Method and system for blocking fragmentation based on SSL (Secure Socket Layer)

Abstract

The invention belongs to the technical field of computers, and discloses an SSL (Secure Socket Layer)-based fragment blocking method and system, and the method comprises the steps: shunting data interacted between a terminal and a server through a terminal mobile network egress router and a gateway general packet service support node (GGSN) connected with the mobile network egress router; the distributed data clienthello is subjected to recombination and analysis, and the server name of the server is obtained; according to the analyzed server name of the server, matching is carried out in a malicious website library; and if the matching is successful, sending a blocking data packet to the mobile network egress router so as to block the connection between the terminal and the server. According to the invention, a bypass blocking technology is adopted, and the phenomenon that the terminal still sends a request after the website is blocked, so that the traffic of the terminal is sharply increased and the network is blocked is avoided.

Description

Technical Field

[0001] The present invention belongs to but is not limited to the field of computer technology, and in particular relates to a method and system based on SSL fragmentation blocking. Background Art

[0002] The existing blocking methods are bad information monitoring systems, spam SMS and spam MMS systems. Spam SMS and spam MMS systems can only block spam SMS and spam MMS content and sending numbers. They are aimed at the spread of advertisements, illegal content, etc., and can play a certain role in mobile phone malware spread through spam SMS and spam MMS. This method of transmission accounts for a relatively small proportion. Bad information monitoring systems can block malware propagation URLs. By simply blocking URLs, it can only block mobile phone users from continuing to access. However, malicious programs on mobile terminals will continue to request these websites, resulting in a surge in access traffic, a large loss of user traffic, and even network congestion. Summary of the invention

[0003] In view of the problems existing in the prior art, the present invention provides a method and system based on SSL fragmentation blocking.

[0004] The present invention is implemented in this way: a method based on SSL fragmentation blocking, the method comprising:

[0005] S1: Diverting data that the terminal interacts with the server through the terminal mobile network egress router and the gateway general wireless packet service support node GGSN connected to the mobile network egress router;

[0006] S2: reorganize and parse the split data clienthello to obtain the servername of the server;

[0007] S3: matching the resolved servername of the server in a malicious website library; if the match is successful, sending a blocking data packet to the mobile network egress router to block the connection between the terminal and the server.

[0008] Further, the S2 specifically includes:

[0009] S21: Initialize SSL blocking rule base;

[0010] S22: Packet processing;

[0011] S23: Determine the SSL traffic and the number of online packets is less than 10. If false, execute step S22;

[0012] S24: hash the four-tuple and search for the reorganization node in the clienhello reorganization table. If found, clienthello needs to be reorganized.

[0013] S25: Determine whether the clienthello of the reassembled packet is complete. If not, execute S22;

[0014] S26: Extract the server_name field from clienthello.

[0015] Another object of the present invention is to provide a system based on SSL fragment blocking for implementing the method based on SSL fragment blocking, the system comprising:

[0016] A traffic distribution module, used for distributing data that the terminal interacts with the server through the terminal mobile network egress router and the gateway general wireless packet service support node GGSN connected to the mobile network egress router;

[0017] The reorganization and analysis module is connected to the diversion module, and reorganizes and analyzes the diverted data clienthello to obtain the servername of the server;

[0018] The blocking module is connected to the reorganization and analysis module, and matches the servername of the server parsed in the malicious website library; if the match is successful, a blocking data packet is sent to the mobile network egress router to block the connection between the terminal and the server.

[0019] Another object of the present invention is to provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method based on SSL fragment blocking.

[0020] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to perform the steps of the method based on SSL fragmentation blocking.

[0021] Another object of the present invention is to provide an information data processing terminal, which is used to implement the SSL fragmentation blocking system.

[0022] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0023] First, the present invention adopts bypass blocking technology to prevent the terminal from still sending requests after the website is blocked, thereby causing a surge in terminal traffic and network congestion.

[0024] This solution uses bypass blocking technology. It reorganizes clienthello to parse the domain name, calculates the hash value of the domain name, quickly matches the malicious domain name, sends TCP Reset packets to the matching flow, and sends blocking messages to the client server at the same time to block the malicious domain name, avoiding the mobile phone from continuously sending requests after the website is blocked, which will cause a surge in terminal traffic and network congestion.

[0025] Second, the technical solution of the present invention solves the technical problems that people have been eager to solve but have never been able to solve successfully:

[0026] Many existing illegal websites transmit clienthello packets during TLS authentication to evade registration detection, resulting in a low blocking success rate and limited blocking effect.

[0027] In the solution of the embodiment of the present invention, the fragmented clienthello is quickly reorganized, the domain name is extracted from the clienthello, and then the domain name is matched with the malicious domain name rule library, and the domain name is bidirectionally blocked if matched.

[0028] Third, the SSL fragmentation blocking method achieves real-time blocking and security protection of malicious communications through the following steps:

[0029] 1. Data diversion: In network communication, the terminal device interacts with the server through the mobile network egress router. In order to monitor and process these communication flows, the system first diverts the terminal's data flow at the mobile network egress router and the connected gateway (such as GGSN). The main purpose of this process is to intercept and divert the communication data between the terminal and the server for subsequent detailed analysis and processing.

[0030] 2. ClientHello reassembly and parsing: In the diverted communication data, the system pays special attention to the ClientHello message in the SSL / TLS handshake process. The ClientHello message is the initial request sent by the client when establishing an SSL / TLS connection, and contains a lot of key information, such as supported encryption algorithms, session ID, etc. By reassembling and parsing the ClientHello message, the system can extract important fields, especially the server name (servername), which is crucial for subsequent security detection.

[0031] 3. Server name matching: The parsed server name is matched with the entries in the system's pre-set malicious website library. The malicious website library contains information about some known malicious or unsafe websites. By comparing the server name, the system can determine whether the terminal is trying to communicate with a malicious server. If the server name is found to exist in the malicious website library, it indicates that the terminal is trying to access an unsafe website.

[0032] 4. Blocking communication: After confirming that the server name matches the malicious website library, the system will immediately generate and send a blocking data packet to the mobile network egress router. The purpose of this data packet is to quickly interrupt the SSL connection between the terminal and the server, thereby preventing the terminal from continuing to communicate with the malicious server. Through this real-time blocking mechanism, the system can effectively prevent potential harm to terminal devices and users caused by malicious websites.

[0033] This technical solution has made significant technological progress in improving terminal security by real-time monitoring and blocking insecure SSL connections, solving the problem of difficulty in effectively identifying and blocking malicious communications in existing technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a flow chart of a method based on SSL fragment blocking provided by an embodiment of the present invention;

[0035] Figure 2 The embodiment of the present invention provides a flowchart of a method for reorganizing and parsing the split data clienthello to obtain the servername of the server;

[0036] Figure 3 It is a system structure diagram based on SSL fragment blocking provided by an embodiment of the present invention;

[0037] In the figure: 1. Diversion module; 2. Recombination and analysis module; 3. Blocking module. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0039] like Figure 1 As shown, an embodiment of the present invention provides a method based on SSL fragment blocking, the method comprising:

[0040] S1: Diverting data that the terminal interacts with the server through the terminal mobile network egress router and the gateway general wireless packet service support node GGSN connected to the mobile network egress router;

[0041] S2: reorganize and parse the split data clienthello to obtain the servername of the server;

[0042] S3: matching the resolved servername of the server in a malicious website library; if the match is successful, sending a blocking data packet to the mobile network egress router to block the connection between the terminal and the server.

[0043] The working principle of this SSL fragment blocking method includes the following four steps:

[0044] 1. Data diversion: In the network environment, the terminal device communicates with the server through the terminal mobile network egress router. In order to monitor and control these communication flows, the terminal data flow is first diverted through the mobile network egress router and the connected gateway general radio packet service support node (GGSN). The purpose of this step is to intercept and divert the communication data between the terminal and the server for subsequent analysis and processing.

[0045] 2. ClientHello reassembly and parsing: Among the diverted data, the focus is on the ClientHello message in the SSL / TLS handshake process. ClientHello is part of the SSL / TLS protocol and contains the initial information when the client initiates a connection. By reassembling and parsing the ClientHello message, the system can extract important fields, such as the server name, which is crucial for subsequent security testing.

[0046] 3. Server name matching: The parsed server name (servername) will be matched with the pre-set malicious website library. The malicious website library contains some known unsafe or illegal website information. By matching the server name, the system can determine whether the terminal is trying to communicate with a malicious server. If the server name is found to have a match in the malicious website library, it means that the terminal is trying to access an unsafe or malicious website.

[0047] 4. Blocking communication: Once a malicious website is matched successfully, the system will generate and send a blocking data packet to the mobile network egress router. The function of this data packet is to immediately block the SSL connection between the terminal and the server, thereby preventing the terminal from continuing to communicate with the malicious server. This blocking mechanism effectively protects the terminal device and its users from malicious websites by intervening in communication traffic in real time.

[0048] like Figure 2 As shown, the S2 specifically includes:

[0049] S21: Initialize SSL blocking rule base;

[0050] S22: Packet processing;

[0051] S23: Determine the SSL traffic and the number of online packets is less than 10. If false, execute step S22;

[0052] S24: hash the four-tuple and search for the reorganization node in the clienhello reorganization table. If found, clienthello needs to be reorganized.

[0053] S25: Determine whether the clienthello of the reassembled packet is complete. If not, execute S22;

[0054] S26: Extract the server_name field from clienthello.

[0055] like Figure 3 As shown, an embodiment of the present invention provides a system based on SSL fragment blocking for implementing the method based on SSL fragment blocking, the system comprising:

[0056] A traffic distribution module 1 is used to distribute data that a terminal interacts with a server through a terminal mobile network egress router and a gateway general wireless packet service support node GGSN connected to the mobile network egress router;

[0057] The reorganization and analysis module 2 is connected to the diversion module 1, and reorganizes and analyzes the diverted data clienthello to obtain the servername of the server;

[0058] The blocking module 3 is connected to the reorganization and analysis module 2, and matches the servername of the server parsed in the malicious website library; if the match is successful, a blocking data packet is sent to the mobile network egress router to block the connection between the terminal and the server.

[0059] An embodiment of the present invention provides a computer device, which includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the processor executes the steps of the method based on SSL fragmentation blocking.

[0060] An embodiment of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of the method based on SSL fragmentation blocking.

[0061] An embodiment of the present invention provides an information data processing terminal, which is used to implement the SSL fragmentation blocking system.

[0062] Embodiment 1: Mobile network communication security protection method based on SSL fragmentation blocking

[0063] In a mobile network environment, the user's mobile terminal device communicates with the Internet server through the mobile network exit router. To ensure communication security, the system first sets up a diversion module between the mobile network exit router and the GGSN (General Radio Packet Service Support Node) to divert the communication data between the user and the server. The system focuses on monitoring the ClientHello message during the SSL / TLS handshake process. By extracting the server name (servername) field in the ClientHello message and matching it with the name in the preset malicious website library, if a match is found, the system immediately generates and sends a blocking data packet to prevent the communication between the mobile terminal and the server, thereby ensuring the user's network security.

[0064] Example 2: Enterprise intranet security protection method based on SSL fragmentation blocking

[0065] In the enterprise's internal network, all employees' computers communicate with external servers through the intranet gateway. In order to prevent employees from accidentally accessing malicious websites, the system installs a diversion device at the intranet gateway to monitor and divert all data flows in and out of the intranet. The system parses the ClientHello message in the SSL / TLS handshake phase in real time, extracts the server name field, and compares it with the enterprise's customized blacklist. If it is found that an employee's computer is trying to access a server on the blacklist, the system will immediately issue a blocking command to terminate the access request to ensure the security of the enterprise's intranet.

[0066] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0067] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A method based on SSL fragmentation blocking, characterized in that: The method includes: S1: Diverting data that the terminal interacts with the server through the terminal mobile network egress router and the gateway general wireless packet service support node GGSN connected to the mobile network egress router; S2: reorganize and parse the split data clienthello to obtain the servername of the server; S3: matching the resolved servername of the server in a malicious website library; if the match is successful, sending a blocking data packet to the mobile network egress router to block the connection between the terminal and the server.

2. The method based on SSL fragment blocking according to claim 1, characterized in that: The S2 specifically includes: S21: Initialize SSL blocking rule base; S22: Packet processing; S23: Determine the SSL traffic and the number of online packets is less than 10. If false, execute step S22; S24: hash the four-tuple and search for the reorganization node in the clienhello reorganization table. If found, clienthello needs to be reorganized. S25: Determine whether the clienthello of the reassembled packet is complete. If not, execute S22; S26: Extract the server_name field from clienthello.

3. A system based on SSL fragment blocking for implementing the method based on SSL fragment blocking as described in any one of claims 1-2, characterized in that: The system includes: A traffic distribution module, used for distributing data that the terminal interacts with the server through the terminal mobile network egress router and the gateway general wireless packet service support node GGSN connected to the mobile network egress router; The reorganization and analysis module is connected to the diversion module, and reorganizes and analyzes the diverted data clienthello to obtain the servername of the server; The blocking module is connected to the reorganization and analysis module, and matches the servername of the server parsed in the malicious website library; if the match is successful, a blocking data packet is sent to the mobile network egress router to block the connection between the terminal and the server.

4. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method based on SSL fragmentation blocking as described in any one of claims 1 and 2.

5. A computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of the method based on SSL fragmentation blocking as described in any one of claims 1 and 2.

6. An information data processing terminal, characterized in that: The information data processing terminal is used to implement the system based on SSL fragmentation blocking as described in claim 3.

7. A mobile network communication security protection method based on SSL fragmentation blocking, characterized in that: The following steps are involved: Divert the communication data between the terminal device and the server through the mobile network egress router and GGSN; Reassemble and parse the ClientHello message in the diverted SSL / TLS handshake message to extract the server name field; Match the extracted server names with the names in the malicious website library; If the match is successful, a blocking data packet is generated and sent to the mobile network egress router to prevent the SSL connection between the terminal device and the server.

Images