HTTPS cleaning method, device and electronic device

Abstract

This specification provides an HTTPS cleaning method, device and electronic device. The method includes: the traffic access switch forwards the HTTPS request message sent by the client to the L4 cleaning server; the L4 cleaning server queries its own VIP list according to the LIP record table, and randomly selects a target VIP to replace the source IP in the message and randomly selects an idle port from the port pool to replace the source port in the message; determines whether the high-defense system has enabled the HTTPS unloading function; if enabled, forwards the message to the traffic access switch, and the traffic access switch further forwards the message to the L7 cleaning server; the L7 cleaning server replaces the IP and port in the message with the real IP and port of the client through the TOA module; the HTTPS proxy module matches the CA certificate maintained in the rule forwarding table according to the SNI information of the message, decrypts the request data sent by the client based on the CA certificate, and performs data cleaning on the decrypted request data.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of communications, and in particular to an HTTPS cleaning method and device and an electronic device. Background Art

[0002] High-defense IP was initially used mainly in large enterprises and websites because these organizations face more complex and frequent cyber attacks. They need a more efficient and reliable way to defend against DDoS attacks and other cyber threats. The emergence of high-defense IP provides a more comprehensive and reliable network security solution for these large enterprises and websites. With the development and popularization of technology, high-defense IP has also gradually been applied to small and medium-sized enterprises and individual users. These users are also facing the threat of cyber attacks, and high-defense IP can provide them with a more flexible and economical defense method. Today, high-defense IP has become one of the important means of protecting network security and is widely used in enterprises and institutions of all sizes.

[0003] High-defense IP is generally used to protect the connection between web servers and other client browsers. However, HTTP (Hypertext Transfer Protocol) uses plain text transmission, and there may be security issues such as information leakage, identity disguise, and message tampering in the HTTP protocol. In order to protect the security of data during transmission, more and more companies use the HTTPS protocol (Hypertext Transfer Protocol Secure). HTTPS establishes an SSL encryption layer on HTTP and encrypts the transmitted data. It is a secure version of the HTTP protocol.

[0004] Since messages transmitted using the HTTPS protocol are encrypted throughout the entire process, if you want to clean the data traffic, you need to decrypt the message first, and then perform cleaning operations based on the message characteristics. This also makes HTTPS message cleaning relatively complicated and requires more resources. Summary of the invention

[0005] The embodiments of this specification provide an HTTPS cleaning method, device, and electronic device.

[0006] According to a first aspect of an embodiment of this specification, an HTTPS cleaning method is provided, which is applied to a high-defense system. The high-defense system may include a traffic access switch, an L4 cleaning server, and an L7 cleaning server; the L7 cleaning server includes a TOA module, the L4 cleaning server includes a NAT module, and the L4 cleaning server and the L7 cleaning server also include the same LIP record table and forwarding rule table; the method includes:

[0007] The traffic access switch forwards the HTTPS request message sent by the client to the L4 cleaning server;

[0008] The L4 cleaning server queries its own VIP list according to the LIP record table, and randomly selects a target VIP to replace the source IP in the message, and randomly selects an idle port from the port pool to replace the source port in the message; further, it determines whether the high-defense system has enabled the HTTPS offloading function; if enabled, the message is forwarded to the traffic access switch, and the traffic access switch further forwards the message to the L7 cleaning server;

[0009] After receiving the message forwarded by the traffic access switch, the L7 cleaning server replaces the IP and port in the message with the real IP and port of the client through the TOA module; further, the HTTPS proxy module matches the CA certificate maintained in the rule forwarding table according to the SNI information of the message, decrypts the request data sent by the client based on the CA certificate, and cleans the decrypted request data.

[0010] Optionally, also include:

[0011] The HTTPS proxy module establishes a connection between the L7 cleaning server and the source server by obtaining the LIP address of the connection between the L7 cleaning server and the source server in the LIP record table, encrypts the request data after data cleaning using the CA certificate, and sends the encrypted data to the source server; further, receives the response data corresponding to the request data returned by the source server, and forwards it to the client.

[0012] Optionally, forwarding the message to the traffic access switch, and further forwarding the message to the L7 cleaning server by the traffic access switch, includes:

[0013] Replace the destination IP of the message with the network card IP of the L7 cleaning server recorded in the LIP record table; and replace the destination port of the message with the binding port of the L7 cleaning server;

[0014] The replaced message is forwarded to the traffic access switch, and the traffic access switch forwards the message to the L7 cleaning server where the network card IP is located according to the destination IP and destination port in the message.

[0015] Optionally, the rule forwarding table also maintains the source station IP and source station port of the source server corresponding to the high-defense IP. After the L4 cleaning server determines whether the high-defense system has enabled the HTTPS offloading function, it also includes:

[0016] If not enabled, the L4 scrubbing server replaces the destination IP and destination port in the message according to the source station IP and source station port in the forwarding rule table;

[0017] The replaced message is forwarded to the traffic access switch, and the traffic access switch forwards the message to the source station server where the source station IP is located according to the destination IP and destination port in the message.

[0018] Optionally, the L4 cleaning server and L7 cleaning server support cross-regional branch room deployment.

[0019] According to a second aspect of an embodiment of this specification, an HTTPS cleaning device is provided, which is applied to a high-defense system. The high-defense system may include a traffic access switch, an L4 cleaning server, and an L7 cleaning server; the L7 cleaning server includes a TOA module, the L4 cleaning server includes a NAT module, and the L4 cleaning server and the L7 cleaning server also include the same LIP record table and forwarding rule table; the device includes:

[0020] The first forwarding unit, the traffic access switch forwards the HTTPS request message sent by the client to the L4 cleaning server;

[0021] The second forwarding unit, the L4 cleaning server queries its own VIP list according to the LIP record table, and randomly selects a target VIP to replace the source IP in the message, and randomly selects an idle port from the port pool to replace the source port in the message; further, it is determined whether the high-defense system has enabled the HTTPS offloading function; if enabled, the message is forwarded to the traffic access switch, and the traffic access switch further forwards the message to the L7 cleaning server;

[0022] The cleaning unit, after receiving the message forwarded by the traffic access switch, the L7 cleaning server replaces the IP and port in the message with the real IP and port of the client through the TOA module; further, the HTTPS proxy module matches the CA certificate maintained in the rule forwarding table according to the SNI information of the message, decrypts the request data sent by the client based on the CA certificate, and cleans the decrypted request data.

[0023] Optionally, also include:

[0024] The response unit, the HTTPS proxy module establishes a connection between the L7 cleaning server and the source server by obtaining the LIP address of the connection between the L7 cleaning server and the source server in the LIP record table, encrypts the request data after data cleaning using the CA certificate, and sends the encrypted data to the source server; further, receives the response data corresponding to the request data returned by the source server, and forwards it to the client.

[0025] Optionally, the second forwarding unit further includes:

[0026] The L7 forwarding subunit, if the HTTPS offloading function is turned on, uses the network card IP of the L7 cleaning server recorded in the LIP record table to replace the destination IP of the message; and uses the binding port of the L7 cleaning server to replace the destination port of the message; forwards the replaced message to the traffic access switch, and the traffic access switch forwards the message to the L7 cleaning server where the network card IP is located according to the destination IP and destination port in the message.

[0027] Optionally, the rule forwarding table also maintains the source station IP and source station port of the source server corresponding to the high-defense IP, and the second forwarding unit further includes:

[0028] The source station forwarding subunit, if the HTTPS offloading function is not enabled, the L4 cleaning server replaces the destination IP and destination port in the message according to the source station IP and source station port in the forwarding rule table; forwards the replaced message to the traffic access switch, and the traffic access switch forwards the message to the source station server where the source station IP is located according to the destination IP and destination port in the message.

[0029] According to a third aspect of the embodiments of this specification, there is provided an electronic device, including:

[0030] processor;

[0031] a memory for storing processor-executable instructions;

[0032] Wherein, the processor is configured as any one of the above-mentioned HTTPS cleaning methods.

[0033] The embodiment of this specification provides an HTTPS offloading solution. The L7 cleaning server receives the traffic message forwarded by the L4 cleaning server NAT, obtains the real source IP information of the request data through the TOA module, and uses it as the request source after offloading to achieve data flow cleaning and protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1aIt is a schematic diagram of a high-defense system provided in an embodiment of this specification;

[0035] Figure 1b It is a schematic diagram of another high-defense system provided in an embodiment of this specification;

[0036] Figure 2 is a schematic diagram of an L4 and L7 cleaning server provided in an embodiment of this specification;

[0037] Figure 3 is a flow chart of an HTTPS cleaning method provided in an embodiment of this specification;

[0038] Figure 4 It is a schematic diagram of the IP and port changes of the request data provided in an embodiment of this specification;

[0039] Figure 5 This is an overall flow chart of HTTPS cleaning provided by an embodiment of this specification;

[0040] Figure 6 It is a hardware structure diagram of the HTTPS cleaning device provided in an embodiment of this specification;

[0041] Figure 7 It is a module of the HTTPS cleaning device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0042] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this specification. Instead, they are merely examples of devices and methods consistent with some aspects of this specification as detailed in the appended claims.

[0043] The terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. The singular forms "a", "the" and "the" used in this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0044] It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0045] With the continuous development of computer technology and the increasing popularization of the Internet, there are more and more network attacks, especially the endless emergence of new forms of network attacks, which has led to increasingly prominent network security issues.

[0046] In order to meet this challenge, some professional network security companies have begun to launch high-defense IP services. At first, high-defense IP mainly used traffic cleaning technology to establish a defense mechanism to resist attacks such as DDoS (Distributed Denial of Service). With the continuous advancement of technology, high-defense IP has gradually developed into a comprehensive network security protection system that integrates multiple defense technologies and strategies, thereby providing more comprehensive security protection.

[0047] High-defense IP was initially used mainly in large enterprises and websites because these organizations face more complex and frequent cyber attacks. They need a more efficient and reliable way to defend against DDoS attacks and other cyber threats. The emergence of high-defense IP provides a more comprehensive and reliable network security solution for these large enterprises and websites. With the development and popularization of technology, high-defense IP has also gradually been applied to small and medium-sized enterprises and individual users. These users are also facing the threat of cyber attacks, and high-defense IP can provide them with a more flexible and economical defense method. Today, high-defense IP has become one of the important means of protecting network security and is widely used in enterprises and institutions of all sizes.

[0048] High-defense IP is generally used to protect the connection between web servers and other client browsers. However, HTTP (Hypertext Transfer Protocol) uses plain text transmission, and there may be security issues such as information leakage, identity disguise, and message tampering in the HTTP protocol. In order to protect the security of data during transmission, more and more companies use the HTTPS protocol (Hypertext Transfer Protocol Secure). HTTPS establishes an SSL encryption layer on HTTP and encrypts the transmitted data. It is a secure version of the HTTP protocol.

[0049] Since messages transmitted using the HTTPS protocol are encrypted throughout the entire process, if you want to clean the data traffic, you need to first unload the HTTPS traffic to obtain the decrypted message, and then perform the cleaning operation based on the message characteristics. This also makes HTTPS message cleaning relatively complicated and requires more resources.

[0050] Moreover, in the related art, in order to realize HTTPS offloading, Nginx proxy is usually adopted to offload SSL (Secure Socket Layer) certificates through Nginx proxy, thereby converting HTTPS requests into HTTP requests. However, as mentioned above, the HTTP protocol has certain security risks, which may lead to information leakage, identity masquerade and message tampering.

[0051] In order to solve the above problems, this specification aims to provide an HTTPS cleaning solution. The L7 cleaning server receives the traffic message forwarded by the L4 cleaning server NAT, obtains the real source IP information of the request data through the TOA module, and uses it as the request source after unloading to achieve data flow cleaning and protection.

[0052] In this manual, the high-defense system that implements HTTPS cleaning can be as follows Figure 1a As shown, the high-defense system can include: a management and control module, a traffic access switch, an L4 cleaning module, and an L7 cleaning module.

[0053] The control module may refer to a management node in a high-defense system, and the control module may provide API calls and remote management services.

[0054] The traffic access switch may refer to a switch for business traffic access to a high-defense switch, which is used to forward the business traffic to a cleaning module such as an L4 cleaning module or an L7 cleaning module.

[0055] The L4 cleaning module is used to provide traffic cleaning of layer 4 messages. The L4 cleaning module can be deployed on the L4 cleaning server.

[0056] The L7 cleaning module is used to provide traffic cleaning of layer 7 messages. The L7 cleaning module can be deployed on the L7 cleaning server.

[0057] In this specification, the control module, L4 cleaning module, and L7 cleaning module can be deployed on independent physical servers, and these physical servers can support cluster deployment. For example, the L4 cleaning module can be deployed on an independent L4 cleaning server (or server cluster), and the L7 cleaning module can be deployed on an independent L7 cleaning server (or server cluster);

[0058] The L7 cleaning module can be further divided into an L7 unloading module and an L7 management module, and the L7 unloading module and the L7 management module can be deployed on the same L7 cleaning server.

[0059] The management IP between each server in this manual, such as L4 cleaning server and L7 cleaning server, can be Figure 1a The management switches shown in the figure can be interconnected, and the service network cards of the L4 cleaning server and the L7 cleaning server can be interconnected through the traffic access switch.

[0060] In this specification, a LIP record table and a forwarding rule table may be deployed on all servers.

[0061] Among them, the LIP record table is used to record the public IP and VIP corresponding to all management IPs; and the forwarding rule table is used to record all forwarding rules and policy information for high-defense IPs.

[0062] Exemplarily, the LIP record and forwarding rule table may be synchronized by a management and control module and maintained exclusively by a thread.

[0063] Please refer to the following Figure 2 Schematic diagram of L4 and L7 cleaning servers shown in FIG. Figure 2 As shown, the L4 cleaning server may include a traffic cleaning module and a Nat (Network Address Translation) module, as well as the aforementioned LIP record table and forwarding rule table.

[0064] The L7 cleaning server may include an L7 unloading module, an L7 cleaning module, a TOA module, and the aforementioned LIP record table and forwarding rule table.

[0065] The L7 offloading module can encrypt and decrypt HTTPS messages through the HTTPS proxy module, that is, offload the messages requested by HTTPS.

[0066] The following is a further introduction to the functions of each of the above modules:

[0067] The Nat module is used for devices in a private network to communicate with the Internet.

[0068] The TOA module is used to enable the backend server to identify and obtain the real client IP address through specific technology.

[0069] The HTTPS proxy module supports multi-threaded high-concurrency data flow reception, and combines HTTP proxy and SSL / TLS protocols to provide data encryption and identity authentication. The HTTPS proxy module can also support access control, load balancing, caching and other functions, which can protect data security, improve performance, and have flexibility and scalability.

[0070] The HTTPS proxy module implements encryption and decryption of data streams by reading and writing HTTPS request data to the buffer area of ​​the SSL engine.

[0071] Back to Figure 1a The springboard module can synchronize the running scripts and configuration files to all cleaning servers (including the server where the control module is located, L4 cleaning server, and L7 cleaning server) through the management IP, and start the respective processes on each server.

[0072] Since the LIP table records the LIP corresponding to the management IP, one management IP can correspond to multiple LIPs, that is, the business network card corresponding to the L7 cleaning server needs to be configured with multiple public IPs, and the LIP corresponding to the L4 cleaning server does not need to be configured on the network card and exists in the form of VIP.

[0073] The business network card of the L7 cleaning server will be configured with at least two public IPs, one of which is bound to the uninstall process of the L7 uninstall module, so that this IP is used as the entry point for receiving HTTPS connection requests and establishing a connection with the client; other public IPs are used to establish a connection with the source server.

[0074] Users can log in to the client interface corresponding to the high-defense system (such as the web interface), create a high-defense IP in the client interface, and configure the corresponding configuration information.

[0075] Exemplarily, the configuration information may include, but is not limited to, forwarding rules corresponding to the high-defense IP, CA certificates, listening information, source server (Real Server) information, etc.

[0076] The listening information may include the specified listening protocol type and listening port. If the high-defense system needs to enable HTTPS offloading, the listening protocol type may be set to HTTPS. The listening IP is a high-defense IP, and the listening port can be defined by yourself.

[0077] The source server information includes the source IP and source port of the source server.

[0078] For example, the above high-security IP and corresponding configuration information configured by the user in the web interface can be sent to Figure 1aThe public network card of the springboard module shown in the figure generates a related forwarding rule table in the control module; further, the control module synchronizes the forwarding rule bar to the L4 cleaning server and the L7 cleaning server.

[0079] It is worth mentioning that the above Figure 1a The L4 cleaning server and the L7 cleaning server deployed in the same area are shown. In actual application, the L4 cleaning server and the L7 cleaning server support cross-regional branch room deployment and have strong environmental adaptability.

[0080] like Figure 1b What is shown is the L4 cleaning server and the L7 cleaning server deployed across regions; that is, the L4 cleaning server and the L7 cleaning server are deployed in different computer rooms in different regions.

[0081] After introducing the high-defense system and the architecture of L4 and L7 cleaning servers, please combine Figure 3 The HTTPS cleaning method shown in the flowchart can be applied to the aforementioned high-defense system. Specifically, the high-defense system can include a traffic access switch, an L4 cleaning server, and an L7 cleaning server; the L7 cleaning server includes a TOA module, the L4 cleaning server includes a NAT module, and the L4 cleaning server and the L7 cleaning server also include the same LIP record table and forwarding rule table.

[0082] Combine the following Figure 2 The method for HTTPS offloading may include the following steps:

[0083] Step 210: The traffic access switch forwards the HTTPS request message sent by the client to the L4 cleaning server.

[0084] The client can send HTTPS request messages to the configured high-defense IP, listening interface or listening domain name. The message will first be sent to the traffic access switch, and then forwarded to the L4 cleaning server through the traffic switch.

[0085] Exemplarily, the HTTPS request needs to carry the corresponding IP and port. Specifically, the real IP carried by the domain name can be a configured high-defense IP, and the port is a listening port.

[0086] Step 220: The L4 cleaning server queries its own VIP list according to the LIP record table, and randomly selects a target VIP to replace the source IP in the message, and randomly selects an idle port from the port pool to replace the source port in the message; further, it is determined whether the high-defense system has enabled the HTTPS offloading function; if enabled, the message is forwarded to the traffic access switch, and the traffic access switch further forwards the message to the L7 cleaning server;

[0087] In this step, the L4 cleaning server replaces the original message with VIP as the source IP, and forwards traffic with the public IP service of the L7 cleaning cluster through the public network service switch, so that L4 and L7 independent protection do not affect each other, thus allowing cross-regional deployment.

[0088] Exemplarily, after the HTTPS request message arrives at the L4 cleaning server, the L4 cleaning server can detect the message. If the IP of the message hits the high-defense IP, the high-defense process can be triggered, that is, step 220 is executed to determine whether the message needs to be forwarded to the L7 cleaning server based on whether the HTTPS offloading function is enabled in the high-defense system.

[0089] For example, if you want to allow HTTPS request messages to be forwarded to the L7 cleaning server, you need to enable the HTTPS offloading function of the high-defense system. The HTTPS offloading function needs to be enabled by setting the listening protocol type to HTTPS when the user sets the configuration information.

[0090] Exemplarily, the forwarding rule table also maintains the source station IP and source station port of the source server corresponding to the high-defense IP; accordingly, if the HTTPS offloading function is not enabled, the L4 cleaning server replaces the destination IP and destination port in the message according to the source station IP and source station port corresponding to the hit high-defense IP in the forwarding rule table;

[0091] The replaced message is forwarded to the traffic access switch, and the traffic access switch forwards the message to the source station server where the source station IP is located according to the destination IP and destination port in the message.

[0092] Exemplarily, if the HTTPS offloading function is enabled, the L4 cleaning server may replace the destination IP of the message with the LIP address of the L7 cleaning server recorded in the LIP record table; and replace the destination port of the message with the binding port of the L7 cleaning server;

[0093] The replaced message is forwarded to the traffic access switch, and the traffic access switch forwards the message to the L7 cleaning server where the network card IP is located according to the destination IP and destination port in the message.

[0094] Step 230: After receiving the message forwarded by the traffic access switch, the L7 cleaning server replaces the IP and port in the message with the real IP and port of the client through the TOA module; further, the HTTPS proxy module matches the CA certificate maintained in the forwarding rule table according to the SNI information of the message, decrypts the request data sent by the client based on the CA certificate, and cleans the decrypted request data.

[0095] In this step, the L7 cleaning server receives the traffic message forwarded by the L4 cleaning server NAT, obtains the real source IP information of the request data through the TOA module, and uses it as the request source after HTTPS unloading to realize data flow cleaning.

[0096] As before Figure 2 As shown in , the L7 cleaning server may include an L7 unloading module, and the HTTPS proxy module and the data receiving module (not shown in the figure) are located in the L7 unloading module.

[0097] After receiving the message, the data receiving module in the L7 offload module can allocate a structure that records the HTTPS connection status. The structure can include handshake status, connection socket, five-tuple information, etc., and add a trigger event to one of the high-concurrency threads of the HTTPS proxy module through hash operation. When the HTTPS proxy module triggers the event, it starts to check the message and then shake hands with the client. After the handshake is completed, it receives the request data sent by the client and records the handshake status, connection socket, five-tuple information and other HTTPS connection status information in the above structure.

[0098] Specifically, the HTTPS proxy module obtains the SNI information according to the client Hello message of the HTTPS request, and matches the CA certificate corresponding to the hit high-defense IP maintained in the forwarding rule table. Then, the SSL engine is initialized based on the matched CA certificate. During the initialization of the SSL engine, the HTTPS proxy module will execute the process of replying server hello to the client; after receiving the reply, the client can initiate an HTTPS handshake with the HTTPS proxy module. Among them, the HTTPS handshake process is used to negotiate the key, that is, the client sends a key to the HTTPS proxy module, and the HTTPS proxy module can return a handshake packet (indicating confirmation of the key) after receiving it. The handshake ends after the client receives the handshake packet. After that, the negotiated key can be used for data transmission between the client and the HTTPS proxy module.

[0099] For example, the client can use the negotiated key to encrypt the request data stream and send the encrypted request data stream to the HTTPS proxy module, and the HTTPS proxy module writes the encrypted request data stream into the SSL engine buffer and decrypts the encrypted request data stream using the negotiated key in the SSL engine buffer. After the decryption is completed, the decrypted request data can be cleaned.

[0100] Through the above embodiments, based on the high-defense IP technology, without changing the HTTPS protocol type, the HTTPS proxy module is used to initialize the SSL engine using the CA certificate corresponding to the high-defense IP, thereby unloading the HTTPS traffic through the SSL engine. Since the HTTPS traffic is decrypted in the buffer of the SSL engine, there is no risk of information leakage. This is equivalent to converting an HTTPS request into an HTTP request, and the embodiments of this specification are more secure.

[0101] In addition, since HTTPS is offloaded to an independent server, it can use more CPU resources and have better performance, while not affecting the cleaning of other protocol traffic; therefore, compared with other data cleaning, the HTTPS cleaning solution provided in this manual has higher traffic cleaning efficiency.

[0102] Exemplarily, after the decrypted request data is cleansed, the following further includes:

[0103] The HTTPS proxy module establishes a connection between the L7 cleaning server and the source server by obtaining the LIP address of the connection between the L7 cleaning server and the source server in the LIP record table, encrypts the request data after data cleaning using the CA certificate, and sends the encrypted data to the source server; further, receives the response data corresponding to the request data returned by the source server, and forwards it to the client.

[0104] Through this embodiment, the HTTPS proxy module establishes connections with the client and the source server respectively, and does not change the original HTTPS communication mode.

[0105] Please refer to the following Figure 4 The schematic diagram of request data IP and port changes is shown in FIG. Figure 4 As shown in the figure, the high-defense IP created by the user is 4.4.4.1, the listening port is 6002, the listening domain name is test.com, and the IP and port of the HTTPS connection to the source server are RS: 5.5.5.1:443.

[0106] The public network card IP address of the jump PC where the jump module is located is 2.2.2.1, and the private network card IP address is 1.1.1.1;

[0107] The private network card IP address of the control PC where the control module is located is 1.1.1.3;

[0108] The L4 cleaning server cluster has multiple L4 cleaning servers; Figure 4 As shown in , the private network card IP address of L4 cleaning server 1 is 1.1.1.4; VIPs are 3.3.3.1, 3.3.3.2, and so on; the private network card IP address of L4 cleaning server 2 is 1.1.1.5; VIPs are 3.3.3.11, 3.3.3.12, and so on.

[0109] The L7 cleaning server cluster has multiple L7 cleaning servers; Figure 4 As shown in the figure, the private network card IP address of L7 cleaning server 1 is 1.1.1.11; the business network cards are 3.3.3.101 / 27, 3.3.3.102 / 32, 3.3.3.103 / 32, etc.; the private network card IP address of L7 cleaning server 2 is 1.1.1.12; the business network cards are 3.3.3.111 / 27, 3.3.3.112 / 32, 3.3.3.13 / 32, etc.

[0110] The source server's IP address is 5.5.5.1, port number is 443, and the domain name is test.com.

[0111] The red line marks the change process from the source IP and port to the destination IP and port of the message:

[0112] Red segment 1 to red segment 2: 6.6.6.1: 6001 -> 4.4.4.1: 6002; the HTTPS request message sent by the client is forwarded by the traffic access switch to L4 cleaning server 1.

[0113] Red line segment 2 to red line segment 3: 3.3.3.1:6003 -> 3.3.3.101:6004; L4 cleaning server 1 uses its own VIP: 3.3.3.1, and randomly selected free port 6003 (this port is a temporary port and not fixed) to replace the source IP and source port in the message; in addition, the service network card IP (3.3.3.101) of L7 cleaning server 1 is used to replace the destination IP in the message, and the port 6004 (this port is a fixed port) bound to the public network card for traffic forwarding by the L7 unloading module in the L7 cleaning server is used to replace the destination port in the HTTPS request. In this way, the message can be forwarded from L4 cleaning server 1 to L7 cleaning server 1.

[0114] Red line segment 3 to red line segment 4: 3.3.3.102:6005 ->5.5.5.1:443. L7 cleaning server 1 replaces the source IP and source port in the message with the public network IP (3.3.3.102) and port (6005) of the business network card; and replaces the destination IP and destination port in the message with the fixed IP (5.5.5.1) and port (443) of the source server. In this way, the message can be forwarded from L7 cleaning server 1 to the source server.

[0115] Finally, please refer to Figure 5 The overall flow chart of HTTPS cleaning shown in the figure provides an overall introduction to the above embodiments:

[0116] The client sends an HTTPS request to the configured high-security IP plus the listening port or listening domain name, and the service switch forwards the traffic to the L4 cleaning cluster;

[0117] Furthermore, after the L4 cleaning process completes traffic cleaning, it looks up its own VIP list according to the LIP record table, selects a source IP for NAT forwarding and randomly selects a free port from the port pool to replace the source IP and source port of the HTTPS request message;

[0118] Further, check the forwarding rule table. If HTTPS offloading is not enabled, replace the destination IP and port of the request data with the IP and port of the source server. If HTTPS offloading is enabled, query the LIP record table to obtain a random LIP address in the L7 cleaning cluster used to establish a connection with the client. Use this LIP address and the binding port of the L7 offloading data receiving module to replace the destination IP and destination port of the request data, and forward the message to the service switch.

[0119] Furthermore, the service switch forwards the HTTPS request traffic to the designated L7 cleaning server according to the destination IP;

[0120] Furthermore, after the L7 cleaning server network card receives the request traffic, it replaces the IP and port of the received message with the real IP and port of the client through the TOA module. It should be noted that the replaced real IP and port of the client are only used in the L7 unloading module for traffic cleaning, and when forwarding the message to the source server, the LIP in the LIP table and the assigned LPORT will be used to replace the IP and port of the message again.

[0121] Furthermore, the data receiving module obtains SNI information according to the client hello, matches the forwarding rule table, and obtains the CA certificate information configured in the rule;

[0122] Furthermore, the HTTPS proxy module attempts to connect to the client, receive the request data, and perform SSL decryption through the CA certificate to achieve traffic unloading, traffic cleaning, and protection based on the client IP;

[0123] Furthermore, the HTTPS proxy module obtains a random LIP address in the LIP record table that belongs to the server connected to the source server, establishes a connection with the source server, and encrypts the cleaned data with the CA certificate.

[0124] Furthermore, the cleaned message is encrypted with SSL, and a random LIP address belonging to the connection between this server and the source server is obtained from the LIP record table, and this IP is used to establish a connection with the source server for data exchange;

[0125] Specifically, the IP and port of the source server are obtained from the forwarding rule table, and the source server information is obtained by matching the corresponding high-defense IP and domain name;

[0126] Furthermore, the L7 cleaning proxy module receives the response message sent by the source server and forwards the response to the client.

[0127] Corresponding to the aforementioned HTTPS cleaning method embodiment, this specification also provides an embodiment of an HTTPS cleaning device. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of the device in which it is located reading the corresponding computer program in the non-volatile memory into the memory and running it. From the hardware level, such as Figure 6 The following is a hardware structure diagram of the device where the HTTPS cleaning device in this manual is located. Figure 6 In addition to the processor, network interface, memory and non-volatile memory shown, the device in which the apparatus in the embodiment is located may also include other hardware according to the actual communication function, which will not be described in detail.

[0128] See also Figure 7 , which is a module diagram of an HTTPS cleaning device provided in an embodiment of this specification, is applied to a high-defense system. The high-defense system may include a traffic access switch, an L4 cleaning server, and an L7 cleaning server; the L7 cleaning server includes a TOA module, the L4 cleaning server includes a NAT module, and the L4 cleaning server and the L7 cleaning server also include the same LIP record table and forwarding rule table.

[0129] The device corresponds to Figure 3 In the embodiment shown, the device comprises:

[0130] The first forwarding unit 710, the traffic access switch forwards the HTTPS request message sent by the client to the L4 cleaning server;

[0131] The second forwarding unit 720, the L4 cleaning server queries its own VIP list according to the LIP record table, and randomly selects a target VIP from the list to replace the source IP in the message, and randomly selects an idle port from the port pool to replace the source port in the message; further, it is determined whether the high-defense system has enabled the HTTPS offloading function; if enabled, the message is forwarded to the traffic access switch, and the traffic access switch further forwards the message to the L7 cleaning server;

[0132] The cleaning unit 730, after receiving the message forwarded by the traffic access switch, the L7 cleaning server replaces the IP and port in the message with the real IP and port of the client through the TOA module; further, the HTTPS proxy module matches the CA certificate maintained in the rule forwarding table according to the SNI information of the message, decrypts the request data sent by the client based on the CA certificate, and performs data cleaning on the decrypted request data.

[0133] Optionally, also include:

[0134] The response unit, the HTTPS proxy module establishes a connection between the L7 cleaning server and the source server by obtaining the LIP address of the connection between the L7 cleaning server and the source server in the LIP record table, encrypts the request data after data cleaning using the CA certificate, and sends the encrypted data to the source server; further, receives the response data corresponding to the request data returned by the source server, and forwards it to the client.

[0135] Optionally, the second forwarding unit 720 further includes:

[0136] The L7 forwarding subunit, if the HTTPS offloading function is turned on, uses the network card IP of the L7 cleaning server recorded in the LIP record table to replace the destination IP of the message; and uses the binding port of the L7 cleaning server to replace the destination port of the message; forwards the replaced message to the traffic access switch, and the traffic access switch forwards the message to the L7 cleaning server where the network card IP is located according to the destination IP and destination port in the message.

[0137] Optionally, the rule forwarding table further maintains the source station IP and source station port of the source server corresponding to the high-defense IP, and the second forwarding unit 720 further includes:

[0138] The source station forwarding subunit, if the HTTPS offloading function is not enabled, the L4 cleaning server replaces the destination IP and destination port in the message according to the source station IP and source station port in the forwarding rule table; forwards the replaced message to the traffic access switch, and the traffic access switch forwards the message to the source station server where the source station IP is located according to the destination IP and destination port in the message.

[0139] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device or a combination of any of these devices.

[0140] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0141] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can refer to the partial description of the method embodiments. The device embodiments described above are only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. Ordinary technicians in this field can understand and implement it without paying creative work.

[0142] above Figure 7 The internal functional modules and structural schematic diagram of the HTTPS cleaning device are described. Its actual execution subject can be an electronic device, including:

[0143] processor;

[0144] a memory for storing processor-executable instructions;

[0145] The processor is configured to execute any one of the above-mentioned HTTPS cleaning method embodiments.

[0146] In the above-mentioned embodiment of the electronic device, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or the processor can be any conventional processor, etc., and the aforementioned memory can be a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk or a solid-state drive. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0147] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the electronic device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0148] Those skilled in the art will readily appreciate other embodiments of the specification after considering the specification and practicing the invention disclosed herein. The specification is intended to cover any variations, uses, or adaptations of the specification that follow the general principles of the specification and include common knowledge or customary techniques in the art that are not disclosed in the specification. The specification and examples are to be considered exemplary only, and the true scope and spirit of the specification are indicated by the following claims.

[0149] It should be understood that the present description is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present description is limited only by the appended claims.

Claims

1. A HTTPS cleaning method, characterized in that: Applied to a high-defense system, the high-defense system includes a traffic access switch, an L4 cleaning server, and an L7 cleaning server; the L7 cleaning server includes a TOA module and an HTTPS proxy module, the L4 cleaning server includes a NAT module, and the L4 cleaning server and the L7 cleaning server also include the same LIP record table and forwarding rule table; wherein the L4 cleaning server is used to provide traffic cleaning of layer 4 messages, the L7 cleaning server is used to provide traffic cleaning of layer 7 messages, the TOA module is used to obtain the real IP and port of the client, the NAT module is a network address translation module, the LIP record table is used to record the LIP and VIP corresponding to the management IP, the LIP includes the public network IP of the service network card corresponding to the L7 cleaning server connected to the source server, and the VIP includes the IP corresponding to the L4 cleaning server; the method includes: The traffic access switch forwards the HTTPS request message sent by the client to the L4 cleaning server; The L4 cleaning server queries its own VIP list according to the LIP record table, and randomly selects a target VIP to replace the source IP in the message, and randomly selects an idle port from the port pool to replace the source port in the message; further, it determines whether the high-defense system has enabled the HTTPS offloading function; if enabled, the message is forwarded to the traffic access switch, and the traffic access switch further forwards the message to the L7 cleaning server; After receiving the message forwarded by the traffic access switch, the L7 cleaning server replaces the IP and port in the message with the real IP and port of the client through the TOA module; further, the HTTPS proxy module matches the CA certificate maintained in the rule forwarding table according to the SNI information of the message, decrypts the request data sent by the client based on the CA certificate, and cleans the decrypted request data.

2. The method according to claim 1, further comprising: The HTTPS proxy module establishes a connection between the L7 cleaning server and the source server by obtaining the LIP address of the connection between the L7 cleaning server and the source server in the LIP record table, encrypts the request data after data cleaning using the CA certificate, and sends the encrypted data to the source server; further, receives the response data corresponding to the request data returned by the source server, and forwards it to the client.

3. According to the method of claim 1, forwarding the message to the traffic access switch, and the traffic access switch further forwarding the message to the L7 cleaning server, comprising: Replace the destination IP of the message with the network card IP of the L7 cleaning server recorded in the LIP record table; and, replacing the destination port of the message with the bound port of the L7 cleaning server; The replaced message is forwarded to the traffic access switch, and the traffic access switch forwards the message to the L7 cleaning server where the network card IP is located according to the destination IP and destination port in the message.

4. According to the method of claim 1, the rule forwarding table also maintains the source station IP and source station port of the source server corresponding to the high-defense IP, and after the L4 cleaning server determines whether the high-defense system has enabled the HTTPS offloading function, it also includes: If not enabled, the L4 scrubbing server replaces the destination IP and destination port in the message according to the source station IP and source station port in the forwarding rule table; The replaced message is forwarded to the traffic access switch, and the traffic access switch forwards the message to the source station server where the source station IP is located according to the destination IP and destination port in the message.

5. According to the method of claim 1, the L4 cleaning server and the L7 cleaning server support cross-regional branch room deployment.

6. An HTTPS cleaning device, characterized in that: Applied to a high-defense system, the high-defense system includes a traffic access switch, an L4 cleaning server, and an L7 cleaning server; the L7 cleaning server includes a TOA module and an HTTPS proxy module, the L4 cleaning server includes a NAT module, and the L4 cleaning server and the L7 cleaning server also include the same LIP record table and forwarding rule table; wherein the L4 cleaning server is used to provide traffic cleaning of layer 4 messages, the L7 cleaning server is used to provide traffic cleaning of layer 7 messages, the TOA module is used to obtain the real IP and port of the client, the NAT module is a network address translation module, the LIP record table is used to record the LIP and VIP corresponding to the management IP, the LIP includes the public network IP of the service network card corresponding to the L7 cleaning server connected to the source server, and the VIP includes the IP corresponding to the L4 cleaning server; the device includes: The first forwarding unit, the traffic access switch forwards the HTTPS request message sent by the client to the L4 cleaning server; The second forwarding unit, the L4 cleaning server queries its own VIP list according to the LIP record table, and randomly selects a target VIP to replace the source IP in the message, and randomly selects an idle port from the port pool to replace the source port in the message; further, it is determined whether the high-defense system has enabled the HTTPS offloading function; if enabled, the message is forwarded to the traffic access switch, and the traffic access switch further forwards the message to the L7 cleaning server; The cleaning unit, after receiving the message forwarded by the traffic access switch, the L7 cleaning server replaces the IP and port in the message with the real IP and port of the client through the TOA module; further, the HTTPS proxy module matches the CA certificate maintained in the rule forwarding table according to the SNI information of the message, decrypts the request data sent by the client based on the CA certificate, and cleans the decrypted request data.

7. The apparatus according to claim 6, further comprising: The response unit, the HTTPS proxy module establishes a connection between the L7 cleaning server and the source server by obtaining the LIP address of the connection between the L7 cleaning server and the source server in the LIP record table, encrypts the request data after data cleaning using the CA certificate, and sends the encrypted data to the source server; further, receives the response data corresponding to the request data returned by the source server, and forwards it to the client.

8. The device according to claim 6, wherein the second forwarding unit further comprises: The L7 forwarding subunit, if the HTTPS offloading function is enabled, replaces the destination IP of the message with the network card IP of the L7 cleaning server recorded in the LIP record table; and replaces the destination port of the message with the binding port of the L7 cleaning server; The replaced message is forwarded to the traffic access switch, and the traffic access switch forwards the message to the L7 cleaning server where the network card IP is located according to the destination IP and destination port in the message.

9. The device according to claim 6, wherein the rule forwarding table further maintains the source station IP and source station port of the source server corresponding to the high-defense IP, and the second forwarding unit further comprises: The source station forwarding subunit, if the HTTPS offloading function is not enabled, the L4 cleaning server replaces the destination IP and destination port in the message according to the source station IP and source station port in the forwarding rule table; The replaced message is forwarded to the traffic access switch, and the traffic access switch forwards the message to the source station server where the source station IP is located according to the destination IP and destination port in the message.

10. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 5.

Images