HTTPS uninstall method, device and electronic device

Abstract

This specification provides an HTTPS unloading method, device and electronic device. The method includes: the traffic access switch forwards the HTTPS request message sent by the client to the L4 cleaning server; the L4 cleaning server determines whether the high-defense system has enabled the HTTPS unloading function; if enabled, the message is forwarded to the traffic access switch, and the traffic access switch further forwards the message to the L7 cleaning server; after the L7 cleaning server receives the message forwarded by the traffic access switch, the HTTPS proxy module matches the CA certificate maintained in the configuration maintenance module according to the SNI information of the message, and initializes the SSL engine based on the CA certificate; establishes an HTTPS handshake with the client, and decrypts the request data related to the HTTPS request sent by the client after the successful handshake through the SSL engine.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of communications, and in particular to an HTTPS unloading method and device and an electronic device. Background Art

[0002] HTTPS offloading is a technology that allows HTTPS traffic to be offloaded directly from the client to a load balancer or reverse proxy server, which then forwards the request to the backend application server. The main purpose of this technology is to reduce the burden on the application server and improve the scalability and security of the system. In this way, it is possible to avoid installing SSL / TLS certificates and related encryption processing on each application server, thereby reducing costs and complexity. In addition, since all encryption and decryption work is performed on the load balancer or reverse proxy, it also helps to centrally manage and monitor the implementation of security policies.

[0003] In the related art, in order to realize HTTPS offloading, Nginx proxy is usually used to offload SSL (Secure Socket Layer) certificates through Nginx proxy, thereby converting HTTPS requests into HTTP requests. However, as mentioned above, the HTTP protocol has certain security risks, which may lead to information leakage, identity masquerade and message tampering. Summary of the invention

[0004] The embodiments of this specification provide an HTTPS uninstallation method, device, and electronic device.

[0005] According to a first aspect of an embodiment of this specification, an HTTPS unloading method is provided, which is applied to a high-defense system, wherein the high-defense system includes a traffic access switch, an L4 cleaning server, and an L7 cleaning server; the L7 cleaning server includes an HTTPS proxy module and a configuration maintenance module, wherein the configuration maintenance module maintains a pre-configured high-defense IP and a corresponding CA certificate; the method includes:

[0006] The traffic access switch forwards the HTTPS request message sent by the client to the L4 cleaning server;

[0007] The L4 cleaning server determines whether the high-defense system has enabled the HTTPS offloading function; if enabled, forwards the message to the traffic access switch, and the traffic access switch further forwards the message to the L7 cleaning server;

[0008] After the L7 cleaning server receives the message forwarded by the traffic access switch, the HTTPS proxy module matches the CA certificate maintained in the configuration maintenance module according to the SNI information of the message, initializes the SSL engine based on the CA certificate, establishes an HTTPS handshake with the client, and decrypts the request data related to the HTTPS request sent by the client after a successful handshake through the SSL engine.

[0009] Optionally, the L7 cleaning server includes an L7 unloading module and an L7 management module, the HTTPS proxy module and the configuration maintenance module are located in the L7 unloading module, the L7 unloading module also includes an HTTPS cleaning module, and the L7 management module includes an Access Log management module and a CC protection management module;

[0010] After the SSL engine decrypts the request data stream related to the HTTPS request sent by the client after a successful handshake, the method further includes:

[0011] The HTTPS cleaning module reads the decrypted HTTPS request data from the cache of the SSL engine, obtains the complete header information of the HTTPS request, and sends it to the L7 management module;

[0012] The Access Log management module in the L7 management module generates corresponding AccessLog information according to the header information;

[0013] After the CC protection management module obtains the Access Log information, it counts the QPS information and verifies the corresponding CC protection rules; if the CC protection rules are hit, the hit CC protection rules are fed back to the HTTPS cleaning module, and the HTTPS cleaning module performs the protection operation corresponding to the hit CC protection rules on the HTTPS request.

[0014] Optionally, the L7 offload module performs the protection operation corresponding to the hit CC protection rule on the same HTTPS request received subsequently based on the hit CC protection rule.

[0015] Optionally, the configuration maintenance module also maintains the source station IP and source station port of the source server corresponding to the high-defense IP;

[0016] After performing the protection operation corresponding to the hit CC protection rule on the HTTPS request, the method further includes:

[0017] The HTTPS proxy module uses the SSL engine to encrypt the request data, and establishes a TCP connection with the source server according to the source IP and source port, and after the TCP connection, forwards the encrypted request data to the source server;

[0018] The HTTPS proxy module establishes an HTTPS handshake with the source server, and receives response data corresponding to the request data returned by the source server through the HTTPS handshake;

[0019] The HTTPS proxy module forwards the response data to the client.

[0020] Optionally, before the HTTPS proxy module forwards the response data to the client, the method further includes:

[0021] The HTTPS proxy module writes the response data into the buffer area of ​​the SSL engine for decryption, forwards the read decrypted response data to the L7 management module, and generates Access Log information through the Access Log management module in the L7 management module;

[0022] The HTTPS proxy module forwards the response data to the client, including:

[0023] The HTTPS proxy module encrypts the decrypted response data using the SSL engine and forwards the encrypted response data to the client.

[0024] Optionally, the forwarding of the message to the traffic access switch, and the traffic access switch further forwarding the message to the L7 cleaning server, includes:

[0025] Replace the destination IP of the message with the network card IP of the L7 cleaning server; and replace the destination port of the message with the binding port of the L7 cleaning server;

[0026] The replaced message is forwarded to the traffic access switch, and the traffic access switch forwards the message to the L7 cleaning server where the network card IP is located according to the destination IP and destination port in the message.

[0027] Optionally, the configuration maintenance module further maintains the source station IP and source station port of the source server corresponding to the high-defense IP; after the L4 cleaning server determines whether the high-defense network has enabled the HTTPS offloading function, it also includes:

[0028] If it is not enabled, the L4 cleaning server replaces the destination IP and destination port in the message according to the source station IP and source station port in the configuration maintenance module;

[0029] The replaced message is forwarded to the traffic access switch, and the traffic access switch forwards the message to the source station server where the source station IP is located according to the destination IP and destination port in the message.

[0030] Optionally, the high-defense system further includes a management and control module; the management and control module is used to record the protection IP configured by the user and the corresponding CA certificate;

[0031] The configuration maintenance module periodically reads the latest protection IP and the corresponding CA certificate from the management and control module, and updates the locally maintained protection IP and the corresponding CA certificate.

[0032] According to a third aspect of an embodiment of this specification, an HTTPS unloading device is provided, which is applied to a high-defense system, wherein the high-defense system includes a traffic access switch, an L4 cleaning server, and an L7 cleaning server; the L7 cleaning server includes an HTTPS proxy module and a configuration maintenance module, wherein the configuration maintenance module maintains a pre-configured high-defense IP and a corresponding CA certificate; the device includes:

[0033] The first forwarding unit, the traffic access switch forwards the HTTPS request message sent by the client to the L4 cleaning server;

[0034] The second forwarding unit, the L4 cleaning server determines whether the high-defense system has the HTTPS offloading function enabled; if enabled, forwards the message to the traffic access switch, and the traffic access switch further forwards the message to the L7 cleaning server;

[0035] Unloading unit, after the L7 cleaning server receives the message forwarded by the traffic access switch, the HTTPS proxy module matches the CA certificate maintained in the configuration maintenance module according to the SNI information of the message, and initializes the SSL engine based on the CA certificate; establishes an HTTPS handshake with the client, and decrypts the request data related to the HTTPS request sent by the client after a successful handshake through the SSL engine.

[0036] According to a third aspect of the embodiments of this specification, there is provided an electronic device, including:

[0037] processor;

[0038] a memory for storing processor-executable instructions;

[0039] Wherein, the processor is configured as any one of the above-mentioned HTTPS offloading methods.

[0040] The embodiment of this specification provides an HTTPS unloading solution. Based on the high-defense IP technology, without changing the HTTPS protocol type, the HTTPS proxy module is used to initialize the SSL engine using the CA certificate corresponding to the high-defense IP, thereby unloading the HTTPS traffic through the SSL engine. Since the HTTPS traffic is decrypted in the buffer of the SSL engine, there is no risk of information leakage. This is equivalent to converting an HTTPS request into an HTTP request, and the embodiment of this specification is more secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a schematic diagram of a high-defense system provided in an embodiment of this specification;

[0042] Figure 2 is a schematic diagram of an L7 cleaning server provided in an embodiment of this specification;

[0043] Figure 3 is a flowchart of an HTTPS uninstallation method provided in an embodiment of this specification;

[0044] Figure 4 It is a schematic diagram of traffic forwarding provided by an embodiment of this specification;

[0045] Figure 5 It is a hardware structure diagram of the HTTPS offloading device provided in an embodiment of this specification;

[0046] Figure 6 It is a module of the HTTPS offloading device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0047] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this specification. Instead, they are merely examples of devices and methods consistent with some aspects of this specification as detailed in the appended claims.

[0048] The terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. The singular forms "a", "the" and "the" used in this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0049] It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0050] With the continuous development of computer technology and the increasing popularization of the Internet, there are more and more network attacks, especially the endless emergence of new forms of network attacks, which has led to increasingly prominent network security issues.

[0051] In order to meet this challenge, some professional network security companies have begun to launch high-defense IP services. At first, high-defense IP mainly used traffic cleaning technology to establish a defense mechanism to resist attacks such as DDoS (Distributed Denial of Service). With the continuous advancement of technology, high-defense IP has gradually developed into a comprehensive network security protection system that integrates multiple defense technologies and strategies, thereby providing more comprehensive security protection.

[0052] High-defense IP was initially used mainly in large enterprises and websites because these organizations face more complex and frequent cyber attacks. They need a more efficient and reliable way to defend against DDoS attacks and other cyber threats. The emergence of high-defense IP provides a more comprehensive and reliable network security solution for these large enterprises and websites. With the development and popularization of technology, high-defense IP has also gradually been applied to small and medium-sized enterprises and individual users. These users are also facing the threat of cyber attacks, and high-defense IP can provide them with a more flexible and economical defense method. Today, high-defense IP has become one of the important means of protecting network security and is widely used in enterprises and institutions of all sizes.

[0053] High-defense IP is generally used to protect the connection between web servers and other client browsers. However, HTTP (Hypertext Transfer Protocol) uses plain text transmission, and there may be security issues such as information leakage, identity disguise, and message tampering in the HTTP protocol. In order to protect the security of data during transmission, more and more companies use the HTTPS protocol (Hypertext Transfer Protocol Secure). HTTPS establishes an SSL encryption layer on HTTP and encrypts the transmitted data. It is a secure version of the HTTP protocol.

[0054] Since the messages transmitted using the HTTPS protocol are encrypted throughout the process, if you want to clean the data traffic, you need to first perform HTTPS unloading to obtain decrypted messages, and then execute some related security policies on the decrypted messages, such as QPS (Queries per second) statistics, Access Log generation, CC (Challenge Collapsar) rule matching, etc.

[0055] In the related art, in order to realize HTTPS offloading, Nginx proxy is usually used to offload SSL (Secure Socket Layer) certificates through Nginx proxy, thereby converting HTTPS requests into HTTP requests. However, as mentioned above, the HTTP protocol has certain security risks, which may lead to information leakage, identity masquerade and message tampering.

[0056] In order to solve the above problems, this specification aims to provide an HTTPS unloading solution, based on the high-defense IP technology, without changing the HTTPS protocol type, through the HTTPS proxy module, using the CA certificate corresponding to the high-defense IP to initialize the SSL engine, thereby unloading the HTTPS traffic through the SSL engine. Since the HTTPS traffic is decrypted in the buffer of the SSL engine, the decrypted data is read-only. After a series of protection detections are completed, it will be re-encrypted and forwarded to the source server in the form of an https request; it can be seen that the decrypted message only exists in the L7 unloading process, and the other full links are still encrypted messages, so there is no risk of information leakage. It is equivalent to converting an HTTPS request into an HTTP request, and the embodiments of this specification are more secure.

[0057] In this manual, the high-defense system that implements HTTPS offloading can be as follows: Figure 1 As shown, the high-defense system can include: a management and control module, a traffic access switch, an L4 cleaning module, and an L7 cleaning module.

[0058] The control module may refer to a management node in a high-defense network, and the control module may provide API calls and remote management services.

[0059] The traffic access switch may refer to a switch for business traffic access to a high-defense switch, which is used to forward the business traffic to a cleaning module such as an L4 cleaning module or an L7 cleaning module.

[0060] The L4 cleaning module is used to provide traffic cleaning for layer 4 packets.

[0061] The L7 cleaning module is used to provide traffic cleaning for layer 7 packets.

[0062] In this specification, the control module, L4 cleaning module, and L7 cleaning module can be deployed on independent physical servers, and these physical servers can support cluster deployment. For example, the L4 cleaning module can be deployed on an independent L4 cleaning server (or server cluster), and the L7 cleaning module can be deployed on an independent L7 cleaning server (or server cluster);

[0063] The L7 cleaning module can be further divided into an L7 unloading module and an L7 management module, and the L7 unloading module and the L7 management module can be deployed on the same L7 cleaning server.

[0064] The management IP between each server in this manual, such as L4 cleaning server and L7 cleaning server, can be Figure 1 The management switches shown in the figure can be interconnected, and the service network cards of the L4 cleaning server and the L7 cleaning server can be interconnected through the traffic access switch.

[0065] Please refer to the following Figure 2 The schematic diagram of the L7 cleaning server is shown in FIG. Figure 2 As shown, the L7 cleaning server may further include an L7 unloading module and an L7 management module. The L7 unloading module is used to unload all data messages such as https request messages, https response messages, etc., and the L7 management module is used to count and manage the unloaded message data.

[0066] Exemplarily, the L7 offload module may further include a data receiving module, an HTTPS proxy module and a configuration maintenance module, and the HTTPS proxy module may further include an SSL engine and an HTTPS cleaning module.

[0067] The L7 management module can also be used to determine whether the unloaded message data hits the preset protection rules, and feed back the hit protection rules to the HTTPS cleaning module, and the HTTPS cleaning module cleans the message. It should be noted that the L7 unloading module and the L7 management module can be separated and run in different processes, thereby reducing the impact of management on message forwarding and improving forwarding efficiency when the L7 unloading module performs interception.

[0068] Exemplarily, the protection rule may include CC protection, and accordingly the L7 management module may further include a data receiving module, a CC protection management module and an Access Log management module.

[0069] The following is a further introduction to the functions of each of the above modules:

[0070] The data receiving module in the L7 offload module can be used to receive the message or data stream of the HTTPS request and distribute it to the HTTPS proxy module.

[0071] The HTTPS proxy module supports multi-threaded high-concurrency data flow reception, and combines HTTP proxy and SSL / TLS protocols to provide data encryption and identity authentication. The HTTPS proxy module can also support access control, load balancing, caching and other functions, which can protect data security, improve performance, and have flexibility and scalability.

[0072] The HTTPS proxy module implements encryption and decryption of data streams by reading and writing data to the buffer area of ​​the SSL engine.

[0073] The HTTPS proxy module can regularly read the configuration file in the management and control module through the configuration maintenance module, and based on the read configuration file, update the matching rules and CC protection rules of the HTTPS module, and interact with the L7 management module to synchronize the updated CC protection rules to the CC protection management module.

[0074] After the HTTPS proxy module decrypts the data stream through the SSL engine, the HTTPS cleaning module can trigger the defense mechanism by calling the CC protection management module in the L7 management module. The CC protection management module determines whether the decrypted data hits the CC protection rule. If it hits, the CC protection rule is forwarded to the HTTPS cleaning module. At this time, the HTTPS cleaning module can maintain an interception table, which can contain the operations to be performed on the specified URL, including speed limit, blacklisting, execution time, etc. In addition, the HTTPS cleaning module can also call the Access Log management module in the L7 management module to implement functions such as statistical QPS information and Access Log packet capture.

[0075] After introducing the high-defense system and the architecture of the L7 cleaning server, please Figure 3 The HTTPS unloading method flow diagram shown in the figure can be applied to the aforementioned high-defense system. Specifically, the high-defense system can include a traffic access switch, an L4 cleaning server, and an L7 cleaning server; the L7 cleaning server includes an HTTPS proxy module and a configuration maintenance module, and the configuration maintenance module maintains a pre-configured high-defense IP and the corresponding CA certificate.

[0076] The high-defense IP and the corresponding CA certificate may be pre-configured. For example, a user may log in to a client interface (eg, a Web interface) corresponding to the high-defense network, create a high-defense IP in the client interface, and configure the corresponding configuration information.

[0077] Exemplarily, the configuration information may include, but is not limited to, forwarding rules corresponding to the high-defense IP, CA certificates, listening information, source server (Real Server) information, etc.

[0078] The listening information may include the specified listening protocol type and listening port. If the high-defense system needs to enable HTTPS offloading, the listening protocol type may be set to HTTPS. The listening IP is a high-defense IP, and the listening port can be defined by yourself.

[0079] The source server information includes the source IP and source port of the source server.

[0080] Exemplarily, the above configuration information configured by the user can be sent from the management switch in the high-defense network to the management and control module, and the management and control module can further synchronize the configuration information to the L4 and L7 cleaning servers through the management IP.

[0081] Combine the following Figure 2 The method for HTTPS offloading may include the following steps:

[0082] Step 210: The traffic access switch forwards the HTTPS request message sent by the client to the L4 cleaning server.

[0083] The client can send an HTTPS request message to the high-defense system. The message will first be sent to the traffic access switch, and then forwarded to the L4 cleaning server through the traffic switch.

[0084] Exemplarily, the HTTPS request needs to carry the corresponding IP and port. Specifically, the real IP carried by the domain name can be a configured high-defense IP, and the port is a listening port.

[0085] Step 220: The L4 cleaning server determines whether the high-defense system has the HTTPS offloading function enabled; if enabled, the message is forwarded to the traffic access switch, and the traffic access switch further forwards the message to the L7 cleaning server.

[0086] After the HTTPS request message arrives at the L4 cleaning server, the L4 cleaning server can detect the message. If the IP of the message hits the high-defense IP, the high-defense process can be triggered, that is, step 220 is executed to determine whether the message needs to be forwarded to the L7 cleaning server based on whether the HTTPS offloading function is enabled in the high-defense system.

[0087] For example, if you want to allow HTTPS request messages to be forwarded to the L7 cleaning server, you need to enable the HTTPS offloading function of the high-defense system. The HTTPS offloading function needs to be enabled by setting the listening protocol type to HTTPS when the user sets the configuration information.

[0088] Exemplarily, if the HTTPS offloading function is not enabled, the L4 cleaning server replaces the destination IP and destination port in the message according to the source station IP and source station port corresponding to the hit high-defense IP in the configuration maintenance module;

[0089] The replaced message is forwarded to the traffic access switch, and the traffic access switch forwards the message to the source station server where the source station IP is located according to the destination IP and destination port in the message.

[0090] Exemplarily, if the HTTPS offloading function is enabled, the L4 cleaning server can replace the destination IP of the message with the network card IP of the L7 cleaning server; and replace the destination port of the message with the binding port of the L7 cleaning server;

[0091] The replaced message is forwarded to the traffic access switch, and the traffic access switch forwards the message to the L7 cleaning server where the network card IP is located according to the destination IP and destination port in the message.

[0092] Step 230: After the L7 cleaning server receives the message forwarded by the traffic access switch, the HTTPS proxy module matches the CA certificate maintained in the configuration maintenance module according to the SNI information of the message, and initializes the SSL engine based on the CA certificate; establishes an HTTPS handshake with the client, and decrypts the request data related to the HTTPS request sent by the client after a successful handshake through the SSL engine.

[0093] As before Figure 2 As shown in, the L7 cleaning server may include an L7 unloading module and an L7 management module, the HTTPS proxy module and the configuration maintenance module are located in the L7 unloading module, the L7 unloading module also includes an HTTPS cleaning module, and the L7 management module includes an Access Log management module and a CC protection management module.

[0094] After receiving the message, the data receiving module in the L7 offload module can allocate a structure that records the HTTPS connection status. The structure can include handshake status, connection socket, five-tuple information, etc., and add a trigger event to one of the high-concurrency threads of the HTTPS proxy module through hash operation. When the HTTPS proxy module triggers the event, it starts to check the message and then shake hands with the client. After the handshake is completed, it receives the request data sent by the client and records the handshake status, connection socket, five-tuple information and other HTTPS connection status information in the above structure.

[0095] Specifically, the HTTPS proxy module obtains SNI information based on the client Hello message of the HTTPS request, and matches the CA certificate corresponding to the hit high-defense IP maintained in the configuration maintenance module. Then, the SSL engine is initialized based on the matched CA certificate; after completing the SSL engine initialization, the HTTPS proxy module can try to initiate an HTTPS handshake with the client, write the data stream of the request connection into the cache area of ​​the SSL engine, obtain the encrypted data stream when reading from the SSL engine cache area, send the data stream to the client, and implement the handshake. After the handshake is completed, the HTTPS proxy module receives the client request data stream and writes it into the SSL engine cache area to decrypt the request data.

[0096] Through the above-mentioned embodiments, based on the high-defense IP technology, without changing the HTTPS protocol type, the HTTPS proxy module is used to initialize the SSL engine using the CA certificate corresponding to the high-defense IP, thereby unloading the HTTPS traffic through the SSL engine. Since the HTTPS traffic is decrypted in the buffer of the SSL engine, the decrypted data is read-only. After a series of protection detections are completed, it will be re-encrypted and forwarded to the source server in the form of an https request; it can be seen that the decrypted message only exists inside the L7 unloading process, and the other full links are still encrypted messages, so there is no risk of information leakage. It is equivalent to converting an HTTPS request into an HTTP request, and the embodiments of this manual are more secure.

[0097] After receiving the HTTPS offload, you can then perform high-defense IP protection on the decrypted request data.

[0098] As before Figure 2 As shown in , the L7 cleaning server may include an L7 unloading module and an L7 management module, the HTTPS proxy module and the configuration maintenance module are located in the L7 unloading module, the L7 unloading module also includes an HTTPS cleaning module, and the L7 management module includes an Access Log management module and a CC protection management module;

[0099] In an exemplary embodiment, after the above step 230, the following steps may also be included:

[0100] The HTTPS cleaning module reads the decrypted HTTPS request data from the cache of the SSL engine, obtains the complete header information of the HTTPS request, and sends it to the L7 management module;

[0101] The Access Log management module in the L7 management module generates corresponding AccessLog information according to the header information;

[0102] After the CC protection management module obtains the Access Log information, it counts the QPS information and verifies the corresponding CC protection rules; if the CC protection rules are hit, the hit CC protection rules are fed back to the HTTPS cleaning module, and the HTTPS cleaning module performs the protection operation corresponding to the hit CC protection rules on the HTTPS request.

[0103] Exemplarily, the protection operation may include URL rate limiting or request blacklisting. The L7 offload module performs the protection operation corresponding to the hit CC protection rule on the same HTTPS request received subsequently based on the hit CC protection rule.

[0104] Through this embodiment, a CC defense method is provided, which matches the corresponding CC protection rules through the header information of the decrypted HTTP request to perform relevant protection operations.

[0105] Exemplarily, after performing the protection operation corresponding to the hit CC protection rule on the HTTPS request, the method further includes:

[0106] The HTTPS proxy module uses the SSL engine to encrypt the request data (encrypt the decrypted request data again), and establishes a TCP connection with the source server according to the source IP and source port of the source server corresponding to the hit high-defense IP in the configuration maintenance module, and after the TCP connection, forwards the encrypted request data to the source server;

[0107] The HTTPS proxy module establishes an HTTPS handshake with the source server, and receives response data corresponding to the request data returned by the source server through the HTTPS handshake;

[0108] The HTTPS proxy module forwards the response data to the client.

[0109] Through this embodiment, the HTTPS proxy module establishes connections with the client and the source server respectively, and does not change the original HTTPS communication mode.

[0110] In an exemplary embodiment, before the HTTPS proxy module forwards the response data to the client, the following steps may also be included:

[0111] The HTTPS proxy module writes the response data into the buffer area of ​​the SSL engine for decryption, forwards the read decrypted response data to the L7 management module, and generates Access Log information through the Access Log management module in the L7 management module;

[0112] The HTTPS proxy module forwards the response data to the client, including:

[0113] The HTTPS proxy module encrypts the decrypted response data using the SSL engine and forwards the encrypted response data to the client.

[0114] Through this embodiment, the same HTTPS unloading method as mentioned above is adopted to decrypt the response data, so as to generate corresponding log information (Access Log) through the AccessLog management module. In this way, the return status of the source server can be confirmed through the log information, for example, the codo returned by the source server can be checked to obtain the status code, so as to better debug the failed link. At the same time, unloading the response data can also reserve space for the subsequent execution of relevant security policies for the source server.

[0115] Finally, please refer to Figure 4 The overall flow chart of HTTPS unloading shown in the figure provides an overall introduction to the above-mentioned embodiments:

[0116] The client sends an HTTPS request message to the server; the message needs to carry the corresponding IP and port; the real IP carried in the domain name is the configured high-defense IP, and the port is the listening port;

[0117] The HTTPS request message enters the traffic access switch, which first forwards the message to the L4 cleaning server. After the L4 cleaning module completes the detection, it forwards the message to the traffic access switch again. The traffic access switch forwards it to the source station or L7 cleaning server according to the destination IP.

[0118] Specifically, the L4 cleaning module determines whether the HTTPS offloading function is enabled. If not, the destination IP and destination port in the message are replaced according to the source station IP and source station port corresponding to the hit high-defense IP in the configuration maintenance module; if enabled, the destination IP of the message is replaced with the network card IP of the L7 cleaning server, and the destination port of the message is replaced with the binding port of the L7 cleaning server;

[0119] In the case of being enabled, the traffic access switch forwards the message to the L7 cleaning server where the network card IP is located according to the destination IP and port.

[0120] Furthermore, after receiving the message, the data receiving module in the L7 offload module can allocate a structure that records the HTTPS connection status. The structure can include handshake status, connection socket, five-tuple information, etc., and add a trigger event to one of the high-concurrency threads of the HTTPS proxy module through a hash operation. When the HTTPS proxy module triggers the event, it starts to check the message and then shake hands with the client. After the handshake is completed, it receives the request data sent by the client and records the handshake status, connection socket, five-tuple information and other HTTPS connection status information in the above structure.

[0121] Specifically, the HTTPS proxy module obtains the SNI information according to the client Hello message of the HTTPS request, and matches the CA certificate corresponding to the hit high-defense IP maintained in the configuration maintenance module. Then, the SSL engine is initialized based on the matched CA certificate. During the initialization of the SSL engine, the HTTPS proxy module will execute the process of replying server hello to the client; after receiving the reply, the client can initiate an HTTPS handshake with the HTTPS proxy module. Among them, the HTTPS handshake process is used to negotiate the key, that is, the client sends a key to the HTTPS proxy module, and the HTTPS proxy module can return a handshake packet (indicating confirmation of the key) after receiving it. The handshake ends after the client receives the handshake packet. After that, the negotiated key can be used for data transmission between the client and the HTTPS proxy module.

[0122] For example, the client can use the negotiated key to encrypt the request data stream and send the encrypted request data stream to the HTTPS proxy module, and the HTTPS proxy module writes the encrypted request data stream into the SSL engine buffer and decrypts the encrypted request data stream in the SSL engine buffer using the negotiated key.

[0123] Specifically, the configuration maintenance module periodically reads the latest configuration information synchronized from the management and control module and updates the currently cached configuration information, which includes high-defense IP, source server information, CA certificate, etc.

[0124] Furthermore, the HTTPS cleaning module performs feature analysis on the decrypted request data and performs CC protection.

[0125] Specifically, the HTTPS proxy module reads the decrypted HTTPS request data from the SSL engine buffer, obtains the complete HTTP request header information, and sends it to the L7 management module. The Access Log management module in the L7 management module generates the corresponding Access Log information based on the header information. The CC protection management module further counts the QPS information and verifies the corresponding CC protection rules. If the rules are matched, the protection operation (speed limit or blacklisting) executed is returned to the L7 unloading process. When the subsequent L7 unloading process receives an HTTPS request that matches the protection operation, it will perform the same protection operation.

[0126] Furthermore, after cleaning the HTTPS request data, the HTTPS proxy module uses the SSL engine to encrypt the request data, and attempts to establish a TCP connection with the source server based on the source IP and source port of the source server. After the connection is completed, the request data is forwarded to the source server.

[0127] Furthermore, after the TCP connection is established, the HTTPS proxy module can try to initiate an HTTPS handshake with the source server in a similar way to the handshake with the client. After the handshake is completed, it checks whether there is still data flow in the https request buffer. If so, it forwards the data flow to the source server.

[0128] Further, the origin server forwards the response data to the L7 cleaning server, and the HTTPS proxy module receives the response data;

[0129] Further, the corresponding HTTPS proxy module writes the response data stream into the SSL engine buffer for decryption, and after reading, forwards the decrypted response data to the L7 management module, and generates Access Log information corresponding to the decrypted response data through the Access Log management module;

[0130] Furthermore, the HTTPS proxy module uses the SSL engine to encrypt the decrypted response data and forwards the encrypted response data to the client.

[0131] To sum up, the embodiments provided in this specification only need to configure the high-defense IP and the corresponding configuration information, and enable the HTTPS offloading function to start the related processes of the L7 offloading module and the L7 management module in the L7 request server. The deployment is simple, so it has strong adaptability to the high-defense environment, lower environmental dependence, and can reduce maintenance costs.

[0132] In addition, HTTPS offloading through the HTTPS proxy module does not require the consumption of additional disk and memory. Since the original data stream is directly parsed, memory resources can be quickly released and the original data can be processed in real time, thereby reducing resource consumption and improving the efficiency of CC protection.

[0133] Corresponding to the aforementioned HTTPS uninstallation method embodiment, this specification also provides an embodiment of an HTTPS uninstallation device. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of the device in which it is located reading the corresponding computer program in the non-volatile memory into the memory and running it. From the hardware level, such as Figure 5 The following is a hardware structure diagram of the device where the HTTPS uninstallation device of this manual is located, except Figure 5 In addition to the processor, network interface, memory and non-volatile memory shown, the device in which the apparatus in the embodiment is located may also include other hardware according to the actual communication function, which will not be described in detail.

[0134] See also Figure 6 , which is a module diagram of an HTTPS unloading device provided in an embodiment of this specification, and is applied to a high-defense system. The high-defense system includes a traffic access switch, an L4 cleaning server, and an L7 cleaning server; the L7 cleaning server includes an HTTPS proxy module and a configuration maintenance module, and the configuration maintenance module maintains a pre-configured high-defense IP and the corresponding CA certificate.

[0135] The device corresponds to Figure 3 In the embodiment shown, the device comprises:

[0136] The first forwarding unit 710, the traffic access switch forwards the HTTPS request message sent by the client to the L4 cleaning server;

[0137] The second forwarding unit 720, the L4 cleaning server determines whether the high-defense system has the HTTPS offloading function enabled; if enabled, forwards the message to the traffic access switch, and the traffic access switch further forwards the message to the L7 cleaning server;

[0138] Unloading unit 730, after the L7 cleaning server receives the message forwarded by the traffic access switch, the HTTPS proxy module matches the CA certificate maintained in the configuration maintenance module according to the SNI information of the message, and initializes the SSL engine based on the CA certificate; establishes an HTTPS handshake with the client, and decrypts the request data related to the HTTPS request sent by the client after a successful handshake through the SSL engine.

[0139] Optionally, the L7 cleaning server includes an L7 unloading module and an L7 management module, the HTTPS proxy module and the configuration maintenance module are located in the L7 unloading module, the L7 unloading module also includes an HTTPS cleaning module, and the L7 management module includes an Access Log management module and a CC protection management module;

[0140] After the unloading unit 730, the method further includes:

[0141] The reading unit, the HTTPS cleaning module reads the decrypted HTTPS request data from the cache area of ​​the SSL engine, obtains the complete header information of the HTTPS request, and sends it to the L7 management module;

[0142] A log generation unit, wherein the Access Log management module in the L7 management module generates corresponding Access Log information according to the header information;

[0143] The CC protection unit, after the CC protection management module obtains the Access Log information, counts the QPS information and verifies the corresponding CC protection rules; if the CC protection rules are hit, the hit CC protection rules are fed back to the HTTPS cleaning module, and the HTTPS cleaning module performs the protection operation corresponding to the hit CC protection rules on the HTTPS request.

[0144] Optionally, the L7 offload module performs the protection operation corresponding to the hit CC protection rule on the same HTTPS request received subsequently based on the hit CC protection rule.

[0145] Optionally, the configuration maintenance module also maintains the source station IP and source station port of the source server corresponding to the high-defense IP;

[0146] After the CC protection unit, it also includes:

[0147] The response unit, the HTTPS proxy module uses the SSL engine to encrypt the request data, and establishes a TCP connection with the source station server according to the source station IP and the source station port, and after the TCP connection, forwards the encrypted request data to the source station server; the HTTPS proxy module establishes an HTTPS handshake with the source station server, and receives the response data corresponding to the request data returned by the source station server through the HTTPS handshake; the HTTPS proxy module forwards the response data to the client.

[0148] Optionally, before the HTTPS proxy module forwards the response data to the client, the method further includes:

[0149] The HTTPS proxy module writes the response data into the buffer area of ​​the SSL engine for decryption, forwards the read decrypted response data to the L7 management module, and generates Access Log information through the Access Log management module in the L7 management module;

[0150] The HTTPS proxy module forwards the response data to the client, including:

[0151] The HTTPS proxy module encrypts the decrypted response data using the SSL engine and forwards the encrypted response data to the client.

[0152] Optionally, the second forwarding unit 720 further includes:

[0153] The L7 forwarding subunit, if the HTTPS offloading function is turned on, uses the network card IP of the L7 cleaning server to replace the destination IP of the message; and uses the bound port of the L7 cleaning server to replace the destination port of the message; forwards the replaced message to the traffic access switch, and the traffic access switch forwards the message to the L7 cleaning server where the network card IP is located according to the destination IP and destination port in the message.

[0154] Optionally, the configuration maintenance module further maintains the source station IP and source station port of the source server corresponding to the high-defense IP; the second forwarding unit 720 further includes:

[0155] The source station forwarding subunit, if the HTTPS offloading function is not enabled, replaces the destination IP and destination port in the message according to the source station IP and source station port in the configuration maintenance module; forwards the replaced message to the traffic access switch, and the traffic access switch forwards the message to the source station server where the source station IP is located according to the destination IP and destination port in the message.

[0156] Optionally, the high-defense system further includes a management and control module; the management and control module is used to record the protection IP configured by the user and the corresponding CA certificate;

[0157] The configuration maintenance module periodically reads the latest protection IP and the corresponding CA certificate from the management and control module, and updates the locally maintained protection IP and the corresponding CA certificate.

[0158] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device or a combination of any of these devices.

[0159] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0160] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can refer to the partial description of the method embodiments. The device embodiments described above are only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. Ordinary technicians in this field can understand and implement it without paying creative work.

[0161] above Figure 6 The internal functional modules and structural schematic diagram of the HTTPS offloading device are described. Its actual execution subject can be an electronic device, including:

[0162] processor;

[0163] a memory for storing processor-executable instructions;

[0164] The processor is configured to execute any one of the above-mentioned HTTPS offloading method embodiments.

[0165] In the above-mentioned embodiment of the electronic device, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or the processor can be any conventional processor, etc., and the aforementioned memory can be a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk or a solid-state drive. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0166] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the electronic device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0167] Those skilled in the art will readily appreciate other embodiments of the specification after considering the specification and practicing the invention disclosed herein. The specification is intended to cover any variations, uses, or adaptations of the specification that follow the general principles of the specification and include common knowledge or customary techniques in the art that are not disclosed in the specification. The specification and examples are to be considered exemplary only, and the true scope and spirit of the specification are indicated by the following claims.

[0168] It should be understood that the present description is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present description is limited only by the appended claims.

Claims

1. An HTTPS uninstallation method, characterized in that: Applied to a high-defense system, the high-defense system includes a traffic access switch, an L4 cleaning server, and an L7 cleaning server; the L7 cleaning server includes an HTTPS proxy module and a configuration maintenance module, and the configuration maintenance module maintains a pre-configured high-defense IP and a corresponding CA certificate; wherein the L4 cleaning server is used to provide traffic cleaning of layer 4 messages, and the L7 cleaning server is used to provide traffic cleaning of layer 7 messages; the method includes: The traffic access switch forwards the HTTPS request message sent by the client to the L4 cleaning server; The L4 cleaning server determines whether the high-defense system has enabled the HTTPS offloading function; if enabled, forwards the message to the traffic access switch, and the traffic access switch further forwards the message to the L7 cleaning server; After the L7 cleaning server receives the message forwarded by the traffic access switch, the HTTPS proxy module matches the CA certificate maintained in the configuration maintenance module according to the SNI information of the message, initializes the SSL engine based on the CA certificate, establishes an HTTPS handshake with the client, and decrypts the request data related to the HTTPS request sent by the client after a successful handshake through the SSL engine.

2. The method according to claim 1, characterized in that The L7 cleaning server includes an L7 unloading module and an L7 management module, the HTTPS proxy module and the configuration maintenance module are located in the L7 unloading module, the L7 unloading module also includes an HTTPS cleaning module, and the L7 management module includes an Access Log management module and a CC protection management module; After the SSL engine decrypts the request data stream related to the HTTPS request sent by the client after a successful handshake, the method further includes: The HTTPS cleaning module reads the decrypted HTTPS request data from the cache of the SSL engine, obtains the complete header information of the HTTPS request, and sends it to the L7 management module; The Access Log management module in the L7 management module generates corresponding Access Log information according to the header information; After the CC protection management module obtains the Access Log information, it counts the QPS information and verifies the corresponding CC protection rules; if the CC protection rules are hit, the hit CC protection rules are fed back to the HTTPS cleaning module, and the HTTPS cleaning module performs the protection operation corresponding to the hit CC protection rules on the HTTPS request.

3. The method according to claim 2, characterized in that The L7 offload module performs the protection operation corresponding to the hit CC protection rule on the same HTTPS request received subsequently based on the hit CC protection rule.

4. The method according to claim 2, characterized in that: The configuration maintenance module also maintains the source station IP and source station port of the source server corresponding to the high-defense IP; After performing the protection operation corresponding to the hit CC protection rule on the HTTPS request, the method further includes: The HTTPS proxy module uses the SSL engine to encrypt the request data, and establishes a TCP connection with the source server according to the source IP and source port, and after the TCP connection, forwards the encrypted request data to the source server; The HTTPS proxy module establishes an HTTPS handshake with the source server, and receives response data corresponding to the request data returned by the source server through the HTTPS handshake; The HTTPS proxy module forwards the response data to the client.

5. The method according to claim 4, characterized in that Before the HTTPS proxy module forwards the response data to the client, the method further includes: The HTTPS proxy module writes the response data into the buffer area of ​​the SSL engine for decryption, forwards the read decrypted response data to the L7 management module, and generates Access Log information through the Access Log management module in the L7 management module; The HTTPS proxy module forwards the response data to the client, including: The HTTPS proxy module encrypts the decrypted response data using the SSL engine and forwards the encrypted response data to the client.

6. The method according to claim 1, characterized in that The forwarding of the message to the traffic access switch, and the traffic access switch further forwarding the message to the L7 cleaning server, includes: Replace the destination IP of the message with the network card IP of the L7 cleaning server; and replace the destination port of the message with the binding port of the L7 cleaning server; The replaced message is forwarded to the traffic access switch, and the traffic access switch forwards the message to the L7 cleaning server where the network card IP is located according to the destination IP and destination port in the message.

7. The method according to claim 1, characterized in that The configuration maintenance module also maintains the source station IP and source station port of the source server corresponding to the high-defense IP; after the L4 cleaning server determines whether the high-defense network has enabled the HTTPS offloading function, it also includes: If it is not enabled, the L4 cleaning server replaces the destination IP and destination port in the message according to the source station IP and source station port in the configuration maintenance module; The replaced message is forwarded to the traffic access switch, and the traffic access switch forwards the message to the source station server where the source station IP is located according to the destination IP and destination port in the message.

8. The method according to claim 1, characterized in that The high-defense system also includes a management and control module; the management and control module is used to record the protection IP configured by the user and the corresponding CA certificate; The configuration maintenance module periodically reads the latest protection IP and the corresponding CA certificate from the management and control module, and updates the locally maintained protection IP and the corresponding CA certificate.

9. An HTTPS uninstallation device, characterized in that: Applied to a high-defense system, the high-defense system includes a traffic access switch, an L4 cleaning server, and an L7 cleaning server; the L7 cleaning server includes an HTTPS proxy module and a configuration maintenance module, and the configuration maintenance module maintains a pre-configured high-defense IP and a corresponding CA certificate; wherein the L4 cleaning server is used to provide traffic cleaning of layer 4 messages, and the L7 cleaning server is used to provide traffic cleaning of layer 7 messages; the device includes: The first forwarding unit, the traffic access switch forwards the HTTPS request message sent by the client to the L4 cleaning server; The second forwarding unit, the L4 cleaning server determines whether the high-defense system has the HTTPS offloading function enabled; if enabled, forwards the message to the traffic access switch, and the traffic access switch further forwards the message to the L7 cleaning server; Unloading unit, after the L7 cleaning server receives the message forwarded by the traffic access switch, the HTTPS proxy module matches the CA certificate maintained in the configuration maintenance module according to the SNI information of the message, and initializes the SSL engine based on the CA certificate; establishes an HTTPS handshake with the client, and decrypts the request data related to the HTTPS request sent by the client after a successful handshake through the SSL engine.

10. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 8.

Images