Encrypted traffic restoration system, method and device, and storage medium

Abstract

The invention discloses an encrypted traffic restoration system, method and device and a storage medium, and relates to the technical field of network security, and the system comprises a data forwarding plane which is used for receiving encrypted traffic and carrying out the data analysis of the encrypted traffic; the user-defined transmission control protocol stack is used for monitoring the analyzed flow and determining a connection relationship between the target server and the target client; the virtual service layer is used for constructing a virtual server and a virtual client, determining a virtual sender and a virtual receiver, and transmitting the analyzed flow to an actual receiver through the virtual sender and the virtual receiver in sequence; the virtual server and the virtual client are both provided with a traffic decryption function and a traffic encryption function, so that data security detection can be carried out on decrypted traffic obtained through the decryption function. The plaintext traffic is obtained through the decryption function between the virtual server and the virtual client, and the problem that an original network structure is changed in the encrypted traffic reduction process is avoided.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an encrypted traffic restoration system, method, device and storage medium. Background Art

[0002] With the widespread use of encryption technology and the increase in data privacy and security requirements, encrypted traffic has exploded. According to the latest transparency report, 100% of the top 100 websites on the Internet support HTTPS (Hypertext Transfer Protocol Secure) encryption, and 97% of them use HTTPS encryption by default. Although encryption technology protects user privacy, it also brings difficulties to data security inspection and network threat detection, making online fraud and illegal activities more covert, and at the same time, it is easier to evade the detection of ransomware, phishing and data leakage.

[0003] The current method for restoring encrypted traffic is to obtain the plaintext data corresponding to the encrypted traffic through a proxy. This solution requires the client to perform special configuration support, which changes the original network structure of the client and cannot be applied on a large scale. In summary, how to achieve encrypted traffic restoration without changing the original network structure of the client is a problem to be solved in this field. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide an encrypted traffic restoration system, method, device and storage medium, which can obtain the decrypted traffic by constructing a virtual server and a virtual client, and using the traffic decryption function of the virtual client and the virtual server to obtain the decrypted traffic without changing the original network topology. The specific scheme is as follows:

[0005] In a first aspect, the present application provides an encrypted traffic restoration system, comprising:

[0006] The data forwarding plane is used to receive the encrypted traffic transmitted by the actual sender and perform data parsing on the encrypted traffic to obtain the corresponding parsed traffic;

[0007] A custom transmission control protocol stack is used to monitor the parsed traffic and determine the connection relationship between the target server and the target client according to the corresponding monitoring result;

[0008] A virtual service layer is used to construct a virtual server and a virtual client based on the transport layer security protocol based on the connection relationship, and determine a virtual sender and a virtual receiver from the virtual server and the virtual client according to the flow direction information of the encrypted traffic, and transmit the parsed traffic to the actual receiver corresponding to the actual sender through the virtual sender and the virtual receiver in turn; and the virtual server and the virtual client are pre-configured with an automatic decryption function for the received parsed traffic and an automatic encryption function for the decrypted traffic, so as to perform data security detection on the decrypted traffic obtained through the automatic decryption function.

[0009] Optionally, the data forwarding plane includes:

[0010] A protocol identification module, used to identify the data transmission protocol corresponding to the encrypted traffic flowing through the encrypted traffic restoration system to obtain a corresponding protocol identification result;

[0011] The parsing module is used to perform data frame parsing on the encrypted traffic based on the protocol identification result to obtain the parsed traffic corresponding to the encrypted traffic.

[0012] Optionally, the data forwarding plane further includes:

[0013] A forwarding module is used to forward the non-encrypted traffic directly to the actual receiver that has established a communication connection with the data forwarding interface in advance through a local data forwarding interface when the traffic sent by the actual sender and flowing through the encrypted traffic restoration system is non-encrypted traffic.

[0014] Optionally, the customized transmission control protocol stack includes:

[0015] A transmission control protocol service interface is used to monitor the parsed traffic to determine all device ports and all Internet Protocol addresses corresponding to the encrypted traffic, and obtain corresponding port monitoring results and address monitoring results;

[0016] The connection relationship determination module is used to determine the connection relationship between the target server and the target client based on the port monitoring result and the address monitoring result.

[0017] Optionally, the data forwarding plane further includes:

[0018] A forwarding path determination module, used to determine a forwarding path of the parsed traffic in the encrypted traffic restoration system based on the flow direction information of the encrypted traffic;

[0019] The forwarding control module is used to control the corresponding custom transmission control protocol stack, the virtual server and the virtual client to forward the parsed traffic based on the forwarding path.

[0020] Optionally, the encrypted traffic restoration system further includes:

[0021] A network device system platform is used to configure a system working environment for the encrypted traffic restoration system based on preset application requirements; the system working environment includes a system boot program, an operating system and a driver.

[0022] In a second aspect, the present application discloses a method for restoring encrypted traffic, comprising:

[0023] Receiving the encrypted traffic transmitted by the actual sender, and performing data parsing on the encrypted traffic to obtain corresponding parsed traffic;

[0024] Perform full port monitoring on the resolved traffic, and determine the connection relationship between the target server and the target client according to the corresponding monitoring results;

[0025] Based on the connection relationship, a virtual server and a virtual client based on the transport layer security protocol are constructed, and according to the flow direction information of the encrypted traffic, a virtual sender and a virtual receiver are determined from the virtual server and the virtual client, and the parsed traffic is transmitted to the actual receiver corresponding to the actual sender through the virtual sender and the virtual receiver in turn; and the virtual server and the virtual client are pre-configured with an automatic decryption function for the received parsed traffic and an automatic encryption function for the decrypted traffic, so as to perform data security detection on the decrypted traffic obtained through the automatic decryption function.

[0026] In a third aspect, the present application provides an electronic device, comprising a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the aforementioned encrypted traffic restoration method.

[0027] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, which implements the aforementioned encrypted traffic restoration method when executed by a processor.

[0028] The encrypted traffic restoration system in the present application includes: a data forwarding plane, which is used to receive the encrypted traffic transmitted by the actual sender and perform data analysis on the encrypted traffic to obtain the corresponding analyzed traffic; a custom transmission control protocol stack, which is used to monitor the analyzed traffic and determine the connection relationship between the target server and the target client according to the corresponding monitoring results; a virtual service layer, which is used to build a virtual server and a virtual client based on the transport layer security protocol based on the connection relationship, and determine the virtual sender and the virtual receiver from the virtual server and the virtual client according to the flow direction information of the encrypted traffic, and transmit the analyzed traffic to the actual receiver corresponding to the actual sender through the virtual sender and the virtual receiver in turn; and the virtual server and the virtual client are pre-configured with an automatic decryption function for the received analyzed traffic and an automatic encryption function for the decrypted traffic, so as to perform data security detection on the decrypted traffic obtained by the automatic decryption function. It can be seen that the present application determines the connection relationship between the target client and the target server by utilizing a custom transmission control protocol stack, constructs a virtual client and a virtual server by utilizing the connection relationship through the virtual service layer, and obtains the decrypted traffic by utilizing the traffic decryption function of the virtual client and the virtual server. This avoids the need to change the original network topology when obtaining the decrypted traffic, and the process of obtaining the plaintext traffic corresponding to the encrypted traffic in the present application does not require special configuration on the server and the client, and can be applied on a large scale.

[0029] The present application also provides an encrypted traffic restoration method, which has the same beneficial effects as the above-mentioned encrypted traffic restoration system. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0031] Figure 1 A schematic diagram of an encrypted traffic restoration system disclosed in this application;

[0032] Figure 2 This is a schematic diagram of the overall structure of an encrypted traffic restoration system disclosed in this application;

[0033] Figure 3 A schematic diagram of data transparent transmission disclosed in this application;

[0034] Figure 4 A schematic diagram of an encrypted traffic transmission path disclosed in this application;

[0035] Figure 5 This is a flow chart of an encrypted traffic restoration method disclosed in this application;

[0036] Figure 6 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] The existing encrypted traffic restoration system obtains plaintext traffic through a proxy. Although the proxy method can obtain the plaintext traffic corresponding to the encrypted traffic, it requires special configuration on the client and the server and changes the original network topology, which cannot be applied on a large scale. The encrypted traffic restoration system provided in the present application can obtain the decrypted traffic by constructing a virtual server and a virtual client, and using the traffic decryption function of the virtual client and the virtual server, thereby obtaining the decrypted traffic without changing the original network topology.

[0039] See also Figure 1 As shown, an embodiment of the present invention discloses an encrypted traffic restoration system, including:

[0040] The data forwarding plane 11 is used to receive the encrypted traffic transmitted by the actual sender, and perform data analysis on the encrypted traffic to obtain corresponding analyzed traffic.

[0041] In this embodiment, the data forwarding plane 11 specifically includes: a protocol identification module, which is used to identify the data transmission protocol corresponding to the encrypted traffic flowing through the encrypted traffic restoration system to obtain the corresponding protocol identification result; a parsing module, which is used to parse the encrypted traffic data frame based on the protocol identification result to obtain the parsed traffic corresponding to the encrypted traffic. The overall structure of the encrypted traffic restoration system is as follows: Figure 2 As shown, it can be understood that there can be several types of data transmission protocols for the encrypted traffic flowing through the encrypted traffic restoration system, and the data forwarding plane can achieve full protocol perspective from the link layer to the application layer, such as Figure 3As shown, in a specific implementation, the protocol identification module in the data forwarding plane 11 performs a layer-by-layer full-protocol perspective from the link layer to the application layer, and the identified protocol types are ICMP (Internet Control Message Protocol), TCP (Transmission Control Protocol), and UDP (User Datagram Protocol) encrypted traffic. The parsing module performs data frame parsing on the encrypted traffic according to the identification result to obtain the corresponding parsed traffic of the encrypted traffic; after obtaining the parsed traffic, the data forwarding plane 11 also uploads the parsed traffic into the custom transmission control protocol stack 12, and receives the data sent by the custom transmission control protocol stack 12 to realize data forwarding. It should be noted that the data forwarding plane 11 also includes a forwarding module, which is used to forward the non-encrypted traffic directly to the actual receiver that has established a communication connection with the data forwarding interface in advance through the local data forwarding interface when the traffic sent by the actual sender through the encrypted traffic restoration system is non-encrypted traffic, that is, if the received traffic is non-encrypted traffic, there is no need to upload the non-encrypted traffic to the custom transmission control protocol stack 12, and the data forwarding plane 11 is directly used to forward the non-encrypted traffic to the actual receiver. It should be noted that the above-mentioned data forwarding plane 11 is also used to control the transmission path of the traffic in the encrypted traffic restoration system; the above-mentioned data forwarding plane 11 also includes: a forwarding path determination module, which is used to determine the forwarding path of the parsed traffic in the encrypted traffic restoration system based on the flow direction information of the encrypted traffic; a forwarding control module, which is used to control the corresponding custom transmission control protocol stack 12, the virtual server and the virtual client to forward the parsed traffic based on the forwarding path. It can be understood that before using the data forwarding plane 11 to encrypt the traffic for parsing, the encrypted traffic restoration system must be connected in series to the communication link between the actual sender and the actual receiver. By parsing the encrypted traffic, the encrypted traffic can be forwarded according to the corresponding parsing results, and the traffic is forwarded by controlling the data forwarding plane 11, thereby improving the reliability of the data forwarding process.

[0042] The custom control transmission protocol stack 12 is used to monitor the parsed traffic and determine the connection relationship between the target server and the target client according to the corresponding monitoring result.

[0043] In this embodiment, the custom transmission control protocol stack 12 includes: a transmission control protocol service interface, which is used to monitor the parsed traffic to determine all device ports and all Internet protocol addresses corresponding to the encrypted traffic, and obtain corresponding port monitoring results and address monitoring results; a connection relationship determination module, which is used to determine the connection relationship between the target server and the target client based on the port monitoring results and the address monitoring results. In addition to the traditional TCP protocol stack function, the biggest difference between the above-mentioned custom transmission control protocol stack 12 is the TCP service interface, that is, the above-mentioned transmission control protocol service interface supports full IP and full port monitoring; the connection relationship determination module in the custom transmission control protocol stack 12 can determine the connection relationship between the target server and the target client according to the monitoring results including the source IP address, the destination IP address, the source port and the destination port. By monitoring the full IP address and the full port of the parsed traffic, the actual sender and the actual receiver corresponding to the parsed traffic, that is, the target server and the target client, can be determined from several actual senders and several actual receivers; and the connection relationship between the target client and the target server is determined according to the monitoring results, which ensures the reliability of the virtual sender and the virtual receiver constructed by the virtual service layer 13 using the connection relationship.

[0044] The virtual service layer 13 is used to build a virtual server and a virtual client based on the transport layer security protocol based on the connection relationship, and determine the virtual sender and the virtual receiver from the virtual server and the virtual client according to the flow direction information of the encrypted traffic, and transmit the parsed traffic to the actual receiver corresponding to the actual sender through the virtual sender and the virtual receiver in turn; and the virtual server and the virtual client are pre-configured with an automatic decryption function for the received parsed traffic and an automatic encryption function for the decrypted traffic, so as to perform data security detection on the decrypted traffic obtained through the automatic decryption function.

[0045] In this embodiment, it is understandable that the traffic flowing through the encrypted traffic restoration system can be sent from the target client to the target server, or from the target server to the target client. In actual application, it is necessary to determine the actual sender and receiver of the traffic from the target client and the target server based on the flow direction information of the traffic. In a specific implementation, Figure 4As shown, if the actual sender is the target server, the specific forwarding process of the encrypted traffic in the encrypted traffic restoration system is as follows: the data forwarding plane 11 receives the encrypted traffic of the target server, and uploads the encrypted traffic to the custom transmission control protocol stack 12, the custom transmission control protocol stack 12 uploads the encrypted traffic to the virtual server, the virtual server uses the automatic decryption function to decrypt the encrypted traffic, and outputs the obtained plaintext traffic. At the same time, the plaintext traffic is sent to the virtual client. After receiving the plaintext traffic, the virtual client uses the automatic encryption function to encrypt the plaintext traffic again, and sends the encrypted traffic to the custom transmission control protocol stack 12, the custom transmission control protocol stack 12 sends the encrypted traffic to the data forwarding plane 11, and forwards the encrypted traffic to the actual receiver through the data forwarding plane.

[0046] It should be noted that the above-mentioned encrypted traffic restoration system also includes a network device system platform, which is used to configure the system working environment for the encrypted traffic restoration system based on preset application requirements; the above-mentioned system working environment includes the system boot loader, operating system and driver. Specifically, the above-mentioned system working environment includes the system boot loader (Boot Loader), OS (Operating System, i.e. operating system), driver (drivers), FS (File System, i.e. file system), library (libs) and related network tools. Through the virtual service layer 13, a virtual server and a virtual client based on TLS (Transport Layer Security) are constructed based on the connection relationship between the target server and the target client. The traffic decryption function in the virtual server and the virtual client can obtain and output the plaintext traffic corresponding to the encrypted traffic, so as to perform data security detection on the decrypted traffic obtained; through the data communication between the virtual server and the virtual client, the encrypted traffic sent by the actual sender can be forwarded to the actual receiver without changing the network attributes of the traffic data after passing through the encrypted traffic restoration system; from the user's perspective, the network attributes of the data entering and leaving the device do not change, and the system actually completes a forward proxy for a session and obtains the session plaintext data information.

[0047] It can be seen that this embodiment can forward the encrypted traffic according to the corresponding analysis results by parsing the encrypted traffic, and control the traffic forwarding by using the data forwarding plane 11, thereby improving the reliability of the data forwarding process; through data communication between the virtual server and the virtual client, the encrypted traffic sent by the actual sender can be forwarded to the actual receiver without changing the network attributes of the traffic data after passing through the encrypted traffic restoration system; through the traffic decryption function in the virtual server and the virtual client, the plaintext traffic corresponding to the encrypted traffic can be obtained and output, so as to perform data security detection on the decrypted traffic obtained.

[0048] Based on the previous embodiment, it can be seen that the present application can obtain the decrypted traffic by constructing a virtual server and a virtual client, and using the traffic decryption function of the virtual client and the virtual server, and obtain the decrypted traffic without changing the original network topology. Next, this embodiment will describe the corresponding encrypted traffic restoration method. Figure 5 As shown, the embodiment of the present application also discloses a method for restoring encrypted traffic, including:

[0049] Step S11, receiving the encrypted traffic transmitted by the actual sender, and performing data analysis on the encrypted traffic to obtain corresponding analyzed traffic.

[0050] Step S12: perform full-port monitoring on the resolved traffic, and determine the connection relationship between the target server and the target client according to the corresponding monitoring results.

[0051] Step S13, constructing a virtual server and a virtual client based on the transport layer security protocol based on the connection relationship, and determining a virtual sender and a virtual receiver from the virtual server and the virtual client according to the flow direction information of the encrypted traffic, and transmitting the parsed traffic to the actual receiver corresponding to the actual sender through the virtual sender and the virtual receiver in turn; and, the virtual server and the virtual client are pre-configured with an automatic decryption function for the received parsed traffic and an automatic encryption function for the decrypted traffic, so as to perform data security detection on the decrypted traffic obtained through the automatic decryption function.

[0052] The encrypted traffic restoration method disclosed in this embodiment has the same technical effect as the corresponding content disclosed in the previous embodiments, and will not be repeated here.

[0053] This embodiment first receives encrypted traffic and performs data analysis on the encrypted traffic, then monitors the analyzed traffic and determines the connection relationship between the target server and the target client, and finally constructs a virtual server and a virtual client, determines a virtual sender and a virtual receiver, and transmits the analyzed traffic to the actual receiver through the virtual sender and the virtual receiver in turn, and uses the automatic decryption function of the virtual sender and the virtual receiver to obtain the plaintext traffic corresponding to the encrypted traffic. It can be seen that the present application determines the connection relationship between the target client and the target server by using a custom transmission control protocol stack, constructs a virtual client and a virtual server by using the connection relationship through the virtual service layer, and obtains the decrypted traffic by using the traffic decryption function of the virtual client and the virtual server, and avoids the problem of changing the original network topology when obtaining the decrypted traffic, and the process of obtaining the plaintext traffic corresponding to the encrypted traffic in the present application does not require special configuration on the server and the client, and can be applied on a large scale.

[0054] Furthermore, the present application also discloses an electronic device. Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0055] Figure 6 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the encrypted traffic restoration method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0056] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0057] In addition, the memory 22 as a carrier for storing resources may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0058] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the encrypted traffic restoration method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0059] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the encrypted traffic restoration method disclosed above is implemented. The specific steps of the method can refer to the corresponding contents disclosed in the above embodiments, and will not be repeated here.

[0060] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0061] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0062] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0063] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0064] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An encrypted traffic restoration system, characterized in that: include: The data forwarding plane is used to receive the encrypted traffic transmitted by the actual sender and perform data parsing on the encrypted traffic to obtain the corresponding parsed traffic; A custom transmission control protocol stack is used to monitor the parsed traffic and determine the connection relationship between the target server and the target client according to the corresponding monitoring result; A virtual service layer is used to construct a virtual server and a virtual client based on the transport layer security protocol based on the connection relationship, and determine a virtual sender and a virtual receiver from the virtual server and the virtual client according to the flow direction information of the encrypted traffic, and transmit the parsed traffic to the actual receiver corresponding to the actual sender through the virtual sender and the virtual receiver in turn; and the virtual server and the virtual client are pre-configured with an automatic decryption function for the received parsed traffic and an automatic encryption function for the decrypted traffic, so as to perform data security detection on the decrypted traffic obtained through the automatic decryption function.

2. The encrypted traffic restoration system according to claim 1, characterized in that: The data forwarding plane includes: A protocol identification module, used to identify the data transmission protocol corresponding to the encrypted traffic flowing through the encrypted traffic restoration system to obtain a corresponding protocol identification result; The parsing module is used to perform data frame parsing on the encrypted traffic based on the protocol identification result to obtain the parsed traffic corresponding to the encrypted traffic.

3. The encrypted traffic restoration system according to claim 1, characterized in that: The data forwarding plane further includes: A forwarding module is used to forward the non-encrypted traffic directly to the actual receiver that has established a communication connection with the data forwarding interface in advance through a local data forwarding interface when the traffic sent by the actual sender and flowing through the encrypted traffic restoration system is non-encrypted traffic.

4. The encrypted traffic restoration system according to claim 1, characterized in that: The custom transmission control protocol stack includes: A transmission control protocol service interface is used to monitor the parsed traffic to determine all device ports and all Internet Protocol addresses corresponding to the encrypted traffic, and obtain corresponding port monitoring results and address monitoring results; The connection relationship determination module is used to determine the connection relationship between the target server and the target client based on the port monitoring result and the address monitoring result.

5. The encrypted traffic restoration system according to claim 1, characterized in that: The data forwarding plane further includes: A forwarding path determination module, used to determine a forwarding path of the parsed traffic in the encrypted traffic restoration system based on the flow direction information of the encrypted traffic; The forwarding control module is used to control the corresponding custom transmission control protocol stack, the virtual server and the virtual client to forward the parsed traffic based on the forwarding path.

6. The encrypted traffic restoration system according to claim 1, characterized in that: Also includes: A network device system platform, used to configure a system working environment for the encrypted traffic restoration system based on preset application requirements; The system working environment includes a system boot program, an operating system and a driver.

7. A method for restoring encrypted traffic, characterized in that: include: Receiving the encrypted traffic transmitted by the actual sender, and performing data parsing on the encrypted traffic to obtain corresponding parsed traffic; Monitoring the resolved traffic, and determining the connection relationship between the target server and the target client according to the corresponding monitoring result; Based on the connection relationship, a virtual server and a virtual client based on the transport layer security protocol are constructed, and according to the flow direction information of the encrypted traffic, a virtual sender and a virtual receiver are determined from the virtual server and the virtual client, and the parsed traffic is transmitted to the actual receiver corresponding to the actual sender through the virtual sender and the virtual receiver in turn; and the virtual server and the virtual client are pre-configured with an automatic decryption function for the received parsed traffic and an automatic encryption function for the decrypted traffic, so as to perform data security detection on the decrypted traffic obtained through the automatic decryption function.

8. The method for restoring encrypted traffic according to claim 7, characterized in that: Before receiving the encrypted traffic transmitted by the actual sender and performing data parsing on the encrypted traffic to obtain the corresponding parsed traffic, the method further includes: The encrypted traffic restoration system is serially connected to the communication link between the actual sender and the actual receiver.

9. An electronic device, characterized in that: The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the encrypted traffic restoration method as described in claim 7 or 8.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, which, when executed by a processor, implements the encrypted traffic restoration method as described in claim 7 or 8.

Images