Based on the source address information and destination address information, a protocol control block and its PCB identifier are obtained; wherein, the protocol control block is used to record the source address information and destination address information; Remove the network layer data and transport layer data from the network layer request data packet to obtain the request data; The destination address information, request data, and PCB identification code are reassembled into a data packet according to a set protocol format and then encrypted to obtain an encrypted request data packet. The encrypted request data packet is sent to the proxy server through the first connection channel; Receive encrypted response data packets sent by the proxy server through the first connection channel; The encrypted response data packet is decrypted to obtain the response data and the PCB identification code; The protocol control block can be retrieved based on the PCB identification code; Based on the protocol control block, network layer data and transport layer data of the response data are constructed to obtain a network layer response data packet; The physical layer data and link layer data of the client are added to the network layer response data packet to obtain the response data packet, and the response data packet is sent to the network card.

2. The method as described in claim 1, characterized in that, The step of reassembling the data packet according to the destination address information, request data, and PCB identification code according to the set protocol format includes: Obtain the user token and application identifier, reassemble the user token, application identifier, destination address information, request data and PCB identifier code into a data packet according to a set protocol format, and encrypt it to obtain the encrypted request data packet.

3. A transparent encrypted proxy method, characterized in that, Applied to proxy servers, including: Receive encrypted request data packets sent by the client through the first connection channel, decrypt them, and obtain the decrypted data packets; The decrypted data packet is parsed according to the set protocol format to obtain the destination address information, request data, and PCB identification code; Based on the destination address information, a second connection channel is established between the proxy server and the application server corresponding to the destination address information; the first connection channel, the second connection channel, and the PCB identifier are associated and stored in the channel association table; The request data is sent to the application server through the second connection channel; Receive response data sent by the application server through the second connection channel; Based on the second connection channel, the first connection channel and PCB identifier are retrieved from the channel association table; The response data and PCB identification code are reassembled into a data packet according to a set protocol format and then encrypted to obtain an encrypted response data packet; The encrypted response data packet is sent to the client through the first connection channel.

4. The method as described in claim 3, characterized in that, The decrypted data packet is parsed according to the set protocol format to obtain the user token and application identifier; Before establishing the second connection channel between the proxy server and the application server corresponding to the destination address information based on the destination address information, the method further includes: Obtain user permission data, and perform authentication based on the user token, application identifier, and user permission data. If authentication is successful, establish the second connection channel; if authentication fails, the user is not authorized to access the application server, and the process ends.

5. A client application, characterized in that, include: The kernel driver is used to intercept the request data packets sent by the client and remove the physical layer data and link layer data from the request data packets to obtain the network layer request data packets; The protocol stack is used to obtain source address information and destination address information based on the network layer data and transport layer data in the network layer request data packet; and to establish a first connection channel between the client and the proxy server based on the source address information. Based on the source address information and destination address information, a protocol control block and its PCB identifier are obtained; wherein, the protocol control block is used to record the source address information and destination address information; the network layer data and transport layer data in the network layer request data packet are removed to obtain the request data; A data reassembler is used to reassemble the destination address information, request data, and PCB identifier according to a set protocol format, and encrypt them to obtain an encrypted request data packet; send the encrypted request data packet to the proxy server through the first connection channel; and receive an encrypted response data packet sent by the proxy server through the first connection channel; decrypt the encrypted response data packet to obtain response data and the PCB identifier; query the protocol control block based on the PCB identifier; construct the network layer data and transport layer data of the response data based on the protocol control block to obtain a network layer response data packet; add the physical layer data and link layer data of the client to the network layer response data packet to obtain a response data packet, and send the response data packet to the network interface card.

6. A proxy server, characterized in that, include: The decryption module is used to receive encrypted request data packets sent by the client through the first connection channel, and decrypt them to obtain decrypted data packets; The parsing module is used to parse the decrypted data packet according to a set protocol format to obtain destination address information, request data, and PCB identification code; The sending module is used to establish a second connection channel between the proxy server and the application server corresponding to the destination address information based on the destination address information. After associating the first connection channel, the second connection channel, and the PCB identifier, store them in the channel association table; Send the request data to the application server through the second connection channel; and receive the response data sent by the application server through the second connection channel. Based on the second connection channel, the first connection channel and PCB identifier are retrieved from the channel association table; The response data and PCB identification code are reassembled into a data packet according to a set protocol format and then encrypted to obtain an encrypted response data packet; the encrypted response data packet is then sent to the client through the first connection channel.

7. An electronic device, characterized in that, include: A processor and a memory, the memory storing machine-readable instructions executable by the processor, which, when executed by the processor, perform the method as described in any one of claims 1-4.

8. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, performs the method as described in any one of claims 1-4.

Images