Encrypted data packet detection method and related equipment

Abstract

The invention provides an encrypted data packet detection method and related equipment, and relates to the technical field of network security. The method comprises the following steps: running a first data acquisition program in a user mode, and acquiring an original data packet and handle information of a to-be-detected encrypted data packet; sending the handle information and the original data packet to an agent center; initiating preset secure communication protocol connection tracking according to the security agent strategy information, performing connection tracking in a kernel mode, running a second data acquisition program, acquiring quintuple information of the to-be-detected encrypted data packet according to the handle information, sending the quintuple information to the agent center, integrating the quintuple information with the original data packet according to the handle information by the agent center, and sending the integrated quintuple information to the kernel mode; under low performance consumption, the cloud encrypted data packet is restored into a four-layer decrypted data packet for security analysis, so that the security detection of a communication system is effectively improved, and the network security is improved.

Description

Background Art

[0002] With the widespread use of Transport Layer Security (TLS) in network environments, network traffic security detection has become increasingly difficult.

[0003] In related technologies, security detection is performed through traditional traffic sniffing technology. However, traditional traffic sniffing technology can only obtain encrypted data and cannot know the original content of the communication. The above network security monitoring methods cannot be applied to network security monitoring based on TSL. Encrypted traffic leads to increasing system risks, which has become an important challenge faced by enterprises.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present disclosure provides an encrypted data packet detection method and related equipment, which at least to a certain extent overcomes the problem that the traffic sniffing technology in the related art cannot be applied to TSL-based network security monitoring and has low security.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, there is provided an encrypted data packet detection method, which is applied to user state, and the method comprises: running a first data acquisition program to obtain the original data packet and handle information of the encrypted data packet to be detected, wherein the original data packet is the data packet before encryption or after decryption obtained when the application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is based on the transmission between the user state and the kernel state in the preset secure communication protocol connection; sending the handle information and the original data packet to a proxy center; initiating the preset secure communication protocol connection tracking according to the secure proxy policy information so that the kernel state performs connection tracking, running a second data acquisition program, obtaining the five-tuple information of the encrypted data packet to be detected according to the handle information, and sending the five-tuple information of the encrypted data packet to be detected to the proxy center, and the proxy center integrating the five-tuple information with the original data packet according to the handle information to obtain the decrypted data packet corresponding to the encrypted data packet to be detected.

[0008] In one embodiment of the present disclosure, the first data acquisition program supports multiple user state libraries, and the user state libraries include at least one of the free software library GnuTLS, the network security service NSS, and the open secure socket layer protocol OpenSSL.

[0009] In one embodiment of the present disclosure, the method also includes: when the user state library is OpenSSL, the first data acquisition program is set at the secure socket layer write application programming interface and the secure socket layer read application programming interface of the OpenSSL; when the user state library is GnuTLS, the first data acquisition program is set at the record sending application programming interface and the record receiving application programming interface of the GnuTLS; when the user state library is NSS, the first data acquisition program is set at the write application programming interface, send application programming interface, read application programming interface and receive application programming interface of the NSS.

[0010] According to another aspect of the present disclosure, there is provided an encrypted data packet detection method, which is applied to a proxy center, the method comprising: receiving handle information and an original data packet of an encrypted data packet to be detected sent by a user state, the handle information and the original data packet are obtained by running a first data acquisition program in the user state, the original data packet is a data packet before encryption or after decryption obtained when an application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is transmitted between the user state and the kernel state in a connection based on a preset secure communication protocol; receiving five-tuple information of the encrypted data packet to be detected sent by the kernel state, the five-tuple information is connection tracking performed by the kernel state, and a second data acquisition program is run to obtain the information according to the handle information of the encrypted data packet to be detected, and the connection tracking is initiated by the user state according to the security proxy policy information; integrating the five-tuple information with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected.

[0011] According to another aspect of the present disclosure, there is provided an encrypted data packet detection device, which is applied to user state, and the device includes: a data acquisition module, which is used to run a first data acquisition program to obtain the original data packet and handle information of the encrypted data packet to be detected, the original data packet is the data packet before encryption or after decryption obtained when the application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is based on the transmission between the user state and the kernel state in the preset secure communication protocol connection; a data sending module, which is used to send the handle information and the original data packet to a proxy center; a tracking initiation module, which is used to initiate the preset secure communication protocol connection tracking according to the secure proxy policy information, so that the kernel state performs connection tracking, runs a second data acquisition program, obtains the five-tuple information of the encrypted data packet to be detected according to the handle information, and sends the five-tuple information of the encrypted data packet to be detected to the proxy center, the proxy center integrates the five-tuple information with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected.

[0012] According to another aspect of the present disclosure, there is provided an encrypted data packet detection device, which is applied to a proxy center, and the device comprises: a data receiving module, which is used to receive handle information and an original data packet of an encrypted data packet to be detected sent by a user state, wherein the handle information and the original data packet are obtained by running a first data acquisition program in the user state, and the original data packet is a data packet before or after encryption obtained when an application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is transmitted between the user state and the kernel state in a connection based on a preset secure communication protocol; an information receiving module, which is used to receive five-tuple information of the encrypted data packet to be detected sent by the kernel state, wherein the five-tuple information is obtained by running a second data acquisition program for connection tracking in the kernel state according to the handle information of the encrypted data packet to be detected, and the connection tracking is initiated by the user state according to the security proxy policy information; a data integration module, which is used to integrate the five-tuple information with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected.

[0013] According to another aspect of the present disclosure, there is provided an encrypted data packet detection system, comprising a user state, a kernel state and a proxy center, wherein: the user state is used to run a first data acquisition program to obtain the original data packet and handle information of the encrypted data packet to be detected, the original data packet is the data packet before encryption or after decryption obtained when the application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is based on the transmission between the user state and the kernel state in the preset secure communication protocol connection; the handle information and the original data packet are sent to the proxy center; the preset secure communication protocol connection tracking is initiated according to the secure proxy policy information; the kernel state is used to run a second data acquisition program for connection tracking, obtain the five-tuple information of the encrypted data packet to be detected according to the handle information, and send the five-tuple information of the encrypted data packet to be detected to the proxy center; the proxy center is used to integrate the five-tuple information with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected.

[0014] According to another aspect of the present disclosure, an electronic device is provided, comprising: a processor and a memory, wherein the memory is used to store executable instructions of the processor; wherein the processor is configured to perform the above-mentioned encrypted data packet detection method by executing the executable instructions.

[0015] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned encrypted data packet detection method is implemented.

[0016] According to another aspect of the present disclosure, a computer program product is provided, the computer program product comprising a computer program or computer instructions, the computer program or the computer instructions being loaded and executed by a processor so that a computer implements the above-mentioned encrypted data packet detection method.

[0017] In the disclosed embodiment, a first data acquisition program is run in user mode to acquire the original data packet and handle information of the encrypted data packet to be detected, wherein the original data packet is the data packet before encryption or after decryption obtained when the application encrypts and decrypts data, and the encrypted data packet to be detected is transmitted between the user mode and the kernel mode in a preset secure communication protocol connection; the handle information and the original data packet are sent to the proxy center; a preset secure communication protocol connection tracking is initiated according to the secure proxy policy information so that the kernel mode performs connection tracking, and a second data acquisition program is run to acquire the five-tuple information of the encrypted data packet to be detected according to the handle information, and the five-tuple information of the encrypted data packet to be detected is sent to the proxy center, and the proxy center integrates the five-tuple information with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected, and improves the existing host security management center and the proxy center for security analysis, thereby realizing the restoration of the encrypted data packet on the cloud to a four-layer decrypted data packet under low performance consumption, effectively solving the difficulty brought to system security monitoring and analysis by the inability of traditional traffic sniffing technology to truly observe the original content of the communication, effectively improving the security detection of the communication system, and improving network security.

[0018] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0020] Figure 1 A schematic diagram showing an exemplary architecture of an encrypted data packet detection method in an embodiment of the present disclosure.

[0021] Figure 2 A flow chart of an encrypted data packet detection method in an embodiment of the present disclosure is shown.

[0022] Figure 3 A flow chart of another method for detecting encrypted data packets in an embodiment of the present disclosure is shown.

[0023] Figure 4 A schematic structural diagram of an encrypted data packet detection system in an embodiment of the present disclosure is shown.

[0024] Figure 5 A schematic diagram of an encrypted data packet detection principle in an embodiment of the present disclosure is shown.

[0025] Figure 6An interactive diagram of an encrypted data packet detection method in an embodiment of the present disclosure is shown.

[0026] Figure 7 A schematic structural diagram of an encrypted data packet detection device in an embodiment of the present disclosure is shown.

[0027] Figure 8 A schematic diagram of the structure of another encrypted data packet detection device in an embodiment of the present disclosure is shown.

[0028] Fig. 9 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0029] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0030] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0031] For ease of understanding, before introducing the embodiments of the present disclosure, several terms involved in the embodiments of the present disclosure are first explained as follows:

[0032] Secure Sockets Layer, abbreviated as SSL, is a protocol that provides secure communications on the Internet. It is used to provide data encryption, identity authentication, and message integrity protection above the network layer and below the application layer to ensure the security and privacy of data during transmission.

[0033] Transport Layer Security, abbreviated as TLS, is a protocol used to provide security in network communications. It is the successor of SSL. Its main user is to protect data transmission between the client and the server to prevent data from being eavesdropped or tampered with.

[0034] The free software library, GNU Transport Layer Security Library, referred to as GnuTLS, is used to implement secure network communications in applications, mainly providing support for TLS or SSL and other related encryption protocols.

[0035] Network Security Services, or NSS for short, is an open source security library that is primarily used to develop secure Internet communication applications. It provides a wide range of security features, including SSL or TLS protocol support, certificate management, key and password management, random number generation, digital signature verification, etc. It is widely used in browsers, email clients, and other applications that require secure communication.

[0036] Open Secure Sockets Layer, abbreviated as OpenSSL, is an open secure socket layer protocol package. Applications can use OpenSSL for secure communication to avoid eavesdropping and confirm the identity of the other end of the connection. It is widely used on web servers on the Internet.

[0037] The specific implementation of the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0038] Figure 1 A schematic diagram showing an exemplary system architecture that can be applied to the encrypted data packet detection method according to an embodiment of the present disclosure.

[0039] like Figure 1 As shown, the system architecture 100 may include a terminal device 110 , a network 120 and a server 130 .

[0040] The network 120 is a medium for providing a communication link between the terminal device 110 and the server 130 , and may be a wired network or a wireless network.

[0041] The user may use the terminal device 110 to interact with the server 130 through the network 120 to receive or send messages.

[0042] The terminal device 110 may be any electronic device with a display function, including but not limited to a smart phone, a tablet computer, a display screen, and a desktop computer.

[0043] The client of the application program that can be installed on the terminal device 110 is the same, or the client of the same type of application program based on different operating systems. Based on the different terminal platforms, the specific form of the client of the application program can also be different, for example, the application program client can be a mobile client, a PC client, etc.

[0044] Exemplarily, the terminal device 110 is installed with various communication client applications, and the communication client application can perform data transmission with the kernel state through the data transmission module, run the first data acquisition program, obtain the original data packet and handle information of the encrypted data packet to be detected, and upload them to the server 130. The terminal device 110 can also initiate connection tracking according to the security proxy policy information, so that the kernel state performs connection tracking, and obtain the five-tuple information of the encrypted data packet to be detected according to the handle information, and send the five-tuple information to the server 130.

[0045] The server 130 may be a server that provides various services, such as a background management server that provides support for the device operated by the user using the terminal device 110, such as a security management center. The background management server establishes an agent center, which can analyze and process the received request and other data (such as the handle information of the encrypted data packet to be detected, the original data packet and the five-tuple information, etc.), obtain the processing result (such as the decrypted data packet corresponding to the encrypted data packet to be detected, etc.), and send the decrypted data packet to the security management center for analysis and processing.

[0046] Optionally, server 130 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0047] Those skilled in the art will know that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration, and any number of terminal devices, networks and servers may be provided according to actual needs, and the embodiments of the present disclosure do not limit this.

[0048] With the widespread use of TLS in modern network environments, network traffic security detection has become increasingly difficult.

[0049] In related technologies, traffic sniffing technology is used to implement traditional network security monitoring. A sniffer is a software device that monitors network data operations. Protocol analysis can be used for both legitimate network management and stealing network information. However, traffic sniffing technology can only obtain encrypted data and cannot truly observe the original data during the communication process. This technology is ineffective for TSL-based network traffic security detection. The system risks caused by encrypted traffic are increasing, which has become a severe challenge facing enterprises.

[0050] Therefore, there is an urgent need to design a detection method that can target encrypted data packets in order to build a benign and healthy network ecological environment.

[0051] Based on this, the encrypted data packet detection method provided by the present invention runs a first data acquisition program in user mode to obtain the original data packet and handle information of the encrypted data packet to be detected, the original data packet is the data packet before encryption or after decryption obtained when the application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is based on the transmission between the user mode and the kernel mode in the preset secure communication protocol connection; the handle information and the original data packet are sent to the proxy center; the preset secure communication protocol connection tracking is initiated according to the secure proxy policy information, so that the kernel mode performs connection tracking, and the second data acquisition program is run to obtain the five-tuple information of the encrypted data packet to be detected according to the handle information, and the five-tuple information of the encrypted data packet to be detected is sent to the proxy center, the proxy center integrates the five-tuple information with the original data packet according to the handle information, and obtains the decrypted data packet corresponding to the encrypted data packet to be detected for security analysis, and by improving the existing host security management center and the proxy center, it is possible to restore the encrypted data packet on the cloud to a four-layer decrypted data packet under low performance consumption, effectively solving the difficulty that the traditional traffic sniffing technology cannot truly observe the original content of the communication, which brings to the system security monitoring and analysis, effectively improving the security detection of the communication system, and improving network security.

[0052] The present exemplary implementation is described in detail below with reference to the accompanying drawings and embodiments.

[0053] First, an encrypted data packet detection method is provided in the embodiments of the present disclosure, and the method can be executed by any electronic device with computing and processing capabilities. In some embodiments, the method can be executed by a user state, and the encrypted data detection device can be configured in a terminal device; in some embodiments, the method can be executed by an agent center, and the encrypted data packet detection device can be configured in a server.

[0054] Figure 2 FIG. 2 is a flow chart of a method for detecting an encrypted data packet according to an embodiment of the present disclosure. Figure 2 As shown, in one embodiment, the encrypted data packet detection method provided in the embodiment of the present disclosure is applied in user mode and includes the following steps:

[0055] S202. Run the first data acquisition program to obtain the original data packet and handle information of the encrypted data packet to be detected. The original data packet is the data packet before encryption or after decryption obtained when the application encrypts and decrypts data. The connection tracking of the encrypted data packet to be detected is based on the transmission between the user state and the kernel state in the preset secure communication protocol connection.

[0056] The first data acquisition program can be a network packet capture tool, a proxy tool, a library using a programming language, etc. Network packet capture tools can include Wireshark, tcpdump, Fiddler, etc. Wireshark can be used for network analysis. By configuring filters, SSL / TLS data packets of specific ports can be captured; tcpdump is a lightweight command line tool suitable for Unix / Linux systems. It captures SSL traffic by specifying ports; Fiddler can capture network data packets, including SSL data packets, and provide filtering functions. The proxy tool can be Burp Suite, which is a multi-functional network security testing tool that can intercept HTTPS requests and responses by configuring a proxy and perform a man-in-the-middle attack on SSL certificates, thereby capturing SSL data packets. The library using a programming language can be Python's Scapy, pcap, and tshark libraries, which can be used to capture and analyze network data packets, and SSL data packets can be captured by writing code.

[0057] The above-mentioned preset secure communication protocol can be SSL or TLS.

[0058] The encrypted data packet to be detected is an encrypted data packet sent by the application. Before sending the original data packet, the application encrypts the original data packet to obtain the encrypted data packet to be detected.

[0059] The encrypted data packet to be detected may also be an encrypted data packet received by an application. After receiving the encrypted data packet to be detected, the application may decrypt the encrypted data packet to be detected to obtain a decrypted data packet, also called an original data packet.

[0060] The handle information of the encrypted data packet to be detected refers to a pointer to system resources, which is used to manage system resources, such as files, processes, threads, communication ports, etc. The role of the handle is to provide a safe way to access or operate system resources, which can hide the specific implementation details of the resources, so that users do not need to care about the physical location or status of the resources, and help the operating system manage resource access rights and synchronization.

[0061] Handles can include file handles, process handles, thread handles, window handles, event handles, mutex handles, semaphore handles, and timer handles. File handles are used to access files or devices; process handles are used to control another process; thread handles are used to control or monitor a process; window handles are used to operate windows and controls; event handles are used to synchronize threads or processes; mutex handles are used to synchronize access to shared resources; semaphore handles are used to control the number of accesses to resources; and timer handles are used to create and control timers. For example, in the Windows operating system, a handle is a 32-bit value represented by the HANDLE type, which is a pointer to a kernel object.

[0062] The handle information is an identifier used to access resources in the system. It does not directly contain the address of the resource, but points to a kernel object managed by the operating system.

[0063] In one embodiment, the first data acquisition program supports multiple user state libraries, and the user state libraries include at least one of the free software library GnuTLS, the network security service NSS, and the open secure socket layer protocol OpenSSL.

[0064] GnuTLS is an open source library that can be used to implement secure communications. It implements the SSL, TLS, and DTLS protocols, and provides multiple functions such as encryption, authentication, and data integrity. It can be used in various network applications to ensure the security of communications. For encryption, GnuTLS can support a variety of encryption algorithms and key exchange mechanisms, such as AES, Camellia, etc., to ensure the security of data during transmission; for identity authentication, it can support a variety of certificate formats to help verify the identities of both parties in communication and prevent man-in-the-middle attacks. For data integrity, it can provide data integrity check functions to ensure that the transmitted data has not been tampered with.

[0065] NSS can provide secure network communication support, protect the security of network communication, and provide a set of application programming interfaces (APIs) to implement security functions. NSS can detect and organize network attacks, protect network systems from network attacks, manage network security, provide security reports, monitor network security in real time, and respond to network attacks in real time. It can also provide security auditing, security management, and implementation of security policies, and can store secret keys, certificates, and other security information.

[0066] OpenSSL provides a variety of encryption algorithms and security functions to protect data communications and information storage, supports symmetric and asymmetric encryption algorithms for data encryption and decryption, can also generate, sign and verify digital certificates, and supports SSL / TLS protocols to ensure the security and privacy of data transmission. OpenSSL can perform encryption and decryption, digital certificate management, cryptography tools, SSL / TLS protocol implementation and other functions.

[0067] In one embodiment, the first data acquisition program may be arranged at an application programming interface (Application Programming Interface, API) for data interaction in a user state library.

[0068] In one embodiment, the encrypted traffic packet detection method provided by the embodiment of the present disclosure also includes: when the user state library is OpenSSL, the first data acquisition program is set at the secure socket layer write application programming interface SSL_Write API and the secure socket layer read application programming interface SSL_Read API of OpenSSL; when the user state library is GnuTLS, the first data acquisition program is set at the record sending application programming interface GnuTLS_Record_Send API and the record receiving application programming interface GnuTLS_Record_Recv API of GnuTLS; when the user state library is NSS, the first data acquisition program is set at the write application programming interface PR_Write API, the send application programming interface PR_Send API, the read application programming interface PR_Read API and the receive application programming interface PR_Recv API of NSS.

[0069] In OpenSSL's SSL_Write API and SSL_Read API, the handle information of the encrypted data packet to be detected is obtained through the first data acquisition program. When reading and writing data in the SSL_Write API and SSL_Read API connection, the first data acquisition program will copy the original data packet before or after encryption, and send the original data packet to the data cache program of the proxy center for caching.

[0070] SSL_Write is used to write encrypted data streams, and SSL_Read is used to read encrypted data streams.

[0071] In one embodiment, if it is GnuTLS, a first data acquisition program and a second data acquisition program are added at GnuTLS_Record_Send API and GnuTLS_Record_Recv API; if it is NSS, a first data acquisition program and a second data acquisition program are added at PR_Write API, PR_Send API, PR_Read API, and PR_Recv API.

[0072] S204: Send the handle information and the original data packet to the proxy center.

[0073] The proxy center can realize functions such as request forwarding and response processing, data caching and acceleration, enhancing network security, breaking access restrictions, and optimizing network structure. The proxy center can serve as a bridge between the client and the security management center. The proxy center can receive the handle information and original data packets sent by the user state, and cache the handle information and original data packets in the data cache program to realize the tracking of the encrypted data packets to be detected.

[0074] S206. Initiate connection tracking of the preset secure communication protocol according to the security proxy policy information to enable the kernel state to perform connection tracking, run the second data acquisition program, obtain the five-tuple information of the encrypted data packet to be detected according to the handle information, and send the five-tuple information of the encrypted data packet to be detected to the proxy center. The proxy center integrates the five-tuple information with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected.

[0075] Security proxy policy information includes, but is not limited to, packet filtering, access control, logging and auditing, intrusion detection and prevention, virus and malware protection, identity authentication and authorization, encryption and key management, threat intelligence integration and other policies. For packet filtering, the proxy center uses packet filtering technology to check the data packets entering and leaving the network, and allows or denies the transmission of data packets according to the preset security policy. The inspection content includes checking the source address, destination address, port number, etc. to prevent unauthorized access; for access control, the proxy center implements strict access control policies to ensure that only authorized users and devices can access network resources, including verification of user identity, new user scoring of devices, and management of binding relationships between users and devices; for logging and auditing, the proxy center records all network activities, including user logins, access records, etc., to facilitate subsequent auditing and monitoring; for intrusion detection and prevention, the proxy center monitors network traffic, identifies abnormal behavior, and takes timely measures to prevent potential attacks. It should be noted that the present disclosure does not specifically limit the content of security proxy policy information.

[0076] It should be noted that the implementation method of the second data acquisition program is the same as the implementation method of the first data acquisition program, which will not be repeated here.

[0077] In one embodiment, an SSL / TLS connection is formed between the user state and the kernel state of the kernel space through the kernel state and user state data transmission module.

[0078] Perform SSL / TLS connection tracking in kernel state, run the second data acquisition program, obtain the five-tuple information of the encrypted data packet to be detected according to the handle information, and send the five-tuple of the encrypted data packet to be detected to the proxy center.

[0079] The five-tuple information of the encrypted data packet to be detected can identify a network communication. The five-tuple information includes the source IP, source port number, destination IP, destination port number and protocol number. The source IP identifies the source host, the source port number identifies the process in the source host that sends the encrypted data packet to be detected in this communication, the destination IP identifies the destination host, the destination port number identifies the process in the destination host that receives the data packet to be detected in this communication, and the protocol number identifies the data format agreed upon by both the sending process and the receiving process.

[0080] After receiving the handle information, original data packet and five-tuple information of the encrypted data packet to be detected, the proxy center combines the original data packet and five-tuple information with the same handle information to obtain a four-layer decrypted data packet corresponding to the encrypted data packet to be detected, and sends the four-layer decrypted data packet to the security management center for subsequent analysis and processing to obtain the detection result.

[0081] In one embodiment, the proxy center can filter the original data packet and five-tuple information according to the handle information to obtain the original data packet and five-tuple information with the same handle information, and integrate the original data packet and five-tuple information to restore the data packet.

[0082] It should be noted that the present disclosure does not specifically limit the detection method of the layer-4 decrypted data packet.

[0083] In the disclosed embodiment, a first data acquisition program is run in user mode to acquire the original data packet and handle information of the encrypted data packet to be detected, wherein the original data packet is the data packet before encryption or after decryption obtained when the application encrypts and decrypts data, and the encrypted data packet to be detected is transmitted between the user mode and the kernel mode in a preset secure communication protocol connection; the handle information and the original data packet are sent to the proxy center; a preset secure communication protocol connection tracking is initiated according to the secure proxy policy information so that the kernel mode performs connection tracking, and a second data acquisition program is run to acquire the five-tuple information of the encrypted data packet to be detected according to the handle information, and the five-tuple information of the encrypted data packet to be detected is sent to the proxy center, and the proxy center integrates the five-tuple information with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected, and by improving the existing host security management center and the proxy center, it is possible to restore the encrypted data packet on the cloud to a four-layer decrypted data packet for security analysis under low performance consumption, effectively solving the difficulty brought to system security monitoring and analysis by the inability of traditional traffic sniffing technology to truly observe the original content of the communication, effectively improving the security detection of the communication system, and improving network security.

[0084] Figure 3 FIG. 2 is a flow chart of another method for detecting encrypted data packets in an embodiment of the present disclosure. Figure 3 As shown, in one embodiment, the encrypted data packet detection method of the embodiment of the present disclosure is applied to a proxy center, and the method includes the following steps:

[0085] S302. Receive the handle information and original data packet of the encrypted data packet to be detected sent by the user state. The handle information and the original data packet are obtained by running the first data acquisition program in the user state. The original data packet is the data packet before encryption or after decryption obtained when the application encrypts and decrypts data. The connection tracking of the encrypted data packet to be detected is based on the transmission between the user state and the kernel state in the preset secure communication protocol connection.

[0086] In one embodiment, after the proxy center receives the handle information of the encrypted data packet to be detected and the original data packet, it can cache them in a data cache program.

[0087] S304, receiving the five-tuple information of the encrypted data packet to be detected sent by the kernel state, the five-tuple information is for connection tracking in the kernel state, running the second data acquisition program, and obtaining it according to the handle information of the encrypted data packet to be detected, and the connection tracking is initiated by the user state according to the security proxy policy information.

[0088] In one embodiment, after the proxy center receives the five-tuple information of the encrypted data packet to be detected sent by the kernel state, it can cache it in the data cache program.

[0089] S306 . Integrate the five-tuple information with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected.

[0090] In one embodiment, the data cache program performs a secondary combination of the original data packet and the five-tuple information, thereby restoring the encrypted data packet to be detected into a four-layer decrypted data packet.

[0091] In the disclosed embodiment, the proxy center receives the handle information and the original data packet of the encrypted data packet to be detected sent by the user state, the handle information and the original data packet are obtained by running the first data acquisition program in the user state, the original data packet is the data packet before encryption or after decryption obtained when the application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is based on the transmission between the user state and the kernel state in the preset secure communication protocol connection; the five-tuple information of the encrypted data packet to be detected sent by the kernel state is received, the five-tuple information is the connection tracking for the kernel state, and the second data acquisition program is run to obtain the handle information of the encrypted data packet to be detected, and the connection tracking is initiated by the user state according to the security proxy policy information; the five-tuple information is integrated with the original data packet according to the handle information to obtain the decrypted data packet corresponding to the encrypted data packet to be detected for security analysis, and by improving the existing host security management center and the proxy center, the encrypted data packet on the cloud is restored to the four-layer decrypted data packet under low performance consumption, which effectively solves the difficulty brought to the system security monitoring and analysis by the traditional traffic sniffing technology that cannot truly observe the original content of the communication, and effectively improves the security detection of the communication system.

[0092] Figure 4 FIG. 2 is a schematic diagram showing the structure of an encrypted data packet detection system according to an embodiment of the present disclosure. Figure 4 As shown, in one embodiment, the encrypted data packet detection system of the embodiment of the present disclosure includes a user state 410, a kernel state 420, an agent center 430 and a security management center 440, wherein:

[0093] The user state 410 is used to run the first data acquisition program to obtain the original data packet and handle information of the encrypted data packet to be detected, the original data packet is the data packet before encryption or after decryption obtained when the application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is based on the transmission between the user state 410 and the kernel state 420 in the preset secure communication protocol connection; the handle information and the original data packet are sent to the proxy center 430; the preset secure communication protocol connection tracking is initiated according to the secure proxy policy information;

[0094] The kernel state 420 is used to run the second data acquisition program to perform connection tracking, obtain the five-tuple information of the encrypted data packet to be detected according to the handle information, and send the five-tuple information of the encrypted data packet to be detected to the proxy center 430;

[0095] The proxy center 430 is used to integrate the five-tuple information with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected;

[0096] The security management center 440 is used to process the decrypted data packets to obtain detection results.

[0097] like Figure 5 As shown, the security management center 440 provides unified management, builds an agent center (Agent Center) 430 corresponding to the security management center 440, improves the agent center 430 so that the agent center 430 has the ability to utilize the host operating system eBPF. The agent center 430 has data caching, SOCKET analysis, and data packet repackaging functions.

[0098] A first data acquisition program is inserted into the user state 410 of the operating system kernel space, and a second data acquisition program is inserted into the kernel state 430. The first data acquisition program and the second data acquisition program can support eBPF tracing technology across multiple user state SSL / TLS libraries, and support multiple user state libraries such as OpenSSL, GnuTLS, and NSS. In the SSL_Write API and SSL_Read API of OpenSSL, the handle information of the encrypted data packet to be detected is obtained through the first data acquisition program. When reading and writing data in the SSL_WriteAPI and SSL_Read API connection, the first data acquisition program will copy the original data packet before or after encryption, and send the original data packet to the data cache program of the proxy center 430 for caching.

[0099] The user state 410 initiates connection tracking according to the security proxy policy information. The kernel state 430 performs connection tracking, runs the second data acquisition program, obtains the five-tuple information of the encrypted data packet to be detected according to the handle information, and sends the five-tuple information to the proxy center 430.

[0100] The proxy center 430 combines the original data packet and the five-tuple information corresponding to the same handle information, thereby restoring the encrypted data packet to be detected into a four-layer decrypted data packet, and sends the four-layer decrypted data packet to the security management center 440, so that the security management center 440 performs security detection on the four-layer decrypted data packet to obtain the detection result.

[0101] In one embodiment, if it is GnuTLS, a first data acquisition program and a second data acquisition program are added at GnuTLS_Record_Send API and GnuTLS_Record_Recv API; if it is NSS, a first data acquisition program and a second data acquisition program are added at PR_Write API, PR_Send API, PR_Read API, and PR_Recv API.

[0102] It should be noted that the principle of solving the problem in this system embodiment is similar to that in the above method embodiment, so the implementation of this system embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0103] In the disclosed embodiment, the user state runs a first data acquisition program to obtain the original data packet and handle information of the encrypted data packet to be detected, the original data packet is the data packet before encryption or after decryption obtained when the application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is based on the transmission between the user state and the kernel state in the preset secure communication protocol connection; the handle information and the original data packet are sent to the proxy center; the preset secure communication protocol connection tracking is initiated according to the secure proxy policy information; the kernel state is used to run a second data acquisition program for connection tracking, obtain the five-tuple information of the encrypted data packet to be detected according to the handle information, and send the five-tuple information of the encrypted data packet to be detected to the proxy center; the proxy center is used to integrate the five-tuple information with the original data packet according to the handle information to obtain the decrypted data packet corresponding to the encrypted data packet to be detected, and by improving the existing host security management center and the proxy center, it is possible to restore the encrypted data packet on the cloud to a four-layer decrypted data packet under low performance consumption for security analysis, effectively solving the difficulty that the traditional traffic sniffing technology cannot truly observe the original content of the communication, which brings to the system security monitoring and analysis, effectively improving the communication system security detection, and improving network security.

[0104] In the present disclosure, by adding a first data acquisition program in the user state of the operating system kernel space, the first data acquisition program can support eBPF tracing technology across multiple user-state SSL / TLS libraries, such as OpenSSL, GnuTLS, NSS and other user-state libraries; by adding a second data acquisition program in the kernel state of the kernel space, the handle information of the encrypted data packet to be detected is obtained through the second acquisition program, and connection tracking is initiated according to the security proxy policy information. The five-tuple information of the encrypted data packet to be detected is obtained in the kernel space using the handle information, and the original data packet before / after encryption and the five-tuple information are recombined with the five-tuple information in the proxy center to obtain a decrypted data packet corresponding to the encrypted data packet to be detected, so that the security management center performs security analysis on the decrypted data packet to obtain the detection result, thereby realizing security monitoring of encrypted traffic on the cloud with low performance consumption, and can restore the encrypted traffic to four-layer decrypted data packets one by one with high accuracy.

[0105] In order to deepen the understanding of the technical solution of the present disclosure, the following Figure 6 A specific example is given below to illustrate.

[0106] Figure 6 An interactive diagram of an encrypted data packet detection method in an embodiment of the present disclosure is shown. Figure 6 As shown, the encrypted data packet detection method provided by the example of the present disclosure includes the following steps:

[0107] S601, user state 410 and kernel state 420 read and write data from the TLS / SSL connection through SSL_Write / Read.

[0108] S602 , when the application encrypts and decrypts data, the user state 410 runs a first data acquisition program, copies the original data packet before or after encryption, obtains the handle information of the encrypted data packet to be detected, and sends it to the proxy center 430 .

[0109] S630. The proxy center 430 caches the original data packet and handle information of the encrypted data packet to be detected.

[0110] S640: User state 410 initiates connection tracking according to the security proxy policy information.

[0111] S605, kernel state 420 performs connection tracking.

[0112] S606 , the kernel state 420 obtains the five-tuple information of the encrypted data packet to be detected according to the handle information, and sends the five-tuple information to the proxy center 430 .

[0113] S607. The proxy center 430 caches the five-tuple information of the encrypted data packet to be detected.

[0114] S608 , the proxy center 430 performs data integration, restores the data packet, obtains the four-layer decrypted data packet, and sends it to the security management center 440 .

[0115] S609. The security management center 440 analyzes and processes the layer-4 decrypted data packet to obtain a detection result.

[0116] It should be noted that the above examples are described using OpenSSL (SSL_Write / Read) as an example. If it is GnuTLS, it is GnuTLS_Record_Send and GnuTLS_Record_Recv; if it is NSS, it is PR_Write, PR_Send, PR_Read and PR_Recv.

[0117] Based on the same inventive concept, the disclosed embodiment also provides an encrypted data packet detection device, such as the following embodiment. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0118] Figure 7 A schematic diagram of the structure of an encrypted data packet detection device in an embodiment of the present disclosure is shown. Figure 7 As shown, the encrypted data packet detection device is applied in user mode and includes a data acquisition module 710, a data sending module 720 and a tracking initiation module 730. Among them:

[0119] The data acquisition module 710 is used to run a first data acquisition program to acquire the original data packet and handle information of the encrypted data packet to be detected, where the original data packet is a data packet before encryption or after decryption obtained when the application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is based on the transmission between the user state and the kernel state in the connection of the preset secure communication protocol;

[0120] The data sending module 720 is used to send the handle information and the original data packet to the proxy center;

[0121] The tracking initiation module 730 is used to initiate the preset security communication protocol connection tracking according to the security proxy policy information, so that the kernel state performs connection tracking, runs the second data acquisition program, obtains the five-tuple information of the encrypted data packet to be detected according to the handle information, and sends the five-tuple information of the encrypted data packet to be detected to the proxy center. The proxy center integrates the five-tuple information with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected.

[0122] In one embodiment, the first data acquisition program supports multiple user-state libraries, and the user-state libraries include at least one of the free software library GnuTLS, the network security service NSS, and the open secure socket layer protocol OpenSSL.

[0123] In one embodiment, when the user state library is OpenSSL, the first data acquisition program is set at the secure socket layer write application programming interface and the secure socket layer read application programming interface of OpenSSL; when the user state library is GnuTLS, the first data acquisition program is set at the record sending application programming interface and the record receiving application programming interface of GnuTLS; when the user state library is NSS, the first data acquisition program is set at the write application programming interface, send application programming interface, read application programming interface and receive application programming interface of NSS.

[0124] In the disclosed embodiment, a first data acquisition program is run in user mode to acquire the original data packet and handle information of the encrypted data packet to be detected, the original data packet is the data packet before encryption or after decryption obtained when the application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is based on the transmission between the user mode and the kernel mode in the preset secure communication protocol connection; the handle information and the original data packet are sent to the proxy center; the preset secure communication protocol connection tracking is initiated according to the secure proxy policy information, so that the kernel mode performs connection tracking, and a second data acquisition program is run to acquire the five-tuple information of the encrypted data packet to be detected according to the handle information, and the five-tuple information of the encrypted data packet to be detected is sent to the proxy center, and the proxy center integrates the five-tuple information with the original data packet according to the handle information to obtain the decrypted data packet corresponding to the encrypted data packet to be detected, and by improving the existing host security management center and the proxy center, it is possible to restore the encrypted data packet on the cloud to a four-layer decrypted data packet for security analysis under low performance consumption, effectively solving the difficulty brought to system security monitoring and analysis by the traditional traffic sniffing technology that cannot truly observe the original content of the communication, effectively improving the security detection of the communication system, and improving network security.

[0125] Figure 8 A schematic diagram of the structure of an encrypted data packet detection device in an embodiment of the present disclosure is shown. Figure 8 As shown, the encrypted data packet detection device is applied to the proxy center and includes a data receiving module 810, an information receiving module 820 and a data integration module 830. Among them:

[0126] The data receiving module 810 is used to receive the handle information and the original data packet of the encrypted data packet to be detected sent by the user state, the handle information and the original data packet are obtained by running the first data acquisition program in the user state, the original data packet is the data packet before encryption or after decryption obtained when the application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is based on the transmission between the user state and the kernel state in the connection of the preset secure communication protocol;

[0127] The information receiving module 820 is used to receive the five-tuple information of the encrypted data packet to be detected sent by the kernel state, the five-tuple information is the connection tracking performed by the kernel state, and the second data acquisition program is run to obtain the data according to the handle information of the encrypted data packet to be detected, and the connection tracking is initiated by the user state according to the security proxy policy information;

[0128] The data integration module 830 is used to integrate the five-tuple information with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected.

[0129] In the disclosed embodiment, the proxy center receives the handle information and the original data packet of the encrypted data packet to be detected sent by the user state, the handle information and the original data packet are obtained by running the first data acquisition program in the user state, the original data packet is the data packet before encryption or after decryption obtained when the application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is based on the transmission between the user state and the kernel state in the preset secure communication protocol connection; the five-tuple information of the encrypted data packet to be detected sent by the kernel state is received, the five-tuple information is connection tracking for the kernel state, and the second data acquisition program is run to obtain the handle information of the encrypted data packet to be detected, and the connection tracking is initiated by the user state according to the security proxy policy information; the five-tuple information is integrated with the original data packet according to the handle information to obtain the decrypted data packet corresponding to the encrypted data packet to be detected, and by improving the existing host security management center and the proxy center, the encrypted data packet on the cloud is restored to a four-layer decrypted data packet under low performance consumption for security analysis, which effectively solves the difficulty that the traditional traffic sniffing technology cannot truly observe the original content of the communication and brings to the system security monitoring and analysis, effectively improves the security detection of the communication system, and improves network security.

[0130] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0131] Refer to the following Fig. 9 The electronic device 900 according to this embodiment of the present disclosure is described. Fig. 9 The electronic device 900 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0132] like Fig. 9 As shown, the electronic device 900 is in the form of a general computing device. The components of the electronic device 900 may include but are not limited to: at least one processing unit 910, at least one storage unit 920, and a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910).

[0133] The storage unit stores program codes, which can be executed by the processing unit 910, so that the processing unit 910 executes the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processing unit 910 can execute the following steps: Figure 2 The method embodiment in the embodiment comprises the following steps: running a first data acquisition program in user mode to acquire the original data packet and handle information of the encrypted data packet to be detected, wherein the original data packet is the data packet before encryption or after decryption obtained when the application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is based on the transmission between the user mode and the kernel mode in the connection of the preset secure communication protocol; sending the handle information and the original data packet to the proxy center; initiating the preset secure communication protocol connection tracking according to the secure proxy policy information so that the kernel mode performs connection tracking, running a second data acquisition program, acquiring the five-tuple information of the encrypted data packet to be detected according to the handle information, and sending the five-tuple information of the encrypted data packet to be detected to the proxy center, and the proxy center integrates the five-tuple information with the original data packet according to the handle information to obtain the decrypted data packet corresponding to the encrypted data packet to be detected.

[0134] Exemplarily, the processing unit 910 may also execute the following steps: Figure 3 The method embodiment in the embodiment comprises the following steps: a proxy center, the method comprising: receiving handle information and an original data packet of an encrypted data packet to be detected sent by a user state, the handle information and the original data packet are obtained by running a first data acquisition program in the user state, the original data packet is a data packet before or after encryption obtained when an application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is based on the transmission between the user state and the kernel state in a connection with a preset secure communication protocol; receiving five-tuple information of an encrypted data packet to be detected sent by the kernel state, the five-tuple information is connection tracking for the kernel state, running a second data acquisition program, and obtaining it according to the handle information of the encrypted data packet to be detected, the connection tracking is initiated by the user state according to the security proxy policy information; integrating the five-tuple information with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected.

[0135] The storage unit 920 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 9201 and / or a cache storage unit 9202 , and may further include a read-only storage unit (ROM) 9203 .

[0136] The storage unit 920 may also include a program / utility 9204 having a set (at least one) of program modules 9205, such program modules 9205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0137] Bus 930 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0138] The electronic device 900 may also communicate with one or more external devices 940 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device 900, and / or any device that enables the electronic device 900 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface 950. Furthermore, the electronic device 900 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 960. Fig. 9 As shown, the network adapter 960 communicates with other modules of the electronic device 900 via the bus 930. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0139] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0140] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. In an exemplary embodiment of the present disclosure, a computer program product is also provided, which includes a computer program or a computer instruction, and the computer program or the computer instruction is loaded and executed by a processor to enable the computer to implement the steps of the method disclosed in the above embodiment.

[0141] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0142] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0143] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0144] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0145] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0146] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0147] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0148] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A method for detecting encrypted data packets, applied in user mode, characterized in that: The method comprises: Run a first data acquisition program to acquire an original data packet and handle information of an encrypted data packet to be detected, wherein the original data packet is a data packet before encryption or after decryption obtained when an application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is based on transmission between the user state and the kernel state in a connection using a preset secure communication protocol; Sending the handle information and the original data packet to a proxy center; Initiate the preset secure communication protocol connection tracking according to the secure proxy policy information to perform connection tracking in the kernel state, run the second data acquisition program, obtain the five-tuple information of the encrypted data packet to be detected according to the handle information, and send the five-tuple information of the encrypted data packet to be detected to the proxy center, the proxy center integrates the five-tuple information with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected.

2. The method for detecting encrypted data packets according to claim 1, characterized in that: The first data acquisition program supports multiple user state libraries, and the user state libraries include at least one of the free software library GnuTLS, the network security service NSS, and the open secure socket layer protocol OpenSSL.

3. The method for detecting encrypted data packets according to claim 2, characterized in that: The method further comprises: When the user state library is OpenSSL, the first data acquisition program is set in the secure socket layer write application programming interface and the secure socket layer read application programming interface of the OpenSSL; When the user state library is GnuTLS, the first data acquisition program is set in the record sending application programming interface and the record receiving application programming interface of the GnuTLS; When the user state library is NSS, the first data acquisition program is set in the write application programming interface, the send application programming interface, the read application programming interface and the receive application programming interface of the NSS.

4. A method for detecting encrypted data packets, applied to an agent center, characterized in that: The method comprises: Receive handle information and original data packet of the encrypted data packet to be detected sent by the user state, wherein the handle information and the original data packet are obtained by running a first data acquisition program in the user state, and the original data packet is a data packet before encryption or after decryption obtained when the application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is transmitted between the user state and the kernel state in a connection based on a preset secure communication protocol; Receive five-tuple information of the encrypted data packet to be detected sent by the kernel state, the five-tuple information is connection tracking for the kernel state, and run a second data acquisition program to obtain the data according to the handle information of the encrypted data packet to be detected, the connection tracking is initiated by the user state according to the security proxy policy information; The five-tuple information is integrated with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected.

5. An encrypted data packet detection device, applied in user mode, characterized in that: The device comprises: A data acquisition module, used to run a first data acquisition program to acquire an original data packet and handle information of an encrypted data packet to be detected, wherein the original data packet is a data packet before encryption or after decryption obtained when an application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is based on transmission between the user state and the kernel state in a preset secure communication protocol connection; A data sending module, used for sending the handle information and the original data packet to an agent center; A tracking initiation module is used to initiate the preset secure communication protocol connection tracking according to the security proxy policy information, so that the kernel state performs connection tracking, runs a second data acquisition program, obtains the five-tuple information of the encrypted data packet to be detected according to the handle information, and sends the five-tuple information of the encrypted data packet to be detected to the proxy center, and the proxy center integrates the five-tuple information with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected.

6. An encrypted data packet detection device, applied to an agent center, the device comprising: A data receiving module, used for receiving handle information and original data packets of the encrypted data packets to be detected sent by the user state, wherein the handle information and the original data packets are obtained by the user state running the first data acquisition program, and the original data packets are data packets before encryption or after decryption obtained when the application encrypts and decrypts data, and the connection tracking of the encrypted data packets to be detected is transmitted between the user state and the kernel state in the connection based on the preset secure communication protocol; An information receiving module, used for receiving the five-tuple information of the encrypted data packet to be detected sent by the kernel state, wherein the five-tuple information is obtained by the kernel state for connection tracking, running a second data acquisition program according to the handle information of the encrypted data packet to be detected, and the connection tracking is initiated by the user state according to the security proxy policy information; The data integration module is used to integrate the five-tuple information with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected.

7. An encrypted data packet detection system, characterized in that: It includes user state, kernel state and proxy center, among which: The user state is used to run a first data acquisition program to obtain the original data packet and handle information of the encrypted data packet to be detected, wherein the original data packet is a data packet before or after encryption obtained when the application encrypts and decrypts data, and the connection tracking of the encrypted data packet to be detected is based on the transmission between the user state and the kernel state in the preset secure communication protocol connection; the handle information and the original data packet are sent to the proxy center; and the preset secure communication protocol connection tracking is initiated according to the secure proxy policy information; The kernel state is used to run a second data acquisition program to perform connection tracking, obtain the five-tuple information of the encrypted data packet to be detected according to the handle information, and send the five-tuple information of the encrypted data packet to be detected to the proxy center; The proxy center is used to integrate the five-tuple information with the original data packet according to the handle information to obtain a decrypted data packet corresponding to the encrypted data packet to be detected.

8. An electronic device, characterized in that: include: A processor and a memory, wherein the memory is used to store executable instructions of the processor; The processor is configured to execute the encrypted data packet detection method according to any one of claims 1 to 3, or the encrypted data packet detection method according to claim 4, by executing the executable instructions.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the encrypted data packet detection method described in any one of claims 1 to 3, or implements the encrypted data packet detection method described in claim 4.

10. A computer program product having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the encrypted data packet detection method described in any one of claims 1 to 3 is implemented, or the encrypted data packet detection method described in claim 4 is implemented.

Images