Method and apparatus for TLS traffic proxy, gateway, storage medium and product

Abstract

The embodiment of the invention discloses a method and device for TLS traffic proxy, a gateway, a machine readable storage medium and a computer program product, and relates to the technical field of communication. The method comprises the following steps: acquiring a TLS protocol ciphertext; decrypting the TLS protocol ciphertext through a kernel mode TLS module to obtain a TLS protocol plaintext; determining a protocol type of the TLS protocol plaintext according to the first traffic feature of the TLS protocol plaintext; under the condition that the protocol type of the TLS protocol plaintext is a recording protocol, determining the message type of the TLS protocol plaintext according to the second traffic characteristic of the TLS protocol plaintext; and under the condition that the message type of the TLS protocol plaintext is a proxy message, forwarding the proxy message to a specified port according to a kernel mode port mapping strategy established based on the eBPF. According to the method, proxy message forwarding of the kernel mode can be achieved, context switching between the user mode and the kernel mode and data copying between the user mode and the kernel mode are reduced, and therefore the efficiency of processing proxy traffic services is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method, device, gateway, machine-readable storage medium, and computer program product for TLS traffic proxy. Background Art

[0002] The traditional application access mode requires that the application address be published on the network so that users can access it at any time. This will inevitably expose the application to the network, and attackers can easily scan and detect, launch DDoS attacks, or exploit vulnerabilities to penetrate, greatly increasing the application security risk. Therefore, more and more applications have begun to use proxies to provide services to the outside world, and application proxy gateways have become increasingly popular. The main function of the application proxy gateway is to identify the access subject and provide a proxy when the subject accesses the Web application. At the same time, the application proxy gateway obtains authorization information from the policy manager and performs access control actions such as allowing access, secondary authentication, or blocking access. In the application proxy gateway, TLS (Transport Layer Security) is generally used to ensure the security of network communications. In the existing traffic proxy method, the traffic processing efficiency of the application proxy gateway after obtaining the proxy traffic from the network port directly reflects the traffic proxy capability of the application proxy gateway. Therefore, how to design a method that can improve the traffic processing efficiency of the application proxy gateway is a technical problem that needs to be solved at present. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a method, device, gateway, machine-readable storage medium and computer program product for TLS traffic proxy, so as to solve the technical problem of how to improve the traffic processing efficiency of the application proxy gateway in the prior art.

[0004] In order to achieve the above-mentioned object, the first aspect of the present application provides a method for TLS traffic proxy, comprising:

[0005] Get TLS protocol ciphertext;

[0006] Decrypt the TLS protocol ciphertext through the kernel-mode TLS module to obtain the TLS protocol plaintext;

[0007] Determine the protocol type of the TLS protocol plain text according to the first traffic feature of the TLS protocol plain text;

[0008] When the protocol type of the TLS protocol plain text is a record protocol, determining the message type of the TLS protocol plain text according to the second traffic feature of the TLS protocol plain text;

[0009] When the message type of the TLS protocol plaintext is a proxy message, the proxy message is forwarded to the specified port according to the kernel port mapping policy established based on eBPF.

[0010] In an embodiment of the present application, the method for TLS traffic proxy also includes: when the protocol type of the TLS protocol plain text is a handshake protocol, sending the TLS protocol plain text to a user-mode proxy process for processing.

[0011] In an embodiment of the present application, the method for TLS traffic proxy also includes: when the message type of the TLS protocol plaintext is a control message, sending the TLS protocol plaintext to a user-mode proxy process for processing.

[0012] In an embodiment of the present application, the method for TLS traffic proxy also includes: when the message type of the TLS protocol plaintext is a proxy message, according to the kernel-mode port mapping policy established based on eBPF, the proxy message is forwarded to a designated port, including: when the message type of the TLS protocol plaintext is a proxy message, according to the forwarding traffic characteristics of the TLS protocol plaintext, the corresponding kernel-mode port mapping policy in the kernel-mode policy database established based on eBPF is determined; and the proxy message is forwarded to the designated port according to the kernel-mode port mapping policy.

[0013] In an embodiment of the present application, the method for TLS traffic proxy also includes: checking the legitimacy of the TLS protocol plaintext according to the policy checkpoint set in the kernel-state policy database; when the TLS protocol plaintext is legal, encrypting the TLS protocol plaintext by the kernel-state TLS module to obtain a proxy message to be forwarded; forwarding the proxy message to a designated port according to the kernel-state port mapping policy, including: forwarding the proxy message to be forwarded to the designated port according to the kernel-state port mapping policy.

[0014] In an embodiment of the present application, according to a first traffic feature of the TLS protocol plaintext, the protocol type of the TLS protocol plaintext is determined, including: according to the first traffic feature of the TLS protocol plaintext, the protocol type of the TLS protocol plaintext is determined by a checkpoint policy set in a kernel-state policy database established based on eBPF; according to a second traffic feature of the TLS protocol plaintext, the message type of the TLS protocol plaintext is determined, including: according to the second traffic feature of the TLS protocol plaintext, the message type of the TLS protocol plaintext is determined by a checkpoint policy set in a kernel-state policy database established based on eBPF.

[0015] In an embodiment of the present application, the first traffic feature includes a TLS protocol header field, and the second traffic feature includes a user agent field of an HTTP header; based on the first traffic feature of the TLS protocol plaintext, the protocol type of the TLS protocol plaintext is determined by the checkpoint policy set in the kernel-state policy database, including: based on the TLS protocol header field, the TLS protocol plaintext is determined as a record protocol by the checkpoint policy set in the kernel-state policy database; based on the second traffic feature of the TLS protocol plaintext, the message type of the TLS protocol plaintext is determined by the checkpoint policy set in the kernel-state policy database, including: based on the user agent field, the message type of the TLS protocol plaintext is determined by the checkpoint policy set in the kernel-state policy database.

[0016] A second aspect of the present application provides an apparatus for TLS traffic proxy, comprising: a memory configured to store instructions; and a processor configured to call instructions from the memory and implement the method for TLS traffic proxy provided according to the above embodiment when executing the instructions.

[0017] The third aspect of the present application provides a proxy gateway, comprising: a device for TLS traffic proxy provided according to the above-mentioned embodiment; a first network card, configured to connect the device for TLS traffic proxy and a client; a second network card, configured to connect the device for TLS traffic proxy and a server.

[0018] A fourth aspect of the present application provides a machine-readable storage medium having instructions stored thereon, the instructions being used to enable a machine to execute the method for TLS traffic proxy provided according to the above-mentioned embodiment.

[0019] A fifth aspect of the present application provides a computer program product, which, when executed by a processor, implements the method for TLS traffic proxy provided according to the above embodiment.

[0020] Through the above technical solution, the TLS protocol ciphertext can be decrypted in the kernel-state TLS module to obtain the TLS protocol plaintext. In the case where the message type of the TLS protocol plaintext is a proxy message, the proxy message is forwarded to the specified port through the kernel-state port mapping strategy. In the above process, the proxy message is forwarded to the specified port in the kernel state, thereby reducing the context switching between the user state and the kernel state, and the data copying between the user state and the kernel state, thereby reducing the computing and storage resources required for the proxy gateway to perform proxy traffic services, and thereby improving its efficiency in processing proxy traffic services.

[0021] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present application, but do not constitute a limitation on the embodiments of the present application. In the accompanying drawings:

[0023] Figure 1 A schematic diagram of the structure of an existing proxy gateway device is shown;

[0024] Figure 2 A schematic diagram of a process for a TLS traffic proxy method according to an embodiment of the present application is shown;

[0025] Figure 3 A schematic diagram of the structure of an application proxy gateway device provided according to an embodiment of the present application is shown;

[0026] Figure 4 A schematic diagram of a TLS protocol ciphertext processing process provided according to an embodiment of the present application is shown;

[0027] Figure 5 A schematic diagram of the structure of another application proxy gateway provided according to an embodiment of the present application is shown;

[0028] Figure 6 A schematic diagram of a WEB traffic proxy access process is shown;

[0029] Figure 7 A structural diagram of another application proxy gateway provided according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific implementation methods described herein are only used to illustrate and explain the embodiments of the present application, and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0031] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of national laws and regulations. In the embodiments of this application, some existing solutions in the industry such as certain software, components, and models may be mentioned, which should be considered as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0032] If there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0033] Figure 1 The structure diagram of an existing proxy gateway device is schematically shown, and the proxy gateway device includes an ingress network card, a data traffic path module 1, a data uplink transparent processing module 2, a data uplink transparent transmission module 3, an application transparent proxy module 4, a data downlink transparent transmission module 5, a data downlink transparent processing module 6, and an egress network card. Among them, the data uplink transparent processing module 2 and the data downlink transparent processing module 6 share memory. In the example of the existing proxy gateway device proxying the request data packet sent by the client, the request data packet sent by the client enters the proxy gateway device from the ingress network card, the data traffic path module 1 is used to make a path decision based on the traffic characteristics of the request data packet, the data uplink traffic transparent processing module 2 is used to transparently process the uplink traffic of the traffic, that is, to create a first mapping relationship, a neighbor item or a routing item, strip the link layer information, and share transparent information with the data downlink traffic transparent processing module 6, the data uplink traffic transparent transmission module 2 is used to transparently transmit the uplink traffic of the traffic, that is, to transmit the traffic from the link layer through the network layer and the transport layer to the application layer, the application transparent proxy module 4 is at the application layer, and is used to authenticate and reverse proxy the traffic. The data downlink traffic transparent transmission module 6 is used to transparently transmit the downlink traffic, that is, to transmit the traffic from the application layer to the link layer. The data downlink traffic transparent processing module 6 is used to supplement the link layer information based on the first mapping relationship in the shared memory and send the traffic from the egress network card to the application server.

[0034] In the above process, the proxy traffic enters the protocol stack after being received from the ingress network card. After the proxy traffic is processed in the protocol stack, the proxy traffic needs to be transmitted to the application layer. After the application transparent proxy module 4 of the application layer completes the processing of the proxy traffic, the proxy traffic is copied to the kernel layer and sent to the real server through the egress network card. This process involves two kernel state and application state switches, and two data copies between the kernel state and the application state. Therefore, the existing proxy gateway device needs to allocate part of the computing and storage resources to the above data copy process to realize the sending of the proxy traffic from the client to the server. Based on the analysis of the above-mentioned prior art, the embodiment of the present application provides a technology for TLS traffic proxy, which can avoid the process of switching and copying data between the kernel state and the application state, thereby improving the traffic proxy efficiency of the proxy gateway.

[0035] Figure 2 The following schematically shows a flow chart of a method for TLS traffic proxy according to an embodiment of the present application. Figure 2 As shown, an embodiment of the present application provides a method for TLS traffic proxy, which may include the following steps:

[0036] S202, obtaining TLS protocol ciphertext;

[0037] S204, decrypting the TLS protocol ciphertext by the kernel-state TLS module to obtain the TLS protocol plaintext;

[0038] S206. Determine the protocol type of the TLS protocol plain text according to the first traffic feature of the TLS protocol plain text;

[0039] S208. When the protocol type of the TLS protocol plain text is a record protocol, determine the message type of the TLS protocol plain text according to the second traffic feature of the TLS protocol plain text;

[0040] S210: When the message type of the TLS protocol plaintext is a proxy message, the proxy message is forwarded to a designated port according to a kernel-mode port mapping policy established based on eBPF.

[0041] See also Figure 3The TLS traffic proxy method provided in the embodiment of the present application decrypts the TLS protocol ciphertext based on the kernel-state TLS module to obtain the TLS protocol plaintext. When the message type of the TLS protocol plaintext is a proxy message, the proxy message is forwarded to the designated port through the kernel-state port mapping strategy. In the above process, the proxy message is forwarded to the designated port in the kernel state, thereby reducing the context switching between the user state and the kernel state, and the data copying between the user state and the kernel state, thereby reducing the computing and storage resources required for the proxy gateway to perform proxy traffic services, and thereby improving its efficiency in processing proxy traffic services.

[0042] It can be understood that the kernel state TLS module in step S204 is a module that implements some functions of the kernel state SSL (Secure Sockets Layer) protocol based on the session layer on the transport layer TCP (Transmission Control Protocol) protocol. Its working mode may include encrypting and decrypting the payload of the SSL frame data with the help of the kernel crypto framework, so the TLS protocol ciphertext can be decrypted. The first traffic feature in step S206 may be the ContentType field of the TLS protocol plain text, and the content recorded in the ContentType field may correspond to the handshake protocol or the record protocol, wherein the handshake protocol is used to negotiate security parameters to establish secure communication between devices, and the record protocol is used to encapsulate the data to be transmitted and ensure that the data is complete and reliable. In step S208, when the protocol type of the TLS protocol plain text is the record protocol, the second traffic feature may be the specific load content in the record protocol, such as the header field of HTTP. The eBPF (extended Berkeley Packet Filter) in step S210 is an extended Berkeley packet filter. In an embodiment of the present application, eBPF allows users to expand kernel functionality by loading and executing custom eBPF programs without modifying the kernel source code.

[0043] Specifically, in some embodiments of the present application, step S210 includes:

[0044] When the message type of the TLS protocol plain text is a proxy message, the corresponding kernel-mode port mapping policy in the kernel-mode policy database established based on eBPF is determined according to the forwarding traffic characteristics of the TLS protocol plain text;

[0045] Forward the proxy message to the specified port according to the kernel port mapping policy.

[0046] In the above steps, the kernel-mode port mapping policy is determined based on the kernel-mode policy database established by eBPF. The kernel-mode policy database established based on eBPF should be established before step S210.

[0047] In some embodiments of the present application, in order to check the legitimacy of the received TLS protocol message, the method for TLS traffic proxy provided by the embodiment of the present application may also include:

[0048] Kernel-mode policy database based on eBPF;

[0049] Check the legitimacy of the TLS protocol plaintext according to the policy checkpoints set in the kernel policy database;

[0050] When the TLS protocol plain text is legal, the TLS protocol plain text is encrypted by the kernel-mode TLS module to obtain the proxy message to be forwarded;

[0051] Forward proxy messages to the specified port according to the kernel port mapping policy, including:

[0052] Forward the proxy message to be forwarded to the specified port according to the kernel port mapping policy.

[0053] See also Figure 5 Therefore, the encryption, decryption, validity check and forwarding of TLS protocol messages are all performed in kernel state. The kernel state policy database established based on eBPF includes both kernel state port mapping policies and policies for checking the validity of TLS protocol messages. By setting corresponding policy checkpoints, the validity check of TLS protocol plaintext has been implemented.

[0054] It can be understood that eBPF can have mount points such as BPF_PROG_TYPE_SOCKET_FILTER, BPF_PROG_TYPE_SOCK_OPS, BPF_PROG_TYPE_SK_SKB, and set policy checkpoints in port connections based on the above mount points.

[0055] The user-state application agent process downloads policy check rules based on local configuration or from the control center, and sends the rules to the kernel-state policy database used by the policy checkpoint. The kernel-state policy database uses eBPF Map to implement policy storage.

[0056] In some embodiments of the present application, the kernel-mode policy database established based on eBPF can be updated in real time during the operation of the proxy gateway.

[0057] In some embodiments of the present application, since the protocol type of the TLS protocol plain text may also be a handshake protocol, the method for TLS traffic proxy provided by the embodiment of the present application may also include:

[0058] When the protocol type of the TLS protocol plain text is the handshake protocol, the TLS protocol plain text is sent to the user-mode proxy process for processing.

[0059] In some embodiments of the present application, since the message type of the record protocol may also be a control message, the method for TLS traffic proxy provided by the embodiment of the present application may also include:

[0060] When the message type of the TLS protocol plain text is a control message, the TLS protocol plain text is sent to the user-mode proxy process for processing.

[0061] Figure 4 A schematic diagram of a process for processing TLS protocol messages by a method for TLS traffic proxy provided by an embodiment of the present application is shown.

[0062] After receiving the TLS protocol message, determine whether the TLS protocol message is plain text. Execute if the TLS protocol message is TLS protocol ciphertext Figure 2 Step S204 is shown, and then step S206 is executed to determine the protocol type of the TLS protocol plaintext. When the protocol type of the TLS protocol is the handshake protocol, the TLS protocol message is sent to the user-mode proxy process for processing. When the protocol type of the TLS protocol is the record protocol, step S208 is executed to determine the message type of the TLS protocol plaintext. When the message type of the TLS protocol plaintext is a control message, the TLS protocol plaintext is sent to the user-mode proxy process for processing; when the message type of the TLS protocol message is a proxy message, step S210 is executed to implement traffic forwarding.

[0063] In some embodiments of the present application, in order to further improve the efficiency of the proxy gateway in processing proxy traffic, the protocol type and message type of the TLS protocol plaintext can be identified through the checkpoint policy set in the kernel policy database established based on eBPF.

[0064] Specifically, step S206 includes: according to the first traffic feature of the TLS protocol plaintext, the protocol type of the TLS protocol plaintext is determined by the checkpoint policy set in the kernel state policy database established based on eBPF. Step S208 includes: according to the second traffic feature of the TLS protocol plaintext, the message type of the TLS protocol plaintext is determined by the checkpoint policy set in the kernel state policy database established based on eBPF.

[0065] Therefore, after the proxy gateway receives the TLS protocol ciphertext, the process from decrypting the TLS protocol ciphertext to obtain the TLS protocol plaintext, identifying the protocol type and message type of the TLS protocol plaintext, until the TLS protocol plaintext is identified as a proxy message and forwarded to the designated port is completely performed in the kernel state, so it can further reduce the performance requirements of the proxy gateway for processing proxy messages, thereby improving the efficiency of the proxy gateway in processing proxy messages.

[0066] As an example, the first traffic feature may include a TLS protocol header field, and the second traffic feature may include a user agent field of an HTTP header.

[0067] According to the first traffic feature of the TLS protocol plain text, the protocol type of the TLS protocol plain text is determined through the checkpoint policy set in the kernel policy database, including:

[0068] According to the TLS protocol header field, the checkpoint policy set by the kernel policy database determines that the TLS protocol plain text is a record protocol;

[0069] According to the second traffic feature of the TLS protocol plaintext, the message type of the TLS protocol plaintext is determined through the checkpoint policy set in the kernel policy database, including:

[0070] The checkpoint policy set by the kernel-mode policy database determines the message type of the TLS protocol plaintext based on the user agent field.

[0071] It can be understood that the user agent field of the HTTP header may include a corresponding identifier of a control message or a proxy message, the identifier of the control message may be AUTH, and the corresponding identifier of the proxy message may be PROXY.

[0072] Specifically, when the user agent field includes an AUTH identifier, the checkpoint policy set in the kernel-mode policy database can determine that the message type of the TLS protocol plaintext is a control message, and send the control message to the user-mode application agent process for processing.

[0073] In conjunction with the above-mentioned method for TLS traffic proxy provided in the embodiment of the present application, see Figure 6 and Figure 7 , the following is an exemplary description of the processing process of the WEB traffic proxy.

[0074] For example, the client uses HTTPS to connect to the application proxy gateway, and the application proxy gateway uses the HTTP protocol to connect and communicate with the resource server. The process of proxy traffic is as follows:

[0075] 1. Apply proxy gateway local configuration or download policy check rules from the control center, and send the policy to the policy database used by the policy checkpoint;

[0076] 2. The client and proxy server establish a TCP connection;

[0077] 3. The client and the proxy server establish a TLS connection. The TLS handshake protocol message is processed by the application proxy process, and the key and other parameters used by TLS are negotiated with the client.

[0078] 4. The application proxy gateway and resource server establish a TCP connection;

[0079] 5. The client initiates a resource access request, and the request message is encrypted using the TLS protocol;

[0080] 6. The application proxy gateway receives the access request and decrypts the message in the kernel-mode TLS module;

[0081] 7. The policy checkpoint performs policy checks on the decrypted request message and blocks illegal request information in a timely manner;

[0082] 8. The application proxy gateway forwards the legitimate request information to the connection channel established between the proxy gateway and the resource server;

[0083] 9. After receiving the request, the resource server returns the response information;

[0084] 10. The policy checkpoint of the application proxy gateway performs a validity check on the response information;

[0085] 11. The application proxy gateway forwards the legitimate response information to the connection established with the client;

[0086] 12. Response traffic is forwarded in kernel mode;

[0087] 13. The kernel-mode TLS module uses the TLS protocol to encrypt and encapsulate the response traffic, and sends the encrypted and encapsulated response traffic to the client;

[0088] 14. The client receives the response traffic.

[0089] In summary, the method for TLS traffic proxy provided in the embodiment of the present application uses a kernel-state TLS module to encrypt and decrypt TLS proxy traffic in the kernel state, and injects eBPF bytecode into the kernel to realize kernel-state forwarding of TLS proxy traffic, thereby avoiding the involvement of the application layer to avoid context switching and data copying operations between the kernel state and the application state. In addition, by injecting eBPF bytecode into the kernel, policy checks on proxy traffic can be implemented in the kernel, without copying the proxy traffic to the application layer for policy checks, thereby improving proxy performance. The application of eBPF technology to strictly verify the data message processing code injected into the kernel can also reduce the error probability and increase the stability of the system.

[0090] The embodiment of the present application also provides a device for TLS traffic proxy, including a memory and a processor. The memory is configured to store instructions; and the processor is configured to call instructions from the memory and implement the method for TLS traffic proxy provided according to any of the above embodiments when executing the instructions.

[0091] An embodiment of the present application also provides a proxy gateway, comprising: the above-mentioned device for TLS traffic proxy; a first network card configured to connect the device for TLS traffic proxy and a client; and a second network card configured to connect the device for TLS traffic proxy and a server.

[0092] An embodiment of the present application also provides a machine-readable storage medium, on which instructions are stored, and the instructions are used to enable a machine to execute the method for TLS traffic proxy provided according to any of the above embodiments.

[0093] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the method for TLS traffic proxy provided according to any of the above embodiments.

[0094] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0095] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0096] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0097] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0098] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0099] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0100] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0101] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0102] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for TLS traffic proxy, characterized in that: include: Get TLS protocol ciphertext; Decrypt the TLS protocol ciphertext by using the kernel-mode TLS module to obtain the TLS protocol plaintext; Determining a protocol type of the TLS protocol plaintext according to a first traffic feature of the TLS protocol plaintext; When the protocol type of the TLS protocol plaintext is a record protocol, determining the message type of the TLS protocol plaintext according to the second traffic feature of the TLS protocol plaintext; When the message type of the TLS protocol plaintext is a proxy message, the proxy message is forwarded to a designated port according to a kernel-mode port mapping strategy established based on eBPF.

2. The method according to claim 1, characterized in that Also includes: When the protocol type of the TLS protocol plain text is the handshake protocol, the TLS protocol plain text is sent to a user-mode proxy process for processing.

3. The method according to claim 1, characterized in that Also includes: When the message type of the TLS protocol plain text is a control message, the TLS protocol plain text is sent to a user-mode proxy process for processing.

4. The method according to claim 1, characterized in that Also includes: When the message type of the TLS protocol plaintext is a proxy message, according to the kernel state port mapping strategy established based on eBPF, the proxy message is forwarded to the designated port, including: In the case where the message type of the TLS protocol plaintext is a proxy message, determining the corresponding kernel-mode port mapping policy in the kernel-mode policy database established based on eBPF according to the forwarding traffic characteristics of the TLS protocol plaintext; The proxy message is forwarded to a designated port according to the kernel-mode port mapping policy.

5. The method according to claim 4, characterized in that Also includes: Checking the legitimacy of the TLS protocol plaintext according to the policy checkpoints set in the kernel state policy database; When the TLS protocol plain text is legal, encrypt the TLS protocol plain text by the kernel-mode TLS module to obtain a proxy message to be forwarded; The step of forwarding the proxy message to the designated port according to the kernel state port mapping strategy includes: The proxy message to be forwarded is forwarded to the designated port according to the kernel-mode port mapping strategy.

6. The method according to claim 1, characterized in that The determining the protocol type of the TLS protocol plaintext according to the first traffic feature of the TLS protocol plaintext includes: According to the first traffic feature of the TLS protocol plaintext, determine the protocol type of the TLS protocol plaintext through a checkpoint policy set in a kernel state policy database established based on eBPF; The determining the message type of the TLS protocol plaintext according to the second traffic feature of the TLS protocol plaintext includes: According to the second traffic feature of the TLS protocol plaintext, the message type of the TLS protocol plaintext is determined by a checkpoint policy set in a kernel state policy database established based on eBPF.

7. The method according to claim 6, characterized in that The first traffic feature includes a TLS protocol header field, and the second traffic feature includes a user agent field of an HTTP header; The determining the protocol type of the TLS protocol plaintext by the checkpoint policy set in the kernel state policy database according to the first traffic feature of the TLS protocol plaintext includes: According to the TLS protocol header field, determining that the TLS protocol plain text is a record protocol through the checkpoint policy set in the kernel state policy database; The determining the message type of the TLS protocol plaintext by the checkpoint policy set in the kernel state policy database according to the second traffic feature of the TLS protocol plaintext includes: According to the user agent field, the message type of the TLS protocol plaintext is determined through the checkpoint policy set by the kernel state policy database.

8. A device for TLS traffic proxy, characterized in that: include: a memory configured to store instructions; as well as A processor is configured to call the instructions from the memory and implement the method for TLS traffic proxy according to any one of claims 1 to 7 when executing the instructions.

9. A proxy gateway, characterized in that: include: The device for TLS traffic proxy according to claim 8; A first network card, configured to connect the device for TLS traffic proxy and a client; The second network card is configured to connect the device for TLS traffic proxy and the server.

10. A machine-readable storage medium, characterized in that: The machine-readable storage medium stores instructions for causing a machine to execute the method for TLS traffic proxy according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the method for TLS traffic proxy according to any one of claims 1 to 7.

Images