Flow data detection method and system, medium and computer equipment

Abstract

The invention discloses a flow data detection method and system, a medium and computer equipment, and the method comprises the steps: capturing a session key parameter carried by a target function when the target function of a kernel space of a transmitting end is called; wherein the target function is called when the sending end sends an encrypted traffic data stream, and the session key parameter is generated when the sending end and a receiving end negotiate a handshake protocol; transmitting the session key parameter from the kernel space to a user space; in the user space, converting the session key parameter into a session key based on the handshake protocol; and intercepting the encrypted traffic data stream from a specified network interface, and decrypting the encrypted traffic data stream by using the session key to obtain a traffic data plaintext for security analysis.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a flow data detection method, system, medium and computer equipment. Background Art

[0002] At present, with the advent of the digital age, data transmission security and privacy protection are top priorities. Traditional data transmission security measures mainly use CA certificates to support HTTPS (Hypertext Transfer Protocol Secure) / TLS (Transport Layer Security) communication security.

[0003] In order to detect possible security vulnerabilities in the communication process between the server and the client, third-party testing agencies usually intercept the communication data between the server and the client and install the same CA certificate to establish a trust chain, thereby capturing the communication keys of the server and the client and decrypting the communication data transmitted in HTTPS / TLS.

[0004] Due to the wide variety of CA certificates and the comprehensiveness of testing, third-party testing agencies need to deploy CA certificates as much as possible in their testing systems. However, the deployment and management of a large number of CA certificates increases the complexity of the testing system and may become a source of security vulnerabilities. Summary of the invention

[0005] In order to solve or partially solve the potential system risks caused by the deployment of CA certificates, the present invention provides a flow data detection method, system, medium and computer device, which can avoid relying on CA certificates to obtain session keys by directly capturing the session key parameters of SSL / TLS sessions in the kernel space, thereby eliminating the need to install various CA certificates in the detection system, and reducing the complexity of configuration and potential security risks. This detection method without the need for CA certificates simplifies the deployment complexity of the detection system while ensuring the security of data detection.

[0006] In order to solve the above technical problems, the first aspect of the present invention discloses a method for detecting flow data, the method comprising:

[0007] When the target function in the kernel space of the sending end is called, the session key parameter carried by the target function is captured; wherein the target function is called when the sending end sends an encrypted traffic data stream, and the session key parameter is generated when the sending end and the receiving end negotiate a handshake protocol;

[0008] Transferring the session key parameters from the kernel space to the user space;

[0009] In the user space, converting the session key parameter into a session key based on the handshake protocol;

[0010] The encrypted traffic data stream is intercepted from a designated network interface, and the encrypted traffic data stream is decrypted using the session key to obtain traffic data plaintext for security analysis.

[0011] Optionally, a probe for capturing a program block is implanted inside the target function, and the probe is used to detect the calling state of the target function;

[0012] When the target function in the kernel space of the sending end is called, capturing the session key parameter carried by the target function specifically includes:

[0013] When the probe detects that the target function is called, the capture program block is triggered to capture the session key parameters.

[0014] Optionally, the triggering the capture program block to capture the session key parameter specifically includes:

[0015] Triggering the capture program block to capture the target address carried inside the target function;

[0016] Capturing a protocol structure according to the target address; wherein the protocol structure includes status information of a handshake protocol;

[0017] The status information in the protocol structure is parsed to obtain the session key parameters.

[0018] Optionally, the transferring the session key parameter from the kernel space to the user space specifically includes:

[0019] The session key parameters are stored in a shared data structure so that the user space and the kernel space share the session key parameters.

[0020] Optionally, converting the session key parameter into a session key based on the handshake protocol in the user space specifically includes:

[0021] Determine a corresponding key derivation function based on the handshake protocol;

[0022] The session key parameters are converted according to the key derivation function to obtain the session key.

[0023] Optionally, intercepting the encrypted traffic data flow from a designated network interface specifically includes:

[0024] The encrypted traffic data stream is intercepted from a designated network interface and stored in the user space.

[0025] Optionally, intercepting the encrypted traffic data flow from a designated network interface specifically includes:

[0026] Intercept some fragmented traffic from the specified network interface;

[0027] The plurality of fragmented flows are assembled into the encrypted flow data stream according to one or more of a TCP sequence number, an IP address, and a port number.

[0028] A second aspect of the present invention discloses a flow data detection system, comprising:

[0029] A key capture module, used for capturing the session key parameters carried by the target function when the target function in the kernel space of the sending end is called; wherein the target function is called when the sending end sends an encrypted traffic data stream, and the session key parameters are generated when the sending end and the receiving end negotiate a handshake protocol;

[0030] A conversion module, used for transferring the session key parameters from the system kernel space to the user space;

[0031] A traffic capture module, used for converting the session key parameter into a session key based on the handshake protocol in the user space;

[0032] The decryption module is used to intercept the encrypted traffic data stream from the specified network interface and decrypt the encrypted traffic data stream using the session key to obtain the traffic data plaintext for security analysis.

[0033] According to a third aspect of the present invention, a computer-readable storage medium is disclosed, on which a computer program is stored, and when the program is executed by a processor, the steps of the above method are implemented.

[0034] According to a fourth aspect of the present invention, a computer device is disclosed, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the program.

[0035] Through one or more technical solutions of the present invention, the present invention has the following beneficial effects or advantages:

[0036] The present invention provides a method, system, medium and computer device for detecting flow data. When the target function of the kernel space of the sending end is called, the session key parameters carried by the target function are captured to avoid relying on the CA certificate to intercept and obtain the session key; the session key parameters are then passed into the user space and converted into the session key in the user space, so that the user space and the kernel space can share data; finally, the encrypted flow data stream is intercepted from the specified network interface, and the session key is used for decryption to obtain the flow data plaintext for security analysis. It can be seen that the technical solution of the present invention captures the session key parameters by monitoring the target function in the kernel space, and realizes data decryption through the collaboration of the user space and the kernel space, thereby avoiding the installation of various CA certificates in the detection system to perform decryption operations, reducing the complexity of system configuration and potential security risks, and ensuring the security of data detection.

[0037] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0039] Figure 1 A flow chart showing an implementation of a method for detecting flow data according to an embodiment of the present invention is shown;

[0040] Figure 2 A schematic diagram of a flow data detection system according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0041] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0042] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0043] First, as Figure 1 As shown, a flow data detection method provided by an embodiment of the present invention at least comprises the following steps:

[0044] S101, when a target function in the kernel space of the sending end is called, capturing a session key parameter carried by the target function.

[0045] The session key parameters are generated when the sending end and the receiving end negotiate the handshake protocol. Specifically, the sending end and the receiving end will exchange session key parameters during the negotiation of the handshake protocol. The session key parameters are key information that constitutes the session key, including but not limited to:

[0046] client_random: client random number.

[0047] server_random: server random number.

[0048] master_secret: master key.

[0049] The session key specified during the negotiation handshake protocol can be derived based on the session key parameters.

[0050] The target function is called when the sender sends the encrypted traffic data stream after the negotiation handshake is completed. An example is the SSL_write function.

[0051] In this embodiment, in order to capture the session key parameters carried by the target function in real time, the communication key parameters are captured by implanting a probe in the target function in the kernel space of the transmitting end, and the probe is implanted inside the target function. The probe belongs to a capture program block, which is used to detect the calling state of the target function and allows the capture program block to be triggered when the target function is executed without modifying or recompiling the kernel. When the probe detects that the target function is called, it triggers the capture program block to capture the session key parameters.

[0052] Furthermore, the probe triggers the capture block to capture the target address carried inside the target function. The target address is located in the first parameter of the target function and is also a pointer to the SSL structure. Therefore, after capturing the target address, the protocol structure is further captured according to the target address. The protocol structure contains the status information of the handshake protocol; the status information in the protocol structure is parsed to obtain the session key parameters: client_random, server_random and master_secret.

[0053] In order to further illustrate and explain this embodiment, a specific example is used for illustration below.

[0054] The capture program block takes the eBPF (Extended Berkeley Packet Filter) program block as an example, and the target function takes the SSL_write function as an example.

[0055] eBPF is a powerful kernel technology that allows users to process kernel events by writing eBPF program blocks without modifying the kernel code, thereby monitoring and analyzing system behavior. In this example, eBPF is used as the underlying technology to capture session key parameters and decrypt encrypted traffic data streams. It is suitable for a variety of application scenarios such as operation and maintenance monitoring, troubleshooting, and security auditing. It not only improves the efficiency of data capture, but also improves the security of data detection. eBPF supports a variety of encryption libraries, including but not limited to openssl, gnutls, nss / nspr, which can meet the data capture needs in different scenarios.

[0056] A probe (uprobe) is set up in the kernel space of the sender and loaded (bound) into the SSL_write function in the SSL protocol library. Specifically, uprobe is loaded through the loader of the eBPF program block, which needs to specify the name and mount point of the target function. The eBPF program block uses the BPF (Berkeley Packet Filter) system call bpf_attach_uprobe (probe mounter) to mount the probe and mount it to the beginning of the SSL_write function. In order to minimize the impact on the performance of the target function, the eBPF program block efficiently performs capture operations to avoid long kernel space operations.

[0057] The SSL_write function is mainly used by the client or server to call when sending encrypted traffic data streams after the TLS handshake. The sending end referred to in this embodiment can be regarded as either a client or a server.

[0058] When the application belonging to the sender calls the SSL_write function, the probe detects the SSL_write function call, triggering the eBPF program block to interact directly with the SSL_write function, thereby capturing the first parameter of the SSL_write function: a pointer to the SSL structure. The SSL structure contains all the state information during the SSL / TLS handshake protocol. By parsing the SSL structure, the eBPF program block can access the session key parameters: client_random, server_random, and master_secret, which are necessary components for generating session keys.

[0059] S102: Transfer the session key parameters from the kernel space to the user space.

[0060] In this embodiment, the kernel space and the user space follow a memory sharing mechanism and store the session key parameters in a shared data structure, so that the user space and the kernel space share the session key parameters.

[0061] Specifically, the eBPF block passes the extracted session key parameters to user space through maps (a data structure). Maps is a data structure provided by the eBPF block that allows data to be securely shared between kernel space and user space. The eBPF block uses the BPF system call bpf_getsockopt to obtain specific fields in the SSL structure, and then uses the BPF system call bpf_map_update_elem to store the extracted session key parameters in the maps data structure for use by user space.

[0062] S103: In the user space, convert the session key parameter into a session key based on the handshake protocol.

[0063] Specifically, a corresponding key derivation function is determined based on the handshake protocol; the session key parameters are converted using the key derivation function to obtain the session key. Take the TLS protocol as an example. The TLS protocol has a key derivation function, such as PRF (pseudo-random function). The pseudo-random function PRF is extracted from the TLS protocol to process the session key parameters to obtain the session key.

[0064] S104, intercepting the encrypted traffic data stream from the designated network interface, and decrypting the encrypted traffic data stream using the session key to obtain traffic data plaintext for security analysis.

[0065] Specifically, the encrypted traffic data stream is intercepted from the designated network interface and stored in the user space, and the decryption operation of the encrypted traffic data stream is performed in the user space. In this embodiment, an efficient data capture technology is used to capture the encrypted traffic data stream passing through the network interface by using libpcap (a capture tool), but it does not form a limitation. Among them, the designated network interface is specified by the eBPF program block according to the actual situation.

[0066] In an optional embodiment, the encrypted traffic data stream may be transmitted in fragments. In this case, a number of fragmented traffic is intercepted from a designated network interface; the number of fragmented traffic is assembled into the encrypted traffic data stream according to one or more of a TCP sequence number, an IP address, and a port number.

[0067] In actual applications, the pcap_open_live function of the libpcap library is used to open the network device, and the pcap_loop or pcap_next_ex function is used to capture several fragmented flows. Then, the TCP sequence number, IP address, port number and other information are used to identify the source order of the fragmented flows, and a queue or buffer is used to reassemble the encrypted flow data stream.

[0068] In order to improve the reassembly efficiency, standard data structures (such as hash tables) can also be used to parse and track TCP sessions.

[0069] During decryption, the session key and encryption / decryption algorithm (such as AES) are used to automatically perform decryption operations on the encrypted traffic data stream.

[0070] In view of the limitations of the prior art, the present invention provides an efficient, secure and transparent data capture solution. By directly capturing the session key parameters of the SSL / TLS session in the kernel space, the reliance on CA certificates can be avoided, so there is no need to install various CA certificates in the detection system, reducing the complexity of configuration and potential security risks. This certificate-free method simplifies the deployment complexity of the detection system while ensuring the real-time accuracy of data capture and the security of data detection.

[0071] Furthermore, the technical solution of the present invention optimizes the memory design, enables the user space and the kernel space to share data, and through the collaborative work of the user space and the kernel space, realizes efficient reorganization and decryption of network traffic data, reduces system overhead, and improves data processing efficiency and stability.

[0072] Furthermore, the technical solution of the present invention can reorganize the fragments of network traffic, thereby ensuring the integrity and correctness of the data.

[0073] In the second aspect, based on the same inventive concept as the method for detecting flow data provided in the embodiment of the first aspect, the embodiment of the present invention further provides a system for detecting flow data, see Figure 2 ,include:

[0074] The key capture module 201 is used to capture the session key parameters carried by the target function when the target function in the kernel space of the sending end is called; wherein the target function is called when the sending end sends an encrypted traffic data stream, and the session key parameters are generated when the sending end and the receiving end negotiate a handshake protocol;

[0075] A conversion module 202, used for transferring the session key parameters from the system kernel space to the user space;

[0076] A traffic capture module 203, configured to convert the session key parameter into a session key based on the handshake protocol in the user space;

[0077] The decryption module 204 is used to intercept the encrypted traffic data stream from the designated network interface and decrypt the encrypted traffic data stream using the session key to obtain traffic data plaintext for security analysis.

[0078] Among them, the key capture module 201 and the conversion module 202 are located in the kernel space, and the traffic capture module 203 and the decryption module 204 are located in the user space.

[0079] Specifically, the key capture module 201 has a capture program block, which is exemplified by an eBPF program block. The eBPF program block implants a probe (uprobe) in the target function of the kernel space of the sending end to detect key information in the communication process.

[0080] It should be noted that the flow data detection system provided by the embodiment of the present invention, wherein the specific manner in which each module performs operations has been described in detail in the method embodiment provided in the above-mentioned first aspect, and the specific implementation process can refer to the method embodiment provided in the above-mentioned first aspect, and will not be elaborated here.

[0081] In the third aspect, based on the same inventive concept as the method for detecting flow data provided in the embodiment of the first aspect mentioned above, the embodiment of the present invention further discloses a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods described above.

[0082] In the fourth aspect, based on the same inventive concept as the method for detecting flow data provided in the embodiment of the first aspect mentioned above, the embodiment of the present invention also discloses a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any of the methods described above when executing the program.

[0083] Through one or more embodiments of the present invention, the present invention has the following beneficial effects or advantages:

[0084] The present invention provides a method, system, medium and computer device for detecting flow data. When the target function of the kernel space of the sending end is called, the session key parameters carried by the target function are captured to avoid relying on the CA certificate to intercept and obtain the session key; the session key parameters are then passed into the user space and converted into the session key in the user space, so that the user space and the kernel space can share data; finally, the encrypted flow data stream is intercepted from the specified network interface, and the session key is used for decryption to obtain the flow data plaintext for security analysis. It can be seen that the technical solution of the present invention captures the session key parameters by monitoring the target function in the kernel space, and realizes data decryption through the collaboration of the user space and the kernel space, thereby avoiding the installation of various CA certificates in the detection system to perform decryption operations, reducing the complexity of system configuration and potential security risks, and ensuring the security of data detection.

[0085] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0086] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for detecting flow data, characterized in that: The method comprises: When a target function in the kernel space of the sending end is called, capturing a session key parameter carried by the target function; wherein the target function is called when the sending end sends an encrypted traffic data stream, and the session key parameter is generated when the sending end and the receiving end negotiate a handshake protocol; Transferring the session key parameters from the kernel space to the user space; In the user space, converting the session key parameter into a session key based on the handshake protocol; The encrypted traffic data stream is intercepted from a designated network interface, and the encrypted traffic data stream is decrypted using the session key to obtain traffic data plaintext for security analysis.

2. The method according to claim 1, characterized in that A probe for capturing a program block is implanted inside the target function, and the probe is used to detect the calling state of the target function; When the target function in the kernel space of the sending end is called, capturing the session key parameter carried by the target function specifically includes: When the probe detects that the target function is called, the capture program block is triggered to capture the session key parameters.

3. The method according to claim 2, characterized in that The triggering of the capture program block to capture the session key parameter specifically includes: Triggering the capture program block to capture the target address carried inside the target function; Capturing a protocol structure according to the target address; wherein the protocol structure includes status information of a handshake protocol; The status information in the protocol structure is parsed to obtain the session key parameters.

4. The method according to claim 1, characterized in that The transferring the session key parameter from the kernel space to the user space specifically includes: The session key parameters are stored in a shared data structure so that the user space and the kernel space share the session key parameters.

5. The method according to claim 1, characterized in that The converting the session key parameter into a session key based on the handshake protocol in the user space specifically includes: Determine a corresponding key derivation function based on the handshake protocol; The session key parameters are converted according to the key derivation function to obtain the session key.

6. The method according to claim 1, characterized in that The step of intercepting the encrypted traffic data flow from the designated network interface specifically includes: The encrypted traffic data stream is intercepted from a designated network interface and stored in the user space.

7. The method according to claim 1, characterized in that The step of intercepting the encrypted traffic data flow from the designated network interface specifically includes: Intercept some fragmented traffic from the specified network interface; The plurality of fragmented flows are assembled into the encrypted flow data stream according to one or more of a TCP sequence number, an IP address, and a port number.

8. A flow data detection system, characterized in that: include: A key capture module, used for capturing session key parameters carried by a target function in a kernel space of a sending end when the target function is called; wherein the target function is called when the sending end sends an encrypted traffic data stream, and the session key parameters are generated when the sending end and the receiving end negotiate a handshake protocol; A conversion module, used for transferring the session key parameters from the system kernel space to the user space; A traffic capture module, used for converting the session key parameter into a session key based on the handshake protocol in the user space; The decryption module is used to intercept the encrypted traffic data stream from the specified network interface and decrypt the encrypted traffic data stream using the session key to obtain the traffic data plaintext for security analysis.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 7 are implemented.

Images