Intrusion detection method and device and storage medium

Abstract

An intrusion detection method and device and a storage medium are suitable for the technical field of network security, and are used for improving the network intrusion detection capability and solving the problem of lack of defense capability for network attacks. The method comprises the steps that the terminal equipment obtains key indication information used for decrypting encrypted session files transmitted in the session process when a client side and a server carry out session every time, and the key indication information corresponding to the encrypted session files transmitted in different session processes is different; and the terminal equipment sends the key indication information acquired each time to gateway equipment, so that the gateway equipment generates a decryption key based on the received key indication information, decrypts a corresponding encrypted session file based on the decryption key, and performs intrusion detection on the decrypted session file.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an intrusion detection method, device and storage medium. Background Art

[0002] With the development of computer software technology and network technology, network security issues have become increasingly prominent. In order to ensure the security and privacy of data transmission, more and more network traffic uses Secure Sockets Layer (SSL) and Transport Layer Security (TLS) to encrypt traffic. However, with the widespread use of encryption protocols, it also brings new challenges to network security. For example, there are often security incidents such as attackers using encryption protocols to transmit malware, hide attack activities, and steal confidential data. If security incidents are not discovered and handled in a timely manner, serious consequences will occur.

[0003] Therefore, how to better improve the intrusion detection capability for this type of encrypted traffic is a technical problem that needs to be solved urgently. Summary of the invention

[0004] The embodiments of the present application provide an intrusion detection method, device and storage medium to solve the problem that the prior art lacks the ability to defend against network attacks.

[0005] In a first aspect, an embodiment of the present application provides an intrusion detection method, the method comprising:

[0006] The terminal device obtains key indication information for decrypting encrypted session files transmitted during each conversation between the client and the server. The key indication information corresponding to the encrypted session files transmitted during different conversations is different. The terminal device sends the key indication information obtained each time to the gateway device, so that the gateway device generates a decryption key based on the received key indication information, decrypts the corresponding encrypted session file based on the decryption key, and performs intrusion detection on the decrypted session file.

[0007] In the above method, the client and the server of the embodiment of the present application use different encryption and decryption keys to interact with the session files each time they have a conversation. The terminal product obtains the indication information of the encryption and decryption keys during each conversation, and synchronously sends the key indication information to the gateway products such as the network intrusion detection system. After receiving the key indication information sent by the terminal, the network intrusion detection system decrypts the encrypted session file in real time and performs deep packet inspection, which expands the detection range of the gateway product and improves the accuracy of the alarm. Among them, since only the encryption and decryption keys corresponding to the session file of the handshake interaction between the client and the server are obtained during the decryption process, even if the key indication information is eavesdropped, the subsequent encrypted traffic is still kept confidential and does not affect the security of the subsequent encrypted traffic, thereby ensuring the security of the ciphertext to the greatest extent, and the whole process does not require client or server-side interactive configuration, simplifying the deployment process.

[0008] In some optional implementation manners, the terminal device obtains key indication information for decrypting an encrypted session file transmitted during each session between the client and the server, including:

[0009] Each time the client initiates a session request to the server, the terminal device obtains a client random number generated when the client and the server perform a handshake based on each session request; the terminal device determines key indication information for decrypting the corresponding encrypted session file based on the client random number.

[0010] The above method, the embodiment of the present application obtains the random number generated by the handshake when the client and the server have a conversation each time through the terminal product, and based on the random number, obtains the key indication information for encrypting and decrypting the session file of the interaction process between the client and the server after this handshake. Due to the uncertainty of the random number, the security of the ciphertext is ensured to the greatest extent, and the whole process does not require client or server interaction configuration, which simplifies the deployment process.

[0011] In some optional implementations, the terminal device determines key indication information for decrypting the corresponding encrypted session file based on the client random number, including:

[0012] The terminal device determines the key indication information for decrypting the corresponding encrypted session file based on the preset master key and the client random number generated in each session; or, the terminal device determines the key indication information for decrypting the corresponding encrypted session file based on the preset master key, the client random number generated in each session, and the extended key; or, the terminal device determines the key indication information for decrypting the corresponding encrypted session file based on the client random number generated in each session, and the extended key;

[0013] Among them, the master key is a fixed key, and the extended key is determined from multiple keys included in a preset key pool based on the identification information carried during the session and the correspondence between the identification information and the key information; or the extended key is determined based on the correspondence between the session type or session service and the key information.

[0014] In some optional implementation manners, the terminal device obtains key indication information for decrypting an encrypted session file transmitted during each session between the client and the server, including:

[0015] The terminal device obtains the SSLKEYLOG file for each conversation between the client and the server; wherein the SSLKEYLOG file includes key indication information for decrypting the encrypted session files transmitted during the conversation.

[0016] Exemplarily, the SSLKEYLOG file described in the embodiment of the present application may be a key file used to record the key used in the SSL / TLS session.

[0017] In a second aspect, an embodiment of the present application provides an intrusion detection method, the method comprising:

[0018] The gateway device obtains key indication information sent by the terminal device for decrypting the encrypted session files transmitted during the session, and the key indication information corresponding to the encrypted session files transmitted during different session processes is different; the gateway device generates a decryption key based on the received key indication information; the gateway device decrypts the corresponding encrypted session file based on the decryption key, and performs intrusion detection on the decrypted session file.

[0019] In the above method, the client and the server of the embodiment of the present application use different encryption and decryption keys to interact with the session files each time they have a conversation. The terminal product obtains the indication information of the encryption and decryption keys during each conversation, and synchronously sends the key indication information to the gateway products such as the network intrusion detection system. After receiving the key indication information sent by the terminal, the network intrusion detection system decrypts the encrypted session file in real time and performs deep packet inspection, which expands the detection range of the gateway product and improves the accuracy of the alarm. Among them, since only the encryption and decryption keys corresponding to the session file of the handshake interaction between the client and the server are obtained during the decryption process, even if the key indication information is eavesdropped, the subsequent encrypted traffic is still kept confidential and does not affect the security of the subsequent encrypted traffic, thereby ensuring the security of the ciphertext to the greatest extent, and the whole process does not require client or server-side interactive configuration, simplifying the deployment process.

[0020] In some optional implementations, the gateway device obtains key indication information sent by the terminal device for decrypting an encrypted session file transmitted during a session, including:

[0021] The gateway device obtains the SSLKEYLOG file sent by the terminal device for each conversation between the client and the server; wherein the SSLKEYLOG file includes the client random number generated when the client and the server shake hands based on the corresponding session request.

[0022] In some optional implementations, the method further comprises:

[0023] The gateway device determines the key indication information corresponding to each encrypted traffic file and used to generate the decryption session key according to the obtained correspondence between the encrypted session file identifier and the key indication information identifier.

[0024] In some optional implementations, the method further comprises:

[0025] During each session, the key indication information received by the gateway device is used to decrypt the encrypted session file generated in the next session; or, during each session, the key indication information received by the gateway device is used to decrypt the encrypted session file generated in the current session.

[0026] In some optional implementations, the method further comprises:

[0027] The key indication information received by the gateway device is the key indication information encrypted by the terminal device, and the gateway device decrypts the key indication information according to the decryption key corresponding to the key indication information of the terminal device protocol in advance.

[0028] In a third aspect, an embodiment of the present application provides an intrusion detection device, the device comprising:

[0029] An acquisition module, used for acquiring key indication information for decrypting encrypted session files transmitted during each session between the client and the server, wherein the key indication information corresponding to the encrypted session files transmitted during different sessions is different;

[0030] The processing module is used to send the key indication information obtained each time to the gateway device, so that the gateway device generates a decryption key based on the received key indication information, decrypts the corresponding encrypted session file based on the decryption key, and performs intrusion detection on the decrypted session file.

[0031] In some optional implementation manners, the processing module is specifically used for:

[0032] After the client initiates a session request to the server each time, the client obtains a client random number generated when the client and the server perform a handshake based on each session request; and determines key indication information for decrypting the corresponding encrypted session file based on the client random number.

[0033] In some optional implementation manners, the processing module is specifically used for:

[0034] Determine the key indication information for decrypting the corresponding encrypted session file based on the preset master key and the client random number generated for each session; or, determine the key indication information for decrypting the corresponding encrypted session file based on the preset master key, the client random number generated for each session, and the extended key; or, determine the key indication information for decrypting the corresponding encrypted session file based on the client random number generated for each session, and the extended key;

[0035] Among them, the master key is a fixed key, and the extended key is determined from multiple keys included in a preset key pool based on the identification information carried during the session and the correspondence between the identification information and the key information; or the extended key is determined based on the correspondence between the session type or session service and the key information.

[0036] In some optional implementation manners, the acquisition module is specifically used to:

[0037] Obtain the SSLKEYLOG file for each conversation between the client and the server; wherein the SSLKEYLOG file includes key indication information for decrypting the encrypted session files transmitted during the conversation.

[0038] In a fourth aspect, an embodiment of the present application provides an intrusion detection device, the device comprising:

[0039] An acquisition module, used to acquire key indication information sent by a terminal device for decrypting an encrypted session file transmitted during a session, wherein the key indication information corresponding to the encrypted session files transmitted during different sessions is different;

[0040] The processing module is used to generate a decryption key based on the received key indication information; decrypt the corresponding encrypted session file based on the decryption key, and perform intrusion detection on the decrypted session file.

[0041] In some optional implementation manners, the acquisition module is specifically used to:

[0042] Obtain the SSLKEYLOG file for each conversation between the client and the server, which is sent by the terminal device; wherein the SSLKEYLOG file includes a client random number generated when the client and the server shake hands based on a corresponding session request.

[0043] In some optional implementation manners, the processing module is specifically used for:

[0044] According to the obtained correspondence between the encrypted session file identifier and the key indication information identifier, the key indication information corresponding to each encrypted traffic file and used to generate the decryption session key is determined.

[0045] In some optional implementation manners, the processing module is further used for:

[0046] During each session, the received key indication information is used to decrypt the encrypted session file generated in the next session; or, during each session, the received key indication information is used to decrypt the encrypted session file generated in the current session.

[0047] In some optional implementation manners, the processing module is further used for:

[0048] The received key indication information is the key indication information encrypted by the terminal device, and the key indication information is decrypted according to the decryption key corresponding to the key indication information of the terminal device protocol in advance.

[0049] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes any intrusion detection method described in the first aspect; or, the processor executes any intrusion detection method described in the second aspect.

[0050] In a sixth aspect, an embodiment of the present application provides a chip system, comprising: a processor and an interface, the processor being used to call and execute a computer program from the interface, when the processor executes the computer program, it can implement the method described in the above-mentioned first aspect or any possible design of the first aspect; or implement the method described in the above-mentioned second aspect or any possible design of the second aspect.

[0051] In the seventh aspect, an embodiment of the present application provides a computer-readable storage medium, which has a computer program for executing the method described in the above-mentioned first aspect or any possible design of the first aspect; or a computer program for executing the method described in the above-mentioned second aspect or any possible design of the second aspect.

[0052] In an eighth aspect, an embodiment of the present application further provides a computer program product, including a computer program. When the computer program is executed, it can implement the method described in the above-mentioned first aspect or any possible design of the first aspect; or it can implement the method described in the above-mentioned second aspect or any possible design of the second aspect.

[0053] The beneficial effects produced by any of the third to eighth aspects are the same as those of the first and second aspects. For details, please refer to the detailed introduction of the first and second aspects, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0055] Figure 1 A schematic diagram of an intrusion detection system architecture provided in an embodiment of the present application;

[0056] Figure 2 A schematic diagram of an intrusion detection method provided in an embodiment of the present application;

[0057] Figure 3 A schematic diagram of an operation scenario flow of an intrusion detection provided in an embodiment of the present application;

[0058] Figure 4 A schematic diagram of the structure of an intrusion detection device provided in an embodiment of the present application;

[0059] Figure 5 A schematic diagram of the structure of another intrusion detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] Some technical terms involved in this application are explained below.

[0061] 1) Encrypted traffic: refers to network traffic encrypted using Secure Sockets Layer or Transport Layer Security protocol.

[0062] 2) Intrusion Detection: It is a technology used to analyze and detect network traffic to identify potential intrusion activities.

[0063] 3) Vulnerability: A flaw in the specific implementation of hardware, software, or protocol or in system security policies that may allow an attacker to access or damage the system without authorization.

[0064] 4) Man-in-the-middle (MITM): Able to establish connections with both ends of network communication and exchange the received data, making both ends of the communication think that they are talking directly to the other party, but in fact the whole conversation is controlled by the middleman.

[0065] 5) Agent: A program written in accordance with a certain standard application program interface. It can only run on the system platform specified by the program (it may support multiple platforms at the same time) and cannot run independently from the specified platform.

[0066] 6) Hook: It is a technology that can replace a function of the target process with a custom function to execute.

[0067] In the embodiments of the present application, "at least one" refers to one or more, and "plurality" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can represent: a, b, c, a and b, a and c, b and c, or a, b and c, where each of a, b, c can be an element itself, or a set containing one or more elements.

[0068] In this application, "exemplary", "in some embodiments", "in other embodiments", etc. are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present concepts in a concrete way.

[0069] In this application, "of", "corresponding", "relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they express are consistent. In the embodiments of this application, communication and transmission can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they express are consistent. For example, transmission can include sending and / or receiving, which can be a noun or a verb.

[0070] It should be pointed out that the words "first", "second", etc. involved in the embodiments of the present application are only used for the purpose of distinguishing the description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying an order.

[0071] With the development of computer software technology and network technology, network security issues have become increasingly prominent. In order to ensure the security and privacy of data transmission, more and more network traffic uses Secure Sockets Layer (SSL) and Transport Layer Security (TLS) to encrypt traffic. However, with the widespread use of encryption protocols, new challenges have also been brought to network security. For example, common security incidents include but are not limited to viruses hidden in executable files downloaded by intranet users through encrypted traffic, or intranet users unknowingly visit malicious websites using HTTPS protocol, or unauthorized internal confidential information is leaked to the external network in the form of encrypted data transmission. In the face of security incidents such as attackers using encryption protocols to transmit malware, hide attack activities, and steal confidential data, if security incidents are not discovered and handled in a timely manner, serious consequences will occur.

[0072] Among them, network intrusion detection is currently a common means of detecting malicious and illegal traffic. The following is a brief description of the intrusion detection scheme in related technologies:

[0073] Currently, encrypted traffic detection is generally divided into ciphertext detection and decrypted plaintext detection. Among them, the method based on decrypted plaintext detection can be divided into two categories, one is decryption detection based on server certificates and private keys, and the other is decryption detection based on middleman agents.

[0074] Ciphertext detection in related technologies mainly refers to a detection method that detects and analyzes data in encrypted communications without first decrypting it. This ciphertext monitoring method mainly focuses on the characteristics and behaviors of encrypted messages, such as the length, frequency, size, protocol and other characteristics of the message. By analyzing the characteristics of these encrypted messages, based on the characteristic analysis results, possible malicious activities such as encrypted tunnels, encrypted proxies, and communications using specific encryption algorithms are detected. However, during the application of this ciphertext monitoring method, since it is impossible to directly view plaintext data, when performing intrusion detection based on ciphertext detection, it often cannot provide the same depth and accuracy as plaintext detection after decryption, and it is often difficult to effectively distinguish normal traffic from malicious traffic.

[0075] The server certificate and private key decryption detection in the related technology mainly refers to the decryption and related security detection of SSL / TLS encrypted communications by deploying the corresponding certificates and private keys on the server side. Among them, the private key is the key to decryption in the solution based on the server certificate and private key, and its management and security are crucial. If the private key is leaked or improperly used in actual application, it may cause serious security problems. For example, when the intrusion detection system is breached or subjected to physical access, the private key can be easily stolen, resulting in the leakage of sensitive information.

[0076] Man-in-the-middle proxy decryption detection in related technologies mainly refers to the method of inserting a man-in-the-middle proxy on the communication link to intercept, decrypt and inspect the encrypted traffic transmitted through the network. Among them, the man-in-the-middle proxy, as a transit node for network traffic, may become the target of attackers in practical applications. If the proxy server has vulnerabilities or is not adequately protected, it may be exploited by hackers to conduct man-in-the-middle attacks, thereby destroying the confidentiality and integrity of communications. When implementing man-in-the-middle proxy decryption and detection, effective certificate management is also required. Incorrect certificate configuration may also lead to security vulnerabilities, and the management and update of certificates will also increase the complexity of system management.

[0077] From the above content, it can be seen that the relevant technology cannot achieve efficient and accurate intrusion detection for encrypted traffic. For example, the algorithm-based encrypted traffic detection in the relevant technology has low accuracy and it is difficult to effectively distinguish normal traffic from malicious traffic; based on the server certificate and private key decryption detection method, there is a great security risk after the private key sensitive file is leaked; the method of obtaining decrypted traffic and then detecting it through a middleman proxy requires user interaction and the deployment effect is not good.

[0078] To solve this problem, the embodiments of the present application provide an intrusion detection method and related devices. When performing intrusion detection, the encrypted traffic of the communicating parties can be decrypted and detected without the need for server or client interactive configuration, thereby providing a more secure and reliable detection solution suitable for encrypted traffic intrusion detection, thereby improving the overall performance of the detection system.

[0079] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments.

[0080] Figure 1 A possible system architecture diagram provided by an embodiment of the present application is exemplarily shown as follows: Figure 1 As shown, the system architecture includes a terminal device 100, a client 200 and a gateway device 300, or may also include other devices, which are not limited here.

[0081] Among them, the terminal device 100 is software or a chip or other form of product that has the function of executing the intrusion detection method of the embodiment of the present application, and is not limited here. For example, in the embodiment of the present application, the terminal device 100 can be a software product deployed on the client.

[0082] The client 200 can be any device with communication capabilities, and in particular, it can be a device that has certain requirements for network security. In some examples, the device may include, but is not limited to: intelligent transportation equipment, such as cars, ships, drones, trains, vans, trucks, flying cars, etc.; smart home devices, such as televisions, sweeping robots, smart desk lamps, audio systems, smart lighting systems, electrical control systems, home background music, home theater systems, intercom systems, video surveillance, etc.; intelligent manufacturing equipment, such as robots, industrial equipment, industrial computers, intelligent logistics, smart factories, etc. Alternatively, the device may also be a computer device, such as a desktop computer, a personal computer, a server, etc. It should also be understood that the device may also be a portable electronic device, such as a mobile phone, a tablet computer, a PDA, headphones, speakers, wearable devices (such as smart watches), vehicle-mounted devices, virtual reality devices, augmented reality devices, etc. Examples of portable electronic devices include, but are not limited to, devices equipped with Or a portable electronic device with other operating systems. The portable electronic device may also be a laptop computer (Laptop) with a touch-sensitive surface (eg, a touch panel).

[0083] The gateway device 300 is also called an internetwork connector or a protocol converter. It is a computer system or device that provides data conversion services between multiple networks. It can be a LAN / host gateway, LAN / LAN gateway, Internet / LAN gateway, data gateway, application gateway, security gateway, etc.

[0084] The system architecture may also include an intrusion detection system (IDS) 400 for identifying attack traffic. The intrusion detection device may be any device with algorithm development and verification capabilities, such as an intrusion detection model server. The intrusion detection system 400 may be deployed in the gateway device 300, or established separately, etc., which is not limited here.

[0085] The system architecture may also include a server 500, which is any device with data processing capabilities, such as a server or a server cluster composed of multiple servers, or a chip or circuit, such as a chip or circuit set in a server or a server cluster. In a specific example, the server 500 may be a cloud server, which may be connected to the client 200 wirelessly.

[0086] The system architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art may know that with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems. For example, the terminal device in the embodiments of the present application may be the same device as the client device. For another example, a terminal device in the embodiments of the present application may correspond to multiple client devices. For another example, a terminal device in the embodiments of the present application corresponds to one client device. That is, the system architecture in the embodiments of the present application may also include other devices, or some devices in the system architecture in the embodiments of the present application may be combined, which is not limited here.

[0087] In the embodiments of the present application, the interaction between a terminal device and a gateway device is taken as an example for explanation. The method provided in the embodiments of the present application can also be applied to the interaction between other execution entities, such as the interaction between a chip or module of a terminal device and a chip or module in a gateway device. When the execution entity is a chip or module, reference can be made to the description in the embodiments of the present application and no further details will be given here.

[0088] Based on the above Figure 1 The system architecture shown and the contents of the above-mentioned related technical introduction, an intrusion detection method is provided in the embodiment of the present application, and the execution subject of the method is introduced by taking the terminal device and the gateway device as examples. In addition, it should be understood that the terminal device can also be replaced by a communication device with terminal device functions or a chip, unit or module inside a communication device with terminal device functions. The gateway device can also be replaced by a communication device with gateway device functions or a chip, unit or module inside a communication device with gateway device functions.

[0089] Figure 2 The following is a possible flow chart of an intrusion detection method provided by an embodiment of the present application. Figure 2 As shown, the method includes:

[0090] Step 201, the terminal device obtains key indication information for decrypting the encrypted session files transmitted during each session between the client and the server, and the key indication information corresponding to the encrypted session files transmitted during different sessions is different.

[0091] As an example, in an embodiment of the present application, the key for encrypting and decrypting the session files transmitted during each session can be generated based on a random number. For example, the session file can be encrypted using an encryption key generated based on a random number generated by a handshake between the client and the server during each session, and the encrypted session file can be decrypted using a decryption key generated based on the random number.

[0092] Exemplarily, the random number may include a client random number generated by handshaking between the client and the server for each session, or the random number may include a server random number generated by handshaking between the client and the server for each session, or the random number may include a client random number and a server random number generated by handshaking between the client and the server for each session.

[0093] Furthermore, the indication information described in the embodiment of the present application may also include a master key and / or an extended key for generating the session key, wherein the master key described in the embodiment of the present application may be a fixed key, and the extended key may be determined from multiple keys included in a preset key pool based on the identification information carried during the session and the correspondence between the identification information and the key information; or the extended key is determined based on the correspondence between the session type or session service and the key information.

[0094] Exemplarily, the terminal device described in the embodiment of the present application can determine the key indication information for decrypting the corresponding encrypted session file based on a preset master key and a client random number generated for each session.

[0095] Exemplarily, the terminal device may determine key indication information for decrypting a corresponding encrypted session file based on a preset master key, a client random number generated for each session, and an extended key.

[0096] Exemplarily, the terminal device may determine key indication information for decrypting a corresponding encrypted session file based on a client random number generated for each session and an extended key.

[0097] As an example, the terminal device described in the embodiment of the present application obtains the indication information by obtaining the SSLKEYLOG file of each conversation between the client and the server, wherein the SSLKEYLOG file includes the indication information.

[0098] Step 202: The terminal device sends the key indication information obtained each time to the gateway device.

[0099] Step 203: The gateway device obtains key indication information sent by the terminal device for decrypting the encrypted session file transmitted during the session.

[0100] Step 204: The gateway device generates a decryption key based on the received key indication information.

[0101] Step 205: the gateway device decrypts the corresponding encrypted session file based on the decryption key, and performs intrusion detection on the decrypted session file.

[0102] As an example, the gateway device in the embodiment of the present application determines the indication information for generating a decryption session key corresponding to each encrypted traffic file based on the correspondence between the acquired encrypted session file identifier and the indication information identifier.

[0103] As an example, during each session in an embodiment of the present application, the indication information received by the gateway device is used to decrypt the encrypted session file generated in the next session; or, during each session, the indication information received by the gateway device is used to decrypt the encrypted session file generated in the current session.

[0104] Furthermore, in order to better improve security, the indication information received by the gateway device is the indication information encrypted by the terminal device, and the gateway device decrypts the indication information according to the decryption key corresponding to the indication information of the terminal device protocol in advance.

[0105] Through the intrusion detection method provided by the embodiment of the present application, the client and the server of the embodiment of the present application use different encryption and decryption keys to interact with the session files each time they have a conversation. The terminal product obtains the indication information of the encryption and decryption keys during each conversation, and synchronously sends the key indication information to the gateway products such as the network intrusion detection system. After receiving the key indication information sent by the terminal, the network intrusion detection system decrypts the encrypted session file in real time and performs deep packet inspection, which expands the detection range of the gateway product and improves the accuracy of the alarm. Among them, since only the encryption and decryption keys corresponding to the session file of the handshake interaction between the client and the server are obtained during the decryption process, even if the key indication information is eavesdropped, the subsequent encrypted traffic is still kept confidential, and the security of the subsequent encrypted traffic is not affected, thereby ensuring the security of the ciphertext to the greatest extent, and the whole process does not require client or server-side interactive configuration, simplifying the deployment process.

[0106] Further, in order to better introduce the embodiments of the present application, an intrusion detection scenario is selected for illustration. It should be noted that the following examples in the embodiments of the present application are only used as examples and do not constitute a limitation on the embodiments of the present application:

[0107] Exemplarily, it is assumed that the embodiment of the present application includes at least two devices in the intrusion detection scenario, namely a client and a gateway device, wherein the client may be deployed with the above-mentioned terminal device or terminal software for executing the intrusion detection method of the present application, and the following is introduced based on different devices:

[0108] Terminal devices in intrusion detection scenarios:

[0109] As an example, in an embodiment of the present application, the terminal device can obtain indication information for generating a session key during each conversation between the terminal device (client) and the server, and the session key can include an encryption key for encrypting a session file and a decryption key for decrypting the encrypted session file, and send the indication information to the gateway device, so that the gateway device can obtain the decryption key corresponding to the encrypted session file based on the indication information, and decrypt the encrypted session file (also called a traffic file) for interaction between the client and the server according to the decryption key, and perform intrusion detection on the decrypted session file.

[0110] Exemplarily, the indication information in the embodiment of the present application may be a unique random number generated by the TLS handshake between the client and the server for each session. For example, the indication information may be the ClientRandom and ServerRandom generated by the TLS handshake for each session.

[0111] Exemplarily, the indication information in the embodiments of the present application may be a unique random number and a master key (also referred to as a prekey) generated by the TLS handshake during each session between the client and the server. For example, the indication information is the ClientRandom, ServerRandom, and the master key generated by the TLS handshake for each session; for another example, the indication information is the ClientRandom and the master key generated by the TLS handshake for each session; for another example, the indication information is the ServerRandom and the master key generated by the TLS handshake for each session.

[0112] As an example, in this scenario, the terminal device can hook the client and obtain the first file of the client application encrypted traffic, wherein the first file includes instruction information for generating a session key. Assume that the name of the first file is SSLKEYLOG file.

[0113] The SSLKEYLOG file may include but is not limited to the following contents:

[0114] File information 1: key tag used to describe the instruction information, which can be expressed as <label>.

[0115] File information 2: Specific key information, which can be expressed as <secret>.

[0116] As an example, the embodiment of the present application can obtain key indication information for decrypting an encrypted session file transmitted during a session based on the SSLKEYLOG file in the following manner:

[0117] For example, the embodiment of the present application may use the file information 1 in combination with the file information 2, wherein: <secret>The key information can be obtained from the following <label>Add in the <label>The keys in the session key may include a master key for generating a session key, and may also include other extended keys for generating a session key, so that <label>The key information in the file and the random number in the file information 3 are combined to obtain the key indication information, and the encryption and decryption keys are generated based on the key indication information.

[0118] As an example, the file information 1 may include labels of multiple key information. In this case, the specific key information of the label may be determined according to the corresponding key label information.

[0119] Exemplarily, the key information included in the file information 1 in the embodiment of the present application may include but is not limited to one or more of the following contents, which may be specifically set according to actual conditions and are not limited here:

[0120] Key information 1: RSA

[0121] Exemplarily, the RSA in the embodiment of the present application may be a 48-byte master key (also referred to as a pre-key) for an encrypted traffic file, which may be encoded as 96 hexadecimal characters.

[0122] Key information 2: CLIENT_RANDOM

[0123] Exemplarily, CLIENT_RANDOM in the embodiment of the present application can be a 48-byte master key (also called a pre-key) of the encrypted traffic file, which can be encoded as 96 hexadecimal characters.

[0124] Key information 3: CLIENT_EARLY_TRAFFIC_SECRET

[0125] Exemplarily, CLIENT_EARLY_TRAFFIC_SECRET in the embodiment of the present application may be a hexadecimal-encoded early traffic key of the client.

[0126] Key information 4: CLIENT_HANDSHAKE_TRAFFIC_SECRET

[0127] Exemplarily, CLIENT_HANDSHAKE_TRAFFIC_SECRET in the embodiment of the present application may be a hexadecimal-encoded handshake traffic key of the client.

[0128] Key information 5: SERVER_HANDSHAKE_TRAFFIC_SECRET

[0129] Exemplarily, in the embodiment of the present application, SERVER_HANDSHAKE_TRAFFIC_SECRET may be a hexadecimal-encoded handshake traffic key on the server side.

[0130] Key information 6: CLIENT_TRAFFIC_SECRET_0

[0131] Exemplarily, CLIENT_TRAFFIC_SECRET_0 in the embodiment of the present application may be the first hexadecimal-encoded application traffic key of the client.

[0132] Key information 7: SERVER_TRAFFIC_SECRET_0

[0133] Exemplarily, SERVER_TRAFFIC_SECRET_0 in the embodiment of the present application may be the first hexadecimal-encoded application traffic key on the server side.

[0134] Key information 8: EARLY_EXPORTER_SECRET

[0135] Exemplarily, EARLY_EXPORTER_SECRET in the embodiment of the present application may be a hexadecimal-encoded early exporter key.

[0136] Key information 9: EXPORTER_SECRET

[0137] Exemplarily, EXPORTER_SECRET in the embodiment of the present application may be a hexadecimal-encoded exporter key.

[0138] Exemplarily, keys 1 to 2 in the above key information may be examples of master keys for assisting in generating decryption keys for corresponding session files, and keys 3 to 9 in the above key information may be examples of extended keys for assisting in generating decryption keys for corresponding session files. The decryption keys generated by combining the master key, the extended key and the random number are less likely to be cracked and have higher security.

[0139] It should be noted that the above description of the master key and the extended key in the embodiment of the present application is only for illustration and does not constitute a limitation on the embodiment of the present application. The embodiment of the present application can set the master key and the extended key according to actual conditions. For example, the above extended key example can also be set as the master key, which is not limited here.

[0140] As an example, the embodiment of the present application can determine the extended key corresponding to the decryption key used to generate the decryption key in a variety of ways, which are not limited to the following:

[0141] Determination method 1: Determine the extended key corresponding to the decryption key used to generate the session based on the correspondence between the session type or session service and the key information.

[0142] Exemplarily, assuming that session type 1 corresponds to extended key 1, session type 2 corresponds to extended key 2, and session type 3 corresponds to extended key 3, when the client initiates a session request to the server, the terminal device can determine that the corresponding extended key is extended key 1 based on the session type, for example, the session type is session type 1. Thus, the terminal device can generate a decryption key for the session file based on the random number generated during the handshake of the session request, the fixed master key, and the extended key 1 corresponding to the session request type.

[0143] Determination method 2: Based on the identification information carried during the session and the correspondence between the identification information and the key information, a corresponding extended key is determined from a plurality of keys included in a preset key pool.

[0144] Exemplarily, it is assumed that a preset key pool includes multiple keys, wherein identifier 1 corresponds to extended key 1 in the key pool, identifier 2 corresponds to extended key 2 in the key pool, and identifier 3 corresponds to extended key 3 in the key pool. When the client initiates a session request to the server, the session request may also carry identification information, such as identifier 1, and the terminal device may obtain the identification information carried in the session request, that is, obtain the identifier 1, and determine the corresponding extended key 1 from the key pool based on the identifier 1, so that the terminal device may generate a decryption key for the session file based on the random number generated during the handshake of the session request, the fixed master key, and the extended key 1 corresponding to the session request.

[0145] As an example, the specific application of the file information 1 for describing the file key in the embodiment of the present application is not limited to the following:

[0146] Application 1: The file information 1 is used to describe the key of the current encrypted file.

[0147] For example, the current gateway device obtains the first file of the encrypted traffic, and the first file includes the file information 1. At this time, the file information 1 is used to represent the key information of the first file of the encrypted traffic.

[0148] Application 2: The file information 1 is used to describe the key for subsequent encrypted files.

[0149] For example, the gateway device currently obtains the first file of the encrypted traffic, and the first file includes the file information 1. At this time, the file information 1 is used to represent the key information of the second file of the encrypted traffic received later.

[0150] The file information 1 may carry a file identifier corresponding to the decryption; or, by default, the next file received immediately after the first file of the encrypted traffic is received, for example, the second file of the encrypted traffic.

[0151] Application 3: The file information 1 is used to describe the key of the previously encrypted file.

[0152] For example, the gateway device currently obtains the first file of the encrypted traffic, and the first file includes the file information 1. At this time, the file information 1 is used to represent the key information of the second file of the encrypted traffic received previously.

[0153] The file information 1 may carry a file identifier corresponding to the decryption; or, by default, the file that was received immediately before the first file of the encrypted traffic, for example, the second file of the encrypted traffic.

[0154] File information 3: Client random value (ClientRandom).

[0155] Exemplarily, the file information 2 may include a 32-byte random value of a "Client Hello" message in a client TLS handshake message, encoded as 64 hexadecimal characters.

[0156] As an example, the SSLKEYLOG file format described in the embodiment of the present application can be as follows:

[0157] <label> <space> <clientrandom> <space> <secret>

[0158] After the terminal device obtains the SSLKEYLOG file, it can obtain the key indication information (for example, the master key and the random number) from the file and send the master key and the random number to the gateway device. Alternatively, the terminal device can directly send the SSLKEYLOG file to the gateway device.

[0159] Gateway device in intrusion detection scenario:

[0160] In this scenario, the gateway device in the embodiment of the present application can be responsible for encrypted traffic caching, decryption and intrusion detection.

[0161] As an example, in an embodiment of the present application, the terminal device can synchronize the SSLKEYLOG file to the gateway device. The gateway device obtains the decryption key of the encrypted traffic file based on the information in the SSLKEYLOG file, and performs decryption and intrusion detection.

[0162] Exemplarily, in the embodiment of the present application, the above-mentioned terminal device can export the SSLKEYLOG file of the encrypted session and synchronize the SSLKEYLOG file to the gateway device by hooking the SSL / TLS, read, write and export functions of the client application.

[0163] Then, the gateway device can obtain the key indication information according to the client TLS handshake message in the SSLKEYLOG file, and generate a decryption key, such as a key block, for decrypting the encrypted session based on the key indication information according to the PRF function, thereby performing a decryption operation on the encrypted traffic file based on the key block.

[0164] For example, in each session, a unique ClientRandom and ServerRandom are generated based on the TLS handshake of each session. The gateway device can obtain the ClientRandom from the Client Hello data packet in the encrypted traffic file of the acquired session, and obtain the ServerRandom from the Server Hello data packet, so that the gateway device can generate a session key based on the ClientRandom and ServerRandom, and use the session key for decryption.

[0165] For another example, in each session, a unique ClientRandom and ServerRandom are generated based on the TLS handshake of each session. The gateway device can obtain the ClientRandom from the Client Hello data packet in the encrypted traffic file of the acquired session, obtain the ServerRandom from the Server Hello data packet, and obtain the master key from other data packets in the encrypted traffic file of the session, so that the gateway device can generate a session key based on the ClientRandom, ServerRandom and the master key, and use the session key for decryption.

[0166] For another example, in each session, a unique ClientRandom and ServerRandom are generated based on the TLS handshake of each session. The gateway device can obtain the ClientRandom from the Client Hello data packet in the encrypted traffic file of the session, and obtain the master key from other data packets in the encrypted traffic file of the session, so that the gateway device can generate a session key based on the ClientRandom and the master key, and use the session key for decryption.

[0167] As another example, in the embodiment of the present application, the gateway device may only receive the instruction information sent from the terminal device, that is, the terminal device only notifies the gateway device of the parameters for generating the session key by means of simple information, without sending the entire SSLKEYLOG file to the gateway device. Among them, the parameters for generating the key may include but are not limited to one or more of ClientRandom and Server Random.

[0168] For example, the ClientRandom in each session is different. In order to better ensure the security of intrusion detection, the ClientRandom in each session can be obtained in real time, so that even if there is a risk of leakage, it will not affect the security of the entire session.

[0169] As an example, in the embodiment of the present application, the gateway device can obtain the encrypted traffic file and the indication information separately, or can obtain the encrypted traffic file and the indication information synchronously.

[0170] As an example, in an embodiment of the present application, the gateway device can determine the indication information for generating a decryption session key corresponding to each encrypted traffic file based on the correspondence between the acquired encrypted traffic file identifier and the indication information identifier.

[0171] As an example, in order to better improve the security of intrusion detection, the indication information received by the gateway device in the embodiment of the present application may be the indication information encrypted by the terminal device, so that the gateway device decrypts the indication information according to the corresponding decryption key agreed upon or agreed with the terminal device in advance.

[0172] Further, in order to better introduce the embodiments of the present application, based on the above application scenarios, the embodiments of the present application provide the following Figure 3 The intrusion detection process steps shown are as follows:

[0173] Step S301: The terminal device hooks the client SSL / TLS function.

[0174] Step S302: The terminal device obtains the SSLKEYLOG file of the client.

[0175] Step S303: The terminal device synchronizes the SSLKEYLOG file to the gateway device.

[0176] Step S304: The gateway device generates a session key based on the SSLKEYLOG file.

[0177] Step S305: The gateway device decrypts the session according to the session key.

[0178] Step S306: After the gateway device determines that the session decryption is successful, it performs intrusion detection on the decrypted session.

[0179] The intrusion detection method provided by the embodiment of the present application provides a new encrypted traffic detection method, namely, a method for performing decryption detection by obtaining synchronous key information on the terminal side, which can decrypt and detect encrypted traffic without the interaction of the server or the client, thereby simplifying the deployment process and transmitting only the key information of a single session during the decryption process. Even if the key information is eavesdropped, subsequent and other encrypted traffic remains confidential, thus having high security, broadening the detection range, and ensuring accuracy. More intrusion events can be detected when traffic is encrypted.

[0180] It is understandable that in order to implement the functions in the above embodiments, the above execution device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and method steps of each example described in the embodiments disclosed in this application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application scenario and design constraints of the technical solution.

[0181] Figure 4 and Figure 5 A schematic diagram of the structure of a possible intrusion detection device provided for an embodiment of the present application. These intrusion detection devices can be used to implement the functions of the above-mentioned terminal device or gateway device in the above-mentioned method embodiment, and thus can also achieve the beneficial effects possessed by the above-mentioned method embodiment. In an embodiment of the present application, the intrusion detection device can be the terminal device or gateway device shown above, and can also be a module (such as a chip) applied to the terminal device or gateway device.

[0182] like Figure 4 As shown, the intrusion detection device 400 includes a processing unit 410 and a transceiver unit 420. The intrusion detection device 400 is used to implement the functions of the terminal device in the above method embodiment, or to implement the functions of the gateway device in the above method embodiment.

[0183] When the intrusion detection device 400 is used to implement the functions of the terminal device:

[0184] The processing unit 410 calls the transceiver unit 420 to execute:

[0185] Obtain key indication information for decrypting encrypted session files transmitted during each conversation between the client and the server, where the key indication information corresponding to the encrypted session files transmitted during different conversations is different; send the key indication information obtained each time to the gateway device, so that the gateway device generates a decryption key based on the received key indication information, decrypts the corresponding encrypted session file based on the decryption key, and performs intrusion detection on the decrypted session file.

[0186] In a possible design, the processing unit 410 is specifically configured to:

[0187] After the client initiates a session request to the server each time, the client obtains a client random number generated when the client and the server perform a handshake based on each session request; and determines key indication information for decrypting the corresponding encrypted session file based on the client random number.

[0188] In a possible design, the processing unit 410 is specifically configured to:

[0189] Determine the key indication information for decrypting the corresponding encrypted session file based on the preset master key and the client random number generated for each session; or, determine the key indication information for decrypting the corresponding encrypted session file based on the preset master key, the client random number generated for each session, and the extended key; or, determine the key indication information for decrypting the corresponding encrypted session file based on the client random number generated for each session, and the extended key;

[0190] Among them, the master key is a fixed key, and the extended key is determined from multiple keys included in a preset key pool based on the identification information carried during the session and the correspondence between the identification information and the key information; or the extended key is determined based on the correspondence between the session type or session service and the key information.

[0191] In a possible design, the processing unit 410 is specifically configured to:

[0192] Obtain the SSLKEYLOG file for each conversation between the client and the server; wherein the SSLKEYLOG file includes key indication information for decrypting the encrypted session files transmitted during the conversation.

[0193] When the intrusion detection device 400 is used to implement the function of a gateway device:

[0194] The processing unit 410 calls the transceiver unit 420 to execute:

[0195] Obtain key indication information sent by the terminal device for decrypting the encrypted session files transmitted during the session, where the key indication information corresponding to the encrypted session files transmitted during different session processes is different; generate a decryption key based on the received key indication information; decrypt the corresponding encrypted session file based on the decryption key, and perform intrusion detection on the decrypted session file.

[0196] In a possible design, the transceiver unit 420 is specifically used for:

[0197] Obtain the SSLKEYLOG file for each conversation between the client and the server, which is sent by the terminal device; wherein the SSLKEYLOG file includes a client random number generated when the client and the server shake hands based on a corresponding session request.

[0198] In a possible design, the processing unit 410 is further configured to:

[0199] According to the obtained correspondence between the encrypted session file identifier and the key indication information identifier, the key indication information corresponding to each encrypted traffic file and used to generate the decryption session key is determined.

[0200] In a possible design, the processing unit 410 is further configured to:

[0201] During each session, the received key indication information is used to decrypt the encrypted session file generated in the next session; or, during each session, the received key indication information is used to decrypt the encrypted session file generated in the current session.

[0202] In a possible design, the processing unit 410 is further configured to:

[0203] The received key indication information is the key indication information encrypted by the terminal device, and the key indication information is decrypted according to the decryption key corresponding to the key indication information of the terminal device protocol in advance.

[0204] For a more detailed description of the processing unit 410 and the transceiver unit 420, reference may be made to the relevant description in the method embodiment shown above.

[0205] like Figure 5 As shown, the intrusion detection device 500 includes a processor 510 and an interface circuit 520. The processor 510 and the interface circuit 520 are coupled to each other. It is understood that the interface circuit 520 can be a transceiver or an input-output interface. Optionally, the intrusion detection device 500 can also include a memory 530 for storing instructions executed by the processor 510 or storing input data required by the processor 510 to run the instructions or storing data generated after the processor 510 runs the instructions.

[0206] When the intrusion detection 500 is used to achieve the above Figure 2-3 When the method is shown, the processor 510 is used to implement the function of the processing unit 410, and the interface circuit 520 is used to implement the function of the transceiver unit 420.

[0207] It is understandable that the processor in the embodiments of the present application may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A general-purpose processor may be a microprocessor or any conventional processor.

[0208] The method steps in the embodiments of the present application can be implemented in hardware or in software instructions that can be executed by a processor. The software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory, flash memory, read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only memory, register, hard disk, mobile hard disk, CD-ROM or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. The storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC. In addition, the ASIC can be located in an access point or a station. The processor and the storage medium can also be present in a terminal device or a gateway device as discrete components.

[0209] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed on a computer, the process or function described in the embodiment of the present application is executed in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device or other programmable device. The computer program or instruction may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program or instruction may be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server, data center, etc. that integrates one or more available media. The available medium may be a magnetic medium, for example, a floppy disk, a hard disk, a tape; it may also be an optical medium, for example, a digital video disc; it may also be a semiconductor medium, for example, a solid-state hard disk. The computer-readable storage medium may be a volatile or nonvolatile storage medium, or may include both volatile and nonvolatile types of storage media.

[0210] In the various embodiments of the present application, unless otherwise specified or provided for in any logical conflict, the terms and / or descriptions between the different embodiments are consistent and may be referenced to each other, and the technical features in the different embodiments may be combined to form new embodiments according to their inherent logical relationships.

[0211] It is understood that the various numbers involved in the embodiments of the present application are only for the convenience of description and are not used to limit the scope of the embodiments of the present application. The size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic.< / secret> < / space> < / clientrandom> < / space> < / label> < / label> < / label> < / label> < / secret> < / secret> < / label>

Claims

1. An intrusion detection method, characterized in that: The method comprises: The terminal device obtains key indication information for decrypting the encrypted session files transmitted during each session between the client and the server, and the key indication information corresponding to the encrypted session files transmitted during different sessions is different; The terminal device sends the key indication information obtained each time to the gateway device, so that the gateway device generates a decryption key based on the received key indication information, decrypts the corresponding encrypted session file based on the decryption key, and performs intrusion detection on the decrypted session file.

2. The method according to claim 1, characterized in that The terminal device obtains key indication information for decrypting encrypted session files transmitted during each session between the client and the server, including: After the client initiates a session request to the server each time, the terminal device obtains a client random number generated when the client and the server perform a handshake based on each session request; The terminal device determines key indication information for decrypting the corresponding encrypted session file based on the client random number.

3. The method according to claim 2, characterized in that The terminal device determines key indication information for decrypting the corresponding encrypted session file based on the client random number, including: The terminal device determines key indication information for decrypting the corresponding encrypted session file based on a preset master key and a client random number generated in each session; or, The terminal device determines key indication information for decrypting the corresponding encrypted session file based on a preset master key, a client random number generated in each session, and an extended key; or, The terminal device determines key indication information for decrypting the corresponding encrypted session file based on the client random number generated in each session and the extended key; Among them, the master key is a fixed key, and the extended key is determined from multiple keys included in a preset key pool based on the identification information carried during the session and the correspondence between the identification information and the key information; or the extended key is determined based on the correspondence between the session type or session service and the key information.

4. The method according to any one of claims 1 to 3, characterized in that The terminal device obtains key indication information for decrypting encrypted session files transmitted during each session between the client and the server, including: The terminal device obtains the SSLKEYLOG file of each session between the client and the server; The SSLKEYLOG file includes key indication information for decrypting encrypted session files transmitted during a session.

5. An intrusion detection method, characterized in that: The method comprises: The gateway device obtains key indication information sent by the terminal device for decrypting the encrypted session file transmitted during the session, and the key indication information corresponding to the encrypted session files transmitted during different session processes is different; The gateway device generates a decryption key based on the received key indication information; The gateway device decrypts the corresponding encrypted session file based on the decryption key, and performs intrusion detection on the decrypted session file.

6. The method according to claim 5, characterized in that The gateway device obtains key indication information sent by the terminal device for decrypting the encrypted session file transmitted during the session, including: The gateway device obtains the SSLKEYLOG file of each session between the client and the server sent by the terminal device; The SSLKEYLOG file includes a client random number generated when the client and the server perform a handshake based on a corresponding session request.

7. The method according to claim 6, characterized in that The method further comprises: The gateway device determines the key indication information corresponding to each encrypted traffic file and used to generate the decryption session key according to the obtained correspondence between the encrypted session file identifier and the key indication information identifier.

8. The method according to claim 7, characterized in that The method further comprises: During each session, the key indication information received by the gateway device is used to decrypt the encrypted session file generated during the next session; or, During each session, the key indication information received by the gateway device is used to decrypt the encrypted session file generated during this session.

9. The method according to any one of claims 5 to 8, characterized in that The method further comprises: The key indication information received by the gateway device is the key indication information encrypted by the terminal device, and the gateway device decrypts the key indication information according to the decryption key corresponding to the key indication information of the terminal device protocol in advance.

10. An intrusion detection device, characterized in that: The device comprises: An acquisition module, used for acquiring key indication information for decrypting encrypted session files transmitted during each session between the client and the server, wherein the key indication information corresponding to the encrypted session files transmitted during different sessions is different; The processing module is used to send the key indication information obtained each time to the gateway device, so that the gateway device generates a decryption key based on the received key indication information, decrypts the corresponding encrypted session file based on the decryption key, and performs intrusion detection on the decrypted session file.

11. An intrusion detection device, characterized in that: The device comprises: An acquisition module, used to acquire key indication information sent by a terminal device for decrypting an encrypted session file transmitted during a session, wherein the key indication information corresponding to the encrypted session files transmitted during different sessions is different; The processing module is used to generate a decryption key based on the received key indication information; decrypt the corresponding encrypted session file based on the decryption key, and perform intrusion detection on the decrypted session file.

12. An electronic device, characterized in that: include: at least one processor, and a memory communicatively connected to the at least one processor, wherein: The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method according to any one of claims 1-4; or execute the method according to any one of claims 5-9.

13. A computer-readable medium storing computer-executable instructions, characterized in that: The computer executable instructions are used to execute the method according to any one of claims 1 to 4; or to execute the method according to any one of claims 5 to 9.

Images