A method and device for identifying a proxy IP address

Abstract

The present invention provides a method and device for identifying a proxy IP address. The method comprises: setting a service domain name of a server, and generating ECH configuration information according to the service domain name, wherein the ECH configuration information comprises a key and a setting value; the public DNS service distributes the ECH configuration information according to the service domain name; the server receives a handshake request from a client, and receives ClientHello data. If the ClientHello data comprises ClientHelloOuter and ClientHelloInner, the IP address of the client is not a proxy IP address; otherwise, the IP address of the client is a proxy IP address. This method has high identification accuracy, high speed, low deployment cost, and is imperceptible to the customer.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and device for identifying a proxy IP address. Background Art

[0002] In international business, service providers that provide enterprise applications need to obtain the IP information of the requesting users and conduct necessary security and compliance checks to prevent batch registration by some users, automated behavioral attacks, and other behaviors that endanger the interests of the service provider and other compliant users.

[0003] Most detections must be carried out through the request source IP, but the proxy technology provided by many IP proxy service providers currently allows some users to easily bypass the IP-related detections set by the service provider and achieve their goals.

[0004] It is very important to determine whether the user uses a proxy to access the network. The existing methods for determining whether the user uses a proxy are very expensive, and there are roughly two types: IP address query and reverse DNS lookup.

[0005] IP address query: The principle is relatively simple. The server first obtains the source IP of the request through the network protocol (if the user uses a proxy, the service obtains the proxy IP), and then purchases and uses a public or commercial IP database to check whether the source IP belongs to a known proxy, VPN or data center.

[0006] The accuracy of this method depends on the effectiveness of the IP database, and its credibility is very high from the actual use. The disadvantage is that the cost of using the IP database is high, ranging from US$100 to US$600 per million calls. For large services that are called tens of millions of times a day, this is a huge cost expenditure.

[0007] Reverse DNS lookup: Using the characteristics of DNS (Domain Name Resolution Service), this method is likely to find the user's real IP information even if the user uses a proxy to access. Its principle is relatively complex, and companies must undergo certain compliance reviews before they can implement related services. The R&D cost is relatively high, and the deployment cost is also high. The more services are deployed, the higher the accuracy. Summary of the invention

[0008] The technical problem to be solved by the present invention is to provide a method and device for identifying a proxy IP address, which has high identification accuracy, high speed, low deployment cost, and is imperceptible to customers.

[0009] In a first aspect, the present invention provides a method for identifying a proxy IP address, which is used for identifying the IP address of a browser supporting the ECH protocol, comprising the following steps:

[0010] Step 1: Set the service domain name of the server and generate ECH configuration information according to the service domain name, wherein the ECH configuration information includes a key and a setting value;

[0011] Step 2: The server notifies the public DNS service provider to add an HTTPS Resource Record, where the HTTPS Resource Record is used to record ECH configuration information; the public DNS service distributes the ECH configuration information according to the service domain name;

[0012] Step 3: After the client sends a resolution request for the service domain name to the public DNS service, the public DNS returns the IP and ECH configuration information corresponding to the service domain name to the client;

[0013] Step 4: The server receives the handshake request from the client and receives the ClientHello data. If the ClientHello data includes ClientHelloOuter and ClientHelloInner, the IP address of the client is not the proxy IP address; otherwise, the IP address of the client is the proxy IP address.

[0014] In a second aspect, the present invention provides a device for identifying a proxy IP address, which is used for identifying the IP address of a browser supporting the ECH protocol, and includes the following modules:

[0015] A setting module, which sets the service domain name of the server and generates ECH configuration information according to the service domain name, wherein the ECH configuration information includes a key and a setting value;

[0016] Notification module, the server notifies the public DNS service provider to add an HTTPS Resource Record, the HTTPS Resource Record is used to record the ECH configuration information; the public DNS service distributes the ECH configuration information according to the service domain name;

[0017] Request module: after the client sends a resolution request for the service domain name to the public DNS service, the public DNS returns the IP and ECH configuration information corresponding to the service domain name to the client;

[0018] Receiving judgment module, the server receives the handshake request from the client and receives ClientHello data. If the ClientHello data includes ClientHelloOuter and ClientHelloInner, the IP address of the client is not a proxy IP address; otherwise, the IP address of the client is a proxy IP address.

[0019] One or more technical solutions provided by the present invention have at least the following technical effects or advantages:

[0020] The present invention can determine whether the client's IP address is a proxy IP address by obtaining the set data, and its accuracy is very high. When implemented, the server-side research and development difficulty is low and the cost is also low, which greatly reduces the cost of the enterprise. The judgment speed is very fast and can be determined when the client makes a handshake request, which is imperceptible to the user.

[0021] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The present invention will be further described below in conjunction with embodiments with reference to the accompanying drawings.

[0023] Figure 1 is a flow chart of the method in Embodiment 1 of the present invention;

[0024] Figure 2 It is a schematic diagram of the structure of the device in the second embodiment of the present invention. DETAILED DESCRIPTION

[0025] The embodiments of the present application provide a method and device for identifying a proxy IP address, thereby solving the technical problem of high cost of identifying a proxy IP in the prior art.

[0026] The technical solution in the embodiment of the present application has the following general idea:

[0027] The present invention uses Encrypted Client Hello (ECH), a privacy-enhancing network security technology, to implement a highly accurate and low-cost solution to determine whether a user device uses a proxy. The method is only suitable for browsers such as Google Chrome-kernel 117, Microsoft Edge-kernel 117 or Firefox-kernel 119.

[0028] In the traditional HTTPS connection establishment process, the client (such as a browser) sends a plaintext ServerName Indication (SNI) field to the server through the TLS handshake. SNI reveals the domain name of the server that the client is trying to access. This may be used by a third party (Internet Service Provider (ISP) Internet Service Provider) to monitor the user's browsing behavior.

[0029] ECH performs hybrid encryption on SNI during the TLS handshake to prevent the server domain name that the client attempts to access from being monitored by a third party.

[0030] With this security extension, it is very easy to detect whether the user's device is using a proxy.

[0031] First, the ECH configuration work:

[0032] 1. Assume that the server service domain name is mycompany.com. This domain name generates ECH configuration information. The ECH configuration information includes: key and verification domain name ech.mycompany.com.

[0033] 2. Notify the public DNS service provider to add an HTTPS Resource Record, where the HTTPS Resource Record is used to record the ECH configuration information.

[0034] Once configured, the public DNS service can distribute ECH configuration information for the domain name mycompany.com.

[0035] When the user device directly accesses mycompany.com without using a proxy, the specific request process is as follows:

[0036] 1. The user device sends a resolution request to the public DNS service for the domain name mycompany.com.

[0037] 2. The public DNS returns the IP address and ECH configuration information corresponding to mycompany.com to the user device;

[0038] 3. The user device discovers that mycompany.com has a key, constructs a secure ClientHello packet during the TLS handshake, and sends it to the IP address corresponding to mycompany.com.

[0039] Compared with the traditional ClientHello, the new data packet is divided into two layers. The outer layer is called ClientHelloOuter. The SNI field in the outer layer stores the ECH verification domain name ech.mycompany.com, which is in plain text. The inner layer of the new data packet is called ClientHelloInner. Its SNI field stores the real target domain name mycompany.com, which is encrypted through hybrid encryption.

[0040] 4. When the mycompany.com server receives the handshake request data from the client, it verifies that the SNI of ClientHelloOuter is ech.mycompany.com, decrypts the SNI field of ClientHelloInner with the key, obtains the real TLS information, completes the handshake, and returns a valid ServerHello data packet.

[0041] 5. The user client receives the ServerHello message from the server and completes the verification, and the TLS handshake ends. After that, the client can communicate with the server in encrypted form.

[0042] If the user's device uses a proxy to access mycompany.com, the situation will be different. The specific process is as follows:

[0043] 1. The user device notifies the proxy service to establish a connection with the mycompany.com service.

[0044] 2. The proxy service sends a resolution request to the public DNS service for the domain name mycompany.com.

[0045] 3. The public DNS returns the IP address and ECH configuration information corresponding to mycompany.com to the proxy service;

[0046] 4. The proxy service establishes a connection with the IP corresponding to mycompany.com, and then notifies the user device that the connection to mycompany.com is successfully established. The proxy service does not process ECH for two reasons: one is that the existing proxy protocol does not send ECH configuration information to the user device, and the other is that apps such as browsers do not support obtaining ECH configuration information from the proxy protocol.

[0047] 5. The user device does not obtain the ECH configuration information. During the TLS handshake, it constructs a traditional ClientHello packet and sends it to the proxy service. The SNI field in the traditional ClientHello stores mycompany.com, which is in plain text.

[0048] 6. The proxy service forwards the traditional ClientHello packet from the user device to the mycompany.com server.

[0049] 7. When the mycompany.com server receives the handshake request data from the client, it reads the outer SNI word as mycompany.com, which is inconsistent with the check value ech.mycompany.com. The server determines that this is a traditional TLS handshake, obtains the real TLS information and completes the handshake according to tradition, and also returns a valid ServerHello data packet; it accurately determines the current source IP as a proxy;

[0050] 8. The user client receives the ServerHello message from the server and completes the verification, and the TLS handshake ends. After that, the client can communicate with the server in encrypted form.

[0051] Embodiment 1

[0052] like Figure 1 As shown, this embodiment provides a method for identifying a proxy IP address, which is used for identifying the IP address of a browser supporting the ECH protocol, and includes the following steps:

[0053] Step 1: Set the service domain name of the server and generate ECH configuration information according to the service domain name. The ECH configuration information includes a key and a setting value. The setting value is the verification domain name, which is used when the ClientHelloInner cannot be decrypted. Complete handshake ;

[0054] Step 2: The server notifies the public DNS service provider to add an HTTPS Resource Record, where the HTTPS Resource Record is used to record ECH configuration information; the public DNS service distributes the ECH configuration information according to the service domain name;

[0055] Step 3: After the client sends a resolution request for the service domain name to the public DNS service, the public DNS returns the IP and ECH configuration information corresponding to the service domain name to the client;

[0056] Step 4: The server receives the handshake request from the client and receives the ClientHello data. If the ClientHello data includes ClientHelloOuter and ClientHelloInner, the IP address of the client is not the proxy IP address; otherwise, the IP address of the client is the proxy IP address.

[0057] In this embodiment, preferably, step 4 is specifically as follows: the server receives a handshake request from the client, receives ClientHello data, and if the ClientHello data includes ClientHelloOuter and ClientHelloInner, ClientHelloOuter includes a plain text setting value, and ClientHelloInner includes a service domain name encrypted by a key; then the IP address of the client is not a proxy IP address;

[0058] If the ClientHello data only includes the service domain name in plain text, the IP address of the client is the proxy IP address.

[0059] Based on the same inventive concept, the present application also provides a device corresponding to the method in Example 1, see Example 2 for details.

[0060] Embodiment 2

[0061] like Figure 2As shown, in this embodiment, a device for identifying a proxy IP address is provided, which is used to identify the IP address of a browser supporting the ECH protocol, and includes the following modules:

[0062] A setting module, which sets the service domain name of the server and generates ECH configuration information according to the service domain name, wherein the ECH configuration information includes a key and a setting value;

[0063] Notification module, the server notifies the public DNS service provider to add an HTTPS Resource Record, the HTTPS Resource Record is used to record the ECH configuration information; the public DNS service distributes the ECH configuration information according to the service domain name;

[0064] Request module: after the client sends a resolution request for the service domain name to the public DNS service, the public DNS returns the IP and ECH configuration information corresponding to the service domain name to the client;

[0065] Receiving judgment module, the server receives the handshake request from the client and receives ClientHello data. If the ClientHello data includes ClientHelloOuter and ClientHelloInner, the IP address of the client is not a proxy IP address; otherwise, the IP address of the client is a proxy IP address.

[0066] In this embodiment, preferably, the receiving judgment module is specifically: the server receives the handshake request of the client, receives the ClientHello data, if the ClientHello data includes ClientHelloOuter and ClientHelloInner, ClientHelloOuter includes a plain text setting value, and ClientHelloInner includes a service domain name encrypted by a key; then the IP address of the client is not a proxy IP address;

[0067] If the ClientHello data only includes the service domain name in plain text, the IP address of the client is the proxy IP address.

[0068] Since the device introduced in the second embodiment of the present invention is a device used to implement the method of the first embodiment of the present invention, those skilled in the art can understand the specific structure and deformation of the device based on the method introduced in the first embodiment of the present invention, so it is not described here in detail. All devices used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0069] Although the specific implementation modes of the present invention are described above, those skilled in the art should understand that the specific implementation modes described are only illustrative and are not intended to limit the scope of the present invention. Equivalent modifications and changes made by those skilled in the art in accordance with the spirit of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A method for identifying a proxy IP address, characterized in that: IP address identification for browsers supporting the ECH protocol includes the following steps: Step 1: Set the service domain name of the server and generate ECH configuration information according to the service domain name, wherein the ECH configuration information includes a key and a setting value; Step 2: The server notifies the public DNS service provider to add an HTTPS Resource Record, where the HTTPS Resource Record is used to record ECH configuration information; the public DNS service distributes the ECH configuration information according to the service domain name; Step 3: After the client sends a resolution request for the service domain name to the public DNS service, the public DNS returns the IP and ECH configuration information corresponding to the service domain name to the client; Step 4: The server receives the handshake request from the client and receives the ClientHello data. If the ClientHello data includes ClientHelloOuter and ClientHelloInner, the IP address of the client is not the proxy IP address; otherwise, the IP address of the client is the proxy IP address.

2. A method for identifying a proxy IP address according to claim 1, characterized in that: The step 4 is specifically as follows: the server receives the handshake request from the client and receives ClientHello data. If the ClientHello data includes ClientHelloOuter and ClientHelloInner, the ClientHelloOuter includes a plain text setting value, and the ClientHelloInner includes a service domain name encrypted by a key, then the IP address of the client is not a proxy IP address; If the ClientHello data only includes the service domain name in plain text, the IP address of the client is the proxy IP address.

3. A device for identifying a proxy IP address, characterized in that: Used for IP address identification of browsers that support the ECH protocol, including the following modules: A setting module, which sets the service domain name of the server and generates ECH configuration information according to the service domain name, wherein the ECH configuration information includes a key and a setting value; Notification module, the server notifies the public DNS service provider to add an HTTPS Resource Record, the HTTPS Resource Record is used to record the ECH configuration information; the public DNS service distributes the ECH configuration information according to the service domain name; Request module: after the client sends a resolution request for the service domain name to the public DNS service, the public DNS returns the IP and ECH configuration information corresponding to the service domain name to the client; Receiving judgment module, the server receives the handshake request from the client and receives ClientHello data. If the ClientHello data includes ClientHelloOuter and ClientHelloInner, the IP address of the client is not a proxy IP address; otherwise, the IP address of the client is a proxy IP address.

4. The device for identifying a proxy IP address according to claim 3, characterized in that: The receiving judgment module is specifically as follows: the server receives the handshake request of the client, receives the ClientHello data, and if the ClientHello data includes ClientHelloOuter and ClientHelloInner, the ClientHelloOuter includes the plain text setting value, and the ClientHelloInner includes the service domain name encrypted by the key; then the IP address of the client is not a proxy IP address; If the ClientHello data only includes the service domain name in plain text, the IP address of the client is the proxy IP address.

Images