Network traffic decryption detection method and device, medium and program product

Abstract

Embodiments of the present application provide a network traffic decryption detection method, device, medium and program product, applied to a traffic decryption system, the traffic decryption system being deployed in a device where a client is located in a forward proxy form, the method comprising: in response to a connection request of the client, obtaining server certificate information and generating a self-signature certificate; establishing a first encrypted connection channel with the client based on the self-signature certificate, and establishing a second encrypted connection channel with the target server; obtaining request data of a client and carrying out flow request detection; sending the request data to a target server; and obtaining response data fed back by the target server and sending the response data to the client. According to the embodiment of the invention, the traffic decryption system is deployed in the equipment where the client is located in a forward proxy mode, so that the traffic decryption system can conveniently obtain the traffic data of the client and realize traffic monitoring, and the applicability and flexibility of traffic monitoring for TLS traffic are effectively improved.

Description

Technical Field

[0001] The present application relates to the technical field of traffic monitoring, and in particular to a network traffic decryption detection method, device, medium and program product. Background Art

[0002] Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are security protocols that aim to provide security and data integrity for Internet communications.

[0003] Traditional network traffic monitoring and security protection solutions usually use bypass mode to perform in-depth inspection and auditing of messages. However, with the popularization and widespread application of SSL / TLS, the proportion of network traffic that can be processed by bypass mode-based security protection solutions is gradually decreasing. In order to process as much SSL / TLS traffic as possible, the security industry has proposed a method of decryption first and then monitoring: bypass decryption of SSL / TLS traffic in the network, and then implement security protection functions based on the decrypted traffic.

[0004] However, due to the confidentiality of the server's private key, it is difficult for the bypass decryption-based security protection solution to obtain and synchronize the server's key; and in order to adapt to the session reuse and recovery mechanism of the SSL / TLS protocol, the bypass decryption device needs to consume additional resources to maintain the session state and its session key; at the same time, in order to solve the certificate verification and trust chain problems, the bypass decryption device also needs to install the corresponding CA root certificate on the client in some way.

[0005] In summary, existing traffic decryption monitoring solutions have low applicability and flexibility for processing SSL / TLS traffic. Summary of the invention

[0006] The purpose of the embodiments of the present application is to provide a network traffic decryption detection method, device, medium and program product to improve the applicability and flexibility of the traffic decryption monitoring solution for processing SSL / TLS traffic.

[0007] In a first aspect, an embodiment of the present application provides a network traffic decryption detection method, which is applied to a traffic decryption system, wherein the traffic decryption system is deployed in a device where a client is located in the form of a forward proxy, and the method includes:

[0008] In response to a connection request initiated by a client to a target server, obtaining server certificate information of the target server based on the connection request, and generating a self-signed certificate based on the server certificate information;

[0009] Establishing a first encrypted connection channel with the client based on the self-signed certificate, and establishing a second encrypted connection channel with the target server based on the connection request;

[0010] Acquire request data transmitted by the client through the first encrypted connection channel, and perform traffic request detection on the client based on the request data;

[0011] Sending the request data to the target server through the second encrypted connection channel;

[0012] Acquire response data fed back by the target server through the second encrypted connection channel, and send the response data to the client through the first encrypted connection channel.

[0013] In an embodiment of the present application, by deploying a traffic decryption system on the device where the client is located in the form of a forward proxy, the traffic decryption system can directly obtain the client's traffic data and implement traffic monitoring in the form of a proxy connection, thereby effectively improving the applicability and flexibility of traffic monitoring for TLS traffic.

[0014] In some possible embodiments, before responding to the connection request initiated by the client to the target server, the method further includes:

[0015] In response to the proxy request of the client, performing a connection detection on a target server corresponding to the proxy request;

[0016] When the connection detection shows that the network is reachable, the address information of the target server is recorded, and the network reachability information is fed back to the client.

[0017] In the embodiment of the present application, a proxy request is first sent to determine whether the corresponding target server is reachable through the network, and then the connection establishment and data interaction process are performed if the network is reachable, thereby further improving the reliability of the proxy connection.

[0018] In some possible embodiments, the responding to the proxy request of the client includes:

[0019] In the case where it is detected that the transmission protocol of the network access request initiated by the client belongs to the preset transmission protocol type, responding to the proxy request of the client;

[0020] The preset transmission protocol types include Transport Layer Security (TLS) and Hypertext Transfer Protocol Security (HTPS).

[0021] In an embodiment of the present application, the access request type of the client is monitored and proxy connection communication is performed for the traffic data of a specific protocol type to obtain the traffic data of the specific protocol type for traffic monitoring, thereby further improving the flexibility of traffic monitoring.

[0022] In some possible embodiments, obtaining request data transmitted by the client through the first encrypted connection channel, and performing traffic request detection on the client based on the request data, includes:

[0023] Obtain request data transmitted by the client through the first encrypted connection channel, and send the request data to a third-party traffic request detection system, so that the third-party traffic request detection system performs traffic request detection on the client based on the request data.

[0024] In an embodiment of the present application, the client traffic obtained by the proxy connection is forwarded to a third-party traffic detection platform to implement traffic monitoring, thereby further improving the flexibility of traffic monitoring.

[0025] In some possible embodiments, sending the request data to the target server through the second encrypted connection channel includes:

[0026] When it is determined that the detection result of the traffic request detection meets the preset audit condition, sending the request data to the target server through the second encrypted connection channel;

[0027] When it is determined that the detection result of the traffic request detection does not meet the preset audit condition, abnormal reminder information is fed back to the client.

[0028] In an embodiment of the present application, the reliability of traffic monitoring is further improved by first performing traffic monitoring after obtaining the client request traffic, and forwarding the request traffic to the server only when the monitoring result is normal.

[0029] In some possible embodiments, the network traffic decryption detection method further includes:

[0030] When it is determined that the detection result of the flow request detection does not meet the preset audit condition, abnormal alarm information is fed back to the client and the current connection channel of the client is interrupted.

[0031] In the embodiment of the present application, the flexibility of traffic monitoring is further improved by monitoring the client traffic obtained by the proxy connection in an asynchronous manner, and interrupting the relevant connection channel and issuing an alarm when monitoring anomalies.

[0032] In some possible embodiments, the network traffic decryption detection method further includes:

[0033] Performing a flow response detection on the client based on the response data, and obtaining a second detection result of the flow response detection;

[0034] When it is determined that the second detection result does not meet the preset second audit condition, abnormal alarm information is fed back to the client and the current connection channel of the client is interrupted.

[0035] In the embodiment of the present application, the reliability and flexibility of flow monitoring are further improved by performing flow monitoring on the response data of the server.

[0036] In a second aspect, an embodiment of the present application provides a network traffic decryption detection device, which is applied to a traffic decryption system, wherein the traffic decryption system is deployed in a device where a client is located in the form of a forward proxy, and the device includes:

[0037] The certificate management module is used to respond to a connection request initiated by the client to the target server, obtain the server certificate information of the target server based on the connection request, and generate a self-signed certificate based on the server certificate information;

[0038] A connection establishment module, configured to establish a first encrypted connection channel with the client based on the self-signed certificate, and to establish a second encrypted connection channel with the target server based on the connection request;

[0039] A traffic acquisition module, used to acquire request data transmitted by the client through the first encrypted connection channel, and perform traffic request detection on the client based on the request data;

[0040] A traffic transmission module, used for sending the request data to the target server through the second encrypted connection channel;

[0041] A response feedback module is used to obtain response data fed back by the target server through the second encrypted connection channel, and send the response data to the client through the first encrypted connection channel.

[0042] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement the method described in any embodiment of the first aspect when executing the program.

[0043] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method described in any embodiment of the first aspect can be implemented.

[0044] In a fifth aspect, an embodiment of the present application provides a computer program product, wherein the computer program product includes a computer program, wherein when the computer program is executed by a processor, the method described in any embodiment of the first aspect can be implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 A flowchart of a network traffic decryption detection method provided in an embodiment of the present application;

[0047] Figure 2 A system architecture diagram of a network traffic decryption detection solution provided in an embodiment of the present application;

[0048] Figure 3 A schematic diagram of the structure of a network traffic decryption detection device provided in an embodiment of the present application;

[0049] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0051] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0052] It should be noted that the existing technology usually uses bypass decryption to obtain the encrypted traffic between the client and the server to achieve traffic monitoring. Bypass decryption refers to decrypting and detecting the content of the data packet in the transmission link without interfering with the encrypted connection between the client and the server.

[0053] However, for monitoring SSL / TLS traffic, the bypass decryption method has the following defects:

[0054] 1. Bypass decryption requires access to the server's private key to decrypt the key negotiation data during the TLS handshake process. However, the server's private key is confidential in nature and is usually not easily exposed, so there are certain difficulties in obtaining the private key. In addition, if the communication process uses a Perfect Forward Secrecy (PFS) encryption suite (such as ECDHE), since each connection uses a new session key, traffic decryption cannot be achieved even if the server's private key is available. For example, the TLS1.3 protocol no longer supports RSA key exchange, but relies entirely on PFS, so bypass decryption of communication traffic is almost impossible in a typical SSL / TLS architecture.

[0055] 2. Since the SSL / TLS protocol supports session reuse and resumption, the bypass decryption device needs to consume additional resources to maintain the session state and correctly manage the corresponding session keys to avoid decryption failure when reconnecting.

[0056] 3. The bypass decryption device needs to ensure that the client trusts the bypass decryption certificate. Therefore, the bypass decryption device usually needs to install a CA root certificate on the client device through a cumbersome process, and needs to ensure that it works smoothly on different devices and browsers, otherwise it may trigger a security warning. In addition, since it is difficult for the bypass decryption device to achieve completely transparent decryption operations, it often has a certain degree of impact on the client or server, which can easily lead to connection interruptions, delays or other problems that affect the user experience.

[0057] In response to the problems existing in the above-mentioned prior art, an embodiment of the present application provides a network traffic decryption detection method. By deploying a traffic decryption system with a forward proxy connection function on the device where the client is located, the traffic of encrypted communication between the client and the server can be directly obtained and the traffic can be monitored, and the session key and maintenance process of the bypass decryption scheme are omitted, thereby further improving the applicability and flexibility of traffic decryption monitoring for TLS traffic.

[0058] like Figure 1 As shown, the embodiment of the present application provides a network traffic decryption detection method, which is applied to a traffic decryption system. The traffic decryption system is deployed in the device where the client is located in the form of a forward proxy. The method may include the steps of:

[0059] S1. In response to a connection request initiated by a client to a target server, server certificate information of the target server is obtained based on the connection request, and a self-signed certificate is generated based on the server certificate information.

[0060] It should be noted that the traffic decryption system is deployed on the client-side device, so that the client and the traffic decryption system are actually in the same operating environment, which can easily realize the establishment of a secure and trustworthy environment between the traffic decryption system and the client. The client can be a browser or application on the device.

[0061] It should be noted that a forward proxy configuration can be performed on the client side so that the client can access the target server through the proxy of the traffic decryption system. Since the traffic decryption system accesses the target server on behalf of the client, there is no need to rely on the certificate and private key of the target server when obtaining the client's traffic.

[0062] For example, when a client initiates an HTTPS or TLS request, the traffic decryption system intercepts the client's request in a "man-in-the-middle" manner. On the one hand, the traffic decryption system establishes a TLS connection with the client in the role of a "server", and on the other hand, it establishes a TLS connection with the target server in the role of a "client". In this way, relative to the client, the traffic decryption system obtains the traffic data sent by the client by "disguising" itself as the target server, thereby realizing traffic monitoring of the client.

[0063] Specifically, when the client initiates a request to the target server, the traffic decryption system obtains information such as the server address to be accessed based on the client's connection request, and obtains the certificate information of the corresponding server based on the server address information, and then generates a self-signed certificate based on the certificate information. By replacing the server certificate with the corresponding self-signed certificate, a TLS connection is established with the client based on the self-signed certificate.

[0064] It should be noted that the certificate information includes information such as expiration time, serial number, digital signature, etc. In traditional TLS communication, the client needs to verify the certificate information of the server, but in the embodiment of the present application, since the traffic decryption system is used as a proxy, the certificate verification policy is modified in the device where the client is located. The client no longer uses the real server certificate as the basis for verification, but uses the self-signed certificate of the traffic decryption system belonging to the device as the basis for verification. In this way, there is no need to deploy the root certificate corresponding to the bypass decryption certificate or proxy certificate on the client side, which solves the certificate verification and trust chain problems on the client side.

[0065] S2. Establish a first encrypted connection channel with the client based on the self-signed certificate, and establish a second encrypted connection channel with the target server based on the connection request.

[0066] It can be understood that based on the locally generated self-signed certificate, the traffic decryption system is equivalent to the role of the server relative to the client. The encrypted connection channel originally established between the client and the real target server is essentially transformed into a first encrypted connection channel established between the client and the traffic decryption system and a second encrypted connection channel established between the traffic decryption system and the target server.

[0067] S3. Obtain request data transmitted by the client through the first encrypted connection channel, and perform traffic request detection on the client based on the request data.

[0068] Specifically, since the connection between the client and the target server is essentially transformed into a transit connection proxied by the traffic decryption system, the original form of the client directly sending request data to the target server is essentially transformed into the client sending the request data to the target server through the traffic decryption system.

[0069] It is understandable that since the traffic decryption system is equivalent to the server role for the client, the TLS encrypted communication between the client and the server is essentially the TLS encrypted communication between the client and the traffic decryption system. In this way, the traffic decryption system can directly obtain the TLS traffic (request data) sent by the client.

[0070] It should be noted that after obtaining the TLS traffic, the traffic decryption system can perform traffic request detection on the client based on the obtained request data. Exemplarily, the traffic request detection can be performed according to the traffic detection strategy built into the traffic decryption system.

[0071] S4. Send the request data to the target server through the second encrypted connection channel.

[0072] It should be noted that after obtaining the client's request data through the first encrypted connection channel, the traffic decryption system can exchange data with the target server through the previously established TLS connection channel (second encrypted connection channel) based on the identity of the "client" and encapsulate the request data again. Send the request data to the target server through the second encrypted connection channel.

[0073] S5. Obtain response data fed back by the target server through the second encrypted connection channel, and send the response data to the client through the first encrypted connection channel.

[0074] It is understandable that after receiving the request data, the target server will return the corresponding response data along the original path. After receiving the response data fed back by the target server, the traffic decryption system first decrypts the response data based on the negotiation of TLS transmission, and then encrypts the data with the TLS certificate expected by the client (i.e. the self-signed certificate mentioned above), and returns it to the client through the previously established TLS connection channel (the first encrypted connection channel) as the "server".

[0075] Based on this, by deploying the traffic decryption system on the client device in the form of a forward proxy, the traffic decryption system can directly obtain the client's traffic data and realize traffic monitoring in the form of a proxy connection, thereby effectively improving the applicability and flexibility of traffic monitoring for TLS traffic.

[0076] In some possible embodiments, before step S1, the following steps may also be included:

[0077] In response to the proxy request of the client, performing a connection detection on the target server corresponding to the proxy request;

[0078] When the connection detection shows that the network is reachable, the address information of the target server is recorded, and the network reachability information is fed back to the client.

[0079] It should be noted that before actually establishing a connection request and performing data interaction, a proxy connection request can be made first. Specifically, by configuring a forward proxy in the client device, the traffic decryption system can implement the proxy function. For example, the traffic decryption system can be configured to support HTTP / HTTPS and SOCKS5 proxies.

[0080] It should be noted that the scheme of the embodiment of the present application can be divided into two stages, the first stage is the proxy connection request stage, and the second stage is the TLS connection establishment and data interaction stage. Among them, in the proxy connection request stage, the client initiates a proxy request, the traffic decryption system responds to the client's proxy request, and attempts to connect to the target server (connection detection) according to the target server address specified in the proxy request. If the network connection is detected to be reachable, the network reachable response information is returned to the client, and the address information of the target server is recorded so as to request connection and data interaction in the next stage; if the network connection is unreachable, an abnormal reminder message is returned to the client.

[0081] Based on this, by first sending a proxy request to determine whether the corresponding target server is reachable through the network, and then performing the connection establishment and data exchange process when the network is reachable, the reliability of the proxy connection is further improved.

[0082] In some possible embodiments, responding to the proxy request of the client includes:

[0083] When it is detected that the transmission protocol of the network access request initiated by the client belongs to the preset transmission protocol type, responding to the proxy request of the client;

[0084] The preset transmission protocol types include Transport Layer Security (TLS) and Hypertext Transfer Protocol Security (HTPS).

[0085] It should be noted that, since existing traffic monitoring technology is mainly limited when processing SSL / TLS, the embodiments of the present application can only decrypt and monitor SSL / TLS traffic.

[0086] It should be noted that you can configure the types of data transmission protocols that require traffic monitoring, such as Transport Layer Security (TLS) and Hypertext Transfer Protocol Secure (HTTPS); the traffic decryption system monitors the network access requests initiated by the client, and when the requested transmission protocol type belongs to the preset transmission protocol type, it responds to the client's proxy request, and implements the TLS connection and data interaction between the client and the target server through a forward proxy, and obtains the request data for traffic monitoring.

[0087] It should be noted that TLS (Transport Layer Security) is a security protocol that provides security and data integrity for network communications. The predecessor of TLS is SSL (Secure Sockets Layer). SSL has gone through several versions, including SSL 1.0, which has never been made public, SSL 2.0, which has serious security vulnerabilities, and SSL 3.0, which has been abandoned due to many security flaws. The standardized subsequent version of SSL is named TLS 1.0, which aims to provide a more secure and standardized encrypted communication method.

[0088] HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP (Hypertext Transfer Protocol), which is HTTP based on SSL security.

[0089] Based on this, by monitoring the access request type of the client and performing proxy connection communication for the traffic data of a specific protocol type, the traffic data of a specific protocol type can be obtained for traffic monitoring, thereby further improving the flexibility of traffic monitoring.

[0090] In some possible embodiments, step S3, obtaining request data transmitted by the client through the first encrypted connection channel, and performing traffic request detection on the client based on the request data, may include:

[0091] Obtain request data transmitted by the client through the first encrypted connection channel, and send the request data to a third-party traffic request detection system, so that the third-party traffic request detection system performs traffic request detection on the client based on the request data.

[0092] It should be noted that in addition to realizing traffic detection of request data based on the detection strategy built into the traffic decryption system, traffic request detection can also be performed based on a third-party traffic request detection system independent of the traffic decryption system. It is understandable that the third-party traffic request detection system can use various relatively mature network traffic analysis tools in the industry. The traffic decryption system converts the plaintext data (request data) obtained by decryption into a corresponding processing format (such as PCAP format, etc.) and sends it to the network traffic analysis tool, so that the network traffic analysis tool can perform traffic detection and behavior analysis, and feed back the detection and analysis results to the traffic decryption system.

[0093] Based on this, the flexibility of traffic monitoring is further improved by using a third-party traffic detection system to detect and analyze the traffic data forwarded by the traffic decryption system.

[0094] In some possible embodiments, step S4, sending the request data to the target server through the second encrypted connection channel, may include:

[0095] When it is determined that the detection result of the traffic request detection meets the preset audit condition, the request data is sent to the target server through the second encrypted connection channel;

[0096] When it is determined that the detection result of the traffic request detection does not meet the preset audit conditions, abnormal reminder information is fed back to the client.

[0097] It should be noted that before obtaining the request data sent by the client and accurately forwarding it to the target server, the request data may be first subjected to flow detection and analysis and corresponding measures may be taken according to the detection results.

[0098] Specifically, based on the obtained request data, traffic detection and analysis can be performed locally in the traffic decryption system or forwarded to a third-party traffic detection system. After obtaining the corresponding detection results, it is first determined whether the detection results meet the conditions (meet the preset audit conditions) based on the preset audit rules. If so, the request data is forwarded to the target server to complete the complete data request and access process; if not, the request data is not forwarded to the target server to interrupt the current data request and access process, and abnormal reminder information is fed back to the client.

[0099] Based on this, the reliability of traffic monitoring is further improved by first monitoring the traffic after obtaining the client request traffic and forwarding the request traffic to the server only when the monitoring result is normal.

[0100] In some possible embodiments, the network traffic decryption detection method further includes:

[0101] When it is determined that the detection result of the traffic request detection does not meet the preset audit conditions, abnormal alarm information is fed back to the client and the current connection channel of the client is interrupted.

[0102] It should be noted that in addition to waiting for the traffic detection results and determining whether to continue forwarding the request data based on the detection results, you can also temporarily ignore the traffic detection results and forward the request data according to the normal process for data access. After receiving the detection results of the traffic request detection, and when the detection results do not meet the preset audit conditions, the corresponding data request will be processed.

[0103] Exemplarily, the correspondence between the request data and the transmission link (connection channel) can be recorded in the process of forwarding the request data, and the request data can be subjected to flow detection and analysis in an asynchronous processing manner. When the flow detection result is obtained and it is determined that the detection result does not meet the preset audit conditions, the connection channel corresponding to the detection result can be interrupted to suspend or terminate the data transmission of the connection channel, and abnormal alarm information can be fed back to the client so that the client can take further measures according to the actual situation.

[0104] Based on this, the flexibility of traffic monitoring is further improved by asynchronously monitoring the client request traffic obtained by the proxy connection and interrupting the relevant connection channels and issuing alarms when monitoring anomalies.

[0105] In some possible embodiments, the network traffic decryption detection method further includes:

[0106] Performing a flow response detection on the client based on the response data, and obtaining a second detection result of the flow response detection;

[0107] When it is determined that the second detection result does not meet the preset second audit condition, abnormal alarm information is fed back to the client and the current connection channel of the client is interrupted.

[0108] It should be noted that in addition to monitoring the client's traffic based on request data, the client's traffic can also be monitored based on response data.

[0109] Specifically, after obtaining the response data returned by the target service through the second encrypted connection channel, the response data can be subjected to traffic detection and analysis (traffic response detection) locally in the traffic decryption system or by using a third-party traffic detection system, and the corresponding second detection result can be obtained. Similar to the traffic request detection, based on the correspondence between the pre-recorded connection channel and the response data, when it is judged that the response data detection is abnormal (the second detection result does not meet the preset second audit condition), the corresponding connection channel is disconnected to suspend or terminate the data transmission of the connection channel, and abnormal alarm information is fed back to the client so that the client can take further measures according to the actual situation.

[0110] Based on this, by further monitoring the flow of response data from the server, the reliability and flexibility of flow monitoring can be improved.

[0111] See also Figure 2 , exemplarily, the traffic decryption system of the embodiment of the present application mainly includes a proxy unit, a TLS server unit, a TLS client unit, a certificate management unit and a traffic detection unit.

[0112] Specifically, the proxy unit is used for the proxy function and supports HTTP / HTTPS and SOCKS5 proxies. When the client connects to the traffic decryption system, it connects to the proxy unit; the proxy unit parses the HTTPS and SOCKS5 traffic and obtains the IP address of the target server to be connected. The TLS server unit is used to complete the TLS handshake with the client; the TLS client unit is used to complete the TLS handshake with the server (target server). The certificate management unit is used to extract the information of the server certificate and generate a self-signed certificate. The traffic detection unit is used to perform traffic detection and analysis on the interaction data between the client and the server obtained by the traffic decryption system, wherein the traffic detection unit can complete the traffic detection and analysis locally or forward the data to a third-party detection system and obtain the detection results.

[0113] It should be noted that the embodiments of the present application have the following beneficial effects:

[0114] 1. The embodiment of the present application is unaware of the server, ensuring the security and independence of the server. Since it does not involve any configuration changes or topology adjustments to the server, it will not affect the network architecture or normal operation of the server. At the same time, since the intervention of the proxy connection only occurs on the client side, it will not pose a risk to the security of the server, avoiding the possibility of the server being exposed or attacked.

[0115] 2. The client only needs to set up a forward proxy in the browser or application to complete the configuration, without the need for additional complex configurations, so that the embodiment of the present application can be quickly deployed in different client environments, improving the applicability and convenience of traffic decryption monitoring.

[0116] 3. The embodiment of the present application can decrypt the encrypted traffic between the client and the server into plain text data, and further convert these data into a commonly used PCAP format file to facilitate comprehensive detection, behavior analysis and log recording of the traffic in the detection system, so that the traffic decryption solution can be seamlessly integrated into the existing security monitoring and auditing system, thereby effectively improving the monitoring depth and analysis capabilities of the security system.

[0117] Please refer to Figure 3 , Figure 3 FIG. 1 shows a block diagram of a network traffic decryption detection device provided by some embodiments of the present application. It should be understood that the network traffic decryption detection device is similar to the above-mentioned Figure 1 Corresponding to the method embodiment, the various steps involved in the above method embodiment can be executed. The specific functions of the network traffic decryption detection device can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0118] Figure 3 The network traffic decryption detection device includes at least one software function module that can be stored in a memory in the form of software or firmware or fixed in the network traffic decryption detection device. The network traffic decryption detection device is applied to a traffic decryption system, and the traffic decryption system is deployed in the device where the client is located in the form of a forward proxy, including:

[0119] The certificate management module 310 is used to respond to a connection request initiated by the client to the target server, obtain the server certificate information of the target server based on the connection request, and generate a self-signed certificate based on the server certificate information;

[0120] A connection establishment module 320, configured to establish a first encrypted connection channel with the client based on the self-signed certificate, and to establish a second encrypted connection channel with the target server based on the connection request;

[0121] The traffic acquisition module 330 is used to acquire the request data transmitted by the client through the first encrypted connection channel, and perform traffic request detection on the client based on the request data;

[0122] Traffic transmission module 340, used to send the request data to the target server through the second encrypted connection channel;

[0123] The response feedback module 350 is used to obtain the response data fed back by the target server through the second encrypted connection channel, and send the response data to the client through the first encrypted connection channel.

[0124] It can be understood that the above-mentioned device item embodiment corresponds to the method item embodiment of the present invention. A network traffic decryption detection device provided by the embodiment of the present invention can implement the network traffic decryption detection method provided by any method item embodiment of the present invention.

[0125] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0126] like Figure 4 As shown, some embodiments of the present application provide an electronic device 400, which includes: a memory 410, a processor 420, and a computer program stored in the memory 410 and executable on the processor 420, wherein the processor 420 reads the program from the memory 410 through a bus 430 and executes the program to implement a method of any embodiment included in the above-mentioned network traffic decryption detection method.

[0127] Processor 420 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 420 can be a microprocessor.

[0128] The memory 410 may be used to store instructions executed by the processor 420 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 420 of the disclosed embodiment may be used to execute instructions in the memory 410 to implement the method shown above. The memory 410 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0129] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon. The computer program is executed by a processor to execute the method described in the method embodiment.

[0130] Some embodiments of the present application further provide a computer program product, which, when executed on a computer, enables the computer to execute the method described in the method embodiment.

[0131] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0132] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0133] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0134] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0135] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0136] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0137] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A network traffic decryption detection method, characterized in that: Applied to a traffic decryption system, the traffic decryption system is deployed in the device where the client is located in the form of a forward proxy, and the method includes: In response to a connection request initiated by a client to a target server, obtaining server certificate information of the target server based on the connection request, and generating a self-signed certificate based on the server certificate information; Establishing a first encrypted connection channel with the client based on the self-signed certificate, and establishing a second encrypted connection channel with the target server based on the connection request; Acquire request data transmitted by the client through the first encrypted connection channel, and perform traffic request detection on the client based on the request data; Sending the request data to the target server through the second encrypted connection channel; Acquire response data fed back by the target server through the second encrypted connection channel, and send the response data to the client through the first encrypted connection channel.

2. The network traffic decryption detection method according to claim 1, characterized in that: Before responding to the connection request initiated by the client to the target server, the method further includes: In response to the proxy request of the client, performing a connection detection on a target server corresponding to the proxy request; When the connection detection shows that the network is reachable, the address information of the target server is recorded, and the network reachability information is fed back to the client.

3. The network traffic decryption detection method according to claim 2, characterized in that: The response to the proxy request of the client includes: In the case where it is detected that the transmission protocol of the network access request initiated by the client belongs to the preset transmission protocol type, responding to the proxy request of the client; The preset transmission protocol types include Transport Layer Security (TLS) and Hypertext Transfer Protocol Security (HTPS).

4. The network traffic decryption detection method according to claim 1, characterized in that: The obtaining request data transmitted by the client through the first encrypted connection channel, and performing flow request detection on the client based on the request data, includes: Obtain request data transmitted by the client through the first encrypted connection channel, and send the request data to a third-party traffic request detection system, so that the third-party traffic request detection system performs traffic request detection on the client based on the request data.

5. The network traffic decryption detection method according to claim 1, characterized in that: The sending the request data to the target server through the second encrypted connection channel includes: When it is determined that the detection result of the traffic request detection meets the preset audit condition, sending the request data to the target server through the second encrypted connection channel; When it is determined that the detection result of the traffic request detection does not meet the preset audit condition, abnormal reminder information is fed back to the client.

6. The network traffic decryption detection method according to claim 1, characterized in that: Also includes: When it is determined that the detection result of the flow request detection does not meet the preset audit condition, abnormal alarm information is fed back to the client and the current connection channel of the client is interrupted.

7. The network traffic decryption detection method according to claim 1, characterized in that: Also includes: Performing a flow response detection on the client based on the response data, and obtaining a second detection result of the flow response detection; When it is determined that the second detection result does not meet the preset second audit condition, abnormal alarm information is fed back to the client, and the current connection channel of the client is interrupted.

8. An electronic device, characterized in that: It comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor can implement the network traffic decryption detection method described in any one of claims 1 to 7 when executing the program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the network traffic decryption detection method according to any one of claims 1 to 7 is executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the network traffic decryption detection method according to any one of claims 1 to 7 is implemented.

Images